Help plz ordinateur bloqué

Noobdog Messages postés 113 Date d'inscription   Statut Membre Dernière intervention   -  
 Utilisateur anonyme -
Bonjour,
Mon ordinateur est infecté de virus et de logiciels espions que je n'arrive pas à enlever. Sur conseil d'un internaute sur ce forum j'ai téléchargé nod32. Après son installation mnn ordinateur a planté. Depuis chaque fois que je l'allume il se bloque totalement au bout de 30 secondes et je ne peut rien y faire. J'ai déjà éteint et rallumé mon ordi 4-5 fois. Toujours rien à faire. Je poste ce message depuis un autre ordinateur bien entendu. Je deséspère pour mon ordinateur.

Je vous en supplie aidez moi, merci
A voir également:

167 réponses

Précédent
Réponse 41 / 167
Utilisateur anonyme
 
merci a toi de ta confiance !bon il en reste un peu mais on va essayer de nettoyer
2) Télécharger et installer AVG Anti-Spyware 7.5

https://www.avg.com/en-ww/free-antivirus-download

Lancer AVG Anti-Spyware.
Cliquer sur le menu Mise à jour.
Dans le paragraphe Mise à jour manuelle, cliquer sur le bouton Commencer la mise à jour.
Attendre la fin de cette mise à jour puis fermer le programme.
Ne pas lancer d'analyse maintenant

Démarre en mode sans échec maintenant avant de poursuivre

3) Lance CCleaner

Puis dans le menu" Nettoyeur"
Cliquer sur "Analyse" (laisser travailler cela peut durer longtemps la 1ere fois)
Cliquer sur le bouton "Lancer le nettoyage".
Fais cela plusieurs fois d affilée puis ferme CCleaner

N'oublie pas de vider ta corbeille. (En principe, CCleaner le fait).

4) Lance AVG Anti-Spyware 7.5

Cliquer sur le menu Analyse (de la barre d'outils).
Cliquer sur l'onglet Paramètres.
Dans Comment réagir? cliquer sur Actions recommandées et choisir Quarantaine.
Dans Comment faire l'analyse ? et dans Programmes potentiellement dangereux, vérifier que toutes les cases soient cochées.
Vérifier que le bouton-radio Générer un rapport après chaque analyse soit aussi coché.
Dans l'onglet Analyse
Cliquer sur Analyse complète du système.
Important : Ne pas ouvrir de fenêtre, ne pas lancer de programme pendant l'exécution de AVG Anti-Spyware, car cela pourrait interférer avec le processus de recherche.
Tres important : A la fin de l'analyse, cocher tout ce qui a été trouvé puis cliquer sur " Appliquer toutes les actions"
Ensuite.
Cliquer sur "Enregistrer le rapport". Ceci génère un rapport en fichier texte qui se trouve dans le dossier Reports du dossier d'AVG Anti-Spyware.
(C:\Programfiles\Grisoft\AVG Antispyware 7.5\Reports )
Puis fermer AVG Anti-Spyware
0
Réponse 42 / 167
Noobdog Messages postés 113 Date d'inscription   Statut Membre Dernière intervention  
 
Voila les rapports anti-spyware ( J'en ai fait un deuxième après )

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 18:33:29 16.11.2007

+ Résultat de l'analyse:



HKLM\SOFTWARE\Classes\WR -> Adware.Generic : Nettoyé et sauvegardé (mise en quarantaine).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\run\\runner1 -> Adware.Generic : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{F1D936D4-0A3F-4B6C-A571-236E4361D031}\RP418\A0177239.exe -> Downloader.Agent.erf : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{F1D936D4-0A3F-4B6C-A571-236E4361D031}\RP418\A0177240.exe -> Not-A-Virus.PSWTool.Win32.FirePass.a : Nettoyé et sauvegardé (mise en quarantaine).
D:\System Volume Information\_restore{F1D936D4-0A3F-4B6C-A571-236E4361D031}\RP418\A0177241.exe -> Not-A-Virus.PSWTool.Win32.FirePass.a : Nettoyé et sauvegardé (mise en quarantaine).


Fin du rapport

-


---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 19:05:00 16.11.2007

+ Résultat de l'analyse:



Rien à signaler.



Fin du rapport
0
Réponse 43 / 167
Utilisateur anonyme
 
tu as bien bossé mais il y en un dans ta restauration, désactive la restauration système pour purger les virus qui seraient dedans (dans DEMARRER puis TOUS LES PROGRAMMES puis ACCESSOIRE puis OUTILS SYSTEME puis RESTAURATION SYSTEME puis paramètre)

redemarre ton ordi
puis réactive là
poste un nouvel hijackthis stp
------------------
0
Réponse 44 / 167
Noobdog Messages postés 113 Date d'inscription   Statut Membre Dernière intervention  
 
Voila et ne dit pas que j'ai bien bossé je n'ai que suivis tes instructions, c'est toi qui a bien bossé, merci.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:26:15, on 16.11.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Jeux\Steam.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Cédric\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: Traducteur - {FF284F5C-7CF9-4682-8701-D467C1DBB99F} - C:\Program Files\PRMT6\PRMTIE\prmtie.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [U.S. Robotics Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [8cfeb6c4] rundll32.exe "C:\WINDOWS\system32\hbwbwuhd.dll",b
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NBInstall] C:\DOCUME~1\CDRIC~1\LOCALS~1\Temp\MBDownloader_876923.exe
O4 - HKLM\..\Run: [Host Process] C:\WINDOWS\Fonts\svchost.exe
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu1188.exe 61A847B5BBF72813339330466188719AB689201522886B092CBD44BD8689220221DD3257
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Steam] "D:\Jeux\Steam.exe" -silent
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Programmes\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB2429] command /c del "C:\WINDOWS\mirar_distro_876260.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - D:\Jeux\Titan Poker\casino.exe (file missing)
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - D:\Jeux\Titan Poker\casino.exe (file missing)
O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PRMT6\PRMTIE\prmtie5.htm
O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PRMT6\PRMTIE\prmtie5.htm
O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PRMT6\PRMTIE\options.htm
O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PRMT6\PRMTIE\options.htm
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~2\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~2\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00465E.dat
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\qfcvgdvm.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: U.S. Robotics Wireless LAN Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Réponse 45 / 167
Utilisateur anonyme
 
desoles de te le dire mais a la ligne 20 il y encore un on ressaie vundo !
Télécharge sur le Bureau.
[url=http://www.atribune.org/ccount/click.php?id=4]vundofix|/url]

=> Double-clic VundoFix.exe.
=> Clic OK
=> Attendre le redemarrage de Vundofix
=> Clic Scan for Vundo
=> Le scan est assez long , à la fin
=> Clic Remove Vundo
=> Puis yes
=> Le Bureau disparaît un moment lors de la suppression des fichiers.
=> Message shutdown
=> clic OK
=> Redémarrage auto
=> copier le rapport qui est dans C:vundofix.txt
0
Réponse 46 / 167
Noobdog Messages postés 113 Date d'inscription   Statut Membre Dernière intervention  
 
Eh merde il y a le même problème que hier je peux plus rien télécharger, Je click sur le lien et après sur enregistrer, et rien. Je peux tenter une restauration du système mais je ne sais pas si c'est assez en arrière pour régler le problème ( 19h25 ).

J'attend ta réponse avant d'agir.
0
Réponse 47 / 167
Utilisateur anonyme
 
attend 10mn stp
0
Réponse 48 / 167
Utilisateur anonyme
 
tu as toujours combofix?
0
Réponse 49 / 167
Noobdog Messages postés 113 Date d'inscription   Statut Membre Dernière intervention  
 
oui
0
Réponse 50 / 167
Noobdog Messages postés 113 Date d'inscription   Statut Membre Dernière intervention  
 
C'est bon ça remarche.
0
Réponse 51 / 167
Utilisateur anonyme
 
relance combofix comme toute a l'heure en mode sans echecs !
0
Réponse 52 / 167
Noobdog Messages postés 113 Date d'inscription   Statut Membre Dernière intervention  
 
OK mais voila le rapport Vundo fix

VundoFix V6.6.1

Checking Java version...

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Scan started at 19:03:45 15.11.2007

Listing files found while scanning....

C:\windows\system32\chqlwqcy.dll

Beginning removal...

Attempting to delete C:\windows\system32\chqlwqcy.dll
C:\windows\system32\chqlwqcy.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.6.1

Checking Java version...

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Scan started at 20:18:21 16.11.2007

Listing files found while scanning....

C:\windows\system32\chqlwqcy.dll

Beginning removal...

Attempting to delete C:\windows\system32\chqlwqcy.dll
C:\windows\system32\chqlwqcy.dll Has been deleted!

Performing Repairs to the registry.
Done!


Je fais quand même la manip avec combo fix ?
0
Réponse 53 / 167
Utilisateur anonyme
 
oui vas y et apres rehijack !
0
Réponse 54 / 167
Noobdog Messages postés 113 Date d'inscription   Statut Membre Dernière intervention  
 
ComboFix 07-11-08.1 - Cédric 2007-11-16 20:48:15.2 - NTFSx86 MINIMAL
Running from: C:\Documents and Settings\Cédric\Bureau\ComboFix.exe
.

Incapable d'obtenir les privilèges Système

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Temporary
C:\WINDOWS\b147.exe
C:\WINDOWS\system32\awvvv.dll
C:\WINDOWS\system32\vvvwa.ini
C:\WINDOWS\system32\vvvwa.ini2

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\DomainService


((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-10-16 to 2007-11-16 ))))))))))))))))))))))))))))))))))))
.

2007-11-16 16:43 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2007-11-16 16:43 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-11-16 16:43 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-11-16 16:43 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-11-16 16:43 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2007-11-16 16:43 2,102 --a------ C:\WINDOWS\system32\tmp.reg
2007-11-16 16:36 85,056 --a------ C:\WINDOWS\system32\igipchma.dll
2007-11-16 16:32 81,984 --a------ C:\WINDOWS\system32\gicrnydl.dll
2007-11-16 15:09 <REP> d-------- C:\WINDOWS\BDOSCAN8
2007-11-16 14:29 36,352 --a------ C:\WINDOWS\system32\nnnnonm.dll
2007-11-15 22:33 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-15 22:33 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-11-15 22:31 <REP> d-------- C:\Program Files\CCleaner
2007-11-15 22:24 36,352 --a------ C:\WINDOWS\system32\pmnkhgh.dll
2007-11-15 22:09 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-15 19:03 <REP> d-------- C:\VundoFix Backups
2007-11-15 15:22 <REP> d-------- C:\Documents and Settings\All Users\Application Data\ESET
2007-11-15 12:29 79,936 --a------ C:\WINDOWS\system32\wgjbcafv.dll
2007-11-15 12:26 85,056 --a------ C:\WINDOWS\system32\mjggorgr.dll
2007-11-15 12:19 120 --a------ C:\n.bat
2007-11-15 12:19 0 --a------ C:\x.dat
2007-11-15 12:18 <REP> d-------- C:\WINDOWS\system32\rMa18yy
2007-11-15 12:18 <REP> d-------- C:\Temp\abW9
2007-11-15 12:18 36,352 --a------ C:\WINDOWS\system32\mljjhii.dll
2007-11-15 12:18 0 --a------ C:\z.dat
2007-11-14 17:38 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-14 12:16 37,376 --a------ C:\WINDOWS\system32\mljjkhh.dll
2007-11-13 08:43 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll
2007-11-13 08:39 36,352 --a------ C:\WINDOWS\system32\ddcbyvs.dll
2007-11-13 08:37 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2007-11-08 19:19 255,504 --a------ C:\Program Files\AzureusUpdater.exe
2007-11-07 12:42 <REP> d-------- C:\Program Files\DivX
2007-11-01 18:57 <REP> d-------- C:\Program Files\OpenOffice.org 2.3
2007-11-01 18:56 <REP> d-------- C:\Program Files\readmes
2007-11-01 18:56 <REP> d-------- C:\Program Files\licenses
2007-10-30 21:37 <REP> dr------- C:\Program Files\Program Files 1
2007-10-24 11:25 462,848 --a------ C:\WINDOWS\system32\ltkrn13n.dll
2007-10-24 11:25 450,560 --a------ C:\WINDOWS\system32\ltimg13n.dll
2007-10-24 11:25 401,408 --a------ C:\WINDOWS\system32\lfcmp13n.dll
2007-10-24 11:25 299,008 --a------ C:\WINDOWS\system32\ltdis13n.dll
2007-10-24 11:25 206,336 --a------ C:\WINDOWS\system32\ltefx13n.dll
2007-10-24 11:25 163,840 --a------ C:\WINDOWS\system32\ltfil13n.dll
2007-10-24 11:25 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll
2007-10-24 11:25 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll
2007-10-23 14:09 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll
2007-10-23 14:08 <REP> d-------- C:\Program Files\Microsoft Works
2007-10-23 14:07 <REP> d-------- C:\Program Files\MSBuild
2007-10-23 14:06 <REP> d-------- C:\Program Files\Microsoft.NET
2007-10-23 14:04 <REP> d-------- C:\Program Files\Microsoft Visual Studio 8
2007-10-23 14:03 <REP> d-------- C:\WINDOWS\SHELLNEW
2007-10-23 14:02 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-10-23 14:01 <REP> dr-h----- C:\MSOCache
2007-10-21 18:26 <REP> d-------- C:\Program Files\Microsoft.Press.Microsoft.Office.Word.2007.Step.by.Step.Jan.2007
2007-10-20 01:56 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2007-10-20 01:56 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2007-10-19 00:42 <REP> d-------- C:\Program Files\Lavalys
2007-10-17 17:10 <REP> d-------- C:\WINDOWS\pss

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-16 14:31 --------- d-----w C:\Program Files\LimeWire
2007-11-13 18:47 --------- d-----w C:\Program Files\Incomplete
2007-11-13 11:10 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-11-12 15:22 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-08 18:19 77,824 ----a-w C:\Program Files\aereg.dll
2007-11-08 18:19 548 ----a-w C:\Program Files\Azureus.exe.manifest
2007-11-01 17:57 --------- d-----w C:\Program Files\Java
2007-10-31 06:54 1,950,619 ----a-w C:\Program Files\swt.jar
2007-10-31 06:51 --------- d-----w C:\Program Files\GameSpy Arcade
2007-10-30 21:36 --------- d-----w C:\Program Files\Ahead
2007-10-30 19:59 --------- d-----w C:\Program Files\OpenOffice.org 2.0
2007-10-30 19:55 9,572,440 ----a-w C:\Program Files\Azureus2.jar
2007-10-26 13:43 278,984 ----a-w C:\WINDOWS\system32\drivers\atksgt.sys
2007-10-06 10:54 --------- d-----w C:\Program Files\iTunes
2007-10-06 10:54 --------- d-----w C:\Program Files\iPod
2007-10-06 10:53 --------- d-----w C:\Program Files\QuickTime
2007-10-06 10:52 --------- d-----w C:\Program Files\Apple Software Update
2007-10-06 10:51 --------- d-----w C:\Program Files\Fichiers communs\Apple
2007-10-06 10:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2007-10-01 11:15 839,692 ----a-w C:\WINDOWS\Fonts\Crack.exe
2007-09-18 20:57 --------- d-----w C:\Program Files\MSN Messenger
2007-09-16 21:13 --------- d-----w C:\Program Files\Midway Home Entertainment
2007-09-10 20:04 67,185,957 ----a-w C:\Program Files\openofficeorg3.cab
2007-09-10 20:04 3,393,494 ----a-w C:\Program Files\openofficeorg4.cab
2007-09-10 19:55 19,165,163 ----a-w C:\Program Files\openofficeorg1.cab
2007-09-10 19:55 17,641,046 ----a-w C:\Program Files\openofficeorg2.cab
2007-09-10 19:53 217 ----a-w C:\Program Files\setup.ini
2007-06-30 11:09 39,882 ----a-w C:\Documents and Settings\PowerISO\uninstall.exe
2007-06-28 21:09 74,329 ----a-w C:\Documents and Settings\eMule\Uninstall.exe
2007-05-13 14:57 5,308,416 ----a-w C:\Documents and Settings\eMule\emule.exe
2007-04-09 12:23 200,704 ----a-w C:\Documents and Settings\PowerISO\PWRISOVM.EXE
2007-04-09 12:22 204,800 ----a-w C:\Documents and Settings\PowerISO\PWRISOSH.DLL
2007-04-09 12:17 925,696 ----a-w C:\Documents and Settings\PowerISO\PowerISO.exe
2007-02-07 06:31 73,728 ----a-w C:\Program Files\swt-gdip-win32-3318.dll
2007-02-07 06:31 40,960 ----a-w C:\Program Files\swt-wgl-win32-3318.dll
2007-02-07 06:31 32,768 ----a-w C:\Program Files\swt-awt-win32-3318.dll
2007-02-07 06:31 290,816 ----a-w C:\Program Files\swt-win32-3318.dll
2006-11-06 08:29 5,120 ----a-w C:\Documents and Settings\PowerISO\piso.exe
2006-09-21 18:54 55,391 ----a-w C:\Program Files\Uninstall.exe
2006-08-21 08:34 72,992 ----a-w C:\Program Files\ChangeLog.txt
2006-06-30 03:45 73,728 ----a-w C:\Program Files\swt-gdip-win32-3232.dll
2006-06-30 03:45 40,960 ----a-w C:\Program Files\swt-wgl-win32-3232.dll
2006-06-30 03:45 323,584 ----a-w C:\Program Files\swt-win32-3232.dll
2006-06-30 03:45 32,768 ----a-w C:\Program Files\swt-awt-win32-3232.dll
2006-05-11 02:05 155,648 ----a-w C:\Program Files\Azureus.exe
2006-03-22 21:12 270,336 ----a-w C:\Documents and Settings\eMule\LinkCreator.exe
2005-07-21 08:03 17,719 ----a-w C:\Program Files\License.txt
2005-07-21 08:03 1,756 ----a-w C:\Program Files\swt-about.html
2003-09-01 09:00 844,448 ----a-w C:\Documents and Settings\Redist\spchapi.exe
2003-09-01 09:00 400,536 ----a-w C:\Documents and Settings\Redist\MSagent.exe
2003-09-01 09:00 2,354,376 ----a-w C:\Documents and Settings\Redist\lhttsfrf.exe
2003-09-01 09:00 2,296,520 ----a-w C:\Documents and Settings\Redist\lhttsged.exe
2003-09-01 09:00 1,873,176 ----a-w C:\Documents and Settings\Redist\Merlin.exe
2002-03-11 09:06 1,822,520 ----a-w C:\Program Files\instmsiw.exe
2002-03-11 08:45 1,708,856 ----a-w C:\Program Files\instmsia.exe
.

((((((((((((((((((((((((((((( snapshot@2007-11-15_22.24.43.40 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-11-16 14:10:05 45,056 ----a-w C:\WINDOWS\BDOSCAN8\avxdisk.dll
+ 2007-11-16 14:10:05 10,240 ----a-w C:\WINDOWS\BDOSCAN8\avxs.dll
+ 2007-11-16 14:10:05 27,136 ----a-w C:\WINDOWS\BDOSCAN8\avxt.dll
+ 2007-11-16 14:10:07 181,760 ----a-w C:\WINDOWS\BDOSCAN8\bdcore.dll
+ 2006-05-25 00:21:00 118,784 ----a-w C:\WINDOWS\BDOSCAN8\bdupd.dll
+ 2006-05-25 00:21:14 53,248 ----a-w C:\WINDOWS\BDOSCAN8\ipsupd.dll
+ 2007-11-16 14:10:08 142,848 ----a-w C:\WINDOWS\BDOSCAN8\libfn.dll
+ 2007-11-16 14:10:05 86,016 ----a-w C:\WINDOWS\BDOSCAN8\librtvr.dll
+ 2006-05-25 00:22:06 53,248 ----a-w C:\WINDOWS\bdoscandel.exe
+ 2006-05-25 00:21:00 118,784 ----a-w C:\WINDOWS\Downloaded Program Files\bdupd.dll
+ 2006-05-25 00:21:14 53,248 ----a-w C:\WINDOWS\Downloaded Program Files\ipsupd.dll
- 2007-11-15 20:57:54 60,416 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2007-11-16 19:30:41 60,416 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2007-11-15 20:57:54 73,234 ----a-w C:\WINDOWS\system32\perfc00C.dat
+ 2007-11-16 19:30:41 73,234 ----a-w C:\WINDOWS\system32\perfc00C.dat
- 2007-11-15 20:57:54 396,770 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-11-16 19:30:41 396,770 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2007-11-15 20:57:54 463,078 ----a-w C:\WINDOWS\system32\perfh00C.dat
+ 2007-11-16 19:30:41 463,078 ----a-w C:\WINDOWS\system32\perfh00C.dat
+ 2007-11-16 19:57:49 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_574.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00941BFA-3919-4ADA-9205-C134C9FC66F0}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3F8A34B6-4FC8-4307-99E5-476FA08F95D2}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{50223A48-684C-4F73-80C2-DF876F0CC5A7}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54F2557A-F960-4C07-8496-F61A533C9C41}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{55DCAD06-EC05-4CE1-BE55-F3264D7B0059}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{560D59BE-4AB8-4832-822F-A9080E90D97B}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6B647BCC-C285-4B01-8A66-338B8567E4BB}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{72e92f21-5097-4a40-8c03-482d9a75902d}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8C7C93E5-2F03-4A67-9410-F3E0D8300BA7}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{96CCF007-06BB-4D85-BAB7-6F68EF23BC3A}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{98718E46-8F6F-42E8-ACC4-84EF53F4A379}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AD792BBB-0A91-42F2-9A28-0E994BCB62D8}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BBB05D9E-0297-404D-A6BF-D8F2876B84A6}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BD279D1A-5AC3-44BD-BF05-3094A9E6AF5E}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c8236026-286b-4c1b-ba2d-fa2274b50b00}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CAD8ED26-4005-460F-9987-5C2DF08278DB}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{dd7f76cd-d959-46a3-aeb6-355ae9a17a7b}]
2007-11-16 16:32 81984 --a------ C:\WINDOWS\system32\gicrnydl.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EC40AA46-5786-4F06-A6B8-20D6CECC7683}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ECA808EE-CEE1-454B-97FC-CE5518ACDDA9}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FEBCB43F-7610-451D-9F04-1EE7405D825A}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe" [2001-07-23 19:02]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 11:06]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-28 23:43]
"U.S. Robotics Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11]
"RTHDCPL"="RTHDCPL.EXE" [2005-09-22 06:36 C:\WINDOWS\RTHDCPL.exe]
"nwiz"="nwiz.exe" [2007-06-28 23:43 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-28 23:43]
"8cfeb6c4"="C:\WINDOWS\system32\hbwbwuhd.dll" []
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]
"Host Process"="C:\WINDOWS\Fonts\svchost.exe" []
"Alcmtr"="ALCMTR.EXE" [2005-05-03 11:43 C:\WINDOWS\Alcmtr.exe]
"@"="" []
"NBInstall"="C:\DOCUME~1\CDRIC~1\LOCALS~1\Temp\MBDownloader_876923.exe" []
"runner1"="C:\WINDOWS\mrofinu1188.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-27 20:24]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:55]
"Steam"="D:\Jeux\Steam.exe" [2007-11-15 12:17]
"SpybotSD TeaTimer"="D:\Programmes\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
"SpybotDeletingB2429"=command /c del "C:\WINDOWS\mirar_distro_876260.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnkhgh]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\qhhpsxvf]
qhhpsxvf.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\awvvv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
backup=C:\WINDOWS\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Cédric^Menu Démarrer^Programmes^Démarrage^GameSpot Download Manager.lnk]
path=C:\Documents and Settings\Cédric\Menu Démarrer\Programmes\Démarrage\GameSpot Download Manager.lnk
backup=C:\WINDOWS\pss\GameSpot Download Manager.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Cédric^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.0.lnk]
path=C:\Documents and Settings\Cédric\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.0.lnk
backup=C:\WINDOWS\pss\OpenOffice.org 2.0.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Cédric^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.3.lnk]
path=C:\Documents and Settings\Cédric\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.3.lnk
backup=C:\WINDOWS\pss\OpenOffice.org 2.3.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
"C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\MSN Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
C:\Documents and Settings\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\QTTask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"usnjsvc"=3 (0x3)

R3 hcw88rc5;Hauppauge WinTV 88x IR Decoder;C:\WINDOWS\system32\Drivers\hcw88rc5.sys
S3 HCW88TUNE;Hauppauge WinTV 88x Tuner;C:\WINDOWS\system32\drivers\hcw88tun.sys
S3 hcw88vid;Hauppauge WinTV 88x Video;C:\WINDOWS\system32\drivers\hcw88vid.sys
S3 HCW88XBAR;Hauppauge WinTV 88x Crossbar;C:\WINDOWS\system32\drivers\HCW88BAR.sys
S3 LMImirr;LMImirr;C:\WINDOWS\system32\DRIVERS\LMImirr.sys
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K]
\Shell\AutoRun\command - K:\LaunchU3.exe -a

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2007-10-06 10:52:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-16 20:58:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-16 21:00:58 - machine was rebooted
C:\ComboFix2.txt ... 2007-11-15 22:25
.
--- E O F ---

-


et

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:03:26, on 16.11.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Cédric\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {00941BFA-3919-4ADA-9205-C134C9FC66F0} - (no file)
O2 - BHO: (no name) - {3F8A34B6-4FC8-4307-99E5-476FA08F95D2} - (no file)
O2 - BHO: (no name) - {50223A48-684C-4F73-80C2-DF876F0CC5A7} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~2\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {54F2557A-F960-4C07-8496-F61A533C9C41} - (no file)
O2 - BHO: (no name) - {55DCAD06-EC05-4CE1-BE55-F3264D7B0059} - (no file)
O2 - BHO: (no name) - {560D59BE-4AB8-4832-822F-A9080E90D97B} - (no file)
O2 - BHO: (no name) - {6B647BCC-C285-4B01-8A66-338B8567E4BB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: (no name) - {72e92f21-5097-4a40-8c03-482d9a75902d} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8C7C93E5-2F03-4A67-9410-F3E0D8300BA7} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {96CCF007-06BB-4D85-BAB7-6F68EF23BC3A} - (no file)
O2 - BHO: (no name) - {98718E46-8F6F-42E8-ACC4-84EF53F4A379} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {AD792BBB-0A91-42F2-9A28-0E994BCB62D8} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {BBB05D9E-0297-404D-A6BF-D8F2876B84A6} - (no file)
O2 - BHO: (no name) - {BD279D1A-5AC3-44BD-BF05-3094A9E6AF5E} - (no file)
O2 - BHO: (no name) - {c8236026-286b-4c1b-ba2d-fa2274b50b00} - (no file)
O2 - BHO: (no name) - {CAD8ED26-4005-460F-9987-5C2DF08278DB} - (no file)
O2 - BHO: {b7a71a9e-a553-6bea-3a64-959ddc67f7dd} - {dd7f76cd-d959-46a3-aeb6-355ae9a17a7b} - C:\WINDOWS\system32\gicrnydl.dll
O2 - BHO: (no name) - {EC40AA46-5786-4F06-A6B8-20D6CECC7683} - (no file)
O2 - BHO: (no name) - {ECA808EE-CEE1-454B-97FC-CE5518ACDDA9} - (no file)
O2 - BHO: (no name) - {FEBCB43F-7610-451D-9F04-1EE7405D825A} - (no file)
O3 - Toolbar: Traducteur - {FF284F5C-7CF9-4682-8701-D467C1DBB99F} - C:\Program Files\PRMT6\PRMTIE\prmtie.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [U.S. Robotics Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [8cfeb6c4] rundll32.exe "C:\WINDOWS\system32\hbwbwuhd.dll",b
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Host Process] C:\WINDOWS\Fonts\svchost.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Steam] "D:\Jeux\Steam.exe" -silent
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Programmes\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB2429] command /c del "C:\WINDOWS\mirar_distro_876260.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - D:\Jeux\Titan Poker\casino.exe (file missing)
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - D:\Jeux\Titan Poker\casino.exe (file missing)
O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PRMT6\PRMTIE\prmtie5.htm
O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PRMT6\PRMTIE\prmtie5.htm
O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PRMT6\PRMTIE\options.htm
O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PRMT6\PRMTIE\options.htm
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~2\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~2\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: pmnkhgh - C:\WINDOWS\
O20 - Winlogon Notify: qhhpsxvf - qhhpsxvf.dll (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: U.S. Robotics Wireless LAN Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
0
Réponse 55 / 167
Utilisateur anonyme
 
relance hijackthis do a scan systeme only et coche les lignes suivantes et clic sur fix

O2 - BHO: (no name) - {00941BFA-3919-4ADA-9205-C134C9FC66F0} - (no file)
O2 - BHO: (no name) - {3F8A34B6-4FC8-4307-99E5-476FA08F95D2} - (no file)
O2 - BHO: (no name) - {50223A48-684C-4F73-80C2-DF876F0CC5A7} - (no file)

O2 - BHO: (no name) - {54F2557A-F960-4C07-8496-F61A533C9C41} - (no file)
O2 - BHO: (no name) - {55DCAD06-EC05-4CE1-BE55-F3264D7B0059} - (no file)
O2 - BHO: (no name) - {560D59BE-4AB8-4832-822F-A9080E90D97B} - (no file)
O2 - BHO: (no name) - {6B647BCC-C285-4B01-8A66-338B8567E4BB} - (no file)

O2 - BHO: (no name) - {72e92f21-5097-4a40-8c03-482d9a75902d} - (no file)

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8C7C93E5-2F03-4A67-9410-F3E0D8300BA7} - (no file)

O2 - BHO: (no name) - {96CCF007-06BB-4D85-BAB7-6F68EF23BC3A} - (no file)
O2 - BHO: (no name) - {98718E46-8F6F-42E8-ACC4-84EF53F4A379} - (no file)

O2 - BHO: (no name) - {AD792BBB-0A91-42F2-9A28-0E994BCB62D8} - (no file)

O2 - BHO: (no name) - {BBB05D9E-0297-404D-A6BF-D8F2876B84A6} - (no file)
O2 - BHO: (no name) - {BD279D1A-5AC3-44BD-BF05-3094A9E6AF5E} - (no file)
O2 - BHO: (no name) - {c8236026-286b-4c1b-ba2d-fa2274b50b00} - (no file)
O2 - BHO: (no name) - {CAD8ED26-4005-460F-9987-5C2DF08278DB} - (no file)

O2 - BHO: (no name) - {EC40AA46-5786-4F06-A6B8-20D6CECC7683} - (no file)
O2 - BHO: (no name) - {ECA808EE-CEE1-454B-97FC-CE5518ACDDA9} - (no file)
O2 - BHO: (no name) - {FEBCB43F-7610-451D-9F04-1EE7405D825A} - (no file)
0
Réponse 56 / 167
Noobdog Messages postés 113 Date d'inscription   Statut Membre Dernière intervention  
 
Voila j'ai cliké sur fix après avoir coché. Quelle est la suite des manip ?
0
Réponse 57 / 167
Utilisateur anonyme
 
tu peu fermer hijackthis recommence la purge de ta restauration systemes ensuite il faut que tu recommence ccleaner et avg anti spyware en mode sans echec et clean de malekal ca devrait etre bon ! copie moi quand meme stp le rapport avg et un nouvel hijackthis






0
Réponse 58 / 167
Utilisateur anonyme
 
ps: effectue aussi un scan avec panda
https://www.pandasecurity.com/?ref=www.pandasoftware.com/activescan/
0
Réponse 59 / 167
Utilisateur anonyme
 
bon on fini demain copie moi les rapport c'est important! si ca n'as pas avancé je te trouve trouve un "exorciste" demain!! passe une bonne soirée !
0
Réponse 60 / 167
Noobdog Messages postés 113 Date d'inscription   Statut Membre Dernière intervention  
 
Bon voila les rapports avg et hijackthis. Ca a pris du temps parce que je sais pas pourquoi mais l'analyse de avg a duré environ 2h30.

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 01:02:56 17.11.2007

+ Résultat de l'analyse:



HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\run\\runner1 -> Adware.Generic : Nettoyé et sauvegardé (mise en quarantaine).


Fin du rapport


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:19:11, on 17.11.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Cédric\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {00941BFA-3919-4ADA-9205-C134C9FC66F0} - (no file)
O2 - BHO: (no name) - {3F8A34B6-4FC8-4307-99E5-476FA08F95D2} - (no file)
O2 - BHO: (no name) - {50223A48-684C-4F73-80C2-DF876F0CC5A7} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~2\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {54F2557A-F960-4C07-8496-F61A533C9C41} - (no file)
O2 - BHO: (no name) - {55DCAD06-EC05-4CE1-BE55-F3264D7B0059} - (no file)
O2 - BHO: (no name) - {560D59BE-4AB8-4832-822F-A9080E90D97B} - (no file)
O2 - BHO: (no name) - {6B647BCC-C285-4B01-8A66-338B8567E4BB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: (no name) - {72e92f21-5097-4a40-8c03-482d9a75902d} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8C7C93E5-2F03-4A67-9410-F3E0D8300BA7} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {96CCF007-06BB-4D85-BAB7-6F68EF23BC3A} - (no file)
O2 - BHO: (no name) - {98718E46-8F6F-42E8-ACC4-84EF53F4A379} - (no file)
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {AD792BBB-0A91-42F2-9A28-0E994BCB62D8} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {BBB05D9E-0297-404D-A6BF-D8F2876B84A6} - (no file)
O2 - BHO: (no name) - {BD279D1A-5AC3-44BD-BF05-3094A9E6AF5E} - (no file)
O2 - BHO: (no name) - {c8236026-286b-4c1b-ba2d-fa2274b50b00} - (no file)
O2 - BHO: (no name) - {CAD8ED26-4005-460F-9987-5C2DF08278DB} - (no file)
O2 - BHO: {b7a71a9e-a553-6bea-3a64-959ddc67f7dd} - {dd7f76cd-d959-46a3-aeb6-355ae9a17a7b} - C:\WINDOWS\system32\gicrnydl.dll
O2 - BHO: (no name) - {EC40AA46-5786-4F06-A6B8-20D6CECC7683} - (no file)
O2 - BHO: (no name) - {ECA808EE-CEE1-454B-97FC-CE5518ACDDA9} - (no file)
O2 - BHO: (no name) - {FEBCB43F-7610-451D-9F04-1EE7405D825A} - (no file)
O3 - Toolbar: Traducteur - {FF284F5C-7CF9-4682-8701-D467C1DBB99F} - C:\Program Files\PRMT6\PRMTIE\prmtie.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [U.S. Robotics Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [8cfeb6c4] rundll32.exe "C:\WINDOWS\system32\hbwbwuhd.dll",b
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Host Process] C:\WINDOWS\Fonts\svchost.exe
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NBInstall] C:\DOCUME~1\CDRIC~1\LOCALS~1\Temp\MBDownloader_876923.exe
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu1188.exe 61A847B5BBF72813339330466188719AB689201522886B092CBD44BD8689220221DD3257
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Steam] "D:\Jeux\Steam.exe" -silent
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Programmes\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB2429] command /c del "C:\WINDOWS\mirar_distro_876260.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - D:\Jeux\Titan Poker\casino.exe (file missing)
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - D:\Jeux\Titan Poker\casino.exe (file missing)
O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PRMT6\PRMTIE\prmtie5.htm
O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PRMT6\PRMTIE\prmtie5.htm
O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PRMT6\PRMTIE\options.htm
O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PRMT6\PRMTIE\options.htm
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~2\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~2\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: pmnkhgh - C:\WINDOWS\
O20 - Winlogon Notify: qhhpsxvf - qhhpsxvf.dll (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: U.S. Robotics Wireless LAN Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
0