pub Résolu

Question

bonjour a tous ,je suis infecté de pub qui s ouvre sans cesse toute seul, j en ai marre
pouvez y remerdier

merci d 'avance

je possede xp fire fox

green day · Answer

Salut

Télécharge ceci sur ton bureau :

Lien :  hijackthis

Démo : http://pageperso.aol.fr/balltrap34/demohijack.htm 
 
Choisir l'option "do a scan and a logfile", et faire un copier/coller du rapport ainsi générer sur le forum.

++

descamps59 · Answer

merci de votre réponse voici mon HijackThis


Logfile of HijackThis v1.99.1
Scan saved at 18:59:55, on 24/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Media Connect\mswmcls.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Windows Media Connect\mswmc.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\AGRSMMSG.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\Medion\KeyStat\KeyStat.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\Dit.exe
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\WINDOWS\system32\XCSyncML.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe
C:\Program Files\Home Cinema\PowerCinema\PCMService.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\ICQLite\ICQLite.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIE.EXE
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\PROMT5\INTEGRAL\pinmenu.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll
R3 - URLSearchHook: Multi_Media_France toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - C:\Program Files\Multi_Media_France	bMul0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1	oolbar.dll
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: Multi_Media_France toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - C:\Program Files\Multi_Media_France	bMul0.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll
O3 - Toolbar: Multi_Media_France toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - C:\Program Files\Multi_Media_France	bMul0.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Keyboard Status] C:\PROGRA~1\Medion\KeyStat\KeyStat.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\Run: [XCSyncML] C:\WINDOWS\system32\XCSyncML.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1036
O4 - HKLM\..\Run: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [PROMT Integrator] "C:\Program Files\PROMT5\INTEGRAL\PinStart.exe" /autorun
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [mix enc] C:\DOCUME~1\DESCAM~1\APPLIC~1\CDROMW~1\Camp Mail.exe
O4 - HKCU\..\Run: [EPSON Stylus DX6000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIE.EXE /FU "C:\WINDOWS\TEMP\E_S102.tmp" /EF "HKCU"
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNfox000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=https://www.aldi.com/
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Pml Driver HPZ12 - Unknown owner - C:\WINDOWS\system32\HPZipm12.exe (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

green day · Answer

re

ok, Télécharge ceci: (by Moe)
http://sosvirus.changelog.fr/Green_day/Lopxp.exe

Lance Lopxp.bat.
Au menu, choisis l'option 1 "Rechercher / Générer un rapport"
Patiente et lorsque l'on te demande d'appuyer sur une touche, appuie.
Ensuite, le rapport s'ouvre, copie colle le en entier sur le forum.

++

descamps59 · Answer

re bonsoir
voici le rapport

_____________ Rapport Lopxp fait le 24/06/2007 à 20:55:10,29 _______________

/!\ Attention /!\

Les résultats de ce rapport sont sujets à interprétations,
Et ne démontrent pas systématiquement des dossiers infectés...

_________________________ Recherche prédéterminé __________________________

[X] C:\Program Files\BitDownload Présent !

Date d'installation/Création du dossier: 07/02/2007 à 09:06
Dernière modification du dossier le: 12/06/2007 à 09:49

Recherche des dossiers crées le: 07/02/2007

C:\Program Files

07/02/2007 09:13 <REP> HIJACK~1 Hijackthis Version Fran‡aise
07/02/2007 09:06 <REP> BITDOW~1 BitDownload

C:\Documents and Settings\descamps christine\Application Data

07/02/2007 18:52 <REP> CDROMW~1 CdromWait

C:\Documents and Settings\le compte de didine\Application Data

C:\Documents and Settings\Propri‚taire\Application Data

[X] C:\Program Files\Multi_Media_France Présent !

Date d'installation/Création du dossier: 22/02/2007 à 17:13
Dernière modification du dossier le: 02/04/2007 à 18:22

Recherche des dossiers crées le: 22/02/2007

C:\Program Files

22/02/2007 17:13 <REP> MULTI_~1 Multi_Media_France

C:\Documents and Settings\All Users\Application Data

22/02/2007 20:13 <REP> MAILAC~1 Mail ace itch download

C:\Documents and Settings\descamps christine\Application Data

C:\Documents and Settings\le compte de didine\Application Data

C:\Documents and Settings\Propri‚taire\Application Data

_________________________ Recherche heuristique __________________________

C:\Documents and Settings\All Users\Application Data\Mail ace itch download
C:\Documents and Settings\descamps christine\Application Data

___________________________ Tâches planifiées _____________________________

Listing de toutes les tâches planifiées:

At12.job: C:\WINDOWS\system32\smmss.exe
At13.job: C:\WINDOWS\system32\wudupdate.exe
At14.job: C:\WINDOWS\system32\wuauclt10.exe
At3.job: C:\WINDOWS\system32\smmss.exe
At5.job: C:\WINDOWS\system32\wudupdate.exe
At6.job: C:\WINDOWS\system32\wuauclt10.exe
WebReg 20050403184959.job: C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe /TaskName 20050403184959 /N "" /M /S /AP /F /T

__________ Détection des paramètres de désinstallation du sponsor _________

Sponsor P2P:

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Comp Bib Bird]

DisplayName REG_SZ CiD Help
UninstallString REG_SZ C:\DOCUME~1\DESCAM~1\APPLIC~1\CDROMW~1\Camp Mail.exe -uninstall

- Label de désinstallation listé "CiD Help" dans Ajout/Supression de Programmes.

Sponsor MSN+:

__________________ Listing des dossiers Application Data __________________

C:\Documents and Settings\All Users\Application Data

Date/heure Création Nom court Nom long

21/06/2007 à 16:31 | Lavasoft
13/03/2007 à 12:34 | EPSON
02/03/2007 à 18:00 | UDL
22/02/2007 à 20:13 | MAILAC~1 Mail ace itch download
17/02/2007 à 08:54 | avg7
12/02/2007 à 04:28 | WHOLES~1 WholeSecurity
05/02/2007 à 17:16 | TEMP
04/02/2007 à 22:18 | Symantec
30/12/2006 à 16:02 | Zylom
01/12/2006 à 19:54 | ESPION~1 espionServerData
13/11/2006 à 21:50 | Trymedia
25/09/2006 à 18:40 | Google
25/08/2006 à 16:34 | DVDSHR~1 DVD Shrink
30/06/2006 à 03:22 | WINDOW~1 Windows Genuine Advantage
25/02/2006 à 01:12 | ATIMMC~1 ATI MMC
09/02/2006 à 04:20 | BOONTY
16/01/2006 à 21:24 | SPYBOT~1 Spybot - Search & Destroy
09/12/2005 à 21:41 | YAHOO!~1 Yahoo! Companion
16/06/2005 à 17:59 | MACROV~1 Macrovision
04/04/2005 à 14:31 | HEWLET~1 Hewlett-Packard
24/03/2005 à 17:22 | BVRPSO~1 BVRP Software
05/02/2005 à 19:41 | CYBERL~1 CyberLink
26/01/2005 à 20:43 | MUVEET~1 muvee Technologies
26/01/2005 à 14:08 | VIEWPO~1 Viewpoint
26/01/2005 à 14:08 | AOL
26/01/2005 à 13:24 | BLUETO~1 Bluetooth
26/01/2005 à 12:41 | QUICKT~1 QuickTime
25/01/2005 à 18:27 | Ahead
25/01/2005 à 16:41 | Adobe
20/01/2005 à 16:26 | MICROS~1 Microsoft
20/01/2005 à 15:53 | SBSI

C:\Documents and Settings\descamps christine\Application Data

Date/heure Création Nom court Nom long

31/05/2007 à 21:58 | ICQLite
24/03/2007 à 10:38 | DivX
02/03/2007 à 18:37 | EPSON
18/02/2007 à 09:41 | MESSEN~1 MessengerSkinner
17/02/2007 à 11:58 | FUNWEB~1 FunWebProducts
17/02/2007 à 08:54 | AVG7
07/02/2007 à 18:52 | CDROMW~1 CdromWait
05/02/2007 à 17:16 | PCTOOL~1 PC Tools
17/01/2007 à 19:41 | EoRezo
30/12/2006 à 16:03 | Zylom
02/12/2006 à 12:41 | Opera
20/11/2006 à 19:11 | LEADER~1 Leadertech
25/08/2006 à 17:57 | ELABOR~1 Elaborate Bytes
19/05/2006 à 18:14 | Alawar
11/05/2006 à 03:07 | SlySoft
14/03/2006 à 19:37 | Ahead
12/03/2006 à 21:03 | ATIMMC~1 ATI MMC
16/01/2006 à 23:24 | ArcSoft
24/12/2005 à 11:49 | Google
18/10/2005 à 16:25 | WHOLES~1 WholeSecurity
10/09/2005 à 10:59 | LABATA~1 La Bataille pour la Terre du Milieu
14/07/2005 à 21:06 | AdobeUM
29/04/2005 à 17:17 | Talkback
08/04/2005 à 19:46 | Help
28/03/2005 à 14:38 | Aim
24/03/2005 à 22:57 | Lavasoft
24/03/2005 à 22:16 | Mozilla
24/03/2005 à 17:18 | Adobe
24/03/2005 à 17:18 | AOL
24/03/2005 à 17:18 | CYBERL~1 CyberLink
24/03/2005 à 17:18 | IDENTI~1 Identities
24/03/2005 à 17:18 | MACROM~1 Macromedia
24/03/2005 à 17:18 | MICROS~1 Microsoft
24/03/2005 à 17:18 | Real
24/03/2005 à 17:18 | Sun
24/03/2005 à 17:18 | YOU'VE~1 You've Got Pictures Screensaver

C:\Documents and Settings\descamps christine\Local Settings\Application Data

Date/heure Création Nom court Nom long

02/04/2007 à 20:22 | MULTI_~1 Multi_Media_France
23/01/2007 à 14:16 | ALICEA~1 Alice ADSL
02/07/2006 à 14:09 | SM
09/05/2006 à 19:11 | IM
07/03/2006 à 22:24 | Mozilla
02/03/2006 à 19:31 | NFSUND~1 NFS Underground 2
23/12/2005 à 21:21 | Nikon
23/12/2005 à 21:21 | Pixology
19/11/2005 à 19:57 | LOGITE~1 Logitech-LS
13/07/2005 à 16:32 | Ahead
20/05/2005 à 23:24 | ABBYY
08/04/2005 à 19:46 | Help
05/04/2005 à 07:33 | Google
29/03/2005 à 19:14 | ISOLAT~1 IsolatedStorage
29/03/2005 à 19:14 | HP
28/03/2005 à 19:26 | IDENTI~1 Identities
28/03/2005 à 14:38 | WILDTA~1 Wildtangent
24/03/2005 à 17:18 | Adobe
24/03/2005 à 17:18 | APPLIC~1 ApplicationHistory
24/03/2005 à 17:18 | MICROS~1 Microsoft
24/03/2005 à 17:18 | POWERC~1 PowerCinema
24/03/2005 à 17:18 | WMTOOL~1 WMTools Downloaded Files
24/03/2005 à 17:18 | {3248F~1 {3248F0A6-6813-11D6-A77B-00B0D0150010}

C:\Documents and Settings\le compte de didine\Application Data

Date/heure Création Nom court Nom long

01/11/2006 à 17:12 | Google
23/08/2006 à 21:37 | Talkback
23/08/2006 à 21:35 | Mozilla
23/08/2006 à 18:48 | Aim
23/08/2006 à 15:10 | WHOLES~1 WholeSecurity
23/08/2006 à 15:09 | Adobe
23/08/2006 à 15:09 | AOL
23/08/2006 à 15:09 | CYBERL~1 CyberLink
23/08/2006 à 15:09 | IDENTI~1 Identities
23/08/2006 à 15:09 | MACROM~1 Macromedia
23/08/2006 à 15:09 | MICROS~1 Microsoft
23/08/2006 à 15:09 | Real
23/08/2006 à 15:09 | Sun
23/08/2006 à 15:09 | YOU'VE~1 You've Got Pictures Screensaver

C:\Documents and Settings\le compte de didine\Local Settings\Application Data

Date/heure Création Nom court Nom long

01/11/2006 à 17:12 | Google
13/09/2006 à 23:46 | IDENTI~1 Identities
23/08/2006 à 21:35 | Mozilla
23/08/2006 à 15:10 | LOGITE~1 Logitech-LS
23/08/2006 à 15:10 | ISOLAT~1 IsolatedStorage
23/08/2006 à 15:10 | HP
23/08/2006 à 15:09 | Adobe
23/08/2006 à 15:09 | APPLIC~1 ApplicationHistory
23/08/2006 à 15:09 | MICROS~1 Microsoft
23/08/2006 à 15:09 | POWERC~1 PowerCinema
23/08/2006 à 15:09 | WMTOOL~1 WMTools Downloaded Files
23/08/2006 à 15:09 | {3248F~1 {3248F0A6-6813-11D6-A77B-00B0D0150010}

C:\Documents and Settings\Propri‚taire\Application Data

Date/heure Création Nom court Nom long

09/06/2005 à 11:22 | Real
27/03/2005 à 23:02 | YOU'VE~1 You've Got Pictures Screensaver

____________________ Listing du dossier Program Files _____________________

C:\Program Files

Date/heure Création Nom court Nom long

21/06/2007 à 19:14 | TORREN~1 torrent_search
21/06/2007 à 19:13 | BITTOR~1 BitTorrent Fastest Tool
18/06/2007 à 16:13 | PROMT5
17/06/2007 à 06:59 | REGIST~2 Registry Mechanic
15/06/2007 à 08:00 | CDROMW~1 CdromWait
10/06/2007 à 11:26 | VIRUSG~1 VirusGarde
31/05/2007 à 21:58 | ICQLite
27/03/2007 à 12:37 | DISC2P~1 Disc2Phone
24/03/2007 à 10:55 | PHOTOF~2 PhotoFiltre
09/03/2007 à 08:22 | Antipub
06/03/2007 à 15:57 | ArcSoft
02/03/2007 à 17:55 | EPSON
23/02/2007 à 10:27 | DAEMON~1 DAEMON Tools
22/02/2007 à 17:13 | MULTI_~1 Multi_Media_France
20/02/2007 à 14:42 | FIXMES~1 FixMessenger
17/02/2007 à 11:11 | MACROG~1 Macrogaming
07/02/2007 à 09:13 | HIJACK~1 Hijackthis Version Fran‡aise
07/02/2007 à 09:06 | BITDOW~1 BitDownload
06/02/2007 à 18:03 | REGIST~1 RegistrySmart
05/02/2007 à 17:16 | SPYWAR~1 Spyware Doctor
04/02/2007 à 22:09 | Lavasoft
22/12/2006 à 12:26 | WI4DF6~1 Windows Media Connect 2
04/12/2006 à 04:49 | DAEMON~2 DaemonTools_WhenUSave_Installer
28/11/2006 à 12:53 | WIE5D0~1 Windows Live Safety Center
13/11/2006 à 21:49 | BFG
13/11/2006 à 17:44 | Gamenext
30/09/2006 à 06:58 | ZYLOMG~1 Zylom Games
29/09/2006 à 23:02 | MESJEU~1 Mes Jeux T‚l‚charg‚s
29/09/2006 à 23:02 | Boonty
28/08/2006 à 12:22 | MIHOVI~1 Mihov Image Resizer
25/08/2006 à 17:52 | ELABOR~1 Elaborate Bytes
25/08/2006 à 16:34 | DVDSHR~1 DVD Shrink
27/07/2006 à 19:13 | KARTRA~1 Kartracing
02/07/2006 à 14:09 | SM
30/06/2006 à 17:54 | NECSYN~1 NEC Synchronization
29/06/2006 à 18:30 | NEC
04/06/2006 à 15:41 | MEDIAM~1 MediaMobsters
20/05/2006 à 02:53 | STRIKE~1 Strike Ball 2
20/05/2006 à 02:52 | REFLEX~1 ReflexiveArcade
11/05/2006 à 17:22 | VSO
09/05/2006 à 19:11 | INCRED~1 IncrediMail
15/04/2006 à 12:59 | MI9A48~1 Microsoft Games
13/03/2006 à 19:04 | PUREBA~1 PureBasic
13/03/2006 à 18:40 | ALGOMI~1 Algominds
11/03/2006 à 16:25 | 2015
08/03/2006 à 15:58 | Maxis
28/02/2006 à 19:14 | LUCASA~1 LucasArts
25/02/2006 à 08:47 | SlySoft
24/02/2006 à 23:02 | ATIMUL~1 ATI Multimedia
08/02/2006 à 17:53 | Creative
08/02/2006 à 16:36 | EAGAME~1 EA GAMES
04/02/2006 à 12:44 | GAMESP~1 GameSpy Arcade
28/01/2006 à 20:37 | ACTIVI~1 Activision
16/01/2006 à 21:24 | SPYBOT~1 Spybot - Search & Destroy
16/01/2006 à 16:43 | CCleaner
23/12/2005 à 21:13 | Nikon
09/12/2005 à 21:33 | Yahoo!
27/11/2005 à 15:49 | ALICE_~1 Alice_Triway_WiFi
19/11/2005 à 18:31 | Logitech
03/11/2005 à 17:16 | FaxTools
27/10/2005 à 19:34 | OBERON~1 Oberon Media
26/10/2005 à 16:28 | Atari
25/10/2005 à 09:59 | CALLOF~1 Call of Duty
22/10/2005 à 14:18 | Medion
19/10/2005 à 16:26 | ALWILS~1 Alwil Software
18/10/2005 à 16:25 | eBay
09/10/2005 à 23:06 | SAGEM
27/09/2005 à 16:45 | Trymedia
27/09/2005 à 16:45 | POPCAP~1 PopCap Games
12/09/2005 à 14:45 | Ubisoft
05/09/2005 à 03:36 | D-Tools
19/07/2005 à 18:36 | MP3PLA~1 MP3 Player Utilities
12/07/2005 à 19:56 | PUBLIS~1 Publisher
12/07/2005 à 19:47 | N-SIDE~1 N-Side Software
06/07/2005 à 17:29 | WINDOW~3 WindowsUpdate
29/06/2005 à 20:15 | SIERRA~1 Sierra On-Line
16/06/2005 à 17:58 | BOONTY~1 BoontyGames
11/06/2005 à 20:49 | EACOM
11/06/2005 à 20:48 | EASPOR~1 EA SPORTS
28/05/2005 à 21:39 | Singles
15/05/2005 à 12:11 | Surreal
25/04/2005 à 19:03 | CODEMA~1 Codemasters
24/04/2005 à 18:57 | EMME-L~1 emme - Langues
20/04/2005 à 17:54 | MSNMES~1 MSN Messenger
20/04/2005 à 17:46 | WinRAR
04/04/2005 à 03:41 | AOLCOM~1 AOL Compagnon
04/04/2005 à 03:40 | AOLTOO~1 AOL Toolbar
04/04/2005 à 03:40 | COMPLU~1 ComPlus Applications
04/04/2005 à 03:40 | directx
04/04/2005 à 03:40 | UNINST~1 Uninstall Information
29/03/2005 à 18:37 | HEWLET~1 Hewlett-Packard
29/03/2005 à 18:33 | HP
28/03/2005 à 15:44 | Fox
28/03/2005 à 14:38 | AIM
28/03/2005 à 12:10 | UBISOF~1 Ubi Soft
28/03/2005 à 12:04 | REDSTO~1 Red Storm Entertainment
27/03/2005 à 10:20 | ROCKST~1 Rockstar Games
25/03/2005 à 21:55 | Valusoft
24/03/2005 à 22:16 | MOZILL~1 Mozilla Firefox
24/03/2005 à 19:10 | THEGIF~1 The Gift
24/03/2005 à 18:50 | eMule
05/02/2005 à 19:40 | CYBERL~1 CyberLink
05/02/2005 à 19:40 | HOMECI~1 Home Cinema
05/02/2005 à 19:14 | X10HAR~1 X10 Hardware
05/02/2005 à 18:50 | OFFICE~1 OfficeUpdate11
05/02/2005 à 18:04 | MIAF9D~1 Microsoft Visual Studio
26/01/2005 à 20:43 | MUVEET~1 muvee Technologies
26/01/2005 à 20:29 | RALINK
26/01/2005 à 20:14 | COMMON~1 Common Files
26/01/2005 à 14:08 | VIEWPO~1 Viewpoint
26/01/2005 à 13:32 | MUSICM~1 Musicmatch
26/01/2005 à 13:18 | IVTCOR~1 IVT Corporation
26/01/2005 à 12:44 | Real
26/01/2005 à 12:41 | QUICKT~1 QuickTime
26/01/2005 à 11:24 | MI2493~1 Microsoft AutoRoute
26/01/2005 à 11:23 | Encarta
26/01/2005 à 11:19 | PICTUR~1 Picture It! Premium 10
26/01/2005 à 11:18 | MI08C4~1 Microsoft Money 2005
26/01/2005 à 11:16 | MICROS~4 Microsoft Office
26/01/2005 à 11:13 | MICROS~3 Microsoft Works
26/01/2005 à 11:13 | MICROS~2 Microsoft Works Suite 2005
25/01/2005 à 18:27 | Ahead
25/01/2005 à 18:24 | DivX
25/01/2005 à 18:24 | Google
25/01/2005 à 17:25 | Java
25/01/2005 à 16:34 | Adobe
20/01/2005 à 20:02 | WI88B7~1 Windows Media Connect
20/01/2005 à 20:01 | HIGHMA~1 HighMAT CD Writing Wizard
20/01/2005 à 18:43 | WINBON~1 Winbond Electronics Corp
20/01/2005 à 18:33 | ATITEC~1 ATI Technologies
20/01/2005 à 16:49 | Intel
20/01/2005 à 16:48 | INSTAL~1 InstallShield Installation Information
20/01/2005 à 16:44 | CARDRE~1 Cardreader Software
20/01/2005 à 16:26 | FICHIE~1 Fichiers communs
20/01/2005 à 15:36 | WINDOW~4 Windows Journal Viewer
20/01/2005 à 15:33 | xerox
20/01/2005 à 15:33 | MICROS~1 microsoft frontpage
20/01/2005 à 15:32 | SERVIC~1 Services en ligne
20/01/2005 à 15:32 | MOVIEM~1 Movie Maker
20/01/2005 à 15:32 | NETMEE~1 NetMeeting
20/01/2005 à 15:32 | OUTLOO~1 Outlook Express
20/01/2005 à 15:32 | INTERN~1 Internet Explorer
20/01/2005 à 15:31 | ONLINE~1 Online Services
20/01/2005 à 15:31 | WINDOW~2 Windows Media Player
20/01/2005 à 15:31 | MESSEN~1 Messenger
20/01/2005 à 15:31 | MSNGAM~1 MSN Gaming Zone
20/01/2005 à 15:31 | MSN
20/01/2005 à 15:31 | WINDOW~1 Windows NT

__________________________ Recherche dans le registre _____________________

# Clés de démarrage :

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
mix enc REG_SZ C:\DOCUME~1\DESCAM~1\APPLIC~1\CDROMW~1\Camp Mail.exe

_____________________ Modification du fichier Hosts _______________________

127.0.0.1= Url bloquée Autre= Redirection

127.0.0.1 bin.errorprotector.com ## added by CiD
127.0.0.1 br.errorsafe.com ## added by CiD
127.0.0.1 br.winantivirus.com ## added by CiD
127.0.0.1 br.winfixer.com ## added by CiD
127.0.0.1 cdn.drivecleaner.com ## added by CiD
127.0.0.1 cdn.errorsafe.com ## added by CiD
127.0.0.1 cdn.winsoftware.com ## added by CiD
127.0.0.1 de.errorsafe.com ## added by CiD
127.0.0.1 de.winantivirus.com ## added by CiD
127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
127.0.0.1 download.cdn.errorsafe.com ## added by CiD
127.0.0.1 download.cdn.winsoftware.com ## added by CiD
127.0.0.1 download.errorsafe.com ## added by CiD
127.0.0.1 download.systemdoctor.com ## added by CiD
127.0.0.1 download.winantispyware.com ## added by CiD
127.0.0.1 download.windrivecleaner.com ## added by CiD
127.0.0.1 download.winfixer.com ## added by CiD
127.0.0.1 drivecleaner.com ## added by CiD
127.0.0.1 dynamique.drivecleaner.com ## added by CiD
127.0.0.1 errorprotector.com ## added by CiD
127.0.0.1 errorsafe.com ## added by CiD
127.0.0.1 es.winantivirus.com ## added by CiD
127.0.0.1 fr.winantivirus.com ## added by CiD
127.0.0.1 fr.winfixer.com ## added by CiD
127.0.0.1 go.drivecleaner.com ## added by CiD
127.0.0.1 go.errorsafe.com ## added by CiD
127.0.0.1 go.winantispyware.com ## added by CiD
127.0.0.1 go.winantivirus.com ## added by CiD
127.0.0.1 hk.winantivirus.com ## added by CiD
127.0.0.1 instlog.errorsafe.com ## added by CiD
127.0.0.1 instlog.winantivirus.com ## added by CiD
127.0.0.1 instlog.winfixer.com ## added by CiD
127.0.0.1 jsp.drivecleaner.com ## added by CiD
127.0.0.1 kb.errorsafe.com ## added by CiD
127.0.0.1 kb.winantivirus.com ## added by CiD
127.0.0.1 nl.errorsafe.com ## added by CiD
127.0.0.1 se.errorsafe.com ## added by CiD
127.0.0.1 secure.drivecleaner.com ## added by CiD
127.0.0.1 secure.errorsafe.com ## added by CiD
127.0.0.1 secure.winantispam.com ## added by CiD
127.0.0.1 secure.winantispy.com ## added by CiD
127.0.0.1 secure.winantivirus.com ## added by CiD
127.0.0.1 support.winantivirus.com ## added by CiD
127.0.0.1 trial.updates.winsoftware.com ## added by CiD
127.0.0.1 ulog.winantivirus.com ## added by CiD
127.0.0.1 utils.errorsafe.com ## added by CiD
127.0.0.1 utils.winantivirus.com ## added by CiD
127.0.0.1 utils.winfixer.com ## added by CiD
127.0.0.1 winantispyware.com ## added by CiD
127.0.0.1 winantivirus.com ## added by CiD
127.0.0.1 winfixer.com ## added by CiD
127.0.0.1 winfixer2006.com ## added by CiD
127.0.0.1 winsoftware.com ## added by CiD
127.0.0.1 www.drivecleaner.com ## added by CiD
127.0.0.1 www.errorprotector.com ## added by CiD
127.0.0.1 www.errorsafe.com ## added by CiD
127.0.0.1 www.systemdoctor.com ## added by CiD
127.0.0.1 www.utils.winfixer.com ## added by CiD
127.0.0.1 www.win-anti-virus-pro.com ## added by CiD
127.0.0.1 www.win-virus-pro.com ## added by CiD
127.0.0.1 www.winantispam.com ## added by CiD
127.0.0.1 www.winantispy.com ## added by CiD
127.0.0.1 www.winantispyware.com ## added by CiD
127.0.0.1 www.winantivirus.com ## added by CiD
127.0.0.1 www.winantiviruspro.com ## added by CiD
127.0.0.1 www.windrivecleaner.com ## added by CiD
127.0.0.1 www.windrivesafe.com ## added by CiD
127.0.0.1 www.winfixer.com ## added by CiD
127.0.0.1 www.winfixer2006.com ## added by CiD
127.0.0.1 www.winsoftware.com ## added by CiD

__________________________ Popups autorisées ______________________________

# Internet Explorer

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow
*.zylom.com REG_BINARY 00000000
netsearchsoft.com REG_SZ
www.netsearchsoft.com REG_SZ
netbios-wait.com REG_SZ
www.netbios-wait.com REG_SZ
*.eu1.badoo.com REG_BINARY

# Mozilla Firefox (1 autorisé 2 interdit)

host popup 1 coursdedroit.free.fr
host popup 1 www.skyrock.com
host popup 1 www.meetic.fr

# Suite Mozilla / SeaMonkey (1 autorisé 2 interdit)

___________________________ Zones de sécurité _____________________________

# HKCU Domains (4)

# P3P History (5)

___________________ Suggestion nettoyage registre _______________

(Pour désinfection manuelle)

REGEDIT4

[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Comp Bib Bird]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mix enc"=-

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow]
"netsearchsoft.com"=-
"www.netsearchsoft.com"=-
"netbios-wait.com"=-
"www.netbios-wait.com"=-

_________________________ Fin du rapport ________________________

green day · Answer

ok,

 
          o Prendre connaissance du contenu du lien suivant: http://www.f-secure.com/products/license-terms/eult_fra.pdf
          o Vous avez donc pris connaissance et accepté les conditions d'utilisations du programme blacklight qui est inclus dans le dossier compressé navilog1.zip que vous allez télécharger.
          o Faire un clic droit sur ce lien : http://perso.orange.fr/il.mafioso/Navifix/Navilog1.zip
          o Enregistrez la cible (du lien) sous... et enregistrez-le sur le bureau.
          o Faire un clic droit sur navilog1.zip et choisir "tout extraire"
          o Double-cliquez sur navilog1.bat
          o Arriver au menu principal, choisir l'option 1 et valider.
          o Patientez jusqu'au message : Analyse Termine le ...
          o Le rapport sera en outre sauvegardé à la racine du disque (fixnavi.txt), poste le stp

++

descamps59 · Answer

bonsoir merci de m aider aussi rapidement

voici le rapport

earch Navipromo version 2.0.3 commencé le 24/06/2007 à 21:49:57,20
 
!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Poster ce rapport sur le forum pour le faire analyser !!!
!!! Ne pas lancer la partie désinfection sans l'avis d'un spécialiste !!!

Fix lancé depuis C:\Program Files
avilog1
Mise a jour le 08.06.2007 a 17h00 by IL-MAFIOSO

Executé en mode normal

*** Recherche Programmes installes *** 

 


*** Recherche dossiers dans C:\WINDOWS ***




*** Recherche dossiers dans C:\Program Files ***




*** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data ***




*** Recherche dossiers dans C:\Documents and Settings\descamps christine\Application Data ***


...\Application Data\MessengerSkinner trouvé !

*** Recherche avec BlackLight Engine/F-secure ***
BlackLight Engine est un produit de F-secure, pour + d'infos :
https://www.f-secure.com/en

Fichier(s) caché(s) dans C:\WINDOWS\system32 :

c:\WINDOWS\system32\fwewuccc.dat 
C:\windows\system32\fwewuccc.exe 
c:\WINDOWS\system32\fwewuccc_nav.dat 
c:\WINDOWS\system32\fwewuccc_navps.dat 

Processus caché(s) dans C:\WINDOWS\system32 :

C:\windows\system32\fwewuccc.exe 


*** Recherche fichiers *** 


C:\WINDOWS\pack.epk trouvé !
C:\WINDOWS\system32
vs2.inf trouvé !


*** Recherche cles registre ***


Recherche dans [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs] 
 
 

Recherche dans [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage] 
 
 

Recherche Clé Magic Control 
 
HKEY_CURRENT_USER\Software\Lanconfig trouvé ! 
HKEY_CURRENT_USER\Software\mc trouvé !  
 
 
*** Module de Recherche complémentaire *** 
(Recherche fichiers spécifiques) 
 
1)Recherche fichiers connus:


2)Recherche Heuristique :
* 
C:\WINDOWS\system32\fwewuccc.dat trouvé !
C:\WINDOWS\system32\pnxnjdcrp.dat trouvé !
** 
C:\WINDOWS\system32\fwewuccc.dat trouvé !
C:\WINDOWS\system32\pnxnjdcrp.dat trouvé !
*** 
**** 
C:\WINDOWS\system32\fwewuccc_navps.dat trouvé !
C:\WINDOWS\system32\pnxnjdcrp_navps.dat trouvé !
***** 
****** 
******* 
******** 
 
 
*** Analyse Terminé le 24/06/2007 à 21:58:50,71 ***

green day · Answer

ok,


          o Double-cliquer sur navilog1.bat
          o Arriver au menu principal, choisir l'option 2 et valider.
          o Indiquer le mode de nettoyage "automatique"
          o Répondre aux questions éventuelles, le bureau disparaîtra, c'est normal !
          o Patienter jusqu'au message : Nettoyage Termine le ...
          o Sauvegarder le rapport de manière à le retrouver, puis fermer le blocnote, le bureau réapparaîtra
          o Redémarrer en mode normal, le rapport sera en outre sauvegardé à la racine du disque (cleannavi.txt)

et fais ce qui est indiqué ici stp :

virus methode preliminaire de desinfection version fr

++

descamps59 · Answer

bonjour veuillez m'excuser pour ce retard mais se fut assez longs
voici les rapports

VG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	00:21:27 25/06/2007

 + Résultat de l'analyse:	



C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP952\A0437694.dll -> Adware.Lop : Aucune action entreprise.
C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP926\A0421610.exe -> Adware.NaviPromo : Aucune action entreprise.
C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP952\A0437695.exe -> Backdoor.Agent.dn : Aucune action entreprise.
C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP957\A0440062.exe -> Hijacker.StartPage.aop : Aucune action entreprise.
C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP952\A0437714.exe -> Not-A-Virus.Downloader.Win32.WinFixer.z : Aucune action entreprise.
C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP952\A0437722.exe -> Not-A-Virus.Downloader.Win32.WinFixer.z : Aucune action entreprise.
:mozilla.137:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.2o7 : Aucune action entreprise.
:mozilla.249:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.2o7 : Aucune action entreprise.
:mozilla.73:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Adtech : Aucune action entreprise.
:mozilla.74:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Adtech : Aucune action entreprise.
:mozilla.85:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Advertising : Aucune action entreprise.
:mozilla.86:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Advertising : Aucune action entreprise.
:mozilla.87:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Advertising : Aucune action entreprise.
:mozilla.88:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Advertising : Aucune action entreprise.
:mozilla.31:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Atdmt : Aucune action entreprise.
C:\Documents and Settings\le compte de didine\Cookies\le_compte_de_didine@atdmt[2].txt -> TrackingCookie.Atdmt : Aucune action entreprise.
:mozilla.148:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Bluestreak : Aucune action entreprise.
:mozilla.149:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Casinotropez : Aucune action entreprise.
:mozilla.104:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Comclick : Aucune action entreprise.
:mozilla.107:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Comclick : Aucune action entreprise.
:mozilla.108:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Comclick : Aucune action entreprise.
:mozilla.30:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Doubleclick : Aucune action entreprise.
C:\Documents and Settings\le compte de didine\Cookies\le_compte_de_didine@doubleclick[1].txt -> TrackingCookie.Doubleclick : Aucune action entreprise.
:mozilla.258:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Estat : Aucune action entreprise.
:mozilla.32:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Hitbox : Aucune action entreprise.
:mozilla.33:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Hitbox : Aucune action entreprise.
:mozilla.34:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Hitbox : Aucune action entreprise.
:mozilla.76:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Imrworldwide : Aucune action entreprise.
:mozilla.77:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Imrworldwide : Aucune action entreprise.
:mozilla.66:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Live : Aucune action entreprise.
:mozilla.67:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Live : Aucune action entreprise.
:mozilla.68:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Live : Aucune action entreprise.
:mozilla.10:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Mediaplex : Aucune action entreprise.
:mozilla.64:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Overture : Aucune action entreprise.
:mozilla.17:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.18:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.19:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.20:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.21:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.22:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.24:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
:mozilla.25:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
:mozilla.26:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
C:\Documents and Settings\le compte de didine\Cookies\le_compte_de_didine@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
:mozilla.123:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Starware : Aucune action entreprise.
:mozilla.127:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Starware : Aucune action entreprise.
:mozilla.128:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Starware : Aucune action entreprise.
:mozilla.129:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Starware : Aucune action entreprise.
:mozilla.11:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Tradedoubler : Aucune action entreprise.
:mozilla.12:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Weborama : Aucune action entreprise.
:mozilla.13:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Weborama : Aucune action entreprise.
:mozilla.14:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Weborama : Aucune action entreprise.
C:\Documents and Settings\le compte de didine\Cookies\le_compte_de_didine@weborama[2].txt -> TrackingCookie.Weborama : Aucune action entreprise.
:mozilla.150:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Webtrendslive : Aucune action entreprise.
:mozilla.151:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Webtrendslive : Aucune action entreprise.
:mozilla.152:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Webtrendslive : Aucune action entreprise.
:mozilla.301:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Yieldmanager : Aucune action entreprise.
:mozilla.302:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Yieldmanager : Aucune action entreprise.
:mozilla.54:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Zedo : Aucune action entreprise.
:mozilla.57:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Zedo : Aucune action entreprise.
:mozilla.58:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Zedo : Aucune action entreprise.
:mozilla.59:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Zedo : Aucune action entreprise.
:mozilla.60:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Zedo : Aucune action entreprise.
:mozilla.61:C:\Documents and Settings\descamps christine\Application Data\Mozilla\Firefox\Profiles\cb6juudx.default\cookies.txt -> TrackingCookie.Zedo : Aucune action entreprise.
C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP951\A0437683.exe -> Trojan.Obfuscated.en : Aucune action entreprise.
C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP952\A0437687.exe -> Trojan.Obfuscated.en : Aucune action entreprise.
C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP952\A0437690.exe -> Trojan.Obfuscated.en : Aucune action entreprise.
C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP952\A0437702.exe -> Trojan.Obfuscated.en : Aucune action entreprise.


Fin du rapport


BitDefender Online Scanner
	

 
	

 

Scan report generated at: Mon, Jun 25, 2007 - 10:14:25

 
	

 
	

 

Scan path: C:\;D:\;E:\;F:\;G:\;H:\;I:\;J:\;K:\;L:\;M:\;
	

 
	

 

 
	

 
	

 

Statistics

Time
	

01:41:45

Files
	

474764

Folders
	

9609

Boot Sectors
	

6

Archives
	

10356

Packed Files
	

17968
	

 
	

 

Results

Identified Viruses
	

2

Infected Files
	

14

Suspect Files
	

1

Warnings
	

0

Disinfected
	

0

Deleted Files
	

15
	

 
	

 

Engines Info

Virus Definitions
	

571226

Engine build
	

AVCORE v1.0 (build 2410) (i386) (Jun 12 2007 21:08:27)

Scan plugins
	

14

Archive plugins
	

38

Unpack plugins
	

6

E-mail plugins
	

6

System plugins
	

1
	

 
	

 

Scan Settings

First Action
	

Disinfect

Second Action
	

Delete

Heuristics
	

Yes

Enable Warnings
	

Yes

Scanned Extensions
	

*;

Exclude Extensions
	

 

Scan Emails
	

Yes

Scan Archives
	

Yes

Scan Packed
	

Yes

Scan Files
	

Yes

Scan Boot
	

Yes
	

 
	

 
 

Scanned File
	

 Status

C:\Documents and Settings\All Users\Application Data\Mail ace itch download\store roam.exe
	

Infected with: Trojan.FatObfus.Gen

C:\Documents and Settings\All Users\Application Data\Mail ace itch download\store roam.exe
	

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Mail ace itch download\store roam.exe
	

Deleted

C:\Documents and Settings\descamps christine\Application Data\CdromWait\BLEH LITE BAIT.exe
	

Infected with: Trojan.FatObfus.Gen

C:\Documents and Settings\descamps christine\Application Data\CdromWait\BLEH LITE BAIT.exe
	

Disinfection failed

C:\Documents and Settings\descamps christine\Application Data\CdromWait\BLEH LITE BAIT.exe
	

Deleted

C:\Documents and Settings\descamps christine\Application Data\CdromWait\Camp Mail.exe
	

Infected with: Trojan.FatObfus.Gen

C:\Documents and Settings\descamps christine\Application Data\CdromWait\Camp Mail.exe
	

Disinfection failed

C:\Documents and Settings\descamps christine\Application Data\CdromWait\Camp Mail.exe
	

Deleted

C:\Documents and Settings\descamps christine\Application Data\CdromWait\yxowplwh.exe
	

Infected with: Trojan.FatObfus.Gen

C:\Documents and Settings\descamps christine\Application Data\CdromWait\yxowplwh.exe
	

Disinfection failed

C:\Documents and Settings\descamps christine\Application Data\CdromWait\yxowplwh.exe
	

Deleted

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP890\S0403841.Acl
	

Suspected of: Trojan.DOS.FormatHDD.B

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP890\S0403841.Acl
	

Disinfection failed

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP890\S0403841.Acl
	

Deleted

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP951\A0437684.exe
	

Infected with: Trojan.FatObfus.Gen

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP951\A0437684.exe
	

Disinfection failed

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP951\A0437684.exe
	

Deleted

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP951\A0437685.exe
	

Infected with: Trojan.FatObfus.Gen

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP951\A0437685.exe
	

Disinfection failed

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP951\A0437685.exe
	

Deleted

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP952\A0437714.exe
	

Infected with: Trojan.Downloader.WinFixer.W

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP952\A0437714.exe
	

Disinfection failed

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP952\A0437714.exe
	

Deleted

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP952\A0437722.exe
	

Infected with: Trojan.Downloader.WinFixer.W

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP952\A0437722.exe
	

Disinfection failed

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP952\A0437722.exe
	

Deleted

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP955\A0437959.exe
	

Infected with: Trojan.FatObfus.Gen

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP955\A0437959.exe
	

Disinfection failed

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP955\A0437959.exe
	

Deleted

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP955\A0437960.exe
	

Infected with: Trojan.FatObfus.Gen

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP955\A0437960.exe
	

Disinfection failed

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP955\A0437960.exe
	

Deleted

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP969\A0446710.exe
	

Infected with: Trojan.FatObfus.Gen

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP969\A0446710.exe
	

Disinfection failed

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP969\A0446710.exe
	

Deleted

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP969\A0446711.exe
	

Infected with: Trojan.FatObfus.Gen

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP969\A0446711.exe
	

Disinfection failed

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP969\A0446711.exe
	

Deleted

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP969\A0446712.exe
	

Infected with: Trojan.FatObfus.Gen

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP969\A0446712.exe
	

Disinfection failed

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP969\A0446712.exe
	

Deleted


Logfile of HijackThis v1.99.1
Scan saved at 10:17:21, on 25/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Media Connect\mswmcls.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Windows Media Connect\mswmc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\AGRSMMSG.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\Medion\KeyStat\KeyStat.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\Dit.exe
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\WINDOWS\system32\XCSyncML.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe
C:\Program Files\Home Cinema\PowerCinema\PCMService.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\ICQLite\ICQLite.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\PROMT5\INTEGRAL\pinmenu.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll
R3 - URLSearchHook: Multi_Media_France toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - C:\Program Files\Multi_Media_France	bMul0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1	oolbar.dll
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: Multi_Media_France toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - C:\Program Files\Multi_Media_France	bMul0.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll
O3 - Toolbar: Multi_Media_France toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - C:\Program Files\Multi_Media_France	bMul0.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Keyboard Status] C:\PROGRA~1\Medion\KeyStat\KeyStat.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\Run: [XCSyncML] C:\WINDOWS\system32\XCSyncML.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1036
O4 - HKLM\..\Run: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [PROMT Integrator] "C:\Program Files\PROMT5\INTEGRAL\PinStart.exe" /autorun
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [mix enc] C:\DOCUME~1\DESCAM~1\APPLIC~1\CDROMW~1\Camp Mail.exe
O4 - HKCU\..\Run: [EPSON Stylus DX6000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIE.EXE /FU "C:\WINDOWS\TEMP\E_S102.tmp" /EF "HKCU"
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNfox000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=https://www.aldi.com/
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Pml Driver HPZ12 - Unknown owner - C:\WINDOWS\system32\HPZipm12.exe (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe




C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP969\A0446713.exe
	

Infected with: Trojan.FatObfus.Gen

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP969\A0446713.exe
	

Disinfection failed

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP969\A0446713.exe
	

Deleted
	

bonne journée

green day · Answer

Salut

 pas de soucis, je sais que c'est assez long !

 as tu supprimé ce qu'avg a trouvé ???

 où en sont tes soucis ???

++

green day · Answer

Salut

oui, dernier détail !

#Désactiver la Restauration du système 

* Cliquez sur le bouton Démarrer. 
* Cliquez avec le bouton droit de la souris sur Poste de travail puis cliquez sur Propriétés. 
* Dans l'onglet Restauration du système, sélectionnez l'option Désactiver la Restauration du système ou Désactiver la Restauration du système sur tous les lecteurs 

( tu pourras la réactivé à la fin de la manip )

Relance HijackThis : choisis " do a scan only" coche la case devant les lignes ci-dessous et clique en bas sur "fix checked" :

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF 

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) 

O3 - Toolbar: Multi_Media_France toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - C:\Program Files\Multi_Media_France	bMul0.dll 

O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" 

O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [mix enc] C:\DOCUME~1\DESCAM~1\APPLIC~1\CDROMW~1\Camp Mail.exe 

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe 

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNfox000 

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab

O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab 


sauf celle-ci !!! 

==> O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab


ensuite, repasse un coup de ccleaner , et installe un parefeu si tu n'en as pas !

 voir ici :

securite proteger un ordinateur contre les malwares d internet

Bonne soirée ;-))

++

descamps59 · Answer

bonjour je vous remercie de votre aide apparamant le problème est résolu
je vous souhaite une bonne journée et encore merci

green day · Answer

Salut

 pas d'quoi ;-))

 bonne soirée !

@+

Pub

12 réponses

Discussions similaires

Newsletters