Ordi lent+pubs tout le temps sur IE7

Question

Bonjour, mon ordi est très très ralenti au démarrage; des fenêtres de pub s'ouvrent avec IE7...J'ai un rapport Hijack pr^t si qqn peut m'aider...Merci

rudyrital · Answer

Tout d'abord Bonjour et bienvenue sur le forum d'entraide COMMENT CA MARCHE 


Télécharge HijackThis ici: 
http://www.merijn.org/files/hijackthis.zip
ou ici :
https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/29061.html 

Dézippe le dans un dossier prévu à cet effet. 
Par exemple C:\hijackthis < Enregistre le bien dans c : ! 
Démo : (Merci a Balltrap34 pour cette réalisation) 
http://perso.orange.fr/rginformatique/section%20virus/Hijenr.gif

Lance le puis: 
clique sur "do a system scan and save logfile" (cf démo) 
faire un copier coller du log entier sur le forum 

Démo : (Merci a Balltrap34 pour cette réalisation) 

http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm


Bon courage 
A+

weco · Answer

Voici le fichier log : 
Logfile of HijackThis v1.99.1
Scan saved at 17:59:38, on 05/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\Nero\InCD\InCD\InCDsrv.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Utilitaires\Ad-Aware 2007\aawservice.exe
D:\Utilitaires\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
C:\Program Files\Inquiero Installable RC\installablerc.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\PFU\ScanSnap\PfuSsSct.exe
C:\Program Files\PFU\ScanSnap\PDF Thumbnail View\pdfquickview.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Ahead\Nero\InCD\InCD\InCD.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\LVComS.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
D:\Utilitaires\Expert PDF 4\vspdfprsrv.exe
D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
D:\Utilitaires\RealPopup\RealPopup.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\DataViz\DvzIncMsgr.exe
C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
D:\Palm\Hotsync.exe
D:\Utilitaires\Post-It\Psn2Lite.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Inquiero Client\inquiero.exe
C:\Program Files\PFU\ScanSnap\Driver\PfuSsMon.exe
D:\Utilitaires\Touches Express\GhostTyp.exe
D:\NaturallySpeaking9\Program
atspeak.exe
D:\UTILIT~1\Post-It\PSNGive.exe
C:\Documents and Settings\Corinne\Local Settings\Temporary Internet Files\Content.IE5\F966U7F3\FxVundoB[1].exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Utilitaires\Hijackthis Version Française\hijackthis vf.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O1 - Hosts: HP51051E HP00187151051E
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: (no name) - {1FB63E52-4D6E-48C1-A08F-F630FE50F337} - (no file)
O2 - BHO: EoBho Class - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\WINDOWS\system32\xgmgsgkr.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [PfuSsSct.exe] C:\Program Files\PFU\ScanSnap\PfuSsSct.exe /Station
O4 - HKLM\..\Run: [Pdfquickview] C:\Program Files\PFU\ScanSnap\PDF Thumbnail View\pdfquickview.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LanguageShortcut] "D:\TT Images\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\Nero\InCD\InCD\InCD.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [QuickTime Task] "D:\TT Images\Quicktime 6\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [vspdfprsrv.exe] D:\Utilitaires\Expert PDF 4\vspdfprsrv.exe --background
O4 - HKLM\..\Run: [ISUSPM Startup] c:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "C:\WINDOWS\system32\icmxcyyl.dll",forkonce
O4 - HKCU\..\Run: [Creative Detector] "D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [RealPopup] "D:\Utilitaires\RealPopup\RealPopup.exe" BOOT
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: Dragon NaturallySpeaking.lnk = D:\NaturallySpeaking9\Program
atspeak.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Boot.Bat
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Fichiers communs\DataViz\DvzIncMsgr.exe
O4 - Global Startup: Device Detector 3.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O4 - Global Startup: Directrec Configuration Tool.lnk = C:\Program Files\Olympus\DeviceDetector\DirectrecConfig.exe
O4 - Global Startup: HotSync Manager.lnk = D:\Palm\Hotsync.exe
O4 - Global Startup: Inquiero Client.lnk = C:\Program Files\Inquiero Client\_INQUIERO.EXE
O4 - Global Startup: Post-it® Software Notes Lite.lnk = D:\Utilitaires\Post-It\Psn2Lite.exe
O4 - Global Startup: ScanSnap Manager.lnk = ?
O4 - Global Startup: Touches Express.lnk = D:\Utilitaires\Touches Express\GhostTyp.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - D:\UTILIT~1\INCRED~1\INCRED~1\binesources\WebMenuImg.htm
O8 - Extra context menu item: Chercher avec Copernic 2001 - D:\Utilitaires\Copernic 2001 Basic\Search Extension.htm
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {2A465934-E5F0-11D2-91B5-00104B9C4765} - D:\Utilitaires\Copernic 2001 Basic\Copernic.exe
O9 - Extra 'Tools' menuitem: Lancer Copernic 2001 - {2A465934-E5F0-11D2-91B5-00104B9C4765} - D:\Utilitaires\Copernic 2001 Basic\Copernic.exe
O9 - Extra button: Copernic 2001 - {2A465936-E5F0-11D2-91B5-00104B9C4765} - D:\Utilitaires\Copernic 2001 Basic\Copernic.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Traduire - {99EFB53C-C965-43CF-9F45-52242D134187} - file://D:\Utilitaires\Copernic 2001 Basic\Translate.htm
O9 - Extra 'Tools' menuitem: &Traduire avec Gist-In-Time - {99EFB53C-C965-43CF-9F45-52242D134187} - file://D:\Utilitaires\Copernic 2001 Basic\Translate.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: *.canalplay.com
O15 - Trusted Zone: *.canalplusactive.com
O15 - Trusted Zone: *.canalplay.com (HKLM)
O15 - Trusted Zone: *.canalplusactive.com (HKLM)
O16 - DPF: {13510606-30FA-11D2-B383-444553540000} (WebClient Class) - https://www.omnis.net/developers/resources/download/index.jsp
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} - http://a516.g.akamai.net/f/516/25175/7d/runaware.download.akamai.com/25175/citrix/wficat-no-eula.cab
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqemea/downloads/sysinfo.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - http://srv4.mediapluspro.net/mediaplus6/App/VirtualMplus/msrdp.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://charon777.free.fr/plugins/hardwaredetection.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cab
O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f001.mail.caramail.lycos.fr/app/uploader/FileUploader.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E6ACF817-0A85-4EBE-9F0A-096C6488CFEA} (NTR ActiveX 1.1.8) - http://www.inquiero.com/inquiero/mod/setup/ntractivex118_24.cab
O16 - DPF: {F11BFF96-CC7A-4482-819B-91EAE4C454EF} (NTR ActiveX 1.1.6) - https://www.inquiero.com/ssl/inquiero/mod/setup/ntractivex116_14.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winepi32 - winepi32.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - D:\Utilitaires\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Utilitaires\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: DM1Service - OLYMPUS IMAGING CORP. - C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\Nero\InCD\InCD\InCDsrv.exe
O23 - Service: Inquiero Installable RC (installablerc) - Net Transmit & Receive - C:\Program Files\Inquiero Installable RC\installablerc.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Service CANALPLAY - Canal+ Active - C:\Program Files\Lecteur CANALPLAY\CanalPlayService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe

rudyrital · Answer

Fais un clic droit sur ce lien :
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.zip
Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau.
Fais un clic droit sur navilog1.zip et choisis "tout extraire"
Ensuite double clique sur navilog1.exe pour lancer l'installation.
Une fois l'installation terminée, le fix s'exécutera automatiquement.
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau).

Laisse-toi guider. Au menu principal, choisis 1 et valides.
(ne fais pas le choix 2,3 ou 4 sans notre avis/accord)

Patiente jusqu'au message :
*** Analyse Termine le ..... ***
Appuie sur une touche comme demandé, le blocnote va s'ouvrir.
Copie-colle l'intégralité dans une réponse. Referme le blocnote.
Le rapport est en outre sauvegardé à la racine du disque (fixnavi.txt)

weco · Answer

Voilà le fichier : 
Search Navipromo version 2.0.5 commencé le 05/08/2007 à 18:24:23,37
 
!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Poster ce rapport sur le forum pour le faire analyser !!!
!!! Ne pas lancer la partie désinfection sans l'avis d'un spécialiste !!!

Fix lancé depuis C:\Program Files
avilog1
Mise a jour le 01.07.2007 a 12h00 by IL-MAFIOSO

Executé en mode normal

*** Recherche Programmes installes *** 

 


*** Recherche dossiers dans C:\WINDOWS ***




*** Recherche dossiers dans C:\Program Files ***




*** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data ***




*** Recherche dossiers dans C:\Documents and Settings\Corinne\Application Data ***



*** Recherche avec BlackLight Engine/F-secure ***
BlackLight Engine est un produit de F-secure, pour + d'infos :
https://www.f-secure.com/en


F-SECURE BLACKLIGHT ROOTKIT ELIMINATOR
======================================

Copyright 2005-2006 F-Secure Corporation. All rights reserved.
This is a beta version. It will expire on 1st of October, 2007.
Version information: 2.2.1064.

[+] Started on 08/05/07 at 18:24:25.
[+] Initializing ...
[+] Starting scan, press Ctrl-C to abort.
[+] Scanning for hidden items ................................................................................................
[+] Scan complete.
[+] Summary: 0 hidden item(s) found, 0 scheduled for renaming.
[+] Exited on 08/05/07 at 18:33:39 (return code = 0).


*** Recherche fichiers *** 




*** Recherche cles registre ***


Recherche dans [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs] 
 
 

Recherche dans [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage] 
 
 

Recherche Clé Magic Control 
 
 
 
*** Module de Recherche complémentaire *** 
(Recherche fichiers spécifiques) 
 
1)Recherche fichiers connus:

C:\WINDOWS\system32\jlkkj.ini2 trouvé ! infection Vundo possible non traité par cet outil !
C:\WINDOWS\system32qstv.ini2 trouvé ! infection Vundo possible non traité par cet outil !
C:\WINDOWS\system32\jlkkj.bak1 trouvé ! infection Vundo possible non traité par cet outil !
C:\WINDOWS\system32qstv.bak1 trouvé ! infection Vundo possible non traité par cet outil !
C:\WINDOWS\system32\jlkkj.bak2 trouvé ! infection Vundo possible non traité par cet outil !
C:\WINDOWS\system32qstv.bak2 trouvé ! infection Vundo possible non traité par cet outil !

2)Recherche Heuristique :
* 
** 
*** 
**** 
***** 
****** 
******* 
******** 

3)Recherche Certificats :


*** Analyse Terminé le 05/08/2007 à 18:34:16,32 ***

rudyrital · Answer

Télécharge VundoFix.exe (par Atribune) sur ton Bureau. 
http://www.atribune.org/ccount/click.php?id=4 

* Double-clique VundoFix.exe afin de le lancer. 
* Lorsque l'outil se lance à nouveau, clique sur le bouton Scan for Vundo 
* Clique sur le bouton Scan for Vundo. 
* Lorsque le scan est complété, clique sur le bouton Remove Vundo 
* Une invite te demandera si tu veux supprimer les fichiers, clique YES 
* Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers. 
* Tu verras une invite qui t'annonce que ton PC va s'éteindre ("shutdown"); clique OK 
* Démarre ton PC à nouveau. 
* Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse. 

Note Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci-haut, à partir de "clique sur le bouton Scan for Vundo".

weco · Answer

Voilà, vundofix;hijack arrive...

rudyrital · Answer

met le rapport de vundo aussi !

weco · Answer

Le fichier hijack :

Logfile of HijackThis v1.99.1
Scan saved at 19:25:17, on 05/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\Nero\InCD\InCD\InCDsrv.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Utilitaires\Ad-Aware 2007\aawservice.exe
D:\Utilitaires\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
C:\Program Files\Inquiero Installable RC\installablerc.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\PFU\ScanSnap\PfuSsSct.exe
C:\Program Files\PFU\ScanSnap\PDF Thumbnail View\pdfquickview.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Ahead\Nero\InCD\InCD\InCD.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\LVComS.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
D:\Utilitaires\Expert PDF 4\vspdfprsrv.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
D:\Utilitaires\RealPopup\RealPopup.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
C:\Program Files\Fichiers communs\DataViz\DvzIncMsgr.exe
C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
D:\Palm\Hotsync.exe
D:\Utilitaires\Post-It\Psn2Lite.exe
C:\Program Files\PFU\ScanSnap\Driver\PfuSsMon.exe
D:\Utilitaires\Touches Express\GhostTyp.exe
D:\NaturallySpeaking9\Program
atspeak.exe
C:\Program Files\Inquiero Client\inquiero.exe
D:\UTILIT~1\Post-It\PSNGive.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Utilitaires\Hijackthis Version Française\hijackthis vf.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O1 - Hosts: HP51051E HP00187151051E
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: (no name) - {1FB63E52-4D6E-48C1-A08F-F630FE50F337} - (no file)
O2 - BHO: EoBho Class - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\WINDOWS\system32\xgmgsgkr.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [PfuSsSct.exe] C:\Program Files\PFU\ScanSnap\PfuSsSct.exe /Station
O4 - HKLM\..\Run: [Pdfquickview] C:\Program Files\PFU\ScanSnap\PDF Thumbnail View\pdfquickview.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LanguageShortcut] "D:\TT Images\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\Nero\InCD\InCD\InCD.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [QuickTime Task] "D:\TT Images\Quicktime 6\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [vspdfprsrv.exe] D:\Utilitaires\Expert PDF 4\vspdfprsrv.exe --background
O4 - HKLM\..\Run: [ISUSPM Startup] c:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "C:\WINDOWS\system32\icmxcyyl.dll",forkonce
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Acrobat 8.1\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Creative Detector] "D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [RealPopup] "D:\Utilitaires\RealPopup\RealPopup.exe" BOOT
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: Dragon NaturallySpeaking.lnk = D:\NaturallySpeaking9\Program
atspeak.exe
O4 - Global Startup: Boot.Bat
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Fichiers communs\DataViz\DvzIncMsgr.exe
O4 - Global Startup: Device Detector 3.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O4 - Global Startup: Directrec Configuration Tool.lnk = C:\Program Files\Olympus\DeviceDetector\DirectrecConfig.exe
O4 - Global Startup: HotSync Manager.lnk = D:\Palm\Hotsync.exe
O4 - Global Startup: Inquiero Client.lnk = C:\Program Files\Inquiero Client\_INQUIERO.EXE
O4 - Global Startup: Post-it® Software Notes Lite.lnk = D:\Utilitaires\Post-It\Psn2Lite.exe
O4 - Global Startup: ScanSnap Manager.lnk = ?
O4 - Global Startup: Touches Express.lnk = D:\Utilitaires\Touches Express\GhostTyp.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - D:\UTILIT~1\INCRED~1\INCRED~1\binesources\WebMenuImg.htm
O8 - Extra context menu item: Chercher avec Copernic 2001 - D:\Utilitaires\Copernic 2001 Basic\Search Extension.htm
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {2A465934-E5F0-11D2-91B5-00104B9C4765} - D:\Utilitaires\Copernic 2001 Basic\Copernic.exe
O9 - Extra 'Tools' menuitem: Lancer Copernic 2001 - {2A465934-E5F0-11D2-91B5-00104B9C4765} - D:\Utilitaires\Copernic 2001 Basic\Copernic.exe
O9 - Extra button: Copernic 2001 - {2A465936-E5F0-11D2-91B5-00104B9C4765} - D:\Utilitaires\Copernic 2001 Basic\Copernic.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Traduire - {99EFB53C-C965-43CF-9F45-52242D134187} - file://D:\Utilitaires\Copernic 2001 Basic\Translate.htm
O9 - Extra 'Tools' menuitem: &Traduire avec Gist-In-Time - {99EFB53C-C965-43CF-9F45-52242D134187} - file://D:\Utilitaires\Copernic 2001 Basic\Translate.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: *.canalplay.com
O15 - Trusted Zone: *.canalplusactive.com
O15 - Trusted Zone: *.canalplay.com (HKLM)
O15 - Trusted Zone: *.canalplusactive.com (HKLM)
O16 - DPF: {13510606-30FA-11D2-B383-444553540000} (WebClient Class) - https://www.omnis.net/developers/resources/download/index.jsp
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} - http://a516.g.akamai.net/f/516/25175/7d/runaware.download.akamai.com/25175/citrix/wficat-no-eula.cab
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqemea/downloads/sysinfo.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - http://srv4.mediapluspro.net/mediaplus6/App/VirtualMplus/msrdp.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://charon777.free.fr/plugins/hardwaredetection.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cab
O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f001.mail.caramail.lycos.fr/app/uploader/FileUploader.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E6ACF817-0A85-4EBE-9F0A-096C6488CFEA} (NTR ActiveX 1.1.8) - http://www.inquiero.com/inquiero/mod/setup/ntractivex118_24.cab
O16 - DPF: {F11BFF96-CC7A-4482-819B-91EAE4C454EF} (NTR ActiveX 1.1.6) - https://www.inquiero.com/ssl/inquiero/mod/setup/ntractivex116_14.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winepi32 - winepi32.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - D:\Utilitaires\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Utilitaires\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: DM1Service - OLYMPUS IMAGING CORP. - C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\Nero\InCD\InCD\InCDsrv.exe
O23 - Service: Inquiero Installable RC (installablerc) - Net Transmit & Receive - C:\Program Files\Inquiero Installable RC\installablerc.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Service CANALPLAY - Canal+ Active - C:\Program Files\Lecteur CANALPLAY\CanalPlayService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe

weco · Answer

Rapport Vundo, j'avais oublié...


VundoFix V6.5.6

Checking Java version...

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Scan started at 18:43:14 05/08/2007

Listing files found while scanning....

C:\windows\system32\bsplrgpi.dll
C:\windows\system32\ikowfvvo.dll
C:\windows\system32\lxexrpqm.dll
C:\windows\system32\ovvfwoki.ini
C:\windows\system32\sjjjjmen.dll
C:\windows\system32	sfmriek.dll

Beginning removal...

 Attempting to delete C:\windows\system32\bsplrgpi.dll
C:\windows\system32\bsplrgpi.dll Has been deleted!

 Attempting to delete C:\windows\system32\ikowfvvo.dll
C:\windows\system32\ikowfvvo.dll Has been deleted!

 Attempting to delete C:\windows\system32\lxexrpqm.dll
C:\windows\system32\lxexrpqm.dll Has been deleted!

 Attempting to delete C:\windows\system32\ovvfwoki.ini
C:\windows\system32\ovvfwoki.ini Has been deleted!

 Attempting to delete C:\windows\system32\sjjjjmen.dll
C:\windows\system32\sjjjjmen.dll Has been deleted!

 Attempting to delete C:\windows\system32	sfmriek.dll
C:\windows\system32	sfmriek.dll Has been deleted!

Performing Repairs to the registry.
Done!

rudyrital · Answer

met le rapport de vundo aussi ! 
--

weco · Answer

c'est quoi le rapport de vundo ?

rudyrital · Answer

Rends toi sur ce site :
https://www.virustotal.com/gui/

Clique sur parcourir et cherche ce fichier :

C:\WINDOWS\system32\jlkkj.ini2 

Clique sur send.

Un rapport va s'élaborer ligne à ligne.

Attends la fin. Il doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note.

Fait de même pour ceux-ci :

C:\WINDOWS\system32\rqstv.ini2 
C:\WINDOWS\system32\jlkkj.bak1 
C:\WINDOWS\system32\rqstv.bak1 
C:\WINDOWS\system32\jlkkj.bak2 
C:\WINDOWS\system32\rqstv.bak2 

Copie les 6 rapport dans ta réponse.

weco · Answer

Je n'obtiens pas de rapport à la fin des annalyses par Virustotal

rudyrital · Answer

tu copie /colle les different scan qu'il a effectue

ca ressemble a ceci : 

File vie____lenvers.txt received on 08.05.2007 20:15:49 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED 


Result: 0/30 (0%)
Loading server information... 
Your file is queued in position: 2.
Estimated start time is between 46 and 66 seconds.
Do not close the window untill scan is complete. 
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file. 
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated. 
 Compact Print results  
Your file has expired or do not exists. 
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished. 
 Email:  
  

Antivirus Version Last Update Result 
AhnLab-V3 2007.8.3.0 2007.08.03 - 
AntiVir 7.4.0.57 2007.08.03 - 
Authentium 4.93.8 2007.08.03 - 
Avast 4.7.1029.0 2007.08.05 - 
AVG 7.5.0.476 2007.08.05 - 
BitDefender 7.2 2007.08.05 - 
CAT-QuickHeal 9.00 2007.08.04 - 
ClamAV 0.91 2007.08.05 - 
DrWeb 4.33 2007.08.05 - 
eSafe 7.0.15.0 2007.07.31 - 
eTrust-Vet 31.1.5032 2007.08.04 - 
Ewido 4.0 2007.08.05 - 
FileAdvisor 1 2007.08.05 - 
Fortinet 2.91.0.0 2007.08.05 - 
F-Prot 4.3.2.48 2007.08.03 - 
F-Secure 6.70.13030.0 2007.08.03 - 
Ikarus T3.1.1.8 2007.08.05 - 
Kaspersky 4.0.2.24 2007.08.05 - 
McAfee 5090 2007.08.03 - 
Microsoft 1.2704 2007.08.05 - 
NOD32v2 2438 2007.08.05 - 
Norman 5.80.02 2007.08.03 - 
Panda 9.0.0.4 2007.08.05 - 
Rising 19.34.40.00 2007.08.03 - 
Sophos 4.19.0 2007.08.01 - 
Sunbelt 2.2.907.0 2007.08.04 - 
Symantec 10 2007.08.05 - 
TheHacker 6.1.7.162 2007.08.04 - 
VBA32 3.12.2.2 2007.08.04 - 
Webwasher-Gateway 6.0.1 2007.08.03 - 
Additional information 
File size: 943 bytes 
MD5: d5eeda183c293f32ab377c6f3de4d0c5 
SHA1: 729029de86de9ce7f0a879ed095d6e02abf08a72

weco · Answer

ok, ça j'ai , je fais ...merci de ta patience et ta présence !

weco · Answer

File jlkkj.bak1 received on 08.05.2007 20:19:18 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED 


Result: 0/31 (0%)
Loading server information... 
Your file is queued in position: 2.
Estimated start time is between 46 and 66 seconds.
Do not close the window untill scan is complete. 
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file. 
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated. 
 Compact Print results  
Your file has expired or do not exists. 
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished. 
 Email:  
  

Antivirus Version Last Update Result 
AhnLab-V3 2007.8.3.0 2007.08.03 - 
AntiVir 7.4.0.57 2007.08.03 - 
Authentium 4.93.8 2007.08.03 - 
Avast 4.7.1029.0 2007.08.05 - 
AVG 7.5.0.476 2007.08.05 - 
BitDefender 7.2 2007.08.05 - 
CAT-QuickHeal 9.00 2007.08.04 - 
ClamAV 0.91 2007.08.05 - 
DrWeb 4.33 2007.08.05 - 
eSafe 7.0.15.0 2007.07.31 - 
eTrust-Vet 31.1.5032 2007.08.04 - 
Ewido 4.0 2007.08.05 - 
FileAdvisor 1 2007.08.05 - 
Fortinet 2.91.0.0 2007.08.05 - 
F-Prot 4.3.2.48 2007.08.03 - 
F-Secure 6.70.13030.0 2007.08.03 - 
Ikarus T3.1.1.8 2007.08.05 - 
Kaspersky 4.0.2.24 2007.08.05 - 
McAfee 5090 2007.08.03 - 
Microsoft 1.2704 2007.08.05 - 
NOD32v2 2438 2007.08.05 - 
Norman 5.80.02 2007.08.03 - 
Panda 9.0.0.4 2007.08.05 - 
Rising 19.34.40.00 2007.08.03 - 
Sophos 4.19.0 2007.08.01 - 
Sunbelt 2.2.907.0 2007.08.04 - 
Symantec 10 2007.08.05 - 
TheHacker 6.1.7.162 2007.08.04 - 
VBA32 3.12.2.2 2007.08.04 - 
VirusBuster 4.3.26:9 2007.08.05 - 
Webwasher-Gateway 6.0.1 2007.08.03 - 
Additional information 
File size: 6369 bytes 
MD5: ee003ee85e096acb1862d878e9d0d10d 
SHA1: 113de883860005da2e112393279de5832fbd841b

weco · Answer

File jlkkj.ini2_ received on 08.05.2007 20:35:08 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED 


Result: 0/32 (0%)
Loading server information... 
Your file is queued in position: 3.
Estimated start time is between 52 and 75 seconds.
Do not close the window untill scan is complete. 
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file. 
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated. 
 Compact Print results  
Your file has expired or do not exists. 
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished. 
 Email:  
  

Antivirus Version Last Update Result 
AhnLab-V3 2007.8.3.0 2007.08.03 - 
AntiVir 7.4.0.57 2007.08.03 - 
Authentium 4.93.8 2007.08.03 - 
Avast 4.7.1029.0 2007.08.05 - 
AVG 7.5.0.476 2007.08.05 - 
BitDefender 7.2 2007.08.05 - 
CAT-QuickHeal 9.00 2007.08.04 - 
ClamAV 0.91 2007.08.05 - 
DrWeb 4.33 2007.08.05 - 
eSafe 7.0.15.0 2007.07.31 - 
eTrust-Vet 31.1.5032 2007.08.04 - 
Ewido 4.0 2007.08.05 - 
FileAdvisor 1 2007.08.05 - 
Fortinet 2.91.0.0 2007.08.05 - 
F-Prot 4.3.2.48 2007.08.03 - 
F-Secure 6.70.13030.0 2007.08.03 - 
Ikarus T3.1.1.8 2007.08.05 - 
Kaspersky 4.0.2.24 2007.08.05 - 
McAfee 5090 2007.08.03 - 
Microsoft 1.2704 2007.08.05 - 
NOD32v2 2438 2007.08.05 - 
Norman 5.80.02 2007.08.03 - 
Panda 9.0.0.4 2007.08.05 - 
Prevx1 V2 2007.08.05 - 
Rising 19.34.40.00 2007.08.03 - 
Sophos 4.19.0 2007.08.01 - 
Sunbelt 2.2.907.0 2007.08.04 - 
Symantec 10 2007.08.05 - 
TheHacker 6.1.7.162 2007.08.04 - 
VBA32 3.12.2.2 2007.08.04 - 
VirusBuster 4.3.26:9 2007.08.05 - 
Webwasher-Gateway 6.0.1 2007.08.03 - 
Additional information 
File size: 892309 bytes 
MD5: 0a58501ceae31ea34614dd690345a83c 
SHA1: 1eb9a55432dac0d66569dd4b48ccce218ffb8cc3

weco · Answer

File rqstv.ini2 received on 08.05.2007 20:43:42 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED 


Result: 0/32 (0%)
Loading server information... 
Your file is queued in position: 1.
Estimated start time is between 40 and 58 seconds.
Do not close the window untill scan is complete. 
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file. 
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated. 
 Compact Print results  
Your file has expired or do not exists. 
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished. 
 Email:  
  

Antivirus Version Last Update Result 
AhnLab-V3 2007.8.3.0 2007.08.03 - 
AntiVir 7.4.0.57 2007.08.03 - 
Authentium 4.93.8 2007.08.03 - 
Avast 4.7.1029.0 2007.08.05 - 
AVG 7.5.0.476 2007.08.05 - 
BitDefender 7.2 2007.08.05 - 
CAT-QuickHeal 9.00 2007.08.04 - 
ClamAV 0.91 2007.08.05 - 
DrWeb 4.33 2007.08.05 - 
eSafe 7.0.15.0 2007.07.31 - 
eTrust-Vet 31.1.5032 2007.08.04 - 
Ewido 4.0 2007.08.05 - 
FileAdvisor 1 2007.08.05 - 
Fortinet 2.91.0.0 2007.08.05 - 
F-Prot 4.3.2.48 2007.08.03 - 
F-Secure 6.70.13030.0 2007.08.03 - 
Ikarus T3.1.1.8 2007.08.05 - 
Kaspersky 4.0.2.24 2007.08.05 - 
McAfee 5090 2007.08.03 - 
Microsoft 1.2704 2007.08.05 - 
NOD32v2 2438 2007.08.05 - 
Norman 5.80.02 2007.08.03 - 
Panda 9.0.0.4 2007.08.05 - 
Prevx1 V2 2007.08.05 - 
Rising 19.34.40.00 2007.08.03 - 
Sophos 4.19.0 2007.08.01 - 
Sunbelt 2.2.907.0 2007.08.04 - 
Symantec 10 2007.08.05 - 
TheHacker 6.1.7.162 2007.08.04 - 
VBA32 3.12.2.2 2007.08.04 - 
VirusBuster 4.3.26:9 2007.08.05 - 
Webwasher-Gateway 6.0.1 2007.08.03 - 
Additional information 
File size: 722424 bytes 
MD5: 346f0aa1d87476803b8d6b271adf492d 
SHA1: 682f0bbcd75559f505579ba3f5971785e1011537 

encore 3....

weco · Answer

File rqstv.bak1 received on 08.05.2007 20:50:12 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED 


Result: 0/32 (0%)
Loading server information... 
Your file is queued in position: 1.
Estimated start time is between 40 and 58 seconds.
Do not close the window untill scan is complete. 
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file. 
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated. 
 Compact Print results  
Your file has expired or do not exists. 
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished. 
 Email:  
  

Antivirus Version Last Update Result 
AhnLab-V3 2007.8.3.0 2007.08.03 - 
AntiVir 7.4.0.57 2007.08.03 - 
Authentium 4.93.8 2007.08.03 - 
Avast 4.7.1029.0 2007.08.05 - 
AVG 7.5.0.476 2007.08.05 - 
BitDefender 7.2 2007.08.05 - 
CAT-QuickHeal 9.00 2007.08.04 - 
ClamAV 0.91 2007.08.05 - 
DrWeb 4.33 2007.08.05 - 
eSafe 7.0.15.0 2007.07.31 - 
eTrust-Vet 31.1.5032 2007.08.04 - 
Ewido 4.0 2007.08.05 - 
FileAdvisor 1 2007.08.05 - 
Fortinet 2.91.0.0 2007.08.05 - 
F-Prot 4.3.2.48 2007.08.03 - 
F-Secure 6.70.13030.0 2007.08.03 - 
Ikarus T3.1.1.8 2007.08.05 - 
Kaspersky 4.0.2.24 2007.08.05 - 
McAfee 5090 2007.08.03 - 
Microsoft 1.2704 2007.08.05 - 
NOD32v2 2438 2007.08.05 - 
Norman 5.80.02 2007.08.03 - 
Panda 9.0.0.4 2007.08.05 - 
Prevx1 V2 2007.08.05 - 
Rising 19.34.40.00 2007.08.03 - 
Sophos 4.19.0 2007.08.01 - 
Sunbelt 2.2.907.0 2007.08.04 - 
Symantec 10 2007.08.05 - 
TheHacker 6.1.7.162 2007.08.04 - 
VBA32 3.12.2.2 2007.08.04 - 
VirusBuster 4.3.26:9 2007.08.05 - 
Webwasher-Gateway 6.0.1 2007.08.03 - 
Additional information 
File size: 6466 bytes 
MD5: 07b71e96e4e1a0bb7245f5781d254c72 
SHA1: f6f14f8524cac927886fce7fd978a4bfe40d7cdb

weco · Answer

File jlkkj.bak2 received on 08.05.2007 20:57:08 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED 


Result: 0/32 (0%)
Loading server information... 
Your file is queued in position: 1.
Estimated start time is between 40 and 58 seconds.
Do not close the window untill scan is complete. 
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file. 
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated. 
 Compact Print results  
Your file has expired or do not exists. 
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished. 
 Email:  
  

Antivirus Version Last Update Result 
AhnLab-V3 2007.8.3.0 2007.08.03 - 
AntiVir 7.4.0.57 2007.08.03 - 
Authentium 4.93.8 2007.08.03 - 
Avast 4.7.1029.0 2007.08.05 - 
AVG 7.5.0.476 2007.08.05 - 
BitDefender 7.2 2007.08.05 - 
CAT-QuickHeal 9.00 2007.08.04 - 
ClamAV 0.91 2007.08.05 - 
DrWeb 4.33 2007.08.05 - 
eSafe 7.0.15.0 2007.07.31 - 
eTrust-Vet 31.1.5032 2007.08.04 - 
Ewido 4.0 2007.08.05 - 
FileAdvisor 1 2007.08.05 - 
Fortinet 2.91.0.0 2007.08.05 - 
F-Prot 4.3.2.48 2007.08.03 - 
F-Secure 6.70.13030.0 2007.08.03 - 
Ikarus T3.1.1.8 2007.08.05 - 
Kaspersky 4.0.2.24 2007.08.05 - 
McAfee 5090 2007.08.03 - 
Microsoft 1.2704 2007.08.05 - 
NOD32v2 2438 2007.08.05 - 
Norman 5.80.02 2007.08.03 - 
Panda 9.0.0.4 2007.08.05 - 
Prevx1 V2 2007.08.05 - 
Rising 19.34.40.00 2007.08.03 - 
Sophos 4.19.0 2007.08.01 - 
Sunbelt 2.2.907.0 2007.08.04 - 
Symantec 10 2007.08.05 - 
TheHacker 6.1.7.162 2007.08.04 - 
VBA32 3.12.2.2 2007.08.04 - 
VirusBuster 4.3.26:9 2007.08.05 - 
Webwasher-Gateway 6.0.1 2007.08.03 - 
Additional information 
File size: 891282 bytes 
MD5: 90115f901f24685fd9dca46cb6370968 
SHA1: b97e2aa65d1185e393d28e96dccadf662790ade9

rudyrital · Answer

Télécharge VirtumundoBegone sur le bureau: 
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe 

Double clique ensuite sur VirtumundoBeGone.exe et suis les instructions. 
Une fois terminé, redémarre et poste le rapport VBG.TXT créé sur le bureau dans ta prochaine réponse avec un nouveau rapport HijackThis. 
Ne t'inquiète pas si tu vois un message Ecran bleu "Erreur fatale", c'est normal et attendu

weco · Answer

Voilà le 6è et dernier...

File rqstv.bak2 received on 08.05.2007 21:02:26 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED 


Result: 0/32 (0%)
Loading server information... 
Your file is queued in position: 3.
Estimated start time is between 52 and 75 seconds.
Do not close the window untill scan is complete. 
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file. 
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated. 
 Compact Print results  
Your file has expired or do not exists. 
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished. 
 Email:  
  

Antivirus Version Last Update Result 
AhnLab-V3 2007.8.3.0 2007.08.03 - 
AntiVir 7.4.0.57 2007.08.03 - 
Authentium 4.93.8 2007.08.03 - 
Avast 4.7.1029.0 2007.08.05 - 
AVG 7.5.0.476 2007.08.05 - 
BitDefender 7.2 2007.08.05 - 
CAT-QuickHeal 9.00 2007.08.04 - 
ClamAV 0.91 2007.08.05 - 
DrWeb 4.33 2007.08.05 - 
eSafe 7.0.15.0 2007.07.31 - 
eTrust-Vet 31.1.5032 2007.08.04 - 
Ewido 4.0 2007.08.05 - 
FileAdvisor 1 2007.08.05 - 
Fortinet 2.91.0.0 2007.08.05 - 
F-Prot 4.3.2.48 2007.08.03 - 
F-Secure 6.70.13030.0 2007.08.03 - 
Ikarus T3.1.1.8 2007.08.05 - 
Kaspersky 4.0.2.24 2007.08.05 - 
McAfee 5090 2007.08.03 - 
Microsoft 1.2704 2007.08.05 - 
NOD32v2 2438 2007.08.05 - 
Norman 5.80.02 2007.08.03 - 
Panda 9.0.0.4 2007.08.05 - 
Prevx1 V2 2007.08.05 - 
Rising 19.34.40.00 2007.08.03 - 
Sophos 4.19.0 2007.08.01 - 
Sunbelt 2.2.907.0 2007.08.04 - 
Symantec 10 2007.08.05 - 
TheHacker 6.1.7.162 2007.08.04 - 
VBA32 3.12.2.2 2007.08.04 - 
VirusBuster 4.3.26:9 2007.08.05 - 
Webwasher-Gateway 6.0.1 2007.08.03 - 
Additional information 
File size: 721614 bytes 
MD5: 6716ccbe26873c6a7ba59dc951024f6a 
SHA1: 94a8fb0607fd6e5a85657b9ea46d8583ee7cd3d0

weco · Answer

Voici le fichier virtumundo...; je redémarre ordi et envoie hijack

weco · Answer

Hijack après redémarrage : 
Logfile of HijackThis v1.99.1
Scan saved at 21:17:59, on 05/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\Nero\InCD\InCD\InCDsrv.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Utilitaires\Ad-Aware 2007\aawservice.exe
D:\Utilitaires\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
C:\Program Files\Inquiero Installable RC\installablerc.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\PFU\ScanSnap\PfuSsSct.exe
C:\Program Files\PFU\ScanSnap\PDF Thumbnail View\pdfquickview.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Ahead\Nero\InCD\InCD\InCD.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\LVComS.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
D:\Utilitaires\Expert PDF 4\vspdfprsrv.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
D:\Program Files\Adobe\Acrobat 8.1\Reader\Reader_sl.exe
D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
D:\Utilitaires\RealPopup\RealPopup.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Fichiers communs\DataViz\DvzIncMsgr.exe
C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
D:\Palm\Hotsync.exe
D:\Utilitaires\Post-It\Psn2Lite.exe
C:\Program Files\PFU\ScanSnap\Driver\PfuSsMon.exe
D:\Utilitaires\Touches Express\GhostTyp.exe
D:\NaturallySpeaking9\Program
atspeak.exe
C:\Program Files\Inquiero Client\inquiero.exe
D:\UTILIT~1\Post-It\PSNGive.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Utilitaires\Hijackthis Version Française\hijackthis vf.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O1 - Hosts: HP51051E HP00187151051E
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: (no name) - {1FB63E52-4D6E-48C1-A08F-F630FE50F337} - (no file)
O2 - BHO: EoBho Class - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\WINDOWS\system32\xgmgsgkr.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [PfuSsSct.exe] C:\Program Files\PFU\ScanSnap\PfuSsSct.exe /Station
O4 - HKLM\..\Run: [Pdfquickview] C:\Program Files\PFU\ScanSnap\PDF Thumbnail View\pdfquickview.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LanguageShortcut] "D:\TT Images\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\Nero\InCD\InCD\InCD.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [QuickTime Task] "D:\TT Images\Quicktime 6\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [vspdfprsrv.exe] D:\Utilitaires\Expert PDF 4\vspdfprsrv.exe --background
O4 - HKLM\..\Run: [ISUSPM Startup] c:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "C:\WINDOWS\system32\icmxcyyl.dll",forkonce
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Acrobat 8.1\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Creative Detector] "D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [RealPopup] "D:\Utilitaires\RealPopup\RealPopup.exe" BOOT
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: Dragon NaturallySpeaking.lnk = D:\NaturallySpeaking9\Program
atspeak.exe
O4 - Global Startup: Boot.Bat
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Fichiers communs\DataViz\DvzIncMsgr.exe
O4 - Global Startup: Device Detector 3.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O4 - Global Startup: Directrec Configuration Tool.lnk = C:\Program Files\Olympus\DeviceDetector\DirectrecConfig.exe
O4 - Global Startup: HotSync Manager.lnk = D:\Palm\Hotsync.exe
O4 - Global Startup: Inquiero Client.lnk = C:\Program Files\Inquiero Client\_INQUIERO.EXE
O4 - Global Startup: Post-it® Software Notes Lite.lnk = D:\Utilitaires\Post-It\Psn2Lite.exe
O4 - Global Startup: ScanSnap Manager.lnk = ?
O4 - Global Startup: Touches Express.lnk = D:\Utilitaires\Touches Express\GhostTyp.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - D:\UTILIT~1\INCRED~1\INCRED~1\binesources\WebMenuImg.htm
O8 - Extra context menu item: Chercher avec Copernic 2001 - D:\Utilitaires\Copernic 2001 Basic\Search Extension.htm
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {2A465934-E5F0-11D2-91B5-00104B9C4765} - D:\Utilitaires\Copernic 2001 Basic\Copernic.exe
O9 - Extra 'Tools' menuitem: Lancer Copernic 2001 - {2A465934-E5F0-11D2-91B5-00104B9C4765} - D:\Utilitaires\Copernic 2001 Basic\Copernic.exe
O9 - Extra button: Copernic 2001 - {2A465936-E5F0-11D2-91B5-00104B9C4765} - D:\Utilitaires\Copernic 2001 Basic\Copernic.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Traduire - {99EFB53C-C965-43CF-9F45-52242D134187} - file://D:\Utilitaires\Copernic 2001 Basic\Translate.htm
O9 - Extra 'Tools' menuitem: &Traduire avec Gist-In-Time - {99EFB53C-C965-43CF-9F45-52242D134187} - file://D:\Utilitaires\Copernic 2001 Basic\Translate.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: *.canalplay.com
O15 - Trusted Zone: *.canalplusactive.com
O15 - Trusted Zone: *.canalplay.com (HKLM)
O15 - Trusted Zone: *.canalplusactive.com (HKLM)
O16 - DPF: {13510606-30FA-11D2-B383-444553540000} (WebClient Class) - https://www.omnis.net/developers/resources/download/index.jsp
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} - http://a516.g.akamai.net/f/516/25175/7d/runaware.download.akamai.com/25175/citrix/wficat-no-eula.cab
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqemea/downloads/sysinfo.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - http://srv4.mediapluspro.net/mediaplus6/App/VirtualMplus/msrdp.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://charon777.free.fr/plugins/hardwaredetection.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cab
O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f001.mail.caramail.lycos.fr/app/uploader/FileUploader.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E6ACF817-0A85-4EBE-9F0A-096C6488CFEA} (NTR ActiveX 1.1.8) - http://www.inquiero.com/inquiero/mod/setup/ntractivex118_24.cab
O16 - DPF: {F11BFF96-CC7A-4482-819B-91EAE4C454EF} (NTR ActiveX 1.1.6) - https://www.inquiero.com/ssl/inquiero/mod/setup/ntractivex116_14.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winepi32 - winepi32.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - D:\Utilitaires\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Utilitaires\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: DM1Service - OLYMPUS IMAGING CORP. - C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\Nero\InCD\InCD\InCDsrv.exe
O23 - Service: Inquiero Installable RC (installablerc) - Net Transmit & Receive - C:\Program Files\Inquiero Installable RC\installablerc.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Service CANALPLAY - Canal+ Active - C:\Program Files\Lecteur CANALPLAY\CanalPlayService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe

rudyrital · Answer

Ouvre ce lien (merci a S!RI pour ce programme). http://siri.urz.free.fr/Fix/SmitfraudFix.php 
et télécharge SmitfraudFix.exe.

Regarde le tuto
Exécute le en choisissant l’option 1, il va générer un rapport
Copie/colle le sur le poste stp.

weco · Answer

SmitFraudFix v2.208

Rapport fait à 21:36:03,70, 05/08/2007
Executé à partir de C:\Documents and Settings\Corinne\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\Nero\InCD\InCD\InCDsrv.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Utilitaires\Ad-Aware 2007\aawservice.exe
D:\Utilitaires\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
C:\Program Files\Inquiero Installable RC\installablerc.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\PFU\ScanSnap\PfuSsSct.exe
C:\Program Files\PFU\ScanSnap\PDF Thumbnail View\pdfquickview.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Ahead\Nero\InCD\InCD\InCD.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\LVComS.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
D:\Utilitaires\Expert PDF 4\vspdfprsrv.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
D:\Utilitaires\RealPopup\RealPopup.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Fichiers communs\DataViz\DvzIncMsgr.exe
C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
D:\Palm\Hotsync.exe
D:\Utilitaires\Post-It\Psn2Lite.exe
C:\Program Files\PFU\ScanSnap\Driver\PfuSsMon.exe
D:\Utilitaires\Touches Express\GhostTyp.exe
D:\NaturallySpeaking9\Program
atspeak.exe
C:\Program Files\Inquiero Client\inquiero.exe
D:\UTILIT~1\Post-It\PSNGive.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Corinne


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Corinne\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Corinne\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL"


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Marvell Yukon Gigabit Ethernet 10/100/1000Base-T Adapter, Copper RJ-45 - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.54.252
DNS Server Search Order: 212.27.53.252

HKLM\SYSTEM\CCS\Services\Tcpip\..\{E0903E40-15A0-4F2F-9DE9-95C314260969}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS1\Services\Tcpip\..\{E0903E40-15A0-4F2F-9DE9-95C314260969}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS2\Services\Tcpip\..\{E0903E40-15A0-4F2F-9DE9-95C314260969}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS3\Services\Tcpip\..\{E0903E40-15A0-4F2F-9DE9-95C314260969}: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.54.252 212.27.53.252
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=212.27.54.252 212.27.53.252


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

rudyrital · Answer

Télécharge « clean.zip » 
http://www.malekal.com/download/clean.zip 
•- Décompresse-le sur ton bureau (clic droit / extraire tout), tu dois obtenir un dossier dénommé "clean ". 

•- Redémarre en mode sans échec. ( note bien ce que tu as à faire ). 
•- Ouvre le dossier « clean » qui se trouve sur ton bureau. 
•- Double-clic sur « clean.cmd ». 
Une fenêtre noire va apparaître, choisis l’option 2. 

Clean va travailler. 
•- Redémarre normalement 
•- Poste qui se trouve ici C:\rapport_clean.txt.


(- Où est le rapport clean ? : « Poste de travail » / double clic sur disque « C / » double-clic sur « rapport_clean.txt » et « copier/coller le contenu » sur le forum. )

weco · Answer

Voici rapport clean.cmd :

 05/08/2007 a 21:56:24,07 
 
*** Recherche des fichiers dans C: 
 
*** Recherche des fichiers dans C:\WINDOWS\ 
 
*** Recherche des fichiers dans C:\WINDOWS\system32 
C:\WINDOWS\system32\mcrh.tmp FOUND 
"C:\Documents and Settings\Corinne\Application Data\ezpinst.exe" FOUND 
 
*** Recherche des fichiers dans C:\Program Files 
*** Fin du rapport !

rudyrital · Answer

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe 
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
• Redémarre ton ordinateur
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
• Choisis ton compte.
Déroule la liste des instructions ci-dessous :
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le scrïpt.
• Appuie sur Y pour commencer le processus de nettoyage.
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
• Appuie sur une touche pour redémarrer le PC.
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
• Appuie sur une touche pour finir l'exécution du scrïpt et charger les icônes de ton Bureau.
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !

weco · Answer

05/08/2007 a 21:56:24,07 
 
*** Recherche des fichiers dans C: 
 
*** Recherche des fichiers dans C:\WINDOWS\ 
 
*** Recherche des fichiers dans C:\WINDOWS\system32 
C:\WINDOWS\system32\mcrh.tmp FOUND 
"C:\Documents and Settings\Corinne\Application Data\ezpinst.exe" FOUND 
 
*** Recherche des fichiers dans C:\Program Files 
*** Fin du rapport !

rudyrital · Answer

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe 
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
• Redémarre ton ordinateur
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
• Choisis ton compte.
Déroule la liste des instructions ci-dessous :
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le scrïpt.
• Appuie sur Y pour commencer le processus de nettoyage.
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
• Appuie sur une touche pour redémarrer le PC.
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
• Appuie sur une touche pour finir l'exécution du scrïpt et charger les icônes de ton Bureau.
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !

weco · Answer

rapport de sdfix : 

SDFix: Version 1.95

Run by Corinne on 05/08/2007 at 22:23

Microsoft Windows XP [version 5.1.2600]

Running From: C:\DOCUME~1\Corinne\Bureau\SDFix

Safe Mode:
Checking Services: 


Restoring Windows Registry Values
Restoring Windows Default Hosts File
Restoring Missing Security Center Service 
Restoring Missing SharedAccess Service 

Rebooting...


Normal Mode:
Checking Files: 

No Trojan Files Found




Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found. 

C:\WINDOWS\system32
No streams found. 

C:\WINDOWS\system32\svchost.exe
No streams found.
 
C:\WINDOWS\system32
toskrnl.exe
No streams found.
 


                                 Final Check:

Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\Utilitaires\AlertInfo\AlertInfo.exe"="D:\Utilitaires\AlertInfo\AlertInfo.exe:*:Enabled:FeedReader"
"D:\Program Files\Kazaa Lite\Kazaa.kpp"="D:\Program Files\Kazaa Lite\Kazaa.kpp:*:Enabled:Kazaa Media Desktop"
"D:\Utilitaires\IncrediMail\IncrediMail\bin\IMApp.exe"="D:\Utilitaires\IncrediMail\IncrediMail\bin\IMApp.exe:*:Enabled:IncrediMail"
"D:\Utilitaires\IncrediMail\IncrediMail\bin\IncMail.exe"="D:\Utilitaires\IncrediMail\IncrediMail\bin\IncMail.exe:*:Enabled:IncrediMail"
"D:\Utilitaires\IncrediMail\IncrediMail\bin\ImpCnt.exe"="D:\Utilitaires\IncrediMail\IncrediMail\bin\ImpCnt.exe:*:Enabled:IncrediMail"
"C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe"="C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe:*:Enabled:Assistance … distance - Windows Messenger et voix"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"E:\setup\HPZNET01.EXE"="E:\setup\HPZNET01.EXE:*:Enabled:hpznet01.exe"
"E:\setup\HPONICIFS01.EXE"="E:\setup\HPONICIFS01.EXE:*:Enabled:hponicifs01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe"="C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe:*:Enabled:Lecteur CANALPLAY"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"D:\Utilitaires\Skype\Phone\Skype.exe"="D:\Utilitaires\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Orb Networks\Orb\bin\Orb.exe"="C:\Program Files\Orb Networks\Orb\bin\Orb.exe:*:Enabled:Orb"
"C:\Program Files\Orb Networks\Orb\bin\OrbTray.exe"="C:\Program Files\Orb Networks\Orb\bin\OrbTray.exe:*:Enabled:OrbTray"
"C:\Program Files\Orb Networks\Orb\bin\OrbStreamerClient.exe"="C:\Program Files\Orb Networks\Orb\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"
"C:\Program Files\Orb Networks\Orb\bin\xmltv.exe"="C:\Program Files\Orb Networks\Orb\bin\xmltv.exe:*:Enabled:OrbTVGuide"
"C:\Program Files\Orb Networks\Orb\bin\OrbChannelScan.exe"="C:\Program Files\Orb Networks\Orb\bin\OrbChannelScan.exe:*:Enabled:OrbChannelScan"
"C:\Program Files\Swapper\Swapper.exe"="C:\Program Files\Swapper\Swapper.exe:*:Enabled:Wambo"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Remaining Files:
---------------


Files with Hidden Attributes:

C:\Documents and Settings\Corinne\Local Settings\Application Data\Microsoft\Messenger\cwelsch@hotmail.com\Sharing Folders\sylvaine64@hotmail.com\Thumbs.db
C:\Program Files\Inquiero Installable RC\0.dll
C:\RECYCLER\NPROTECT\00592888.dll
C:\RECYCLER\NPROTECT\00592913.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP115\A0021319.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP116\A0021516.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP116\A0021531.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP117\A0021544.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP118\A0021698.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP119\A0021733.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP120\A0021782.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP125\A0022356.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP126\A0022451.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP127\A0022485.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP133\A0022753.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP134\A0022787.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP135\A0022863.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP136\A0022934.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP136\A0023866.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP137\A0023904.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP139\A0023962.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP140\A0024093.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP141\A0024137.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP143\A0024423.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP149\A0024478.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP150\A0024504.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP151\A0024588.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP153\A0025608.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP154\A0025804.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP155\A0025857.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP160\A0026337.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP161\A0027340.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP162\A0027413.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP163\A0027435.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP164\A0027566.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP166\A0027602.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP166\A0027607.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP167\A0027616.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP167\A0027624.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP170\A0028122.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP171\A0028179.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP172\A0028205.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP173\A0028437.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP176\A0028547.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP177\A0028627.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP178\A0028653.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP179\A0028815.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP180\A0028837.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP181\A0028886.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP182\A0028986.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP183\A0029064.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP184\A0029153.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP185\A0030178.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP186\A0030348.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP187\A0030391.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP188\A0030442.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP189\A0031631.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP192\A0032070.dll
C:\System Volume Information\_restore{BAE935F4-A0C3-4FEE-8815-E6C8D8FBB649}\RP194\A0032185.dll
C:\Program Files\Picasa2\setup.exe
C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp
C:\WINDOWS\system32\jlkkj.tmp
C:\WINDOWS\system32qstv.tmp
C:\WINDOWS\system32\config\default.tmp.LOG
C:\WINDOWS\system32\config\software.tmp.LOG
C:\WINDOWS\system32\config\system.tmp.LOG

                                 Finished

weco · Answer

et le rapport hijack :

Logfile of HijackThis v1.99.1
Scan saved at 22:40:12, on 05/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\Nero\InCD\InCD\InCDsrv.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Utilitaires\Ad-Aware 2007\aawservice.exe
D:\Utilitaires\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
C:\Program Files\Inquiero Installable RC\installablerc.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32
otepad.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\PFU\ScanSnap\PfuSsSct.exe
C:\Program Files\PFU\ScanSnap\PDF Thumbnail View\pdfquickview.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Ahead\Nero\InCD\InCD\InCD.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\LVComS.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
D:\Utilitaires\Expert PDF 4\vspdfprsrv.exe
D:\Program Files\Adobe\Acrobat 8.1\Reader\Reader_sl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
D:\Utilitaires\RealPopup\RealPopup.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
C:\Program Files\Fichiers communs\DataViz\DvzIncMsgr.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
D:\Palm\Hotsync.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Utilitaires\Post-It\Psn2Lite.exe
C:\Program Files\Inquiero Client\inquiero.exe
C:\Program Files\PFU\ScanSnap\Driver\PfuSsMon.exe
D:\Utilitaires\Touches Express\GhostTyp.exe
D:\NaturallySpeaking9\Program
atspeak.exe
D:\UTILIT~1\Post-It\PSNGive.exe
D:\Utilitaires\Hijackthis Version Française\hijackthis vf.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: (no name) - {1FB63E52-4D6E-48C1-A08F-F630FE50F337} - (no file)
O2 - BHO: EoBho Class - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\WINDOWS\system32\xgmgsgkr.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Fichiers communs\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [PfuSsSct.exe] C:\Program Files\PFU\ScanSnap\PfuSsSct.exe /Station
O4 - HKLM\..\Run: [Pdfquickview] C:\Program Files\PFU\ScanSnap\PDF Thumbnail View\pdfquickview.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LanguageShortcut] "D:\TT Images\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\Nero\InCD\InCD\InCD.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [QuickTime Task] "D:\TT Images\Quicktime 6\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [vspdfprsrv.exe] D:\Utilitaires\Expert PDF 4\vspdfprsrv.exe --background
O4 - HKLM\..\Run: [ISUSPM Startup] c:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "C:\WINDOWS\system32\icmxcyyl.dll",forkonce
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Acrobat 8.1\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Creative Detector] "D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [RealPopup] "D:\Utilitaires\RealPopup\RealPopup.exe" BOOT
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: Dragon NaturallySpeaking.lnk = D:\NaturallySpeaking9\Program
atspeak.exe
O4 - Global Startup: Boot.Bat
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Fichiers communs\DataViz\DvzIncMsgr.exe
O4 - Global Startup: Device Detector 3.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O4 - Global Startup: Directrec Configuration Tool.lnk = C:\Program Files\Olympus\DeviceDetector\DirectrecConfig.exe
O4 - Global Startup: HotSync Manager.lnk = D:\Palm\Hotsync.exe
O4 - Global Startup: Inquiero Client.lnk = C:\Program Files\Inquiero Client\_INQUIERO.EXE
O4 - Global Startup: Post-it® Software Notes Lite.lnk = D:\Utilitaires\Post-It\Psn2Lite.exe
O4 - Global Startup: ScanSnap Manager.lnk = ?
O4 - Global Startup: Touches Express.lnk = D:\Utilitaires\Touches Express\GhostTyp.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - D:\UTILIT~1\INCRED~1\INCRED~1\binesources\WebMenuImg.htm
O8 - Extra context menu item: Chercher avec Copernic 2001 - D:\Utilitaires\Copernic 2001 Basic\Search Extension.htm
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {2A465934-E5F0-11D2-91B5-00104B9C4765} - D:\Utilitaires\Copernic 2001 Basic\Copernic.exe
O9 - Extra 'Tools' menuitem: Lancer Copernic 2001 - {2A465934-E5F0-11D2-91B5-00104B9C4765} - D:\Utilitaires\Copernic 2001 Basic\Copernic.exe
O9 - Extra button: Copernic 2001 - {2A465936-E5F0-11D2-91B5-00104B9C4765} - D:\Utilitaires\Copernic 2001 Basic\Copernic.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Traduire - {99EFB53C-C965-43CF-9F45-52242D134187} - file://D:\Utilitaires\Copernic 2001 Basic\Translate.htm
O9 - Extra 'Tools' menuitem: &Traduire avec Gist-In-Time - {99EFB53C-C965-43CF-9F45-52242D134187} - file://D:\Utilitaires\Copernic 2001 Basic\Translate.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: *.canalplay.com
O15 - Trusted Zone: *.canalplusactive.com
O15 - Trusted Zone: *.canalplay.com (HKLM)
O15 - Trusted Zone: *.canalplusactive.com (HKLM)
O16 - DPF: {13510606-30FA-11D2-B383-444553540000} (WebClient Class) - https://www.omnis.net/developers/resources/download/index.jsp
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} - http://a516.g.akamai.net/f/516/25175/7d/runaware.download.akamai.com/25175/citrix/wficat-no-eula.cab
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqemea/downloads/sysinfo.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - http://srv4.mediapluspro.net/mediaplus6/App/VirtualMplus/msrdp.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://charon777.free.fr/plugins/hardwaredetection.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cab
O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f001.mail.caramail.lycos.fr/app/uploader/FileUploader.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - https://support.norton.com/sp/en/us/home/current/info
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E6ACF817-0A85-4EBE-9F0A-096C6488CFEA} (NTR ActiveX 1.1.8) - http://www.inquiero.com/inquiero/mod/setup/ntractivex118_24.cab
O16 - DPF: {F11BFF96-CC7A-4482-819B-91EAE4C454EF} (NTR ActiveX 1.1.6) - https://www.inquiero.com/ssl/inquiero/mod/setup/ntractivex116_14.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winepi32 - winepi32.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - D:\Utilitaires\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Utilitaires\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: DM1Service - OLYMPUS IMAGING CORP. - C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\Nero\InCD\InCD\InCDsrv.exe
O23 - Service: Inquiero Installable RC (installablerc) - Net Transmit & Receive - C:\Program Files\Inquiero Installable RC\installablerc.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Service CANALPLAY - Canal+ Active - C:\Program Files\Lecteur CANALPLAY\CanalPlayService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\AppCore\AppSvc32.exe

rudyrital · Answer

Rends toi sur ce site :
https://www.virustotal.com/gui/

Clique sur parcourir et cherche ce fichier :

C:\WINDOWS\system32\jlkkj.tmp 


Clique sur send.

Un rapport va s'élaborer ligne à ligne.

Attends la fin. Il doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note.

Copie le dans ta réponse. 

de meme avec : 

C:\WINDOWS\system32\rqstv.tmp

weco · Answer

File jlkkj.tmp received on 08.05.2007 22:50:37 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED 


Result: 0/30 (0%)
Loading server information... 
Your file is queued in position: 2.
Estimated start time is between 46 and 66 seconds.
Do not close the window untill scan is complete. 
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file. 
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated. 
 Compact Print results  
Your file has expired or do not exists. 
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished. 
 Email:  
  

Antivirus Version Last Update Result 
AhnLab-V3 2007.8.3.0 2007.08.03 - 
AntiVir 7.4.0.57 2007.08.05 - 
Authentium 4.93.8 2007.08.03 - 
Avast 4.7.1029.0 2007.08.05 - 
AVG 7.5.0.476 2007.08.05 - 
BitDefender 7.2 2007.08.05 - 
CAT-QuickHeal 9.00 2007.08.04 - 
ClamAV 0.91 2007.08.05 - 
DrWeb 4.33 2007.08.05 - 
eSafe 7.0.15.0 2007.07.31 - 
eTrust-Vet 31.1.5032 2007.08.04 - 
Ewido 4.0 2007.08.05 - 
FileAdvisor 1 2007.08.05 - 
Fortinet 2.91.0.0 2007.08.05 - 
F-Prot 4.3.2.48 2007.08.03 - 
F-Secure 6.70.13030.0 2007.08.03 - 
Ikarus T3.1.1.8 2007.08.05 - 
Kaspersky 4.0.2.24 2007.08.05 - 
McAfee 5090 2007.08.03 - 
Microsoft 1.2704 2007.08.05 - 
NOD32v2 2438 2007.08.05 - 
Norman 5.80.02 2007.08.03 - 
Panda 9.0.0.4 2007.08.05 - 
Rising 19.34.40.00 2007.08.03 - 
Sophos 4.19.0 2007.08.01 - 
Sunbelt 2.2.907.0 2007.08.04 - 
Symantec 10 2007.08.05 - 
TheHacker 6.1.7.162 2007.08.04 - 
VBA32 3.12.2.2 2007.08.04 - 
Webwasher-Gateway 6.0.1 2007.08.03 - 
Additional information 
File size: 896326 bytes 
MD5: b01b6b167b3e355a40b533c0cd0b8ba2 
SHA1: 55abe8c8a7bdf23f77799a693f8e7d7b387c62e3

rudyrital · Answer

* télécharge AVG Anti-Spyware 

avg antispyware
http://www.infos-du-net.com/telecharger/Ewido-Security-Suite,0301-734.html


Tuto : http://www.kachouri.com/tuto/tuto-161-avg-anti-spyware-75-pour-votre-securite.html

* tu l'installes 

Démarrer AVG antispyware. Cliquer sur "mise à jour", cliquer sur le bouton "Commencer la mise à jour" et attendre la fin de cette mise à jour puis, fermer le programme. 

si tu n'arrives pas à le mettre à jour prends ici les Mise à jour:

http://downloads.ewido.net/avgas-signatures-full-current.exe 



Démarre en mode sans échec : 
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter 
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée. 
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal ! 
(Si F8 ne marche pas utilise la touche F5). 

 relance AVG AS et cliquer sur l'onglet "scanner" puis sur "Analyse complète du système". 
Une fois le scan terminé, il t'affiche un rapport. Cliquer sur "configurer..." en bas a gauche et choisir "supprimer". Ensuite cliquer sur "Appliquer toutes les actions ", ca va supprimer toutes les infections détectées. 
Ensuite cliquer sur "Enregistrer le rapport d'analyse" -> "enregistrer sous" et enregistrer le rapport où bon te semble, afin de me l'envoyer dans ta prochaine réponse. 


Copie Et colle le rapport ici

weco · Answer

File rqstv.tmp received on 08.05.2007 23:02:27 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED 


Result: 0/32 (0%)
Loading server information... 
Your file is queued in position: 2.
Estimated start time is between 46 and 66 seconds.
Do not close the window untill scan is complete. 
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file. 
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated. 
 Compact Print results  
Your file has expired or do not exists. 
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished. 
 Email:  
  

Antivirus Version Last Update Result 
AhnLab-V3 2007.8.3.0 2007.08.03 - 
AntiVir 7.4.0.57 2007.08.05 - 
Authentium 4.93.8 2007.08.03 - 
Avast 4.7.1029.0 2007.08.05 - 
AVG 7.5.0.476 2007.08.05 - 
BitDefender 7.2 2007.08.05 - 
CAT-QuickHeal 9.00 2007.08.04 - 
ClamAV 0.91 2007.08.05 - 
DrWeb 4.33 2007.08.05 - 
eSafe 7.0.15.0 2007.07.31 - 
eTrust-Vet 31.1.5032 2007.08.04 - 
Ewido 4.0 2007.08.05 - 
FileAdvisor 1 2007.08.05 - 
Fortinet 2.91.0.0 2007.08.05 - 
F-Prot 4.3.2.48 2007.08.03 - 
F-Secure 6.70.13030.0 2007.08.03 - 
Ikarus T3.1.1.8 2007.08.05 - 
Kaspersky 4.0.2.24 2007.08.05 - 
McAfee 5090 2007.08.03 - 
Microsoft 1.2704 2007.08.05 - 
NOD32v2 2438 2007.08.05 - 
Norman 5.80.02 2007.08.03 - 
Panda 9.0.0.4 2007.08.05 - 
Prevx1 V2 2007.08.05 - 
Rising 19.34.40.00 2007.08.03 - 
Sophos 4.19.0 2007.08.01 - 
Sunbelt 2.2.907.0 2007.08.04 - 
Symantec 10 2007.08.05 - 
TheHacker 6.1.7.162 2007.08.04 - 
VBA32 3.12.2.2 2007.08.04 - 
VirusBuster 4.3.26:9 2007.08.05 - 
Webwasher-Gateway 6.0.1 2007.08.05 - 
Additional information 
File size: 721110 bytes 
MD5: 766e5c4fcb5b7b13e8e689997dc5adc6 
SHA1: e08bbcf2cefb6a7319019e61c998d8f702f58660

rudyrital · Answer

télécharge AVG Anti-Spyware 

avg antispyware 
http://www.infos-du-net.com/telecharger/Ewido-Security-Suite,0301-734.html 


Tuto : http://www.kachouri.com/tuto/tuto-161-avg-anti-spyware-75-pour-votre-securite.html 

* tu l'installes 

Démarrer AVG antispyware. Cliquer sur "mise à jour", cliquer sur le bouton "Commencer la mise à jour" et attendre la fin de cette mise à jour puis, fermer le programme. 

si tu n'arrives pas à le mettre à jour prends ici les Mise à jour: 

http://downloads.ewido.net/avgas-signatures-full-current.exe 



Démarre en mode sans échec : 
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter 
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée. 
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal ! 
(Si F8 ne marche pas utilise la touche F5). 

relance AVG AS et cliquer sur l'onglet "scanner" puis sur "Analyse complète du système". 
Une fois le scan terminé, il t'affiche un rapport. Cliquer sur "configurer..." en bas a gauche et choisir "supprimer". Ensuite cliquer sur "Appliquer toutes les actions ", ca va supprimer toutes les infections détectées. 
Ensuite cliquer sur "Enregistrer le rapport d'analyse" -> "enregistrer sous" et enregistrer le rapport où bon te semble, afin de me l'envoyer dans ta prochaine réponse. 


Copie Et colle le rapport ici

weco · Answer

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	23:44:44 05/08/2007

 + Résultat de l'analyse:	



C:\Documents and Settings\Corinne\Cookies\corinne@2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Corinne\Cookies\corinne@sfr.122.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Corinne\Cookies\corinne@adtech[2].txt -> TrackingCookie.Adtech : Nettoyé.
C:\Documents and Settings\Corinne\Cookies\corinne@advertising[2].txt -> TrackingCookie.Advertising : Nettoyé.
C:\Documents and Settings\Corinne\Cookies\corinne@adviva[1].txt -> TrackingCookie.Adviva : Nettoyé.
C:\Documents and Settings\Corinne\Cookies\corinne@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\Corinne\Cookies\corinne@iv2.bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\Corinne\Cookies\corinne@fl01.ct2.comclick[1].txt -> TrackingCookie.Comclick : Nettoyé.
C:\Documents and Settings\Corinne\Cookies\corinne@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Nettoyé.
C:\Documents and Settings\Corinne\Cookies\corinne@doubleclick[2].txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\Corinne\Cookies\corinne@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyé.
C:\Documents and Settings\Corinne\Cookies\corinne@overture[1].txt -> TrackingCookie.Overture : Nettoyé.
C:\Documents and Settings\Corinne\Cookies\corinne@www.paypal[1].txt -> TrackingCookie.Paypal : Nettoyé.
C:\Documents and Settings\Corinne\Cookies\corinne@smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\Corinne\Cookies\corinne@statcounter[1].txt -> TrackingCookie.Statcounter : Nettoyé.
C:\Documents and Settings\Corinne\Cookies\corinne@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Nettoyé.
C:\Documents and Settings\Corinne\Cookies\corinne@zedo[1].txt -> TrackingCookie.Zedo : Nettoyé.


Fin du rapport

mais je ne susi pas allée au bout, il y en a pour 1 h ou plus et mon ordi chauffe et se met à ventiler !!! Horreur, en ouvrant IE, une page de pub !!! encore... pourtant on bosse depuisdes hueres, d'ailleurs grand merci

weco · Answer

là je m'arrête, si t'as des idées, je continue demain .... bye et merci

rudyrital · Answer

fait un scan ici 
https://www.bitdefender.fr/ 

* En bas, à gauche de la fenêtre, clique sur BitDefender SCAN ONLINE 
* Dans la nouvelle fenêtre, clique sur j‘accepte
* Accepte le contrôle Active X et Installe le. Le scanner se charge
* La fenêtre change encore, clique sur ’cliquez ici pour scanner’
* Les signatures se chargent, etc. 

tuto en image : 
http://pageperso.aol.fr/rginformatique/mapage/defender.htm 

copie colle le résultat ici

Ordi lent+pubs tout le temps sur IE7

41 réponses

Votre réponse

Discussions similaires

Newsletters