alertre securité windows Résolu/Fermé

Question

Bonjour tous,
voilà depuis hier soir j'ai un virus , une alerte avec un petit triangle jaune s'affiche tout le temps dasn la barre de tache prés de l'icone avast. Des raccourcis se sont installé sur le bureau, des pages internet s'ouvrent me demandant de telécharger des mises à jour plutot louche pour la sécurité windows. Avast detecte des virus win32 qq chose et quand je fais une analyse au demarrage il trouve un virus pas plus..
Je n'y connait rien en informlatique, j'ai vu dans ce forum un descriptif d'un virus ressemblant à celui que j'ai. Pouvez vous m'aider svp.
Je suis sous windows xp j'ai avast et c cleaner et le pare feu de windows
Merci
ps:j'ose plus allumer mon pc..je vous écrit là de mon boulot

Utilisateur anonyme · Answer

Bonjour

Qu'as-tu comme atni-spywares et comme pare-feu ?

Il va falloir malgré tout rallumer ton PC si tu veux le désinfecter avant qu'il ne soit vraiment trop tard .. 
Tu peux déjà commencer par faire ces deux manipulations


Télécharge HijackThis : 
---> http://www.commentcamarche.net/download/fichiers/hijackthis.zip

Installe le dans son propre dossier :
- clic droit sur le bureau, tu choisis "nouveau dossier" puis installe-le à l'intérieur.
Fais un clic droit sur Hijackthis, choisis "renommer" puis marque ceci : abcde.exe 
Double-clic sur HijackThis. Clic sur "I Accept" puis clic sur "do a system scan and save logfile" 
Puis copie et colle ici le rapport qu'il va te générer.

Démo pour HijackThis si besoin  :
http://pageperso.aol.fr/balltrap34/demohijack.htm


ET


Télécharge et installe AVG anti-spyware : mets le à jour
Tu fais un scan complet de ton système, dès qu'il a fini.
Si il te trouve des espions,supprime les. Enregistre le rapport et colle le ici stp 

AVG anti-spyware : reste gratuit après la période d'essai en français
---->http://www.infos-du-net.com/telecharger/Anti-Spyware-AVG,0301-7063.html

Si tu as besoin d'aide avec Ewido(devenu AVG-antispyware) regarde ce tutoriel:
--> http://kerio.probb.fr/chasser-les-virus-et-spywares-de-votre-systeme-f1/tutoriel-avg-anti-spyware-anti-spyware-t701.htm

A++

poulette559 · Answer

salut!
Merci pour ton aide
je telecharge avg anti spyware sur telecharger.net car ton lien ne marchais pas. Ils mettent que ce n'est qu'une version d'évaluation valable 30 jours. C'est la version 7.5

poulette559 · Answer

Donc en antivirus j'ai avast, pare feu windows et c'est tout! pas de spyware ni autre.
J'ai qqes question d'ordre 'pratique': vasi je pouvoir installer tout ca sur mon bureau alors que je n'ai ni barre de tache et juste mon fond d'écran qui s'affiche (sans icones ou dossier). idem en mode sans échec, l'écran est tout noir.
Dois je me mettre en mode sans échec pour faire la manip de hijack? 
Toujours pour hijack: une fois renommé je le lance en cliquant sur abcde.exe?

Utilisateur anonyme · Answer

Même si tu installes un nouveau programmes tu n'as aucunes icônes qui se met sur le bureau ? ! 
Donc je vois pas comment tu pourrais fair epour Hijackthis..

Il fuadrait que tu t'entraines ou peut-être sais-tu le faire, c'est d'ouvrir le gestionnaire des tâches .. comme tu n'as pas le menu démarer, il faut que tu appuies en même temps sur trois touches, les touches sont 

- CTRL (en bas à gauche)
- ALT (en bas à gauche) 
- Suppr (en général vers le haut à droite) 

Voilà tu appuies sur les trois en même temps, le gestionnaires des tâches devrait s'ouvrir, dans ce cas là on pourrait faire quelque chose le cas échéant, on va avoir du mal même en mode sans échec d'après ce que tu dis ;-)

poulette559 · Answer

salut alorsj'ai pu installer hijack sans le mettre sur le bureau évidement et sans avoir renommer le .exe Voici le rapport qu'il a generé:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:27:26, on 27/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32
appdokt.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32	askmgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.fr/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.picasa.com/support/welcome.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\uqtodzqm.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [1474aad1] rundll32.exe "C:\WINDOWS\system32\atndbtfl.dll",b
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Enregistrement d'un produit Joint Operations Typhoon Rising.lnk = C:\Documents and Settings\Moi\Local Settings\Temp\{CCFC9AE2-C6A8-4EBA-AD4D-86A557E53170}\{0325F1C1-883A-41AB-8981-B27359ABDFAF}\NOVG.EXE
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe
O23 - Service: DomainService -   - C:\WINDOWS\system32
appdokt.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcappcapd.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

poulette559 · Answer

je reviens à peu prés toute les 1/2 voire heure car je veux rester le moins longtemps connecté sur internet

Utilisateur anonyme · Answer

Essaye de faire ça pour commencer, car ne sachant pas si tu vas pourvoir y accéder difficile de te dire quoi faire pour le moment.

*Télécharge SmitfraudFix et enregistre le sur le bureau. Si ton anti-virus t'alerte d'un virus, désactive-le.
http://siri.urz.free.fr/Fix/SmitfraudFix.zip

décompresse SmitfraudFix

Redémarre le PC en mode sans échec : tu tapotes sur la touche F8 de ton clavier (ou F5 ) dès le démarrage et tu choisis le mode sans échec) 

- Ouvre le dossier "SmitfraudFix" et double clique sur "Smitfraudfix.cmd", choisit l 'option 2 et tu réponds oui à tout. 

Enregistre le rapport puis Copie/colle le rapport sur le forum stp. (si possible)


ET


* A faire en mode sans échec 
Télécharge VundoFix
---> http://redir.fr/goqv

Redémarre ton PC. Dès l'allumage de celui-ci tapote la touche F8 (ou F5 si F8 ne fonctionne pas), à l'écran qui va apparaître choisis "mode sans echec" attends un peu.. 

double clic dessus choisis "start for vundo" 
attends quelques minutes, quand le scan est terminé clic sur "remove vundo"
un message te demandera si tu veux supprimes les fichiers sur "yes"
Quand il a terminé, clic sur "yes" ton ordinateur devrait redemarrer sinon, fais le par toi même
Une fois qu'il a redemarré colle le rapport C:\vundofix.txt (si possible)


Puis essaye d'accéder au gestionnaire des taches comme je t'ai indiqué plus haut pour pouvoir faire des modifications necessaires.

poulette559 · Answer

voici le rapport de SmitFraud:
SmitFraudFix v2.256

Rapport fait à 22:35:15,85, 27/11/2007
Executé à partir de C:\Documents and Settings\Moi\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1       localhost
127.0.0.1	hityou.com
127.0.0.1	www.hityou.com
127.0.0.1	180searchassistant.com
127.0.0.1	www.180searchassistant.com
127.0.0.1	180solutions.com
127.0.0.1	www.180solutions.com
127.0.0.1	bis.180solutions.com
127.0.0.1	config.180solutions.com
127.0.0.1	cts.180solutions.com
127.0.0.1	downloads.180solutions.com
127.0.0.1	installs.180solutions.com
127.0.0.1	nowhere.180solutions.com
127.0.0.1	ping.180solutions.com
127.0.0.1	tv.180solutions.com
127.0.0.1	uploads.180solutions.com
127.0.0.1	public.zangocash.com
127.0.0.1	www.public.zangocash.com
127.0.0.1	static.zangocash.com
127.0.0.1	www.static.zangocash.com
127.0.0.1	www.zangocash.com
127.0.0.1	zangocash.com
127.0.0.1	007guard.com
127.0.0.1	www.007guard.com
127.0.0.1	2search.com
127.0.0.1	www.2search.com
127.0.0.1	2search.org
127.0.0.1	www.2search.org
127.0.0.1	bardownload.com
127.0.0.1	www.bardownload.com
127.0.0.1	download.bardownload.com
127.0.0.1	www.download.bardownload.com
127.0.0.1	feeds.2search.com
127.0.0.1	www.feeds.2search.com
127.0.0.1	feeds2.2search.org
127.0.0.1	www.feeds2.2search.org
127.0.0.1	install.007guard.com
127.0.0.1	www.install.007guard.com
127.0.0.1	the.007guard.com
127.0.0.1	www.the.007guard.com
127.0.0.1	topbrowsing.com
127.0.0.1	www.topbrowsing.com
127.0.0.1	2squared.com
127.0.0.1	www.2squared.com
127.0.0.1	play3w.com
127.0.0.1	www.play3w.com
127.0.0.1	playon.play3w.com
127.0.0.1	7search.com
127.0.0.1	www.7search.com
127.0.0.1	3abetterinternet.com
127.0.0.1	www.3abetterinternet.com
127.0.0.1	abetterinternet.com
127.0.0.1	www.abetterinternet.com
127.0.0.1	bigtrafficnetwork.com
127.0.0.1	www.bigtrafficnetwork.com
127.0.0.1	download.abetterinternet.com
127.0.0.1	thinstall.abetterinternet.com
127.0.0.1	www.toolbar3.trafficgeneration.biz
127.0.0.1	www.toolbar5.trafficgeneration.biz
127.0.0.1	trafficgeneration.biz
127.0.0.1	www.trafficgeneration.biz
127.0.0.1	www3.bigtrafficnetwork.com
127.0.0.1	iframebiz.com
127.0.0.1	www.iframebiz.com
127.0.0.1	absolutee.com
127.0.0.1	www.absolutee.com
127.0.0.1	pornohome.net
127.0.0.1	www.pornohome.net
127.0.0.1	adarmor.com
127.0.0.1	www.adarmor.com
127.0.0.1	addictivetechnologies.com
127.0.0.1	www.addictivetechnologies.com
127.0.0.1	addictivetechnologies.net
127.0.0.1	www.addictivetechnologies.net
127.0.0.1	admin2cash.biz
127.0.0.1	www.admin2cash.biz
127.0.0.1	ad.mokead.com
127.0.0.1	www.ad.mokead.com
127.0.0.1	mokead.com
127.0.0.1	www.mokead.com
127.0.0.1	adprotect.com
127.0.0.1	www.adprotect.com
127.0.0.1	adscontex.com
127.0.0.1	www.adscontex.com
127.0.0.1	miaminews365.net
127.0.0.1	www.miaminews365.net
127.0.0.1	redir.ws
127.0.0.1	www.redir.ws
127.0.0.1	www.zestyfind.com
127.0.0.1	zestyfind.com
127.0.0.1	miosearch.com
127.0.0.1	www.miosearch.com
127.0.0.1	advcash.biz
127.0.0.1	www.advcash.biz
127.0.0.1	adwarebazooka.com
127.0.0.1	www.adwarebazooka.com
127.0.0.1	get.adwarebazooka.com
127.0.0.1	adwarefinder.com
127.0.0.1	www.adwarefinder.com
127.0.0.1	nbcsearch.com
127.0.0.1	www.nbcsearch.com
127.0.0.1	adwarepunisher.com
127.0.0.1	www.adwarepunisher.com
127.0.0.1	agava.com
127.0.0.1	agava.ru
127.0.0.1	hu15.ru
127.0.0.1	hut1.ru
127.0.0.1	all4internet.com
127.0.0.1	www.all4internet.com
127.0.0.1	www.allcybersearch.com
127.0.0.1	www.tinybar.com
127.0.0.1	babe.k-lined.com
127.0.0.1	www.babe.k-lined.com
127.0.0.1	babe.the-killer.bz
127.0.0.1	www.babe.the-killer.bz
127.0.0.1	did.i-used.cc
127.0.0.1	www.did.i-used.cc
127.0.0.1	i-used.cc
127.0.0.1	k-lined.com
127.0.0.1	antispyware.com
127.0.0.1	www.antispyware.com
127.0.0.1	spysoldier.com
127.0.0.1	www.spysoldier.com
127.0.0.1	antivermins.com
127.0.0.1	www.antivermins.com
127.0.0.1	anti-vermins.com
127.0.0.1	www.anti-vermins.com
127.0.0.1	dl1.antivermins.com
127.0.0.1	antivirgear.com
127.0.0.1	www.antivirgear.com
127.0.0.1	dl1.antivirgear.com
127.0.0.1	sigmadown.biz
127.0.0.1	www.sigmadown.biz
127.0.0.1	anti-virus-pro.com
127.0.0.1	www.anti-virus-pro.com
127.0.0.1	iwon.com
127.0.0.1	goldenfreehost.com
127.0.0.1	www.goldenfreehost.com
127.0.0.1	logs.vapochille.com
127.0.0.1	www.logs.vapochille.com
127.0.0.1	asta-killer.com
127.0.0.1	realphx.com
127.0.0.1	antivirusgolden.com
127.0.0.1	www.antivirusgolden.com
127.0.0.1	azebar.com
127.0.0.1	toolbar.azebar.com
127.0.0.1	www.toolbar.azebar.com
127.0.0.1	n3.net
127.0.0.1	sdbot.n3.net
127.0.0.1	www.supernet.speedserv.com
127.0.0.1	topsite.us
127.0.0.1	www.topsite.us
127.0.0.1	topsites.us
127.0.0.1	www.topsites.us
127.0.0.1	topsitez.us
127.0.0.1	www.topsitez.us
127.0.0.1	lfxmsc.gov.cn
127.0.0.1	www.lfxmsc.gov.cn
127.0.0.1	www.zjkjw.gov.cn
127.0.0.1	zjkjw.gov.cn
127.0.0.1	multitrader.info
127.0.0.1	www.multitrader.info
127.0.0.1	arquivojpgs.smtp.ru
127.0.0.1	www.arquivojpgs.smtp.ru
127.0.0.1	pochta.ru
127.0.0.1	www.pochta.ru
127.0.0.1	smtp.ru
127.0.0.1	www.smtp.ru
127.0.0.1	cartoes.uol.com.br
127.0.0.1	hobbypesca.com.br
127.0.0.1	www.hobbypesca.com.br
127.0.0.1	ofuxico.uol.com.br
127.0.0.1	newmediaidea.com
127.0.0.1	www.newmediaidea.com
127.0.0.1	bettersearch.biz
127.0.0.1	www.bettersearch.biz
127.0.0.1	asdeykuddq.com
127.0.0.1	www.asdeykuddq.com
127.0.0.1	asidseiupc.com
127.0.0.1	www.asidseiupc.com
127.0.0.1	fjsynebcod.com
127.0.0.1	www.fjsynebcod.com
127.0.0.1	qiudheadsd.com
127.0.0.1	www.qiudheadsd.com
127.0.0.1	superbgirlz.com
127.0.0.1	www.superbgirlz.com
127.0.0.1	blazefind.com
127.0.0.1	jerrynews.com
127.0.0.1	www.jerrynews.com
127.0.0.1	bonzi.com
127.0.0.1	www.bonzi.com
127.0.0.1	bookedspace.com
127.0.0.1	www.bookedspace.com
127.0.0.1	bravesentry.com
127.0.0.1	www.bravesentry.com
127.0.0.1	download.bravesentry.com
127.0.0.1	www.download.bravesentry.com
127.0.0.1	featured-results.com
127.0.0.1	searchmadesafe.net
127.0.0.1	quicklaunch.com
127.0.0.1	aavc.com
127.0.0.1	acjp.com
127.0.0.1	ebav.com
127.0.0.1	ebaw.com
127.0.0.1	ebch.com
127.0.0.1	ebdv.com
127.0.0.1	ebdw.com
127.0.0.1	ebgo.com
127.0.0.1	ebjp.com
127.0.0.1	ebkb.com
127.0.0.1	ebkn.com
127.0.0.1	ebky.com
127.0.0.1	eblv.com
127.0.0.1	ebmu.com
127.0.0.1	ebvr.com
127.0.0.1	ecmh.com
127.0.0.1	ecmp.com
127.0.0.1	ecpm.com
127.0.0.1	ecwz.com
127.0.0.1	ecyb.com
127.0.0.1	edhq.com
127.0.0.1	edty.com
127.0.0.1	eduy.com
127.0.0.1	eeev.com
127.0.0.1	emch.com
127.0.0.1	farse.com
127.0.0.1	germany.rub.to
127.0.0.1	H24413.tfil.com
127.0.0.1	ibmx.com
127.0.0.1	icwb.com
127.0.0.1	icwo.com
127.0.0.1	icwp.com
127.0.0.1	iddh.com
127.0.0.1	idhh.com
127.0.0.1	ifiz.com
127.0.0.1	iguu.com
127.0.0.1	lop.com
127.0.0.1	rub.to
127.0.0.1	samz.com
127.0.0.1	saoe.com
127.0.0.1	sbee.com
127.0.0.1	sbjr.com
127.0.0.1	sbnl.com
127.0.0.1	sbnt.com
127.0.0.1	sbvr.com
127.0.0.1	scbm.com
127.0.0.1	sckr.com
127.0.0.1	scrk.com
127.0.0.1	sdry.com
127.0.0.1	search.rub.to
127.0.0.1	seld.com
127.0.0.1	sfux.com
127.0.0.1	sheat.com
127.0.0.1	sipo.com
127.0.0.1	smds.com
127.0.0.1	srib.com
127.0.0.1	srox.com
127.0.0.1	srsf.com
127.0.0.1	ssaw.com
127.0.0.1	ssby.com
127.0.0.1	surj.com
127.0.0.1	tbvg.com
127.0.0.1	tdak.com
127.0.0.1	tdko.com
127.0.0.1	tdmy.com
127.0.0.1	tefs.com
127.0.0.1	tfil.com
127.0.0.1	thko.com
127.0.0.1	tjar.com
127.0.0.1	tjaw.com
127.0.0.1	tjdo.com
127.0.0.1	tjem.com
127.0.0.1	tjgo.com
127.0.0.1	torc.com
127.0.0.1	unitedstates.rub.to
127.0.0.1	wabq.com
127.0.0.1	wabu.com
127.0.0.1	wbkb.com
127.0.0.1	wethere.com
127.0.0.1	www.wethere.com
127.0.0.1	wfix.com
127.0.0.1	wflu.com
127.0.0.1	c4tdownload.com
127.0.0.1	www.c4tdownload.com
127.0.0.1	hostance.net
127.0.0.1	www.hostance.net
127.0.0.1	b.casalemedia.com
127.0.0.1	casalemedia.com
127.0.0.1	www.casalemedia.com
127.0.0.1	cashsurfers.com
127.0.0.1	www.cashsurfers.com
127.0.0.1	cashdeluxe.net
127.0.0.1	www.cashdeluxe.net
127.0.0.1	CashUnlim.com
127.0.0.1	www.CashUnlim.com
127.0.0.1	stats.cashdeluxe.net
127.0.0.1	www.stats.cashdeluxe.net
127.0.0.1	tsx.org
127.0.0.1	upx.tsx.org
127.0.0.1	888.com
127.0.0.1	www.888.com
127.0.0.1	images.888.com
127.0.0.1	whoisprivacyprotect.com
127.0.0.1	www.whoisprivacyprotect.com
127.0.0.1	data-hoster.com
127.0.0.1	www.data-hoster.com
127.0.0.1	netsearchsoft.com
127.0.0.1	www.netsearchsoft.com
127.0.0.1	pcgewinnen.de
127.0.0.1	www.pcgewinnen.de
127.0.0.1	breenten.biz
127.0.0.1	www.breenten.biz
127.0.0.1	ozonung.biz
127.0.0.1	www.ozonung.biz
127.0.0.1	troonety.biz
127.0.0.1	www.troonety.biz
127.0.0.1	votreenton.biz
127.0.0.1	www.votreenton.biz
127.0.0.1	www.zurrusco.com
127.0.0.1	zurrusco.com
127.0.0.1	1987324.com
127.0.0.1	www.1987324.com
127.0.0.1	out.true-counter.com
127.0.0.1	ads.centralmedia.ws
127.0.0.1	c.centralmedia.ws
127.0.0.1	centralmedia.ws
127.0.0.1	Sexxpassport.com
127.0.0.1	www.Sexxpassport.com
127.0.0.1	clickspring.net
127.0.0.1	www.clickspring.net
127.0.0.1	100888290cs.com
127.0.0.1	www.100888290cs.com
127.0.0.1	132.com
127.0.0.1	www.132.com
127.0.0.1	136136.net
127.0.0.1	www.136136.net
127.0.0.1	163ns.com
127.0.0.1	www.163ns.com
127.0.0.1	ac66.cn
127.0.0.1	www.ac66.cn
127.0.0.1	bigwww.com
127.0.0.1	www.bigwww.com
127.0.0.1	chenshijituan.com
127.0.0.1	www.chenshijituan.com
127.0.0.1	cnzz.com
127.0.0.1	www.cnzz.com
127.0.0.1	down.136136.net
127.0.0.1	ert0003.e76.163ns.com
127.0.0.1	jhzjyj.bigwww.com
127.0.0.1	mir.100888290cs.com
127.0.0.1	q36.cn
127.0.0.1	www.q36.cn
127.0.0.1	s59.cnzz.com
127.0.0.1	tzxsj.com
127.0.0.1	www.tzxsj.com
127.0.0.1	u7u.cn
127.0.0.1	www.u7u.cn
127.0.0.1	wg581.com
127.0.0.1	www.wg581.com
127.0.0.1	woool.100888290cs.com
127.0.0.1	cnetadd.com
127.0.0.1	www.cnetadd.com
127.0.0.1	3721.com
127.0.0.1	139mm.com
127.0.0.1	www.139mm.com
127.0.0.1	okmmm.com
127.0.0.1	www.okmmm.com
127.0.0.1	adservs.com
127.0.0.1	command.adservs.com
127.0.0.1	csx.adservs.com
127.0.0.1	www.csx.adservs.com
127.0.0.1	nonameforthisdomain.com
127.0.0.1	www.nonameforthisdomain.com
127.0.0.1	www.commonname.com
127.0.0.1	contentmatch.net
127.0.0.1	www.contentmatch.net
127.0.0.1	contra-virus.com
127.0.0.1	www.contra-virus.com
127.0.0.1	008k.com
127.0.0.1	www.008k.com
127.0.0.1	00hq.com
127.0.0.1	www.00hq.com
127.0.0.1	010402.com
127.0.0.1	100sexlinks.com
127.0.0.1	www.100sexlinks.com
127.0.0.1	10sek.com
127.0.0.1	www.10sek.com
127.0.0.1	1-domains-registrations.com
127.0.0.1	www.1-domains-registrations.com
127.0.0.1	1-extreme.biz
127.0.0.1	www.1-extreme.biz
127.0.0.1	1sexparty.com
127.0.0.1	www.1sexparty.com
127.0.0.1	1stpagehere.com
127.0.0.1	www.1stpagehere.com
127.0.0.1	2020search.com
127.0.0.1	www.2020search.com
127.0.0.1	20x2p.com
127.0.0.1	24teen.com
127.0.0.1	www.24teen.com
127.0.0.1	36site.com
127.0.0.1	www.36site.com
127.0.0.1	4corn.net
127.0.0.1	www.4corn.net
127.0.0.1	4klm.com
127.0.0.1	6sek.com
127.0.0.1	www.6sek.com
127.0.0.1	75tz.com
127.0.0.1	777top.com
127.0.0.1	www.777top.com
127.0.0.1	8ad.com
127.0.0.1	www.8ad.com
127.0.0.1	aboutclicker.com
127.0.0.1	www.aboutclicker.com
127.0.0.1	abrp.net
127.0.0.1	www.abrp.net
127.0.0.1	accessthefuture.net
127.0.0.1	www.accessthefuture.net
127.0.0.1	acemedic.com
127.0.0.1	www.acemedic.com
127.0.0.1	actionbreastcancer.org
127.0.0.1	www.actionbreastcancer.org
127.0.0.1	activexupdate.com
127.0.0.1	www.activexupdate.com
127.0.0.1	ad25.com
127.0.0.1	ad45.com
127.0.0.1	ad77.com
127.0.0.1	ad86.com
127.0.0.1	adamsupportgroup.org
127.0.0.1	www.adamsupportgroup.org
127.0.0.1	adasearch.com
127.0.0.1	www.adasearch.com
127.0.0.1	adipics.com
127.0.0.1	www.adipics.com
127.0.0.1	adspics.com
127.0.0.1	www.adspics.com
127.0.0.1	adult-engine-search.com
127.0.0.1	www.adult-engine-search.com
127.0.0.1	adult-erotic-guide.net
127.0.0.1	www.adult-erotic-guide.net
127.0.0.1	adult-friends-finder.net
127.0.0.1	www.adult-friends-finder.net
127.0.0.1	adultgambling.org
127.0.0.1	adult-host.org
127.0.0.1	adulthyperlinks.com
127.0.0.1	www.adulthyperlinks.com
127.0.0.1	adultsgames.net
127.0.0.1	adulttds.com
127.0.0.1	www.adulttds.com
127.0.0.1	advert.exaccess.ru
127.0.0.1	africaspromise.org
127.0.0.1	agentstudio.com
127.0.0.1	akril.com
127.0.0.1	alcatel.ws
127.0.0.1	alfa-search.com
127.0.0.1	allabtcars.com
127.0.0.1	allabtjeeps.com
127.0.0.1	allcybersearch.com
127.0.0.1	allhyperlinks.com
127.0.0.1	all-inet.com
127.0.0.1	allinternetbusiness.com
127.0.0.1	almarvideos.com
127.0.0.1	amandamountains.com
127.0.0.1	american-teens.net
127.0.0.1	amigeek.com
127.0.0.1	amisbusiness.com
127.0.0.1	analmovi.com
127.0.0.1	anin.org
127.0.0.1	annaromeo.com
127.0.0.1	antrocity.com
127.0.0.1	anything4health.com
127.0.0.1	approvedlinks.com
127.0.0.1	www.approvedlinks.com
127.0.0.1	apsua.com
127.0.0.1	aregay.com
127.0.0.1	arheo.com
127.0.0.1	arizonaweb.org
127.0.0.1	armitageinn.com
127.0.0.1	artachnid.com
127.0.0.1	art-func.com
127.0.0.1	art-xxx.com
127.0.0.1	asdbiz.biz
127.0.0.1	www.asdbiz.biz
127.0.0.1	asiankingkong.com
127.0.0.1	ass-gals.com
127.0.0.1	athenrye.com
127.0.0.1	avian-ads.com
127.0.0.1	ayakawamura.com
127.0.0.1	ayumitaniguchi.com
127.0.0.1	backup.mabou.org
127.0.0.1	bannedhost.net
127.0.0.1	barbudafarms.com
127.0.0.1	barnandfence.com
127.0.0.1	batsearch.com
127.0.0.1	baygraphicsllc.com
127.0.0.1	bbbsearch.com
127.0.0.1	bb-search.com
127.0.0.1	bdsmlibrary.net
127.0.0.1	bedhome.com
127.0.0.1	bediadance.com
127.0.0.1	bellabasketsfl.com
127.0.0.1	bernaolatwin.com
127.0.0.1	best-counter.com
127.0.0.1	bestcrawler.com
127.0.0.1	bestfor.ru
127.0.0.1	best-hardpics.com
127.0.0.1	bestporngate.com
127.0.0.1	best-winning-casino.com
127.0.0.1	bestxporno.com
127.0.0.1	bitchesonline.net
127.0.0.1	blackjack-free.net
127.0.0.1	blender.xu.pl
127.0.0.1	bodaciousbabette.com
127.0.0.1	boobdoll.com
127.0.0.1	boobsandtits.com
127.0.0.1	boobsclub.com
127.0.0.1	boredlife.com
127.0.0.1	bowlofogumbo.com
127.0.0.1	bradcoem.org
127.0.0.1	brandiyoung.com
127.0.0.1	brookeburn.com
127.0.0.1	bucps.com
127.0.0.1	burgerkingbigscreen.com
127.0.0.1	buscards.net
127.0.0.1	bustyrussell.com
127.0.0.1	buttejazz.org
127.0.0.1	buyselldomain.net
127.0.0.1	calcioturris.com
127.0.0.1	camup.net
127.0.0.1	canberracricketcoaching.com
127.0.0.1	candycantaloupes.com
127.0.0.1	cantfind.com
127.0.0.1	careers.dulcineasystems.net
127.0.0.1	carsands.com
127.0.0.1	carsrentals.net
127.0.0.1	casino.com.free.game.pogo.gratisdownloads.nl
127.0.0.1	casino2win.net
127.0.0.1	casino-gambling-1.net
127.0.0.1	casino-gambling-2.net
127.0.0.1	casinomidas.net
127.0.0.1	casinonline.net
127.0.0.1	casino-onlines.net
127.0.0.1	catallogue.com
127.0.0.1	catsss.da.ru
127.0.0.1	caxa.ru
127.0.0.1	cc.panet.org
127.0.0.1	ccecaedbebfcaf.com
127.0.0.1	www.ccecaedbebfcaf.com
127.0.0.1	cclebali.org
127.0.0.1	ceewawires.org
127.0.0.1	certumgroup.com
127.0.0.1	chelancatering.com
127.0.0.1	childrenvilla.com
127.0.0.1	chips-4-free.com
127.0.0.1	chrisswasey.com
127.0.0.1	chriswallace.net
127.0.0.1	ckick4thumbs.com
127.0.0.1	clackamasliteraryreview.com
127.0.0.1	clearsearch.cc
127.0.0.1	clearsearch.net
127.0.0.1	clickaire.com
127.0.0.1	click-now.net
127.0.0.1	clickyestoenter.net
127.0.0.1	clrsch.com
127.0.0.1	cmtapestry.com
127.0.0.1	coolfetishsite.com
127.0.0.1	coolfreehost.com
127.0.0.1	coolfreepage.com
127.0.0.1	coolfreepages.com
127.0.0.1	cool-homepage.co
127.0.0.1	cool-homepage.com
127.0.0.1	coolmoneysearch.com
127.0.0.1	coolpornsearch.com
127.0.0.1	cool-search.net
127.0.0.1	cool-search.netfartpost.com
127.0.0.1	coolsearcher.info
127.0.0.1	coolservecorp.net
127.0.0.1	www.coolservecorp.net
127.0.0.1	coolwebsearch.com
127.0.0.1	www.coolwebsearch.com
127.0.0.1	cool-web-search.com
127.0.0.1	coolwebsearsh.com
127.0.0.1	coolwwwsearch.com
127.0.0.1	www.coolwwwsearch.com
127.0.0.1	copmtraine.com
127.0.0.1	couldnotfind.com
127.0.0.1	count.cc
127.0.0.1	count-all.com
127.0.0.1	cracks.me.uk
127.0.0.1	creamedcutties.com
127.0.0.1	creditsearchonline.com
127.0.0.1	crestring.com
127.0.0.1	crooder.com
127.0.0.1	curvedspaces.com
127.0.0.1	cvs.jps.ru
127.0.0.1	cvsymphony.com
127.0.0.1	cydom.com
127.0.0.1	daily-gals.com
127.0.0.1	dancingbabycd.com
127.0.0.1	datanotary.com
127.0.0.1	datareco.com
127.0.0.1	davemarshall.org
127.0.0.1	db105.com
127.0.0.1	dcfitusa.com
127.0.0.1	defaultsearch.net
127.0.0.1	derklaif.biz
127.0.0.1	www.derklaif.biz
127.0.0.1	desarrollocreativo.com
127.0.0.1	dev.ntcor.com
127.0.0.1	develip.com
127.0.0.1	dewis.spb.ru
127.0.0.1	dewis.us
127.0.0.1	df809jow4wj2304lfd0sf9fsd0a2t4ldf809jow4wj2304lfd0sf9fsd0a2t4ld.biz
127.0.0.1	dietpills4free.com
127.0.0.1	dietpussy.com
127.0.0.1	digistreamsa.com
127.0.0.1	dionforvalleycouncil.org
127.0.0.1	dnl.mabou.org
127.0.0.1	doctorwaldron.com
127.0.0.1	document-not-found.pornpic.org
127.0.0.1	doggyaction.com
127.0.0.1	domains2003.net
127.0.0.1	domains-for-you-online.com
127.0.0.1	domain-your-registration.com
127.0.0.1	domkrat.com
127.0.0.1	download.secureyournet.biz
127.0.0.1	www.download.secureyournet.biz
127.0.0.1	dp-host.com
127.0.0.1	dragqueen.gay-clan.com
127.0.0.1	drug-sources-exposed.com
127.0.0.1	drvvv.com
127.0.0.1	dulcineasystems.net
127.0.0.1	dutch-sex.com
127.0.0.1	dvdbank.org
127.0.0.1	eases.net
127.0.0.1	easyantispy.com
127.0.0.1	easycategories.com
127.0.0.1	easy-search.net
127.0.0.1	easysearchingtips.com
127.0.0.1	ecosrioplatenses.org
127.0.0.1	ecstasyporn.net
127.0.0.1	eikokoike.com
127.0.0.1	e-localad.com
127.0.0.1	enjoywebsurf.com
127.0.0.1	e-plus.cc
127.0.0.1	epornsex.com
127.0.0.1	euuu.com
127.0.0.1	evidence-detector.biz
127.0.0.1	evilspidercomics.com
127.0.0.1	evko.biz
127.0.0.1	www.evko.biz
127.0.0.1	ewebsearch.net
127.0.0.1	e-websitesolutions.com
127.0.0.1	ewizard.cc
127.0.0.1	exaccess.ru
127.0.0.1	www.exaccess.ru
127.0.0.1	excellentsckin.com
127.0.0.1	extremeseek.net
127.0.0.1	faithstevens.com
127.0.0.1	fantasiewelten.com
127.0.0.1	farmsteadbandb.com
127.0.0.1	fartpost.com
127.0.0.1	fastwebfinder.com
127.0.0.1	faxporn.com
127.0.0.1	fhg.panet.org
127.0.0.1	finance-loans.com
127.0.0.1	find4u.net
127.0.0.1	find-itnow.com
127.0.0.1	findit-now.com
127.0.0.1	findloss.com
127.0.0.1	findthesite.com
127.0.0.1	find-uk-health.co.uk
127.0.0.1	fine-search.net
127.0.0.1	fionasteel.com
127.0.0.1	firstbookmark.net
127.0.0.1	fitness-free.com
127.0.0.1	foodvacations.net
127.0.0.1	forex.jps.ru
127.0.0.1	forexcredit.com
127.0.0.1	forexcredit.ru
127.0.0.1	formingfusions.com
127.0.0.1	forsythfire.net
127.0.0.1	forthline.com
127.0.0.1	free4porno.net
127.0.0.1	free64all.com
127.0.0.1	freebookmark.net
127.0.0.1	freebookmarks.net
127.0.0.1	freecategories.com
127.0.0.1	free-chipes.com
127.0.0.1	freecoolhost.com
127.0.0.1	free-hit.com
127.0.0.1	free-pics-and-movies.com
127.0.0.1	freerbhost.com
127.0.0.1	free-sex-movie-clips.net
127.0.0.1	freeshemalepics.net
127.0.0.1	freeyaho.com
127.0.0.1	freshseek.com
127.0.0.1	freshteensite.com
127.0.0.1	full-search.net
127.0.0.1	funny-girls.com
127.0.0.1	ga31.com
127.0.0.1	gabrielscott.com
127.0.0.1	galpostgirls.com
127.0.0.1	gals-for-free.com
127.0.0.1	gambling-online4you.com
127.0.0.1	gameterror.net
127.0.0.1	gay50.com
127.0.0.1	gay-clan.com
127.0.0.1	generalsmeltingofcanada.com
127.0.0.1	geteens.com
127.0.0.1	getpicshere.com
127.0.0.1	gimmezamore.com
127.0.0.1	gimnasiaer.com
127.0.0.1	girls4rent.net
127.0.0.1	girls-porn-life.com
127.0.0.1	glbdf.org
127.0.0.1	global-finder.com
127.0.0.1	globe-finder.cc
127.0.0.1	globe-finder.com
127.0.0.1	globesearch.com
127.0.0.1	www.globesearch.com
127.0.0.1	go2-search.com
127.0.0.1	gocybersearch.com
127.0.0.1	golftennis.net
127.0.0.1	good-mortgages.net
127.0.0.1	good-mortgages-calculator.com
127.0.0.1	goodsexs.com
127.0.0.1	google.panet.org
127.0.0.1	googlebar.jps.ru
127.0.0.1	googlf.com
127.0.0.1	gradforum.org
127.0.0.1	gratisdownloads.nl
127.0.0.1	gratis-porn-movie.com
127.0.0.1	gratis-pornopics.com
127.0.0.1	guzzycats.com
127.0.0.1	gzphoenix.com
127.0.0.1	hallnetaccolade.com
127.0.0.1	hand-book.com
127.0.0.1	happyanal.com
127.0.0.1	hardbodytgp.com
127.0.0.1	hardcoreover.com
127.0.0.1	hard-gals.com
127.0.0.1	hardloved.com
127.0.0.1	hardwareseek.net
127.0.0.1	harukaigawa.com
127.0.0.1	havy.biz
127.0.0.1	hccsolanonapa.org
127.0.0.1	health-protein.com
127.0.0.1	hentai4u.net
127.0.0.1	here4search.com
127.0.0.1	heyrichy.com
127.0.0.1	hi.studioaperto.net
127.0.0.1	www.hi.studioaperto.net
127.0.0.1	hiddenguides.com
127.0.0.1	himen.biz
127.0.0.1	hi-search.com
127.0.0.1	hitlistlyrics.com
127.0.0.1	holidayautostr.com
127.0.0.1	homemortage.ws
127.0.0.1	hostssp.com
127.0.0.1	hotbookmark.com
127.0.0.1	hot-cartoon-sex.anime.american-teens.net
127.0.0.1	hotels-list.net
127.0.0.1	hotelxxxcams.com
127.0.0.1	hotfreebies.com
127.0.0.1	www.hotfreebies.com
127.0.0.1	hotpopup.com
127.0.0.1	hotsearchbox.com
127.0.0.1	hotsex-series.com
127.0.0.1	hotstartpage.com
127.0.0.1	hqsex.biz
127.0.0.1	hugeporn4u.net
127.0.0.1	hunacsa.com
127.0.0.1	hupacasath.com
127.0.0.1	hzsx.com
127.0.0.1	icansearch.net
127.0.0.1	iefeadsl.com
127.0.0.1	ie-search.com
127.0.0.1	incestporngate.com
127.0.0.1	infodigger.net
127.0.0.1	infoglobus.com
127.0.0.1	inherhole.com
127.0.0.1	insertthiscock.com
127.0.0.1	insuranceall.net
127.0.0.1	insurance-flood.net
127.0.0.1	internetsearch.ru
127.0.0.1	ionichost.com
127.0.0.1	ionomist.com
127.0.0.1	ipsex.net
127.0.0.1	itsanal.com
127.0.0.1	itseasy.us
127.0.0.1	iweb-commerce.com
127.0.0.1	iwebland.com
127.0.0.1	jeannineoldfield.com
127.0.0.1	jetseeker.com
127.0.0.1	jmhgallery.org
127.0.0.1	joannelatham.com
127.0.0.1	jps.ru
127.0.0.1	judin.ru
127.0.0.1	junkysex.com
127.0.0.1	karleyt.narod.ru
127.0.0.1	kathisomers.com
127.0.0.1	kazaa-lite.ws
127.0.0.1	keithgreenpro.com
127.0.0.1	kenmccaul.com
127.0.0.1	kilosex.com
127.0.0.1	kimhines.com
127.0.0.1	kinoru.com
127.0.0.1	ksdspups.org
127.0.0.1	landrape.com
127.0.0.1	lauraroebuck.com
127.0.0.1	lavasoftupdate.com
127.0.0.1	www.lavasoftupdate.com
127.0.0.1	leannalovelace.com
127.0.0.1	lesobank.ru
127.0.0.1	libertyonlinehosting.com
127.0.0.1	lingerie-mania.com
127.0.0.1	lisamatthew.com
127.0.0.1	livegambling.com
127.0.0.1	liveholio.com
127.0.0.1	livenewspaper.com
127.0.0.1	lookfor.cc
127.0.0.1	looking-for.cc
127.0.0.1	louiseleeds.com
127.0.0.1	lovelas.com
127.0.0.1	lovelysearch.com
127.0.0.1	love-pix.com
127.0.0.1	low-taxes.com
127.0.0.1	luckysearch.net
127.0.0.1	lunitaweb.net
127.0.0.1	lustful-porno.com
127.0.0.1	mabou.org
127.0.0.1	www.mabou.org
127.0.0.1	mackinnonsbrook.org
127.0.0.1	madfinder.com
127.0.0.1	madisonmoons.com
127.0.0.1	madisonoilco.com
127.0.0.1	madonalive.com
127.0.0.1	majuozawa.com
127.0.0.1	makin-do.com
127.0.0.1	male4free.com
127.0.0.1	map-quest.org
127.0.0.1	marilynchamber.com
127.0.0.1	martfinder.com
127.0.0.1	massearch.com
127.0.0.1	matetrava.com
127.0.0.1	mature50.com
127.0.0.1	matureporngate.com
127.0.0.1	maxdzines.com
127.0.0.1	mcgeeforlabor.com
127.0.0.1	mdstunisie.org
127.0.0.1	medicare-insurance.net
127.0.0.1	medicare-supplemental.com
127.0.0.1	mega-dating-tips.com
127.0.0.1	megumikanzaki.com
127.0.0.1	meshalynn.com
127.0.0.1	meta-adult.com
127.0.0.1	meta-casino.com
127.0.0.1	metafora.ru
127.0.0.1	meta-mobile.com
127.0.0.1	metapoisk.ru
127.0.0.1	meta-porn.com
127.0.0.1	michiyonakajima.com
127.0.0.1	miconsultamedica.com
127.0.0.1	mikasakamoto.com
127.0.0.1	mikoni.com
127.0.0.1	militarygods.porn4porn.net
127.0.0.1	millennialpeople.org
127.0.0.1	mipham.org
127.0.0.1	missingcommand.com
127.0.0.1	mommykiss.com
127.0.0.1	moneyhunters.com
127.0.0.1	montgomeryhospitalanesthesia.com
127.0.0.1	morflot.com
127.0.0.1	mortgage-debt.net
127.0.0.1	mortismaximus.com
127.0.0.1	moscowwhores.com
127.0.0.1	moviecategories.com
127.0.0.1	mp3-pix.com
127.0.0.1	mpeg-look.com
127.0.0.1	mrtg.jps.ru
127.0.0.1	msnguard.cc
127.0.0.1	msn-info.net
127.0.0.1	multipussy.com
127.0.0.1	mundopolar.com
127.0.0.1	mustv.com
127.0.0.1	mywebsearch.net
127.0.0.1	nativehardcore.com
127.0.0.1	naturalspy.com
127.0.0.1	nav.mabou.org
127.0.0.1	nbasportsbook.net
127.0.0.1	nellyslyrics.com
127.0.0.1	nepgyan.com
127.0.0.1	nesrecords.com
127.0.0.1	net.mabou.org
127.0.0.1	net.xibu315.com
127.0.0.1	netfartpost.com
127.0.0.1	netshastra.net
127.0.0.1	nettime.ru
127.0.0.1	nettracker.jps.ru
127.0.0.1	netyellowpages.info
127.0.0.1	nevest.net
127.0.0.1	newcategories.com
127.0.0.1	newcracks.com
127.0.0.1	newcracks.net
127.0.0.1	new-incest.com
127.0.0.1	newlife-lajolla.com
127.0.0.1	new-search.net
127.0.0.1	newsexgate.com
127.0.0.1	newtonsracks.com
127.0.0.1	newxpics.com
127.0.0.1	nhlsportsbook.net
127.0.0.1	niagaracapital.com
127.0.0.1	niche-tv.com
127.0.0.1	nmrba.com
127.0.0.1	noblindlinks.com
127.0.0.1	www.noblindlinks.com
127.0.0.1	nocalories.net
127.0.0.1	nocensor.com
127.0.0.1	noproblemsurf.com
127.0.0.1	nsbabes.com
127.0.0.1	ntcor.com
127.0.0.1	www.ntcor.com
127.0.0.1	nuclearwitness.org
127.0.0.1	n-udd.com
127.0.0.1	nursemania.com
127.0.0.1	nvntour.com
127.0.0.1	nvphall.org
127.0.0.1	oborot.com
127.0.0.1	ocalalivestockmarket.com
127.0.0.1	ocsff.com
127.0.0.1	oeatlanta.com
127.0.0.1	oharrowsearch.com
127.0.0.1	ok-search.com
127.0.0.1	okulta.com
127.0.0.1	omegabrains.net
127.0.0.1	onemoresearch.net
127.0.0.1	online-casino-1.net
127.0.0.1	online-casino-bonus.info
127.0.0.1	online-casinos-x.com
127.0.0.1	onlineserverz.com
127.0.0.1	onlinetradings.net
127.0.0.1	online-winning.net
127.0.0.1	onlycunt.com
127.0.0.1	onlyinsured.com
127.0.0.1	operanabuco.com
127.0.0.1	opsex.com
127.0.0.1	oregoncharters.org
127.0.0.1	ormandcompany.com
127.0.0.1	otrlives.com
127.0.0.1	ozawamadoka.com
127.0.0.1	paigesummer.com
127.0.0.1	pamelacollections.com
127.0.0.1	panamcup.com
127.0.0.1	panet.org
127.0.0.1	www.panet.org
127.0.0.1	pantygirls4u.com
127.0.0.1	pantyhoserealm.com
127.0.0.1	pantyplace.com
127.0.0.1	pastubes.com
127.0.0.1	paulapage.com
127.0.0.1	paulhoover.com
127.0.0.1	payfortraffic.net
127.0.0.1	pcspyremover.com
127.0.0.1	pedo.ws
127.0.0.1	people.1gb.ru
127.0.0.1	pervertbot.com
127.0.0.1	pharmacy2003.com
127.0.0.1	pharma-diet-pills.com
127.0.0.1	pharmalocator.com
127.0.0.1	phendimetrazine-tenuate-adipex.com
127.0.0.1	picsdir.com
127.0.0.1	picsforbucks.com
127.0.0.1	picsofseductiveladies.com
127.0.0.1	pics-videos.com
127.0.0.1	picture-posters.com
127.0.0.1	pills-birth-control.com
127.0.0.1	pillsmall.com
127.0.0.1	pilotronix.com
127.0.0.1	pixpox.com
127.0.0.1	planemusic.com
127.0.0.1	poiska.net
127.0.0.1	poker-casino-free.com
127.0.0.1	poker-games-free.net
127.0.0.1	polradiologia.com
127.0.0.1	pooi.net
127.0.0.1	porn4porn.net
127.0.0.1	porncamz.com
127.0.0.1	pornfree.info
127.0.0.1	pornnightdreams.com
127.0.0.1	pornokopec.com
127.0.0.1	pornpic.org
127.0.0.1	porn-screen.com
127.0.0.1	porn-teacher.com
127.0.0.1	porntetris.com
127.0.0.1	porntwist.com
127.0.0.1	powerwebsearch.com
127.0.0.1	prblitz.com
127.0.0.1	pretypics.com
127.0.0.1	pribalt.com
127.0.0.1	privacy-support.biz
127.0.0.1	privateporn.net
127.0.0.1	prosearching.com
127.0.0.1	www.prosearching.com
127.0.0.1	prostactive.com
127.0.0.1	prostol.com
127.0.0.1	protect-yourself.biz
127.0.0.1	prsainlandempire.org
127.0.0.1	psn.cn
127.0.0.1	put-your-link-here.com
127.0.0.1	p-uud.com
127.0.0.1	pyrocorp.com
127.0.0.1	quick-search.ws
127.0.0.1	quiksearchgenealogy.com
127.0.0.1	r16254.coolservecorp.net
127.0.0.1	rack.cc
127.0.0.1	radfrall.org
127.0.0.1	ramgo.com
127.0.0.1	ranafrog.ne
127.0.0.1	rapegate.com
127.0.0.1	rb37.com
127.0.0.1	redbudbmx.com
127.0.0.1	refinance-help.com
127.0.0.1	removeearthkeepers.org
127.0.0.1	rf104.com
127.0.0.1	rightfinder.net
127.0.0.1	robbsproshop.com
127.0.0.1	robertferencz.com
127.0.0.1	rotocasters.com
127.0.0.1	royalsearch.net
127.0.0.1	runsearch.com
127.0.0.1	russiansponsor.com
127.0.0.1	russogay.com
127.0.0.1	s2.exocrew.com
127.0.0.1	sacitylife.com
127.0.0.1	samplegals.com
127.0.0.1	sbssurvivor.com
127.0.0.1	scarypix.com
127.0.0.1	sccdnet.com
127.0.0.1	schoolforest.com
127.0.0.1	search.psn.cn
127.0.0.1	search.xrenoder.com
127.0.0.1	search-1.net
127.0.0.1	search-2003.com
127.0.0.1	search-777.com
127.0.0.1	search-about.net
127.0.0.1	searchadultweb.com
127.0.0.1	searchbutler.com
127.0.0.1	searchbutler.org
127.0.0.1	searchbuttler.com
127.0.0.1	searchclick.cc
127.0.0.1	searchcomplete.com
127.0.0.1	searchdesire.com
127.0.0.1	searchdot.net
127.0.0.1	searchexpander.com
127.0.0.1	searchfastnet.com
127.0.0.1	searchforge.com
127.0.0.1	search-hawk.com
127.0.0.1	searching-the-net.com
127.0.0.1	search-log.com
127.0.0.1	search-meta.com
127.0.0.1	searchmeta.md
127.0.0.1	searchmeta.net
127.0.0.1	www.searchmeta.net
127.0.0.1	searchmeta.ru
127.0.0.1	searchmeta.webhost.ru
127.0.0.1	search-motor.com
127.0.0.1	searchnow.ws
127.0.0.1	searchonfly.com
127.0.0.1	search-safe.com
127.0.0.1	search-to-find.com
127.0.0.1	SEARCHTOFIND.NET
127.0.0.1	www.SEARCHTOFIND.NET
127.0.0.1	search-what.net
127.0.0.1	searchwhatuwant.com
127.0.0.1	searchxp.com
127.0.0.1	sebot.com
127.0.0.1	securenp.org
127.0.0.1	secureyournet.biz
127.0.0.1	www.secureyournet.biz
127.0.0.1	security-warning.biz
127.0.0.1	seehardcore.com
127.0.0.1	seekwell.net
127.0.0.1	selfbookmark.com
127.0.0.1	selfbookmark.info
127.0.0.1	selfbookmark.net
127.0.0.1	sex.free4porno.net
127.0.0.1	sex-coach.com
127.0.0.1	sex-festival.com
127.0.0.1	sexgalleries4all.com
127.0.0.1	sexmoviesnet.com
127.0.0.1	sexpatriot.net
127.0.0.1	sexpornonline.com
127.0.0.1	sex-video-galleries.com
127.0.0.1	sexy18.cc
127.0.0.1	sexycat.adult-host.org
127.0.0.1	sfbayfolkboats.com
127.0.0.1	sgirls.net
127.0.0.1	sharempeg.com
127.0.0.1	shopcards.net
127.0.0.1	shopknights.com
127.0.0.1	sic02.com
127.0.0.1	sintrader.com
127.0.0.1	site1.ru
127.0.0.1	sites-in-web.com
127.0.0.1	sitevictoria.com
127.0.0.1	sixroads.com
127.0.0.1	skakalka.ru
127.0.0.1	slawsearch.com
127.0.0.1	smartsumo.com
127.0.0.1	smutarchive.net
127.0.0.1	solongas.com
127.0.0.1	sonomaevents.com
127.0.0.1	spermatrix.com
127.0.0.1	sportbooks-free4you.com
127.0.0.1	spros.com
127.0.0.1	spyass.com
127.0.0.1	spybotremover.net
127.0.0.1	spyorgy.net
127.0.0.1	ss.panet.org
127.0.0.1	staceyowens.com
127.0.0.1	stacistaxx.com
127.0.0.1	stacystaxx.com
127.0.0.1	start-space.com
127.0.0.1	steamycock.com
127.0.0.1	sterva.com
127.0.0.1	stevecashdollar.com
127.0.0.1	stop-tracking.biz
127.0.0.1	stopvotefraud.com
127.0.0.1	stopxxxpics.com
127.0.0.1	strekoza.com
127.0.0.1	studioaperto.net
127.0.0.1	stuffstore.com
127.0.0.1	styleclickink.com
127.0.0.1	summercollins.com
127.0.0.1	summitcross.com
127.0.0.1	supersexmachine.com
127.0.0.1	superwebsearch.com
127.0.0.1	super-websearch.com
127.0.0.1	supret.com
127.0.0.1	suzannebrecht.com
127.0.0.1	sweeteenz.com
127.0.0.1	t.rack.cc
127.0.0.1	t058.com
127.0.0.1	tacil.org
127.0.0.1	tangounion.com
127.0.0.1	tastethemusic.com
127.0.0.1	tax-refund4you.com
127.0.0.1	tech-jobs.ws
127.0.0.1	technology-related.com
127.0.0.1	teen-biz.com
127.0.0.1	teen-pic-post.com
127.0.0.1	teenpornosex.com
127.0.0.1	teens4free.net
127.0.0.1	teensact.com
127.0.0.1	teensgate.com
127.0.0.1	teensguru.com
127.0.0.1	teenswamp.com
127.0.0.1	testosterone-birth-control.com
127.0.0.1	tgp-4-you.com
127.0.0.1	the-exit.com
127.0.0.1	thefakejournal.com
127.0.0.1	the-huns-yellow-pages.com
127.0.0.1	thehuy.net
127.0.0.1	theproxy.org
127.0.0.1	therealsearch.com
127.0.0.1	thesten.com
127.0.0.1	thornleygroup.com
127.0.0.1	tings.org
127.0.0.1	tinybar.com
127.0.0.1	titanvision.com
127.0.0.1	titsianna.com
127.0.0.1	tit-x.com
127.0.0.1	toddhayes.com
127.0.0.1	toolbar.cc
127.0.0.1	toolbarbucks.biz
127.0.0.1	www.toolbarbucks.biz
127.0.0.1	toon-comics.com
127.0.0.1	topx.cc
127.0.0.1	trackhits.cc
127.0.0.1	tracktraff.cc
127.0.0.1	traff5all.biz
127.0.0.1	www.traff5all.biz
127.0.0.1	trafficback.com
127.0.0.1	trafficswitcher.com
127.0.0.1	travel.picture-posters.com
127.0.0.1	true-counter.com
127.0.0.1	www.true-counter.com
127.0.0.1	true-portal.com
127.0.0.1	trytechnical.com
127.0.0.1	u-239.com
127.0.0.1	u45.cx
127.0.0.1	u46.cx
127.0.0.1	u47.cc
127.0.0.1	u48.cc
127.0.0.1	ufindall.click-now.net
127.0.0.1	umaxsearch.com
127.0.0.1	une-autre-france.com
127.0.0.1	unigays.com
127.0.0.1	unipages.cc
127.0.0.1	up2you.ru
127.0.0.1	uralitel.ru
127.0.0.1	urlstat.com
127.0.0.1	urlstat.ru
127.0.0.1	ursie.net
127.0.0.1	usefullsoft.net
127.0.0.1	utahsweet.com
127.0.0.1	utopicportal.com
127.0.0.1	uusocialjustice.org
127.0.0.1	uydsiygeds.com
127.0.0.1	www.uydsiygeds.com
127.0.0.1	v-224.com
127.0.0.1	v61.com
127.0.0.1	www.v61.com
127.0.0.1	vaginpics.com
127.0.0.1	valmyers.com
127.0.0.1	vegas-free.com
127.0.0.1	vegbuy.com
127.0.0.1	veloventures.com
127.0.0.1	veryeasysearch.com
127.0.0.1	verzila.com
127.0.0.1	victoriaadam.com
127.0.0.1	videocategories.com
127.0.0.1	vipru.com
127.0.0.1	www.vipru.com
127.0.0.1	vitamins-for-each.com
127.0.0.1	votehowe.org
127.0.0.1	vxebony.com
127.0.0.1	wakeupdick.com
127.0.0.1	warnomore.org
127.0.0.1	watersport-specialties.com
127.0.0.1	webcoolsearch.com
127.0.0.1	web-homepage.net
127.0.0.1	web-search.tk
127.0.0.1	websearchdot.com
127.0.0.1	weekend-movies.com
127.0.0.1	wetpornostars.com
127.0.0.1	whatsyoursearch.com
127.0.0.1	white-pages.ws
127.0.0.1	whittierblvd.com
127.0.0.1	win-in-casino.com
127.0.0.1	winmsn.com
127.0.0.1	winprotect.net
127.0.0.1	winshow.biz
127.0.0.1	wiresearch.com
127.0.0.1	wolfpacracing.com
127.0.0.1	wordlist.jps.ru
127.0.0.1	wpc2001.org
127.0.0.1	wspzone.sexpornonline.com
127.0.0.1	wwwbet.net
127.0.0.1	wwwbetting.net
127.0.0.1	wwwpokergames.com
127.0.0.1	wwwpokerplayers.com
127.0.0.1	wwwroulette.net
127.0.0.1	xcomics4u.com
127.0.0.1	x-google.net
127.0.0.1	www.xibu315.com
127.0.0.1	xibu315.com
127.0.0.1	xic-bs.com
127.0.0.1	xldr.com
127.0.0.1	x-library.com
127.0.0.1	xp18.com
127.0.0.1	www.xrenoder.com
127.0.0.1	xrenoder.com
127.0.0.1	xrenosearch.com
127.0.0.1	xtragay.com
127.0.0.1	xu.pl
127.0.0.1	xu.xu.pl
127.0.0.1	x-webdesign.com
127.0.0.1	www.xwebsearch.biz
127.0.0.1	xwebsearch.biz
127.0.0.1	xxxcategories.com
127.0.0.1	xxxemailxxx.com
127.0.0.1	yahoo.panet.org
127.0.0.1	y-e-l-l-o-w.com
127.0.0.1	yellow500.com
127.0.0.1	yezol.com
127.0.0.1	youfindall.com
127.0.0.1	youfindall.net
127.0.0.1	yourbookmarks.info
127.0.0.1	yourbookmarks.ws
127.0.0.1	your-prescriptions.net
127.0.0.1	you-search.com.ru
127.0.0.1	you-search.com
127.0.0.1	ypir.com
127.0.0.1	ysa-info.net
127.0.0.1	yukohamano.com
127.0.0.1	ywebsearch.info
127.0.0.1	zapros.com
127.0.0.1	www.zelaznyworld.com
127.0.0.1	zelaznyworld.com
127.0.0.1	zesearch.com
127.0.0.1	ziportal.com
127.0.0.1	zipportal.com
127.0.0.1	www.znext.com
127.0.0.1	znext.com
127.0.0.1	zoneoffreeporn.com
127.0.0.1	zoomegasite.com
127.0.0.1	zvimigdal.com
127.0.0.1	zyban-zocor-levitra.com
127.0.0.1	idgsearch.com
127.0.0.1	cameup.com
127.0.0.1	kliksearch.com
127.0.0.1	searchmeup.com
127.0.0.1	msupdate.net
127.0.0.1	www.msupdate.net
127.0.0.1	redirect.msupdate.net
127.0.0.1	omega-search.com
127.0.0.1	adaware.cc
127.0.0.1	ad-ware.cc
127.0.0.1	count.hitscount.net
127.0.0.1	dl.ad-ware.cc
127.0.0.1	downloads.adaware.cc
127.0.0.1	fined.biz
127.0.0.1	hitscount.net
127.0.0.1	magicsearch.ws
127.0.0.1	www.magicsearch.ws
127.0.0.1	aulde.net
127.0.0.1	www.aulde.net
127.0.0.1	searchdrive.info
127.0.0.1	wwwsearchdrive.info
127.0.0.1	tooncomics.com
127.0.0.1	hervam.com
127.0.0.1	www.hervam.com
127.0.0.1	komforochka.info
127.0.0.1	www.komforochka.info
127.0.0.1	nunah.info
127.0.0.1	www.nunah.info
127.0.0.1	vother.info
127.0.0.1	www.vother.info
127.0.0.1	wm.komforochka.info
127.0.0.1	www.wm.komforochka.info
127.0.0.1	wm.vother.info
127.0.0.1	www.wm.vother.info
127.0.0.1	cool-xxx.net
127.0.0.1	www.cantfind.com
127.0.0.1	crazywinnings.com
127.0.0.1	www.crazywinnings.com
127.0.0.1	frame.crazywinnings.com
127.0.0.1	topconverting.com
127.0.0.1	www.topconverting.com
127.0.0.1	crystalysmedia.com
127.0.0.1	www.crystalysmedia.com
127.0.0.1	curepcsolutions.com
127.0.0.1	www.curepcsolutions.com
127.0.0.1	pcflashsoft.com
127.0.0.1	www.pcflashsoft.com
127.0.0.1	spylog.com
127.0.0.1	www.spylog.com
127.0.0.1	game4all.biz
127.0.0.1	www.game4all.biz
127.0.0.1	canidetect.org
127.0.0.1	www.canidetect.org
127.0.0.1	ebestfind.org
127.0.0.1	www.ebestfind.org
127.0.0.1	findanyshow.org
127.0.0.1	www.findanyshow.org
127.0.0.1	findwapsite.org
127.0.0.1	www.findwapsite.org
127.0.0.1	itfindout.org
127.0.0.1	www.itfindout.org
127.0.0.1	nowsearchonline.org
127.0.0.1	www.nowsearchonline.org
127.0.0.1	asianpornmag.com
127.0.0.1	www.asianpornmag.com
127.0.0.1	ebony-pornmag.com
127.0.0.1	www.ebony-pornmag.com
127.0.0.1	lesbianspornmag.com
127.0.0.1	www.lesbianspornmag.com
127.0.0.1	nylonpornmag.com
127.0.0.1	www.nylonpornmag.com
127.0.0.1	shemalespornmag.com
127.0.0.1	www.shemalespornmag.com
127.0.0.1	asiantoolbar.com
127.0.0.1	www.asiantoolbar.com
127.0.0.1	dailytoolbar.com
127.0.0.1	www.dailytoolbar.com
127.0.0.1	maturetoolbar.com
127.0.0.1	www.maturetoolbar.com
127.0.0.1	revolto3.da.ru
127.0.0.1	dating-search.net
127.0.0.1	andromedical.com
127.0.0.1	www.andromedical.com
127.0.0.1	deskbar.worldtostart.com
127.0.0.1	www.deskbar.worldtostart.com
127.0.0.1	worldtostart.com
127.0.0.1	www.worldtostart.com
127.0.0.1	dialer-shop.com
127.0.0.1	www.dialer-shop.com
127.0.0.1	dialoff.com
127.0.0.1	www.dialoff.com
127.0.0.1	5starvideos.com
127.0.0.1	www.5starvideos.com
127.0.0.1	digikeygen.com
127.0.0.1	www.digikeygen.com
127.0.0.1	moviereality.com
127.0.0.1	www.moviereality.com
127.0.0.1	securityindex.net
127.0.0.1	www.securityindex.net
127.0.0.1	sexpicsporn.com
127.0.0.1	www.sexpicsporn.com
127.0.0.1	dcdl.dmcast.com
127.0.0.1	dcww.dmcast.com
127.0.0.1	dmcast.com
127.0.0.1	www.dmcast.com
127.0.0.1	dudu.com
127.0.0.1	www.dudu.com
127.0.0.1	ibm.dmcast.com
127.0.0.1	ulink13.dudu.com
127.0.0.1	ulink7.dudu.com
127.0.0.1	wazzupnet.com
127.0.0.1	www.wazzupnet.com
127.0.0.1	dotcomtoolbar.com
127.0.0.1	www.dotcomtoolbar.com
127.0.0.1	easywww.info
127.0.0.1	www.easywww.info
127.0.0.1	search.findthewebsiteyouneed.com
127.0.0.1	www.search.findthewebsiteyouneed.com
127.0.0.1	linksummary.com
127.0.0.1	downloadmax.net
127.0.0.1	www.downloadmax.net
127.0.0.1	flrxtools.greatnuke.com
127.0.0.1	flrx-tools.net
127.0.0.1	www.flrx-tools.net
127.0.0.1	de.drivecleaner.com
127.0.0.1	fr.drivecleaner.com
127.0.0.1	www.fr.drivecleaner.com
127.0.0.1	gomyron.com
127.0.0.1	www.gomyron.com
127.0.0.1	helpyourpcnow.com
127.0.0.1	www.helpyourpcnow.com
127.0.0.1	best-targeted-traffic.com
127.0.0.1	www.best-targeted-traffic.com
127.0.0.1	www.xsec.org
127.0.0.1	xsec.org
127.0.0.1	wanfuchina.com
127.0.0.1	www.wanfuchina.com
127.0.0.1	www.zxlinks.com
127.0.0.1	zxlinks.com
127.0.0.1	duolaimi.net
127.0.0.1	cdn.movies-etc.com
127.0.0.1	cdn2.movies-etc.com
127.0.0.1	internet-optimizer.com
127.0.0.1	www.internet-optimizer.com
127.0.0.1	movies-etc.com
127.0.0.1	www.yoogee.com
127.0.0.1	yoogee.com
127.0.0.1	de.ag
127.0.0.1	games.de.ag
127.0.0.1	www.games.de.ag
127.0.0.1	little-download.net
127.0.0.1	www.little-download.net
127.0.0.1	little-help.com
127.0.0.1	www.little-help.com
127.0.0.1	toolbarbest.biz
127.0.0.1	www.toolbarbest.biz
127.0.0.1	1800searchonline.com
127.0.0.1	www.1800searchonline.com
127.0.0.1	1stsearchportal.com
127.0.0.1	www.1stsearchportal.com
127.0.0.1	24-7searching-and-more.com
127.0.0.1	www.24-7searching-and-more.com
127.0.0.1	971searchbox.com
127.0.0.1	www.971searchbox.com
127.0.0.1	aaawebfinder.com
127.0.0.1	www.aaawebfinder.com
127.0.0.1	adshttp.com
127.0.0.1	www.adshttp.com
127.0.0.1	adsonwww.com
127.0.0.1	www.adsonwww.com
127.0.0.1	ampmsearch.com
127.0.0.1	www.ampmsearch.com
127.0.0.1	clickhere4search.com
127.0.0.1	www.clickhere4search.com
127.0.0.1	clicktomakeasearch.com
127.0.0.1	www.clicktomakeasearch.com
127.0.0.1	directsearchzone.com
127.0.0.1	www.directsearchzone.com
127.0.0.1	dnaads.com
127.0.0.1	www.dnaads.com
127.0.0.1	easysearch4you.com
127.0.0.1	www.easysearch4you.com
127.0.0.1	enterthesearch.com
127.0.0.1	www.enterthesearch.com
127.0.0.1	esearch2005.com
127.0.0.1	www.esearch2005.com
127.0.0.1	eza1netsearch.com
127.0.0.1	www.eza1netsearch.com
127.0.0.1	ezwebsearching.com
127.0.0.1	www.ezwebsearching.com
127.0.0.1	globalefinder.com
127.0.0.1	www.globalefinder.com
127.0.0.1	go2realsearch.com
127.0.0.1	www.go2realsearch.com
127.0.0.1	httpwwwads.com
127.0.0.1	www.httpwwwads.com
127.0.0.1	msupdater.net
127.0.0.1	www.msupdater.net
127.0.0.1	myseachexplorer.com
127.0.0.1	www.myseachexplorer.com
127.0.0.1	quicksearch360.com
127.0.0.1	www.quicksearch360.com
127.0.0.1	s1s1s1search.com
127.0.0.1	www.s1s1s1search.com
127.0.0.1	search101online.com
127.0.0.1	www.search101online.com
127.0.0.1	search123forme.com
127.0.0.1	www.search123forme.com
127.0.0.1	search345quest.com
127.0.0.1	www.search345quest.com
127.0.0.1	searchmiracle.com
127.0.0.1	www.searchmiracle.com
127.0.0.1	searchtheworld4you.com
127.0.0.1	www.searchtheworld4you.com
127.0.0.1	searchwebzone.com
127.0.0.1	www.searchwebzone.com
127.0.0.1	seektheglobe.com
127.0.0.1	www.seektheglobe.com
127.0.0.1	sitesearchcentral.com
127.0.0.1	www.sitesearchcentral.com
127.0.0.1	the818search-co.com
127.0.0.1	www.the818search-co.com
127.0.0.1	type2find.com
127.0.0.1	www.type2find.com
127.0.0.1	www.xosearchox.com
127.0.0.1	xosearchox.com
127.0.0.1	www.yoursearchspace.com
127.0.0.1	yoursearchspace.com
127.0.0.1	savehits.com
127.0.0.1	www.savehits.com
127.0.0.1	energy-factor.com
127.0.0.1	www.energy-factor.com
127.0.0.1	errorkiller.com
127.0.0.1	www.errorkiller.com
127.0.0.1	bin.errorprotector.com
127.0.0.1	errorprotector.com
127.0.0.1	www.errorprotector.com
127.0.0.1	404dns.com
127.0.0.1	www.404dns.com
127.0.0.1	br.errorsafe.com
127.0.0.1	cdn.errorsafe.com
127.0.0.1	de.errorsafe.com
127.0.0.1	download.cdn.errorsafe.com
127.0.0.1	download.errorsafe.com
127.0.0.1	errorsafe.com
127.0.0.1	www.errorsafe.com
127.0.0.1	errorsdns.com
127.0.0.1	www.errorsdns.com
127.0.0.1	go.errorsafe.com
127.0.0.1	idnserror.com
127.0.0.1	www.idnserror.com
127.0.0.1	iednserror.com
127.0.0.1	www.iednserror.com
127.0.0.1	iesecurepage.com
127.0.0.1	www.iesecurepage.com
127.0.0.1	instlog.errorsafe.com
127.0.0.1	kb.errorsafe.com
127.0.0.1	nl.errorsafe.com
127.0.0.1	se.errorsafe.com
127.0.0.1	secure.errorsafe.com
127.0.0.1	utils.errorsafe.com
127.0.0.1	kr62.com
127.0.0.1	www.kr62.com
127.0.0.1	bullseye-network.com
127.0.0.1	www.bullseye-network.com
127.0.0.1	offers.bullseye-network.com
127.0.0.1	www.offers.bullseye-network.com
127.0.0.1	ezcybersearch.com
127.0.0.1	www.ezcybersearch.com
127.0.0.1	www.jethomepage.com
127.0.0.1	otcmomo.com
127.0.0.1	ez-searching.com
127.0.0.1	geil-de.info
127.0.0.1	www.geil-de.info
127.0.0.1	souljah.com
127.0.0.1	www.souljah.com
127.0.0.1	cameouk.co.uk
127.0.0.1	www.cameouk.co.uk
127.0.0.1	floorsovertexas.com
127.0.0.1	www.floorsovertexas.com
127.0.0.1	graceinthedesert.org
127.0.0.1	www.graceinthedesert.org
127.0.0.1	hiboss.com
127.0.0.1	www.hiboss.com
127.0.0.1	northernsoulclub.com
127.0.0.1	www.northernsoulclub.com
127.0.0.1	oxfordclockrepairs.co.uk
127.0.0.1	www.oxfordclockrepairs.co.uk
127.0.0.1	releaseforlife.com
127.0.0.1	www.releaseforlife.com
127.0.0.1	starcleaningservice.com.au
127.0.0.1	www.starcleaningservice.com.au
127.0.0.1	airtleworld.com
127.0.0.1	www.airtleworld.com
127.0.0.1	domaincar.com
127.0.0.1	www.domaincar.com
127.0.0.1	worldray.com
127.0.0.1	www.worldray.com
127.0.0.1	www5.worldray.com
127.0.0.1	www6.worldray.com
127.0.0.1	lavl-vicky.com
127.0.0.1	www.lavl-vicky.com
127.0.0.1	marketing-know-how.com
127.0.0.1	www.marketing-know-how.com
127.0.0.1	findthewebsiteyouneed.com
127.0.0.1	www.findthewebsiteyouneed.com
127.0.0.1	fixerantispy.com
127.0.0.1	www.fixerantispy.com
127.0.0.1	flashdollars.com
127.0.0.1	www.flashdollars.com
127.0.0.1	signupprocess.com
127.0.0.1	www.signupprocess.com
127.0.0.1	americancarbargains.com
127.0.0.1	www.americancarbargains.com
127.0.0.1	dogproblemswebsite.com
127.0.0.1	www.dogproblemswebsite.com
127.0.0.1	dvdtocdsite.com
127.0.0.1	www.dvdtocdsite.com
127.0.0.1	edietprogram.com
127.0.0.1	www.edietprogram.com
127.0.0.1	extremepaidsurveys.com
127.0.0.1	www.extremepaidsurveys.com
127.0.0.1	hotmp3music.com
127.0.0.1	www.hotmp3music.com
127.0.0.1	sharedgamesite.com
127.0.0.1	www.sharedgamesite.com
127.0.0.1	sharedmoviesite.com
127.0.0.1	www.sharedmoviesite.com
127.0.0.1	sharedtvsite.com
127.0.0.1	www.sharedtvsite.com
127.0.0.1	adwareprotectionsite.com
127.0.0.1	www.adwareprotectionsite.com
127.0.0.1	antivirusprotector.com
127.0.0.1	www.antivirusprotector.com
127.0.0.1	registrycleanersite.com
127.0.0.1	www.registrycleanersite.com
127.0.0.1	spywareremoversite.com
127.0.0.1	www.spywareremoversite.com
127.0.0.1	freehqmovies.com
127.0.0.1	freescratchandwin.com
127.0.0.1	xzoomy.com
127.0.0.1	myfuncards.smileycentral.com
127.0.0.1	www.myfuncards.smileycentral.com
127.0.0.1	smileycentral.com
127.0.0.1	findwhatevernow.com
127.0.0.1	www.findwhatevernow.com
127.0.0.1	fickenisgeil.de
127.0.0.1	www.gocybersearch.com
127.0.0.1	gohip.com
127.0.0.1	www.gohip.com
127.0.0.1	goldengr.hypermart.net
127.0.0.1	antiddos.us
127.0.0.1	www.antiddos.us
127.0.0.1	earthllnk.net
127.0.0.1	www.earthllnk.net
127.0.0.1	getpatytoday.info
127.0.0.1	www.getpatytoday.info
127.0.0.1	my-dedik-one.com
127.0.0.1	www.my-dedik-one.com
127.0.0.1	mayancasino.com
127.0.0.1	hachimitsu-lemon.com
127.0.0.1	www.hachimitsu-lemon.com
127.0.0.1	hardcorefantasyland.com
127.0.0.1	www.hardcorefantasyland.com
127.0.0.1	hardfootballbabes.com
127.0.0.1	www.hardfootballbabes.com
127.0.0.1	www.digitalfan.com
127.0.0.1	free-popup-killer.com
127.0.0.1	www.free-popup-killer.com
127.0.0.1	hastalavista.com
127.0.0.1	www.hastalavista.com
127.0.0.1	ibankis.org
127.0.0.1	www.ibankis.org
127.0.0.1	get.hitvirus.com
127.0.0.1	hitvirus.com
127.0.0.1	www.hitvirus.com
127.0.0.1	homelandnetwork.COM
127.0.0.1	www.homelandnetwork.COM
127.0.0.1	google123.web1000.com
127.0.0.1	web1000.com
127.0.0.1	hotbar.com
127.0.0.1	begin2search.com
127.0.0.1	www.begin2search.com
127.0.0.1	mainstreamdollars.com
127.0.0.1	www.mainstreamdollars.com
127.0.0.1	huntbar.com
127.0.0.1	www.huntbar.com
127.0.0.1	infport.com
127.0.0.1	www.infport.com
127.0.0.1	srfgate.com
127.0.0.1	www.srfgate.com
127.0.0.1	totalvelocity.com
127.0.0.1	www.totalvelocity.com
127.0.0.1	webnetinfo.net
127.0.0.1	www.webnetinfo.net
127.0.0.1	imiserver.com
127.0.0.1	search.imiserver.com
127.0.0.1	ieplugin.com
127.0.0.1	search.ieplugin.com
127.0.0.1	onlinesecurityworld.com
127.0.0.1	www.onlinesecurityworld.com
127.0.0.1	smutserver.com
127.0.0.1	code.ignphrases.com
127.0.0.1	igetnet.com
127.0.0.1	www.igetnet.com
127.0.0.1	ignphrases.com
127.0.0.1	www.ignphrases.com
127.0.0.1	i-lookup.com
127.0.0.1	spidersearch.com
127.0.0.1	globalwebsearch.com
127.0.0.1	innovagest2000.com
127.0.0.1	www.innovagest2000.com
127.0.0.1	1stantivirus.com
127.0.0.1	www.1stantivirus.com
127.0.0.1	alfacleaner.com
127.0.0.1	www.alfacleaner.com
127.0.0.1	spydeface.com
127.0.0.1	www.spydeface.com
127.0.0.1	www.xsremover.com
127.0.0.1	xsremover.com
127.0.0.1	instafinder.com
127.0.0.1	www.instafinder.com
127.0.0.1	2007-download.com
127.0.0.1	www.2007-download.com
127.0.0.1	acrobat-2007.com
127.0.0.1	www.acrobat-2007.com
127.0.0.1	acrobat-8.com
127.0.0.1	www.acrobat-8.com
127.0.0.1	acrobat-center.com
127.0.0.1	www.acrobat-center.com
127.0.0.1	acrobat-hq.com
127.0.0.1	www.acrobat-hq.com
127.0.0.1	acrobatreader-8.com
127.0.0.1	www.acrobatreader-8.com
127.0.0.1	acrobat-reader-8.de
127.0.0.1	www.acrobat-reader-8.de
127.0.0.1	acrobat-stop.com
127.0.0.1	www.acrobat-stop.com
127.0.0.1	adawarenow.com
127.0.0.1	www.adawarenow.com
127.0.0.1	adobe-download-now.com
127.0.0.1	adobe-downloads.com
127.0.0.1	www.adobe-downloads.com
127.0.0.1	adobe-reader-8.fr
127.0.0.1	www.adobe-reader-8.fr
127.0.0.1	all-bittorrent.com
127.0.0.1	www.all-bittorrent.com
127.0.0.1	all-downloads-now.com
127.0.0.1	www.all-downloads-now.com
127.0.0.1	all-edonkey.com
127.0.0.1	www.all-edonkey.com
127.0.0.1	all-limewire.com
127.0.0.1	www.all-limewire.com
127.0.0.1	antivir2007.com
127.0.0.1	www.antivir2007.com
127.0.0.1	antivirus.fastfreedownload.com
127.0.0.1	www.antivirus.fastfreedownload.com
127.0.0.1	antivirus-hq.net
127.0.0.1	www.antivirus-hq.net
127.0.0.1	antivirus-stop.com
127.0.0.1	www.antivirus-stop.com
127.0.0.1	ares-freebie.com
127.0.0.1	www.ares-freebie.com
127.0.0.1	arespro2007.com
127.0.0.1	aresultra.com
127.0.0.1	www.aresultra.com
127.0.0.1	ares-usa.com
127.0.0.1	www.ares-usa.com
127.0.0.1	avast.free-software-center.com
127.0.0.1	www.avast.free-software-center.com
127.0.0.1	avast-2007.com
127.0.0.1	www.avast-2007.com
127.0.0.1	avast-downloads.com
127.0.0.1	www.avast-downloads.com
127.0.0.1	avast-hq.com
127.0.0.1	www.avast-hq.com
127.0.0.1	avg.grab-it-today.net
127.0.0.1	www.avg.grab-it-today.net
127.0.0.1	avg.softwarecenterz.com
127.0.0.1	www.avg.softwarecenterz.com
127.0.0.1	avg-secure.com
127.0.0.1	www.avg-secure.com
127.0.0.1	azureusclub.com
127.0.0.1	www.azureusclub.com
127.0.0.1	azureus-freebie.com
127.0.0.1	www.azureus-freebie.com
127.0.0.1	bearshare.download-me.info
127.0.0.1	www.bearshare.download-me.info
127.0.0.1	bearshare.mp3-muzic.com
127.0.0.1	www.bearshare.mp3-muzic.com
127.0.0.1	bearshare-download.org
127.0.0.1	www.bearshare-download.org
127.0.0.1	bearshare-downloads.net
127.0.0.1	www.bearshare-downloads.net
127.0.0.1	bearsharelive.co.uk
127.0.0.1	www.bearsharelive.co.uk
127.0.0.1	bearshare-music-downloads.com
127.0.0.1	www.bearshare-music-downloads.com
127.0.0.1	bearsharepro2007.com
127.0.0.1	www.bearsharepro2007.com
127.0.0.1	bearshare-usa.com
127.0.0.1	www.bearshare-usa.com
127.0.0.1	bitcomet-freebie.com
127.0.0.1	www.bitcomet-freebie.com
127.0.0.1	click-to-download.com
127.0.0.1	www.click-to-download.com
127.0.0.1	directdvdpro.com
127.0.0.1	www.directdvdpro.com
127.0.0.1	download-2007.com
127.0.0.1	www.download-2007.com
127.0.0.1	download-ad-aware.com
127.0.0.1	www.download-ad-aware.com
127.0.0.1	download-all-4-free.com
127.0.0.1	www.download-all-4-free.com
127.0.0.1	download-all-area.com
127.0.0.1	www.download-all-area.com
127.0.0.1	download-antivir.com
127.0.0.1	www.download-antivir.com
127.0.0.1	downloadanysong.com
127.0.0.1	www.downloadanysong.com
127.0.0.1	download-avast.com
127.0.0.1	www.download-avast.com
127.0.0.1	downloadcorporation.com
127.0.0.1	www.downloadcorporation.com
127.0.0.1	download-dvdshrink.com
127.0.0.1	www.download-dvdshrink.com
127.0.0.1	download-for-free.net
127.0.0.1	www.download-for-free.net
127.0.0.1	downloadfreesoft.com
127.0.0.1	www.downloadfreesoft.com
127.0.0.1	downloadfreeway.com
127.0.0.1	www.downloadfreeway.com
127.0.0.1	downloadimesh.com
127.0.0.1	www.downloadimesh.com
127.0.0.1	download-itunes-now.com
127.0.0.1	www.download-itunes-now.com
127.0.0.1	download-limewire.org
127.0.0.1	www.download-limewire.org
127.0.0.1	downloadlost.tv
127.0.0.1	www.downloadlost.tv
127.0.0.1	download-mcafee.com
127.0.0.1	www.download-mcafee.com
127.0.0.1	download-me.info
127.0.0.1	download-real-player.com
127.0.0.1	www.download-real-player.com
127.0.0.1	downloadservicearea.com
127.0.0.1	www.downloadservicearea.com
127.0.0.1	downloads-free.org
127.0.0.1	www.downloads-free.org
127.0.0.1	downloadsglobe.com
127.0.0.1	www.downloadsglobe.com
127.0.0.1	download-this.us
127.0.0.1	www.download-this.us
127.0.0.1	download-trillian.com
127.0.0.1	www.download-trillian.com
127.0.0.1	download-windvd.com
127.0.0.1	www.download-windvd.com
127.0.0.1	download-winrar.com
127.0.0.1	www.download-winrar.com
127.0.0.1	downloadwizard.com
127.0.0.1	downloadzcenter.com
127.0.0.1	downloadzcentral.com
127.0.0.1	downloadzfree.com
127.0.0.1	www.downloadzfree.com
127.0.0.1	downloadznow.net
127.0.0.1	download-zone-free.com
127.0.0.1	www.download-zone-free.com
127.0.0.1	download-zone-free.net
127.0.0.1	www.download-zone-free.net
127.0.0.1	easymp3musicnow.com
127.0.0.1	www.easymp3musicnow.com
127.0.0.1	emule.mp3-muzic.com
127.0.0.1	www.emule.mp3-muzic.com
127.0.0.1	emuledownloadhome.com
127.0.0.1	www.emuledownloadhome.com
127.0.0.1	emule-freebie.com
127.0.0.1	www.emule-freebie.com
127.0.0.1	etomi.all-downloads-now.com
127.0.0.1	www.etomi.all-downloads-now.com
127.0.0.1	fastfreedownload.com
127.0.0.1	firefoxdownload-now.com
127.0.0.1	www.firefoxdownload-now.com
127.0.0.1	free-adobe-download-support.com
127.0.0.1	www.free-adobe-download-support.com
127.0.0.1	free-avg.org
127.0.0.1	www.free-avg.org
127.0.0.1	free-avg-download.com
127.0.0.1	www.free-avg-download.com
127.0.0.1	free-bearshares.com
127.0.0.1	www.free-bearshares.com
127.0.0.1	freedownloadhq.com
127.0.0.1	www.freedownloadhq.com
127.0.0.1	freedownloadpage.com
127.0.0.1	www.freedownloadpage.com
127.0.0.1	free-download-place.com
127.0.0.1	www.free-download-place.com
127.0.0.1	free-download-support.com
127.0.0.1	www.free-download-support.com
127.0.0.1	freedownloadzone.com
127.0.0.1	www.freedownloadzone.com
127.0.0.1	freemp3access.com
127.0.0.1	www.freemp3access.com
127.0.0.1	free-music-network.com
127.0.0.1	www.free-music-network.com
127.0.0.1	free-program-download.com
127.0.0.1	www.free-program-download.com
127.0.0.1	free-software-center.com
127.0.0.1	www.free-software-center.com
127.0.0.1	freeunlimitedskype.com
127.0.0.1	www.freeunlimitedskype.com
127.0.0.1	fullsoftwaredownloadz.com
127.0.0.1	www.fullsoftwaredownloadz.com
127.0.0.1	getanysoftware.com
127.0.0.1	www.getanysoftware.com
127.0.0.1	getdvdshrink2007.com
127.0.0.1	www.getdvdshrink2007.com
127.0.0.1	get-ipod-music.com
127.0.0.1	www.get-ipod-music.com
127.0.0.1	get-mp3-onlined.com
127.0.0.1	www.get-mp3-onlined.com
127.0.0.1	get-realplayer.com
127.0.0.1	www.get-realplayer.com
127.0.0.1	get-winrar.com
127.0.0.1	www.get-winrar.com
127.0.0.1	grab-it-today.net
127.0.0.1	hq-downloads.com
127.0.0.1	www.hq-downloads.com
127.0.0.1	incredimail-download-now.com
127.0.0.1	www.incredimail-download-now.com
127.0.0.1	incredimail-hq.com
127.0.0.1	www.incredimail-hq.com
127.0.0.1	incredimailpro.com
127.0.0.1	www.incredimailpro.com
127.0.0.1	interactivebrands.com
127.0.0.1	www.interactivebrands.com
127.0.0.1	ipod-itunes-download-now.com
127.0.0.1	www.ipod-itunes-download-now.com
127.0.0.1	ipod-music-store.com
127.0.0.1	www.ipod-music-store.com
127.0.0.1	ipod-tunes-download.com
127.0.0.1	www.ipod-tunes-download.com
127.0.0.1	irfanview-center.com
127.0.0.1	www.irfanview-center.com
127.0.0.1	irfanview-download-now.com
127.0.0.1	www.irfanview-download-now.com
127.0.0.1	irfanview-stop.com
127.0.0.1	www.irfanview-stop.com
127.0.0.1	itunesandipods.com
127.0.0.1	www.itunesandipods.com
127.0.0.1	itunesfreebies.com
127.0.0.1	www.itunesfreebies.com
127.0.0.1	k-litegold.com
127.0.0.1	www.k-litegold.com
127.0.0.1	klitepro.com
127.0.0.1	www.klitepro.com
127.0.0.1	k-litetk.com
127.0.0.1	www.k-litetk.com
127.0.0.1	lets-get-it.info
127.0.0.1	www.lets-get-it.info
127.0.0.1	lets-get-it.net
127.0.0.1	lets-get-it.org
127.0.0.1	www.lets-get-it.org
127.0.0.1	limewire2007pro.info
127.0.0.1	www.limewire2007pro.info
127.0.0.1	limewire-download-pro.com
127.0.0.1	www.limewire-download-pro.com
127.0.0.1	limewire-mp3-share.com
127.0.0.1	www.limewire-mp3-share.com
127.0.0.1	limewirenetwork.com
127.0.0.1	www.limewirenetwork.com
127.0.0.1	limewire-pro-downloads.com
127.0.0.1	www.limewire-pro-downloads.com
127.0.0.1	limewirezone.com
127.0.0.1	www.limewirezone.com
127.0.0.1	liveplayer.tv
127.0.0.1	www.liveplayer.tv
127.0.0.1	mcafee-antivirus-2007.com
127.0.0.1	www.mcafee-antivirus-2007.com
127.0.0.1	mediaplayer-2007.com
127.0.0.1	www.mediaplayer-2007.com
127.0.0.1	mediaplayer-download.org
127.0.0.1	www.mediaplayer-download.org
127.0.0.1	mediaplayer-download-now.com
127.0.0.1	www.mediaplayer-download-now.com
127.0.0.1	mp3bearshare.com
127.0.0.1	www.mp3bearshare.com
127.0.0.1	mp3-morpheus.com
127.0.0.1	www.mp3-morpheus.com
127.0.0.1	mp3musichq.com
127.0.0.1	www.mp3musichq.com
127.0.0.1	mp3-music-source.com
127.0.0.1	www.mp3-music-source.com
127.0.0.1	mp3-muzic.com
127.0.0.1	www.mp3-muzic.com
127.0.0.1	mp3winmx.com
127.0.0.1	www.mp3winmx.com
127.0.0.1	musicmatch.free-software-center.com
127.0.0.1	www.musicmatch.free-software-center.com

poulette559 · Answer

j'ai lancé vundo fix en mode sans echec k'ai fait san for vundo mais aprés ca bug je ne peux pas faire remove for vundo.
en mode normal les icones sont revenus mais le virus est toujours la et la secutity tool bar aussi.
avast m'a detecte: Win32tiny-JL[trj]
j'ai plein de fentre qui s'ouvent et toujours le systeme alerte windows avec le petit triangle jaune dans la barre de tache

Utilisateur anonyme · Answer

Ton rapport Sitfraudfix est incomplet
Rends toi sur ce site et fais le hébergé puis envoie le lien ici stp
https://www.cjoint.com/

poulette559 · Answer

salut 
j'ai mis le rapport ici: https://www.cjoint.com/?lCirwZZXwR
j'ai fait une autre analyse AVG il m'a trouvé des cookies traceurs et des cheval de troi nommé tiny

poulette559 · Answer

je viens de télécharger spybot, penses tu que cela puisse m'aider un peu?

g!rly · Answer

bonjour a vous deux,

pour avancer un peu :

Télécharge Zeb-Restore

http://telechargement.zebulon.fr/zeb-restore.html

enregistre ce fichier sur le bureau.

-Clic droit Zeb-Restore.zip ==> Extraire tout choisis comme lieu d'enregistrement le bureau.
-Ouvre le dossier ZR_1.0.0.37 ==> double clic sur Zeb-Restore.exe
- Coche la case devant : Réinitialiser Fichier Hosts
- Ne coche aucune autre case
-Clique sur Restaurer
-Redémarre ton PC 

puis fais vundofix :

Télécharge VundoFix.exe (par Atribune) sur ton Bureau.
http://www.atribune.org/ccount/click.php?id=4
* Double-clique VundoFix.exe afin de le lancer
* Clique sur le bouton Scan for Vundo
* Lorsque le scan est complété, clique sur le bouton Remove Vundo
* Une invite te demandera si tu veux supprimer les fichiers, clique YES
* Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers
* Tu verras une invite qui t'annonce que ton PC va redémarrer; clique OK
* Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse

Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci-haut, à partir de "clique sur le bouton Scan for Vundo".

et repost un log hijackthis ,

poulette559 · Answer

voici ce que vundo fix a supprimé: eqkrrvtk.dll  uqtodzqm.dll  uqtodzqm.dll
en fait j'en ai fait 2 d'affilé donc voici le dernier rapport: 

VundoFix V6.6.2

Checking Java version...

Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.

Scan started at 22:59:03 27/11/2007

Listing files found while scanning....


Beginning removal...

VundoFix V6.6.2

Checking Java version...

Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.

Scan started at 23:07:59 27/11/2007

Listing files found while scanning....


VundoFix V6.6.2

Checking Java version...

Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.

Scan started at 12:02:23 28/11/2007

Listing files found while scanning....

C:\windows\system32\eqkrrvtk.dll
C:\WINDOWS\system32\uqtodzqm.dll
C:\windows\system32\uqtodzqm.dllbox

Beginning removal...

 Attempting to delete C:\windows\system32\eqkrrvtk.dll
C:\windows\system32\eqkrrvtk.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\uqtodzqm.dll
C:\WINDOWS\system32\uqtodzqm.dll Could not be deleted.

 Attempting to delete C:\windows\system32\uqtodzqm.dllbox
C:\windows\system32\uqtodzqm.dllbox Has been deleted!

Performing Repairs to the registry.
Done!

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\uqtodzqm.dll
C:\WINDOWS\system32\uqtodzqm.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.6.2

Checking Java version...

Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.

Scan started at 12:12:16 28/11/2007

Listing files found while scanning....

No infected files were found.

et voici le rapport hijack:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:17:34, on 28/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.picasa.com/support/welcome.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [1474aad1] rundll32.exe "C:\WINDOWS\system32\cewtlepm.dll",b
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Enregistrement d'un produit Joint Operations Typhoon Rising.lnk = C:\Documents and Settings\Moi\Local Settings\Temp\{CCFC9AE2-C6A8-4EBA-AD4D-86A557E53170}\{0325F1C1-883A-41AB-8981-B27359ABDFAF}\NOVG.EXE
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32
appdokt.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcappcapd.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

g!rly · Answer

re,

Télécharge combofix.exe (par sUBs) sur ton Bureau.

-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe      

-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse. 

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

poulette559 · Answer

ok voici le rapport de combo fix, la security tools bar est revenue!! avec les raccourcis sur le bureau bien sur!! ComboFix 07-11-19.4B - Moi 2007-11-28 12:37:25.1 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.709 [GMT 1:00] Running from: C:\Documents and Settings\Moi\Bureau\ComboFix.exe * Created a new restore point . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Administrateur\Bureau\Live Safety Center.lnk C:\Documents and Settings\Administrateur\Bureau\Online Security Guide.lnk C:\Documents and Settings\Administrateur\Favoris\Online Security Guide.lnk C:\Documents and Settings\All Users\Menu Démarrer\Live Safety Center.lnk C:\Documents and Settings\All Users\Menu Démarrer\Online Security Guide.lnk C:\Documents and Settings\Moi\Favoris\Online Security Guide.lnk C:\WINDOWS\system32\mlnmp.ini C:\WINDOWS\system32\mlnmp.ini2 C:\WINDOWS\system32\pmnlm.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_DOMAINSERVICE -------\DomainService ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-10-28 to 2007-11-28 )))))))))))))))))))))))))))))))))))) . 2007-11-28 12:38 145,984 --a------ C:\WINDOWS\system32\ywichyua.dll 2007-11-28 12:38 145,984 --a------ C:\WINDOWS\system32\pwqwssne.dll 2007-11-28 12:38 20,810 ---hs---- C:\WINDOWS\system32\ywichyua.dllbox 2007-11-27 23:41 78,912 --a------ C:\WINDOWS\system32\mgjqfvir.dll 2007-11-27 23:38 783,515 ---hs---- C:\WINDOWS\system32\mpeltwec.ini 2007-11-27 23:38 85,056 --a------ C:\WINDOWS\system32\cewtlepm.dll 2007-11-27 23:38 71,232 --a------ C:\WINDOWS\system32\madtbhiu.exe 2007-11-27 23:23 78,912 --a------ C:\WINDOWS\system32\ckkudhxp.dll 2007-11-27 23:23 474 ---hs---- C:\WINDOWS\system32\cjuwemho.ini 2007-11-27 22:59 d-------- C:\VundoFix Backups 2007-11-27 22:56 71,232 --a------ C:\WINDOWS\system32\fuukjmwi.exe 2007-11-27 22:35 806 --a------ C:\WINDOWS\system32 mp.reg 2007-11-27 19:30 d-------- C:\Documents and Settings\Moi\Application Data\Grisoft 2007-11-27 19:30 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-11-27 19:29 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2007-11-27 19:26 d-------- C:\Program Files\Trend Micro 2007-11-26 19:07 d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau 2007-11-26 19:07 d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression 2007-11-26 19:07 d--h----- C:\Documents and Settings\Administrateur\ModŠles 2007-11-26 19:07 dr------- C:\Documents and Settings\Administrateur\Mes documents 2007-11-26 19:07 dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer 2007-11-26 19:07 dr------- C:\Documents and Settings\Administrateur\Favoris 2007-11-26 19:07 d-------- C:\Documents and Settings\Administrateur\Bureau 2007-11-26 19:07 d-------- C:\Documents and Settings\Administrateur\Application Data\You've Got Pictures Screensaver 2007-11-26 19:07 d-------- C:\Documents and Settings\Administrateur\Application Data\Symantec 2007-11-26 19:07 d-------- C:\Documents and Settings\Administrateur\Application Data\Jasc Software Inc 2007-11-25 20:58 414 ---hs---- C:\WINDOWS\system32\lftbdnta.ini 2007-11-25 20:55 79,936 --a------ C:\WINDOWS\system32\ftjislot.dll 2007-11-24 20:13 d-------- C:\Program Files\Doom 3 2007-11-24 20:11 38,912 --a------ C:\WINDOWS\system32\ddcdbcb.dll 2007-11-24 19:38 d-------- C:\Documents and Settings\All Users\Application Data\POPWWPROFILES 2007-11-18 21:24 d-------- C:\Program Files\ViaMichelin 2007-11-18 21:23 104,576 --a------ C:\WINDOWS\system32\drivers\wceusbsh.sys 2007-11-18 21:23 104,576 --a------ C:\WINDOWS\system32\dllcache\wceusbsh.sys 2007-11-18 21:21 d-------- C:\Program Files\Microsoft ActiveSync 2007-11-18 21:21 30,592 --------- C:\WINDOWS\system32\drivers ndismpx.sys 2007-11-18 21:21 12,800 --------- C:\WINDOWS\system32\drivers\usb8023x.sys 2007-11-18 21:20 d-------- C:\WINDOWS\Downloaded Installations . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-28 11:42 --------- d-----w C:\Documents and Settings\Moi\Application Data\Skype 2007-11-28 10:57 --------- d-----w C:\Program Files\PowerArchiver 2007-11-24 23:58 --------- d-----w C:\Documents and Settings\Moi\Application Data\Azureus 2007-11-24 18:38 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-24 18:37 --------- d-----w C:\Program Files\Ubisoft 2007-11-17 16:15 --------- d-----w C:\Program Files\FoxTarot4 2007-10-28 11:59 --------- d-----w C:\Program Files\GUILD WARS 2007-10-27 13:25 --------- d-----w C:\Program Files\Picasa2 2007-10-25 16:43 8,516,608 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll 2007-10-08 22:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-10-08 07:20 46,080 ----a-w C:\WINDOWS\system32\ftp.exe 2007-09-06 10:09 801,144 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-09-06 10:00 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr 2007-01-18 17:33 1,127,307 ----a-w C:\Program Files\wrar362fr.exe 2006-10-03 19:08 9,998,384 ----a-w C:\Program Files ero_nero_6.6.1.4_language_pack_francais_francais_10297.exe 2006-09-11 17:17 8,799,656 ----a-w C:\Program Files\Azureus_2.5.0.0_Win32.setup.exe 1999-04-06 13:27 99,840 ----a-w C:\Program Files\Fichiers communs\IRAABOUT.DLL 1998-12-09 03:53 70,144 ----a-w C:\Program Files\Fichiers communs\IRAMDMTR.DLL 1998-12-09 03:53 48,640 ----a-w C:\Program Files\Fichiers communs\IRALPTTR.DLL 1998-12-09 03:53 31,744 ----a-w C:\Program Files\Fichiers communs\IRAWEBTR.DLL 1998-12-09 03:53 186,368 ----a-w C:\Program Files\Fichiers communs\IRAREG.DLL 1998-12-09 03:53 17,920 ----a-w C:\Program Files\Fichiers communs\IRASRIAL.DLL . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2ABAAC42-84DF-4C00-89DA-BC7EB2B0E70B}] 2007-11-24 20:11 38912 --a------ C:\WINDOWS\system32\ddcdbcb.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}] 2007-11-28 12:38 145984 --a------ C:\WINDOWS\system32\ywichyua.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b69e2b35-a60a-4140-83b1-75a97c0fcef7}] 2007-11-27 23:41 78912 --a------ C:\WINDOWS\system32\mgjqfvir.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{11A69AE4-FBED-4832-A2BF-45AF82825583}"= C:\WINDOWS\system32\ywichyua.dll [2007-11-28 12:38 145984] [HKEY_CLASSES_ROOT\clsid\{11a69ae4-fbed-4832-a2bf-45af82825583}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CursorXP"="C:\Program Files\CursorXP\CursorXP.exe" [2005-01-19 16:34] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-10-13 17:20] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00] "SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [2005-03-14 00:37] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-28 18:17] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-06-26 21:45] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="RUNDLL32.exe" [2004-08-05 13:00 C:\WINDOWS\system32 undll32.exe] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 11:06] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25] "1474aad1"="C:\WINDOWS\system32\cewtlepm.dll" [2007-11-27 23:38] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00] "ALUAlert"="C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe" [] "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-28 02:17] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"= 0 (0x0) [hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{2ABAAC42-84DF-4C00-89DA-BC7EB2B0E70B}"= C:\WINDOWS\system32\ddcdbcb.dll [2007-11-24 20:11 38912] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\ddcdbcb] ddcdbcb.dll 2007-11-24 20:11 38912 C:\WINDOWS\system32\ddcdbcb.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\ywichyua] ywichyua.dll 2007-11-28 12:38 145984 C:\WINDOWS\system32\ywichyua.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\pmnlm.dll R0 ElbyVCD;ElbyVCD;C:\WINDOWS\system32\DRIVERS\ElbyVCD.sys R1 SSHDRV76;SSHDRV76;\??\C:\WINDOWS\system32\drivers\SSHDRV76.sys R2 litsgt;litsgt;C:\WINDOWS\system32\DRIVERS\litsgt.sys R2 tansgt;tansgt;C:\WINDOWS\system32\DRIVERS ansgt.sys S3 Netdmin;Netdmin;C:\WINDOWS\system32\drivers asacd.sys S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers pf.sys S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys S3 Usblink;Usblink Driver;C:\WINDOWS\system32\Drivers\ulink.sys . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2005-11-18 19:15:04 C:\WINDOWS\Tasks\Rappel d'abonnement 1 auprès de l'ISP.job" "2007-11-28 11:43:00 C:\WINDOWS\Tasks\Symantec NetDetect.job" - C:\Program Files\Symantec\LiveUpdate\NDetect.exe . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-28 12:41:32 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-28 12:43:25 - machine was rebooted . --- E O F ---

g!rly · Answer

re,

il va faloir passer par le registre pour arriver a bout de la desinfection.

Fix.reg

Ouvre le bloc-notes (click droit sur le bureau > dans l´arborescence choisie nouveau et nouveau fichier texte) et fais un copier coller de ce qui est en citation ci-dessous (copie tout d'un trait-sans les barres(X)) :

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
REGEDIT4

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2ABAAC42-84DF-4C00-89DA-BC7EB2B0E70B}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b69e2b35-a60a-4140-83b1-75a97c0fcef7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
[-HKEY_CLASSES_ROOT\clsid\{11a69ae4-fbed-4832-a2bf-45af82825583}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"1474aad1"=-
[hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{2ABAAC42-84DF-4C00-89DA-BC7EB2B0E70B}"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\ddcdbcb]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\ywichyua]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

note : regedit4 doit etre sur la premiere ligne dans le bloc note et il y a une ligne blanche a la fin
Puis click sur "fichier"/"enregistrer sous" :
dans : sur le bureau
Nom du fichier : fix.reg
Type de fichier : "tous les fichiers"
clique sur "enregistrer"

ca doit ressembler a ca une fois enrregistré :

http://img520.imageshack.us/img520/4251/screenshot005ps2.png

quitte internet et double clique sur fix.reg => tu dois obligatoirement avoir un message "voulez-vous vraiment ajouter les informations contenues dans ce fichier .reg au registre ?"
Si c'est bien le cas, clique sur "oui"

Télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe (de Old_Timer) sur ton Bureau.
double-click sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

    Citation :
    
C:\WINDOWS\system32\ddcdbcb.dll
C:\WINDOWS\system32\ywichyua.dll
C:\WINDOWS\system32\mgjqfvir.dll
C:\WINDOWS\system32\cewtlepm.dll
C:\WINDOWS\system32\ddcdbcb.dll
C:\WINDOWS\system32\pmnlm.dll
C:\WINDOWS\system32\pwqwssne.dll
C:\WINDOWS\system32\mpeltwec.ini
C:\WINDOWS\system32\madtbhiu.exe
C:\WINDOWS\system32\ckkudhxp.dll
C:\WINDOWS\system32\cjuwemho.ini
C:\WINDOWS\system32\fuukjmwi.exe
C:\WINDOWS\system32	mp.reg
C:\WINDOWS\system32\lftbdnta.ini
C:\WINDOWS\system32\ftjislot.dll

Click sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
click sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.
Ps : il te sera peut-être demander de redémarrer le pc pour achever la suppression. Si c'est le cas accepte par Yes.
http://img137.imageshack.us/img137/3558/refaitjk8.th.jpg

instal un par feu :

par feu : kerio

Kerio (pare-feu) : reste gratuit après la période d'essai en français
----> https://www.zebulon.fr/telechargements/securite/firewalls/kerio.html

Regarde ce tutoriel si tu as besoin d'aide pour l'installation et la configuration de Kerio
--> https://kerio.probb.fr/t1-tuto-pour-kerio-4-2

Plus d'info :
->https://kerio.probb.fr/ 

ou zone alarm plus facil a configurer mais moins performant

http://www.kachouri.com/tuto/tuto-143-zonealarm-installation-du-firewall--pare-feu.html

desinstal avast et instale celui ci a la place

->https://www.malekal.com/avira-free-security-antivirus-gratuit/

et fais un scan complet avec antivir et post le rapport ici 

http://mickael.barroux.free.fr/securite/antivir.php <- tutoriel configuration du scanner... 

ps : si tu a des doutes sur la facon de faire demande avant de commencer.

@+

poulette559 · Answer

voici le rapport de move it:
DllUnregisterServer procedure not found in C:\WINDOWS\system32\ddcdbcb.dll
C:\WINDOWS\system32\ddcdbcb.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\ddcdbcb.dll scheduled to be moved on reboot.
C:\WINDOWS\system32\ywichyua.dll unregistered successfully.
File move failed. C:\WINDOWS\system32\ywichyua.dll scheduled to be moved on reboot.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\mgjqfvir.dll
C:\WINDOWS\system32\mgjqfvir.dll NOT unregistered.
C:\WINDOWS\system32\mgjqfvir.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\cewtlepm.dll
C:\WINDOWS\system32\cewtlepm.dll NOT unregistered.
C:\WINDOWS\system32\cewtlepm.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\ddcdbcb.dll
C:\WINDOWS\system32\ddcdbcb.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\ddcdbcb.dll scheduled to be moved on reboot.
File/Folder C:\WINDOWS\system32\pmnlm.dll not found.
C:\WINDOWS\system32\pwqwssne.dll unregistered successfully.
C:\WINDOWS\system32\pwqwssne.dll moved successfully.
C:\WINDOWS\system32\mpeltwec.ini moved successfully.
C:\WINDOWS\system32\madtbhiu.exe moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\ckkudhxp.dll
C:\WINDOWS\system32\ckkudhxp.dll NOT unregistered.
C:\WINDOWS\system32\ckkudhxp.dll moved successfully.
C:\WINDOWS\system32\cjuwemho.ini moved successfully.
C:\WINDOWS\system32\fuukjmwi.exe moved successfully.
C:\WINDOWS\system32	mp.reg moved successfully.
C:\WINDOWS\system32\lftbdnta.ini moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\ftjislot.dll
C:\WINDOWS\system32\ftjislot.dll NOT unregistered.
C:\WINDOWS\system32\ftjislot.dll moved successfully.
 
Created on 11/28/2007 13:26:48

mon ordi rame de plus en plus..pff je commence à desesperer!

g!rly · Answer

re,

redemarre le pc et refais combofix et post le rapport ici stp

@+

poulette559 · Answer

pour l'instant ca me gonfle trop je fais ca ce soir.
merci pour ton aide

g!rly · Answer

ok 
@+

poulette559 · Answer

salut
voici ca qu'on m'a proposé de faire également:

   1. Téléchargez une copie d'urgence de SAV32CLI. Sur un ordinateur Windows non infecté, exécutez ce fichier pour en extraire le contenu dans le dossier SAV32CLI sur un support pouvant être protégé en écriture. Ajoutez tout fichier IDE approprié à ce dossier et protégez le disque en écriture (sur un CD/R ou un CD/RW, fermez la session).
   2. Redémarrez l'ordinateur en Mode sans échec. Allez dans Démarrer|Arrêter. Sélectionnez 'Redémarrer' dans la liste déroulante et cliquez sur 'OK'. Windows va redémarrer. Appuyez sur F8 lorsque vous apercevez le texte "Pressez F8 pour la résolution des problèmes et les options de démarrage avancées pour Windows 2000" en bas de l'écran. Dans le menu des options avancées Windows 2000, sélectionnez la troisième option 'Mode sans échec avec invite de commande'.
   3. Sur l'ordinateur infecté, insérez le CD-ROM dans le lecteur de CD-ROM (D: dans ce cas).
      A l'invite de commandes, tapez

      D:
      pour accéder au lecteur de CD-ROM. Saisissez :

      CD SAV32CLI
      Puis, saisissez :

      SAV32CLI -REMOVE -P=C:\LOGFILE.TXT
      pour supprimer le cheval de Troie.
   4. Avant de quitter le Mode sans échec, modifiez toutes les entrées de registre mentionnées dans les instructions de récupération après analyse des chevaux de Troie.

qu'en penses tu?

g!rly · Answer

re,

ca y est ca va mieux ;-)

qui est-ce qui t´a conseillé ca?

c´est un scan en ligne de commande...

de toute maniere on va effectuer un scan mais j´aimerais d´abord voir si il reste des cles infectées

alors refais un combofix et poste le rapport ici

poulette559 · Answer

re, 
ok te fache pas!!lol
c'est un ami qui m'a conseillé ça (il fait de l'informatique mais malheureusement pour moi il habite loin et a un faible débit internet..le comble pour un informaticien me diras tu!!!)
bon je fais ce cher combofix ce soir et je le poste le plus rapidement possible!
Merci bcp!
(je vais te remercier bcp donc si ça t'enerve prend sur toi car je n'arreterai pas!!! lol)

g!rly · Answer

tu as eu l´impression que j´etais fachée? lol

ce scan peux etre une solution en effet, mais pas entiere, car il n´aurait pas pu desinfecter la totalité...

tu lui a montré le topik a ton ami?

de rien ;-)

poulette559 · Answer

voici le dernier scan de combo fix: kerio est en marche par contre je prefere garder avast ComboFix 07-11-19.4B - Moi 2007-11-28 19:07:37.3 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.633 [GMT 1:00] Running from: C:\Documents and Settings\Moi\Bureau\ComboFix.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Menu Démarrer\Live Safety Center.lnk C:\Documents and Settings\All Users\Menu Démarrer\Online Security Guide.lnk C:\Documents and Settings\Moi\Bureau\Live Safety Center.lnk C:\Documents and Settings\Moi\Bureau\Online Security Guide.lnk C:\Documents and Settings\Moi\Favoris\Online Security Guide.lnk C:\WINDOWS\cookies.ini C:\WINDOWS\system32\ijkmp.ini C:\WINDOWS\system32\ijkmp.ini2 C:\WINDOWS\system32\pmkji.dll C:\WINDOWS\system32\ywichyua.dllbox . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-10-28 to 2007-11-28 )))))))))))))))))))))))))))))))))))) . 2007-11-28 19:13 96 ---hs---- C:\WINDOWS\system32\ywichyua.dllbox 2007-11-28 13:42 d-------- C:\Program Files\Sunbelt Software 2007-11-28 13:39 0 --a------ C:\WINDOWS\system32\mcrh.tmp 2007-11-28 13:05 d-------- C:\WINDOWS\BDOSCAN8 2007-11-28 12:43 C:\Documents and Settings\PropriÚtaire\Local Settings 2007-11-28 12:38 145,984 --a------ C:\WINDOWS\system32\ywichyua.dll 2007-11-27 22:59 d-------- C:\VundoFix Backups 2007-11-27 19:30 d-------- C:\Documents and Settings\Moi\Application Data\Grisoft 2007-11-27 19:30 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-11-27 19:29 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2007-11-27 19:26 d-------- C:\Program Files\Trend Micro 2007-11-26 19:07 d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau 2007-11-26 19:07 d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression 2007-11-26 19:07 d--h----- C:\Documents and Settings\Administrateur\ModŠles 2007-11-26 19:07 dr------- C:\Documents and Settings\Administrateur\Mes documents 2007-11-26 19:07 dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer 2007-11-26 19:07 dr------- C:\Documents and Settings\Administrateur\Favoris 2007-11-26 19:07 d-------- C:\Documents and Settings\Administrateur\Bureau 2007-11-26 19:07 d-------- C:\Documents and Settings\Administrateur\Application Data\You've Got Pictures Screensaver 2007-11-26 19:07 d-------- C:\Documents and Settings\Administrateur\Application Data\Symantec 2007-11-26 19:07 d-------- C:\Documents and Settings\Administrateur\Application Data\Jasc Software Inc 2007-11-24 20:13 d-------- C:\Program Files\Doom 3 2007-11-24 20:11 38,912 --a------ C:\WINDOWS\system32\ddcdbcb.dll 2007-11-24 19:38 d-------- C:\Documents and Settings\All Users\Application Data\POPWWPROFILES 2007-11-18 21:24 d-------- C:\Program Files\ViaMichelin 2007-11-18 21:23 104,576 --a------ C:\WINDOWS\system32\drivers\wceusbsh.sys 2007-11-18 21:23 104,576 --a------ C:\WINDOWS\system32\dllcache\wceusbsh.sys 2007-11-18 21:21 d-------- C:\Program Files\Microsoft ActiveSync 2007-11-18 21:21 30,592 --------- C:\WINDOWS\system32\drivers ndismpx.sys 2007-11-18 21:21 12,800 --------- C:\WINDOWS\system32\drivers\usb8023x.sys 2007-11-18 21:20 d-------- C:\WINDOWS\Downloaded Installations . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-28 18:14 --------- d-----w C:\Documents and Settings\Moi\Application Data\Skype 2007-11-28 12:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-11-28 10:57 --------- d-----w C:\Program Files\PowerArchiver 2007-11-24 23:58 --------- d-----w C:\Documents and Settings\Moi\Application Data\Azureus 2007-11-24 18:38 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-24 18:37 --------- d-----w C:\Program Files\Ubisoft 2007-11-17 16:15 --------- d-----w C:\Program Files\FoxTarot4 2007-10-28 11:59 --------- d-----w C:\Program Files\GUILD WARS 2007-10-27 13:25 --------- d-----w C:\Program Files\Picasa2 2007-10-25 16:43 8,516,608 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll 2007-10-08 07:20 46,080 ----a-w C:\WINDOWS\system32\ftp.exe 2007-09-06 10:09 801,144 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-09-06 10:00 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr 2007-01-18 17:33 1,127,307 ----a-w C:\Program Files\wrar362fr.exe 2006-10-03 19:08 9,998,384 ----a-w C:\Program Files ero_nero_6.6.1.4_language_pack_francais_francais_10297.exe 2006-09-11 17:17 8,799,656 ----a-w C:\Program Files\Azureus_2.5.0.0_Win32.setup.exe 1999-04-06 13:27 99,840 ----a-w C:\Program Files\Fichiers communs\IRAABOUT.DLL 1998-12-09 03:53 70,144 ----a-w C:\Program Files\Fichiers communs\IRAMDMTR.DLL 1998-12-09 03:53 48,640 ----a-w C:\Program Files\Fichiers communs\IRALPTTR.DLL 1998-12-09 03:53 31,744 ----a-w C:\Program Files\Fichiers communs\IRAWEBTR.DLL 1998-12-09 03:53 186,368 ----a-w C:\Program Files\Fichiers communs\IRAREG.DLL 1998-12-09 03:53 17,920 ----a-w C:\Program Files\Fichiers communs\IRASRIAL.DLL . ((((((((((((((((((((((((((((( snapshot@2007-11-28_12.42.42.17 ))))))))))))))))))))))))))))))))))))))))) . + 2006-05-25 00:21:00 118,784 ----a-w C:\WINDOWS\BDOSCAN8\bdupd.dll + 2006-05-25 00:21:14 53,248 ----a-w C:\WINDOWS\BDOSCAN8\ipsupd.dll + 2006-05-25 00:22:06 53,248 ----a-w C:\WINDOWS\bdoscandel.exe + 2006-05-25 00:21:00 118,784 ----a-w C:\WINDOWS\Downloaded Program Files\bdupd.dll + 2006-05-25 00:21:14 53,248 ----a-w C:\WINDOWS\Downloaded Program Files\ipsupd.dll + 2005-12-15 17:13:34 274,432 ----a-w C:\WINDOWS\system32\drivers\fwdrv.sys + 2005-12-15 17:01:52 81,920 ----a-w C:\WINDOWS\system32\drivers\khips.sys + 2007-11-28 18:13:29 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_660.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2ABAAC42-84DF-4C00-89DA-BC7EB2B0E70B}] 2007-11-24 20:11 38912 --a------ C:\WINDOWS\system32\ddcdbcb.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{98ED5A8C-6825-437A-99A5-37DF0157F2FF}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}] 2007-11-28 12:38 145984 --a------ C:\WINDOWS\system32\ywichyua.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b69e2b35-a60a-4140-83b1-75a97c0fcef7}] C:\WINDOWS\system32\mgjqfvir.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{11A69AE4-FBED-4832-A2BF-45AF82825583}"= C:\WINDOWS\system32\ywichyua.dll [2007-11-28 12:38 145984] [HKEY_CLASSES_ROOT\clsid\{11a69ae4-fbed-4832-a2bf-45af82825583}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CursorXP"="C:\Program Files\CursorXP\CursorXP.exe" [2005-01-19 16:34] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-10-13 17:20] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00] "SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [2005-03-14 00:37] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-28 18:17] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-06-26 21:45] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="RUNDLL32.exe" [2004-08-05 13:00 C:\WINDOWS\system32 undll32.exe] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 11:06] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00] "ALUAlert"="C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe" [] "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-28 02:17] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"= 0 (0x0) [hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{2ABAAC42-84DF-4C00-89DA-BC7EB2B0E70B}"= C:\WINDOWS\system32\ddcdbcb.dll [2007-11-24 20:11 38912] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\ddcdbcb] ddcdbcb.dll 2007-11-24 20:11 38912 C:\WINDOWS\system32\ddcdbcb.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\ywichyua] ywichyua.dll 2007-11-28 12:38 145984 C:\WINDOWS\system32\ywichyua.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\pmkji.dll R0 ElbyVCD;ElbyVCD;C:\WINDOWS\system32\DRIVERS\ElbyVCD.sys R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys R1 SSHDRV76;SSHDRV76;\??\C:\WINDOWS\system32\drivers\SSHDRV76.sys R2 litsgt;litsgt;C:\WINDOWS\system32\DRIVERS\litsgt.sys R2 tansgt;tansgt;C:\WINDOWS\system32\DRIVERS ansgt.sys S3 Netdmin;Netdmin;C:\WINDOWS\system32\drivers asacd.sys S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers pf.sys S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys S3 Usblink;Usblink Driver;C:\WINDOWS\system32\Drivers\ulink.sys . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2005-11-18 19:15:04 C:\WINDOWS\Tasks\Rappel d'abonnement 1 auprès de l'ISP.job" "2007-11-28 18:13:31 C:\WINDOWS\Tasks\Symantec NetDetect.job" - C:\Program Files\Symantec\LiveUpdate\NDetect.exe . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-28 19:14:28 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-28 19:16:15 - machine was rebooted C:\ComboFix2.txt ... 2007-11-28 12:43 . --- E O F ---

g!rly · Answer

re,

tu es sur d´avoir bien effectué la manip avec le fichier .reg?

et redemarrer le pc apres le passgae de ot_move it?

Claudio44 · Answer

Je prends le train en route après avoir parcouru cette discussion (pour ma culture)
Je parcourais le forum pour voir les discussions sur les conseils d'antivirus (car je souhaite supprimer Norton) quand je suis tombé sur ce sujet.

Doit on en conclure que "Avast" est un mauvais antivirus ?

Merci pour ceux qui ont pris le temps de dépanner "Poulette"

poulette559 · Answer

oui k'ai deja fait
quand au dernier venu le pb n'est pas encore résolu
Dois je refaire la manip avec fix reg et le reste?

g!rly · Answer

je te prepare la manip je repost des que j´ai finie
@+

poulette559 · Answer

me revoilà j'ai été plus rapideeuh!!!lol voilà où j'en suis: salut J'ai supprimé qq programmes comme windows live messenger par ex et d'autres. J'ai relancé fixreg puis combofix.j'ai fait redémarrer puis j'ai éteint et rallumer mon pc. voici le rapport de combo fix: DllUnregisterServer procedure not found in C:\WINDOWS\system32\ddcdbcb.dll C:\WINDOWS\system32\ddcdbcb.dll NOT unregistered. File move failed. C:\WINDOWS\system32\ddcdbcb.dll scheduled to be moved on reboot. C:\WINDOWS\system32\ywichyua.dll unregistered successfully. File move failed. C:\WINDOWS\system32\ywichyua.dll scheduled to be moved on reboot. File/Folder C:\WINDOWS\system32\mgjqfvir.dll not found. File/Folder C:\WINDOWS\system32\cewtlepm.dll not found. DllUnregisterServer procedure not found in C:\WINDOWS\system32\ddcdbcb.dll C:\WINDOWS\system32\ddcdbcb.dll NOT unregistered. File move failed. C:\WINDOWS\system32\ddcdbcb.dll scheduled to be moved on reboot. File/Folder C:\WINDOWS\system32\pmnlm.dll not found. File/Folder C:\WINDOWS\system32\pwqwssne.dll not found. File/Folder C:\WINDOWS\system32\mpeltwec.ini not found. File/Folder C:\WINDOWS\system32\madtbhiu.exe not found. File/Folder C:\WINDOWS\system32\ckkudhxp.dll not found. File/Folder C:\WINDOWS\system32\cjuwemho.ini not found. File/Folder C:\WINDOWS\system32\fuukjmwi.exe not found. File/Folder C:\WINDOWS\system32 mp.reg not found. File/Folder C:\WINDOWS\system32\lftbdnta.ini not found. File/Folder C:\WINDOWS\system32\ftjislot.dll not found. Created on 11/28/2007 19:40:09 Quand je passe ma souris sur l'icone de spybot dans la barre de tache il y a marqué que 55900 processus ont été mis en liste noire! Ensuite j'ai fait une analyse avec spybot: --- Search result list --- Virtumonde.generic: [SBI $88EE1D0F] Réglages (Valeur du registre, nothing done) HKEY_CLASSES_ROOTCLSID\{A95B2816-1D7E-4561-A202-68C0DE02353A}\InprocServer32\=...C:\WINDOWS\SYSTEM32\YWICHYUA.DLL... Virtumonde.generic: [SBI $75DA8FD9] Bibliothèque (Fichier, nothing done) C:\WINDOWS\system32\ywichyua.dll Virtumonde.generic: [SBI $75DA8FD9] Bibliothèque (Fichier, nothing done) C:\WINDOWS\system32\ywichyua.dllbox Virtumonde.generic: [SBI $FFB000DB] Réglages (Clé du registre, nothing done) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\YWICHYUA Virtumonde.generic: [SBI $6026F3EE] Réglages (Valeur du registre, nothing done) HKEY_CLASSES_ROOTCLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}\InprocServer32\=...C:\WINDOWS\SYSTEM32\YWICHYUA.DLL... Virtumonde.generic: [SBI $8DF9F290] Class ID (Clé du registre, nothing done) HKEY_CLASSES_ROOT\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583} Virtumonde.generic: [SBI $2C44C86A] Class ID (Clé du registre, nothing done) HKEY_CLASSES_ROOT\CLSID\{A95B2816-1D7E-4561-A202-68C0DE02353A} Virtumonde.generic: [SBI $B8DFB189] Browser helper object (Clé du registre, nothing done) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A} Virtumonde.generic: [SBI $6ED3869C] Réglages utilisateur (Clé du registre, nothing done) HKEY_USERS\S-1-5-21-2315030208-30936638-2905759216-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{11A69AE4-FBED-4832-A2BF-45AF82825583} Virtumonde.generic: [SBI $CF6EBC66] Réglages utilisateur (Clé du registre, nothing done) HKEY_USERS\S-1-5-21-2315030208-30936638-2905759216-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A95B2816-1D7E-4561-A202-68C0DE02353A} BlueStreak: [SBI $4CDCC3D5] Cookie traceur (Internet Explorer: Moi) (Cookie, nothing done) DoubleClick: [SBI $4CDCC3D5] Cookie traceur (Internet Explorer: Moi) (Cookie, nothing done) Tradedoubler: [SBI $4CDCC3D5] Cookie traceur (Internet Explorer: Moi) (Cookie, nothing done) Adviva: [SBI $4CDCC3D5] Cookie traceur (Internet Explorer: Moi) (Cookie, nothing done) --- Spybot - Search & Destroy version: 1.5 (build: 20070830) --- 2007-08-31 blindman.exe (1.0.0.6) 2007-08-31 SDMain.exe (1.0.0.4) 2007-08-31 SDUpdate.exe (1.0.6.4) 2007-08-31 SDWinSec.exe (1.0.0.8) 2007-08-31 SpybotSD.exe (1.5.1.15) 2007-08-31 TeaTimer.exe (1.5.0.9) 2007-11-28 unins000.exe (51.46.0.0) 2007-08-31 Update.exe (1.4.0.5) 2007-08-31 advcheck.dll (1.5.3.0) 2007-04-02 aports.dll (2.1.0.0) 2007-04-02 DelZip179.dll (1.79.5.3) 2007-08-31 SDHelper.dll (1.5.0.8) 2007-08-31 Tools.dll (2.1.2.0) 2007-11-21 Includes\Cookies.sbi (*) 2007-10-31 Includes\Dialer.sbi (*) 2007-11-21 Includes\DialerC.sbi (*) 2007-11-07 Includes\Hijackers.sbi (*) 2007-11-21 Includes\HijackersC.sbi (*) 2007-10-04 Includes\Keyloggers.sbi (*) 2007-11-21 Includes\KeyloggersC.sbi (*) 2004-11-29 Includes\LSP.sbi (*) 2007-11-07 Includes\Malware.sbi (*) 2007-11-21 Includes\MalwareC.sbi (*) 2007-10-24 Includes\PUPS.sbi (*) 2007-11-21 Includes\PUPSC.sbi (*) 2007-11-21 Includes\Revision.sbi (*) 2007-05-30 Includes\Security.sbi (*) 2007-11-21 Includes\SecurityC.sbi (*) 2007-11-07 Includes\Spybots.sbi (*) 2007-11-21 Includes\SpybotsC.sbi (*) 2007-11-06 Includes\Tracks.uti 2007-11-14 Includes\Trojans.sbi (*) 2007-11-21 Includes\TrojansC.sbi (*) 2008-12-24 Plugins\TCPIPAddress.dll --- System information --- Windows XP (Build: 2600) Service Pack 2 (5.1.2600) / .NETFramework / 1.1: Microsoft .NET Framework 1.1 Hotfix (KB928366) / .NETFramework / 1.1: Microsoft .NET Framework 1.1 Service Pack 1 (KB867460) / Microsoft .NET Framework 2.0: This Security Update is for Microsoft .NET Framework 2.0. If you later install a more recent service pack, this Security Update will be uninstalled automatically. For more information, visit https://support.microsoft.com/en-us/help/917283/ms06-033-a-vulnerability-in-asp-net-could-allow-information-disclosure / Microsoft .NET Framework 2.0: This Security Update is for Microsoft .NET Framework 2.0. If you later install a more recent service pack, this Security Update will be uninstalled automatically. For more information, visit https://support.microsoft.com/en-us/help/922770 / Microsoft .NET Framework 2.0: This Security Update is for Microsoft .NET Framework 2.0. If you later install a more recent service pack, this Security Update will be uninstalled automatically. For more information, visit https://support.microsoft.com/en-us/help/928365/description-of-the-security-update-for-the-net-framework-2-0-for-windo / MSXML4SP2: FIX: ASP stops responding when calling Response.Redirect to another server using msxml4 sp2 / MSXML4SP2: Security update for MSXML4 SP2 (KB936181) / Step By Step Interactive Training / SP2: Mise à jour de sécurité pour Step by Step Interactive Training (KB898458) / Step By Step Interactive Training / SP2: Mise à jour de sécurité pour Step by Step Interactive Training (KB923723) / Windows / SP1: Microsoft Internationalized Domain Names Mitigation APIs / Windows / SP1: Microsoft National Language Support Downlevel APIs / Windows Media Player 6.4: Mise à jour de sécurité pour Lecteur Windows Media 6.4 (KB925398) / Windows Media Player 9: Mise à jour de sécurité pour Lecteur Windows Media 9 (KB917734) / Windows Media Player 9: Mise à jour de sécurité pour Lecteur Windows Media 9 (KB936782) / Windows XP: Mise à jour de sécurité pour Windows XP (KB923689) / Windows XP / SP0: Mise à jour de sécurité pour Windows Internet Explorer 7 (KB928090) / Windows XP / SP0: Mise à jour de sécurité pour Windows Internet Explorer 7 (KB929969) / Windows XP / SP0: Mise à jour de sécurité pour Windows Internet Explorer 7 (KB931768) / Windows XP / SP0: Mise à jour de sécurité pour Windows Internet Explorer 7 (KB933566) / Windows XP / SP0: Mise à jour de sécurité pour Windows Internet Explorer 7 (KB937143) / Windows XP / SP0: Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127) / Windows XP / SP0: Mise à jour de sécurité pour Windows Internet Explorer 7 (KB939653) / Windows XP / SP3: Correctif Windows XP - KB873339 / Windows XP / SP3: Correctif Windows XP - KB885250 / Windows XP / SP3: Correctif Windows XP - KB885835 / Windows XP / SP3: Correctif Windows XP - KB885836 / Windows XP / SP3: Correctif Windows XP - KB886185 / Windows XP / SP3: Correctif Windows XP - KB887472 / Windows XP / SP3: Correctif Windows XP - KB888113 / Windows XP / SP3: Correctif Windows XP - KB888302 / Windows XP / SP3: Correctif Windows XP - KB888310 / Windows XP / SP3: Correctif Windows XP - KB889673 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB890046) / Windows XP / SP3: Correctif Windows XP - KB890175 / Windows XP / SP3: Correctif Windows XP - KB890859 / Windows XP / SP3: Correctif Windows XP - KB891781 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB893756) / Windows XP / SP3: Windows Installer 3.1 (KB893803) / Windows XP / SP3: Mise à jour pour Windows XP (KB894391) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB896358) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB896422) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB896423) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB896424) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB896428) / Windows XP / SP3: Mise à jour pour Windows XP (KB896727) / Windows XP / SP3: Mise à jour pour Windows XP (KB898461) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB899587) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB899591) / Windows XP / SP3: Mise à jour pour Windows XP (KB900485) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB900725) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB901017) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB901214) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB902400) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB904706) / Windows XP / SP3: Mise à jour pour Windows XP (KB904942) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB905414) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB905749) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB908519) / Windows XP / SP3: Mise à jour pour Windows XP (KB908531) / Windows XP / SP3: Hotfix for Windows XP (KB909394) / Windows XP / SP3: Mise à jour pour Windows XP (KB910437) / Windows XP / SP3: Mise à jour pour Windows XP (KB911280) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB911562) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB911567) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB911927) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB912919) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB913580) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB914388) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB914389) / Windows XP / SP3: Correctif pour Windows XP (KB914440) / Windows XP / SP3: Hotfix for Windows XP (KB915865) / Windows XP / SP3: Mise à jour pour Windows XP (KB916595) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB917159) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB917344) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB917422) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB917953) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB918118) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB918439) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB918899) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB919007) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB920213) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB920214) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB920670) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB920683) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB920685) / Windows XP / SP3: Mise à jour pour Windows XP (KB920872) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB921398) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB921503) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB921883) / Windows XP / SP3: Mise à jour pour Windows XP (KB922582) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB922616) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB922760) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB922819) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB923191) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB923414) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB923694) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB923980) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB924191) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB924270) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB924496) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB924667) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB925486) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB925902) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB926255) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB926436) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB927779) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB927802) / Windows XP / SP3: Mise à jour pour Windows XP (KB927891) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB928255) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB928843) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB929123) / Windows XP / SP3: Mise à jour pour Windows XP (KB929338) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB930178) / Windows XP / SP3: Mise à jour pour Windows XP (KB930916) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB931261) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB931784) / Windows XP / SP3: Mise à jour pour Windows XP (KB931836) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB932168) / Windows XP / SP3: Mise à jour pour Windows XP (KB933360) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB933729) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB935839) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB935840) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB936021) / Windows XP / SP3: Mise à jour pour Windows XP (KB936357) / Windows XP / SP3: Mise à jour pour Windows XP (KB938828) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB938829) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB941202) / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB943460) / Windows XP OOB / SP10: High Definition Audio Driver Package - KB835221 --- Startup entries list --- Located: HK_LM:Run, !AVG Anti-Spyware command: "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized file: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe size: 6731312 MD5: CC6BC45DD5A58158645E7FB2953604FE Located: HK_LM:Run, avast! command: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe file: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe size: 79224 MD5: 8CF58586AE4577ED71FFE8883A6D4B3B Located: HK_LM:Run, NvCplDaemon command: RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup file: size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: HK_LM:RunOnce, Spybot - Search & Destroy command: "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck file: C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe size: 4943184 MD5: C92780F50B8BB7A89E919585916494A9 Located: HK_CU:Run, ALUAlert where: .DEFAULT... command: C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe file: size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: HK_CU:Run, CTFMON.EXE where: .DEFAULT... command: C:\WINDOWS\system32\CTFMON.EXE file: C:\WINDOWS\system32\CTFMON.EXE size: 15360 MD5: 5584247B568C2E53934873F4B655FE6A Located: HK_CU:Run, Picasa Media Detector where: .DEFAULT... command: C:\Program Files\Picasa2\PicasaMediaDetector.exe file: C:\Program Files\Picasa2\PicasaMediaDetector.exe size: 443968 MD5: 4F09BD29EEA4468BFF2FA64EDE88AE31 Located: HK_CU:Run, CTFMON.EXE where: S-1-5-19... command: C:\WINDOWS\system32\CTFMON.EXE file: C:\WINDOWS\system32\CTFMON.EXE size: 15360 MD5: 5584247B568C2E53934873F4B655FE6A Located: HK_CU:Run, CTFMON.EXE where: S-1-5-20... command: C:\WINDOWS\system32\CTFMON.EXE file: C:\WINDOWS\system32\CTFMON.EXE size: 15360 MD5: 5584247B568C2E53934873F4B655FE6A Located: HK_CU:Run, ctfmon.exe where: S-1-5-21-2315030208-30936638-2905759216-1006... command: C:\WINDOWS\system32\ctfmon.exe file: C:\WINDOWS\system32\ctfmon.exe size: 15360 MD5: 5584247B568C2E53934873F4B655FE6A Located: HK_CU:Run, CursorXP where: S-1-5-21-2315030208-30936638-2905759216-1006... command: C:\Program Files\CursorXP\CursorXP.exe file: C:\Program Files\CursorXP\CursorXP.exe size: 128000 MD5: 7B70742882445F1269FC49708AB39751 Located: HK_CU:Run, MsnMsgr where: S-1-5-21-2315030208-30936638-2905759216-1006... command: "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background file: size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: HK_CU:Run, Skype where: S-1-5-21-2315030208-30936638-2905759216-1006... command: "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized file: size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: HK_CU:Run, SpybotSD TeaTimer where: S-1-5-21-2315030208-30936638-2905759216-1006... command: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe file: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe size: 1460560 MD5: B7D4586BFC0DD6C3BE7DCCC252A3E97E Located: HK_CU:Run, SuperCopier2.exe where: S-1-5-21-2315030208-30936638-2905759216-1006... command: C:\Program Files\SuperCopier2\SuperCopier2.exe file: C:\Program Files\SuperCopier2\SuperCopier2.exe size: 1057280 MD5: 6A2FC790CD507336E05B7FAE29D79432 Located: HK_CU:Run, swg where: S-1-5-21-2315030208-30936638-2905759216-1006... command: C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe file: C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe size: 68856 MD5: E616A6A6E91B0A86F2F6217CDE835FFE Located: HK_CU:Run, ALUAlert where: S-1-5-18... command: C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe file: size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: HK_CU:Run, CTFMON.EXE where: S-1-5-18... command: C:\WINDOWS\system32\CTFMON.EXE file: C:\WINDOWS\system32\CTFMON.EXE size: 15360 MD5: 5584247B568C2E53934873F4B655FE6A Located: HK_CU:Run, Picasa Media Detector where: S-1-5-18... command: C:\Program Files\Picasa2\PicasaMediaDetector.exe file: C:\Program Files\Picasa2\PicasaMediaDetector.exe size: 443968 MD5: 4F09BD29EEA4468BFF2FA64EDE88AE31 Located: Démarrage (tous utilisateurs), Lancement rapide d'Adobe Reader.lnk where: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage... command: C:\Program Files\Adobe\Acrobat 7.0\Reader eader_sl.exe file: C:\Program Files\Adobe\Acrobat 7.0\Reader eader_sl.exe size: 29696 MD5: 43362B96870CE8649F4F2EC893DA93F0 Located: Démarrage (utilisateur), Enregistrement d'un produit Joint Operations Typhoon Rising.lnk where: C:\Documents and Settings\Moi\Menu Démarrer\Programmes\Démarrage... command: C:\Documents and Settings\Moi\Local Settings\Temp\{CCFC9AE2-C6A8-4EBA-AD4D-86A557E53170}\{0325F1C1-883A-41AB-8981-B27359ABDFAF}\NOVG.EXE file: size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: WinLogon, crypt32chain command: crypt32.dll file: crypt32.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: WinLogon, cryptnet command: cryptnet.dll file: cryptnet.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: WinLogon, cscdll command: cscdll.dll file: cscdll.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: WinLogon, ddcdbcb command: ddcdbcb.dll file: ddcdbcb.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: WinLogon, ScCertProp command: wlnotify.dll file: wlnotify.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: WinLogon, Schedule command: wlnotify.dll file: wlnotify.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: WinLogon, sclgntfy command: sclgntfy.dll file: sclgntfy.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: WinLogon, SensLogn command: WlNotify.dll file: WlNotify.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: WinLogon, termsrv command: wlnotify.dll file: wlnotify.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: WinLogon, WgaLogon command: WgaLogon.dll file: WgaLogon.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: WinLogon, wlballoon command: wlnotify.dll file: wlnotify.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: WinLogon, ywichyua command: ywichyua.dll file: ywichyua.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! --- Browser helper object list --- {1105EDDA-0BE7-4F40-91D0-369944E296A0} () location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ BHO name: CLSID name: {1B706E98-55B5-4157-A003-D2DA51456C15} () location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ BHO name: CLSID name: Path: C:\WINDOWS\system32\ Long name: mljgg.dll Short name: Date (created): 28/11/2007 19:18:54 Date (last access): 28/11/2007 19:18:54 Date (last write): 28/11/2007 19:18:54 Filesize: 329312 Attributes: archive MD5: C5957B2B1EB7753D08496BC5AD904D0B CRC32: 061BFADE {2ABAAC42-84DF-4C00-89DA-BC7EB2B0E70B} () location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ BHO name: CLSID name: Path: C:\WINDOWS\system32\ Long name: ddcdbcb.dll Short name: Date (created): 24/11/2007 20:11:08 Date (last access): 28/11/2007 19:49:12 Date (last write): 24/11/2007 20:11:08 Filesize: 38912 Attributes: archive MD5: 488BEFC625A7A519A7839815BD892949 CRC32: 0EBA4FC1 {5CA3D70E-1895-11CF-8E15-001234567890} (DriveLetterAccess) location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ BHO name: CLSID name: DriveLetterAccess description: Hewlett-Packard's DLA software classification: Unknown known filename: tfswshx.dll info link: info source: TonyKlein Path: C:\WINDOWS\system32\dla\ Long name: tfswshx.dll Short name: Date (created): 11/11/2005 10:33:22 Date (last access): 28/11/2007 19:04:50 Date (last write): 06/12/2004 02:05:00 Filesize: 118842 Attributes: archive MD5: 37943B990D318145D1EFCBEEF8F9566A CRC32: C6D87067 Version: 1.4.8.0 {A95B2816-1D7E-4561-A202-68C0DE02353A} () location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ BHO name: CLSID name: Path: C:\WINDOWS\system32\ Long name: ywichyua.dll Short name: Date (created): 28/11/2007 12:38:50 Date (last access): 28/11/2007 19:58:50 Date (last write): 28/11/2007 12:38:50 Filesize: 145984 Attributes: archive MD5: 87D686E92CB00FAAEFA7DB9B272527D0 CRC32: 9BC1FCA2 {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper) location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ BHO name: CLSID name: Google Toolbar Helper description: Google toolbar classification: Open for discussion known filename: googletoolbar.dll
googletoolbar*.dll
(* = number)
googletoolbar_en_*.**-big.dll
Googletoolbar_en_*.*.**-deleon.dll info link: http://www.google.com/intl/fr/toolbar/ie/index.html info source: TonyKlein Path: c:\program files\google\ Long name: GoogleToolbar2.dll Short name: GOOGLE~2.DLL Date (created): 05/08/2007 15:28:32 Date (last access): 28/11/2007 19:23:26 Date (last write): 19/01/2007 22:56:04 Filesize: 2436160 Attributes: readonly archive MD5: 6D44E0C3B43D27484FBB355E470C4188 CRC32: 2DE875CD Version: 4.0.1601.4978 {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO) location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ BHO name: CLSID name: Google Toolbar Notifier BHO Path: C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\ Long name: swg.dll Short name: Date (created): 28/08/2007 18:17:10 Date (last access): 28/11/2007 19:04:50 Date (last write): 28/08/2007 18:17:10 Filesize: 325048 Attributes: archive MD5: 1DC47CA76A0FFEAA25B45DE5706F2115 CRC32: E2052360 Version: 2.0.301.7164 {b69e2b35-a60a-4140-83b1-75a97c0fcef7} ({7fecf0c7-9a57-1b38-0414-a06a53b2e96b}) location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ BHO name: {7fecf0c7-9a57-1b38-0414-a06a53b2e96b} CLSID name: Path: C:\WINDOWS\system32\ Long name: mgjqfvir.dll --- ActiveX list --- {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) DPF name: CLSID name: BDSCANONLINE Control Installer: C:\WINDOWS\Downloaded Program Files\oscan8.inf Codebase: http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab description: classification: Legitimate known filename: oscan8.ocx info link: info source: Safer Networking Ltd. Path: C:\WINDOWS\DOWNLO~1\ Long name: oscan8.ocx Short name: Date (created): 25/10/2007 16:54:18 Date (last access): 28/11/2007 13:05:34 Date (last write): 25/10/2007 16:54:18 Filesize: 471040 Attributes: archive MD5: BC4E154A06C9208EF36669B1B9E5FDAD CRC32: DF08A08D Version: 1.0.0.1 {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.2) DPF name: Java Runtime Environment 1.4.2 CLSID name: Java Plug-in 1.4.2_03 Installer: Codebase: https://www.oracle.com/java/technologies/ description: Sun Java classification: Legitimate known filename: %PROGRAM FILES%\JabaSoft\JRE\*\Bin pjava131.dll info link: info source: Patrick M. Kolla Path: C:\Program Files\Java\j2re1.4.2_03\bin\ Long name: NPJPI142_03.dll Short name: NPJPI1~1.DLL Date (created): 19/11/2003 18:48:18 Date (last access): 14/11/2007 19:03:36 Date (last write): 19/11/2003 18:48:12 Filesize: 65650 Attributes: archive MD5: 2AD31341BE41AC9B086128AD86A2B53F CRC32: 081CFB35 Version: 1.4.2.30 {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} (Java Runtime Environment 1.4.2) DPF name: Java Runtime Environment 1.4.2 CLSID name: Java Plug-in 1.4.2_03 Installer: Codebase: https://www.oracle.com/java/technologies/ description: classification: Legitimate known filename: npjpi142_03.dll info link: info source: Safer Networking Ltd. Path: C:\Program Files\Java\j2re1.4.2_03\bin\ Long name: NPJPI142_03.dll Short name: NPJPI1~1.DLL Date (created): 19/11/2003 18:48:18 Date (last access): 28/11/2007 20:05:40 Date (last write): 19/11/2003 18:48:12 Filesize: 65650 Attributes: archive MD5: 2AD31341BE41AC9B086128AD86A2B53F CRC32: 081CFB35 Version: 1.4.2.30 {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) DPF name: CLSID name: Shockwave Flash Object Installer: C:\WINDOWS\Downloaded Program Files\swflash.inf Codebase: http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab description: Macromedia Shockwave Flash Player classification: Legitimate known filename: info link: info source: Patrick M. Kolla Path: C:\WINDOWS\system32\Macromed\Flash\ Long name: Flash9.ocx Short name: Date (created): 22/06/2006 13:44:22 Date (last access): 28/11/2007 19:31:24 Date (last write): 22/06/2006 13:44:22 Filesize: 2201224 Attributes: readonly archive MD5: 99F80CA1EBE95677668F54CAC6F4AD6D CRC32: B7385E3B Version: 9.0.16.0 --- Process list --- PID: 0 ( 0) [System] PID: 744 ( 0) \SystemRoot\System32\smss.exe size: 50688 PID: 792 ( 0) \??\C:\WINDOWS\system32\csrss.exe size: 6144 PID: 816 ( 0) \??\C:\WINDOWS\system32\winlogon.exe size: 506368 PID: 864 ( 0) C:\WINDOWS\system32\services.exe size: 108544 MD5: 732E0B1ABAACE15D80EC19056B0A2AF9 PID: 876 ( 0) C:\WINDOWS\system32\lsass.exe size: 13312 MD5: 9F3744A5C6F49291A7A685040A013399 PID: 1140 ( 0) C:\WINDOWS\system32\svchost.exe size: 14336 MD5: 1BD6C2F707A275CB7C16FD99FE0F31CA PID: 1208 ( 0) C:\WINDOWS\system32\svchost.exe size: 14336 MD5: 1BD6C2F707A275CB7C16FD99FE0F31CA PID: 1248 ( 0) C:\WINDOWS\System32\svchost.exe size: 14336 MD5: 1BD6C2F707A275CB7C16FD99FE0F31CA PID: 1328 ( 0) C:\WINDOWS\system32\svchost.exe size: 14336 MD5: 1BD6C2F707A275CB7C16FD99FE0F31CA PID: 1392 ( 0) C:\WINDOWS\system32\svchost.exe size: 14336 MD5: 1BD6C2F707A275CB7C16FD99FE0F31CA PID: 1480 ( 0) C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe size: 16248 MD5: 765E0E2BDB83C58FFC411DA401D8BA66 PID: 1552 ( 0) C:\Program Files\Alwil Software\Avast4\ashServ.exe size: 132472 MD5: 47DF7F40F77FCE0A134021C6BF0FF52A PID: 1768 ( 0) C:\WINDOWS\Explorer.EXE size: 1037312 MD5: D0288319660EDCFED07C7E74C4EA38A5 PID: 1908 ( 0) C:\WINDOWS\system32\spoolsv.exe size: 57856 MD5: DA81EC57ACD4CDC3D4C51CF3D409AF9F PID: 2024 ( 0) C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe size: 312880 MD5: 5DCD235C061022BCDA9AA48670B64211 PID: 264 ( 0) C:\WINDOWS\system32\drivers\CDAC11BA.EXE size: 54784 MD5: 9BDBDA21D3BA8E374FD06A405BE10215 PID: 320 ( 0) C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe size: 86140 MD5: D43E91E271C041BB86A6223462A41D28 PID: 368 ( 0) C:\WINDOWS\system32 vsvc32.exe size: 127043 MD5: 153C0BA143A174B38CB06338C6EF4CC5 PID: 476 ( 0) C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe size: 79224 MD5: 8CF58586AE4577ED71FFE8883A6D4B3B PID: 572 ( 0) C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe size: 6731312 MD5: CC6BC45DD5A58158645E7FB2953604FE PID: 584 ( 0) C:\WINDOWS\system32\svchost.exe size: 14336 MD5: 1BD6C2F707A275CB7C16FD99FE0F31CA PID: 636 ( 0) C:\Program Files\CursorXP\CursorXP.exe size: 128000 MD5: 7B70742882445F1269FC49708AB39751 PID: 696 ( 0) C:\WINDOWS\system32\ctfmon.exe size: 15360 MD5: 5584247B568C2E53934873F4B655FE6A PID: 788 ( 0) C:\Program Files\SuperCopier2\SuperCopier2.exe size: 1057280 MD5: 6A2FC790CD507336E05B7FAE29D79432 PID: 1016 ( 0) C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe size: 68856 MD5: E616A6A6E91B0A86F2F6217CDE835FFE PID: 1268 ( 0) C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe size: 1460560 MD5: B7D4586BFC0DD6C3BE7DCCC252A3E97E PID: 2296 ( 0) C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe size: 243064 MD5: 3F4A782FECFA42AB86CEA759EB929106 PID: 2380 ( 0) C:\Program Files\Alwil Software\Avast4\ashWebSv.exe size: 345464 MD5: CDED5892E327CDCBB64E598AE6C4E3E3 PID: 2496 ( 0) C:\WINDOWS\System32\alg.exe size: 44544 MD5: 2FE681D10C5FC343DBBC0610B8DD4D24 PID: 2880 ( 0) C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe size: 4943184 MD5: C92780F50B8BB7A89E919585916494A9 PID: 3292 ( 0) C:\WINDOWS\system32\NOTEPAD.EXE size: 70656 MD5: 16F769BC1D37CC14E3093B9881CF1691 --- Browser start & search pages list --- Spybot - Search & Destroy browser pages report, 28/11/2007 20:05:39 HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page C:\windows\system32\blank.htm HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page https://www.google.fr/?gws_rd=ssl HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default_Search_URL http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\@ http://home.microsoft.com/access/autosearch.asp?p=%s HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page C:\windows\system32\blank.htm HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm --- Winsock Layered Service Provider list --- --- Uninstall list --- (ABBYY FineReader 5.0 Sprint) (AddressBook) 1.0 (Adobe PhotoDeluxe Business Edition 1.0 Tryout) install location: C:\Program Files\PhotoDeluxe BE 1.0 TO install source: C:\DOCUME~1\MOI\LOCALS~1\TEMP\~EXB0000\ uninstall cmd: C:\WINDOWS\UNINST.EXE -f"C:\Program Files\PhotoDeluxe BE 1.0 TO\DeIsL1.isu" publisher: Adobe Systems, Inc. Ecran de veille AOL Photos (AOL YGP Screensaver) uninstall cmd: C:\Program Files\Fichiers communs\AOL\Screensaver\uninst_ygpss.exe (AudioPlugin.dll) uninstall cmd: C:\WINDOWS\system32\MSIEXEC.EXE /x {AB708C9B-97C8-4AC9-899B-DBF226AC9382} avast! Antivirus 4.7 (avast!) version (major): 4 version (minor): 7 install location: C:\PROGRA~1\ALWILS~1\Avast4 install source: C:\DOCUME~1\Moi\LOCALS~1\TEMPOR~1\Content.IE5\67HR1TC4 uninstall cmd: rundll32 C:\PROGRA~1\ALWILS~1\Avast4\Setup\setiface.dll,RunSetup publisher: Alwil Software help link: https://www.avast.com/fr-fr/index AVG Anti-Spyware 7.5 (AVGAntiSpyware75) install location: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5 uninstall cmd: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe publisher: Grisoft Ltd. help link: https://www.avg.com/fr-fr/homepage Azureus 2.5.0.0 (Azureus) install location: C:\Program Files\Azureus uninstall cmd: C:\Program Files\Azureus\Uninstall.exe (Branding) BSPlayer (BSPlayer1) uninstall cmd: "C:\Program Files\Webteh\BSplayer\uninstall.exe" SafeCast Shared Components (CdaC13Ba) version (major): 2 version (minor): 20 install location: C:\Program Files\Fichiers communs\Macrovision Shared\SafeCast\Install\ uninstall cmd: C:\Program Files\Fichiers communs\Macrovision Shared\SafeCast\Install\CDAC13BA.EXE /uninstall publisher: Macrovision CloneCD (CloneCD) install location: C:\Program Files\Elaborate Bytes\CloneCD uninstall cmd: "C:\Program Files\Elaborate Bytes\CloneCD\ccd-uninst.exe" /D="C:\Program Files\Elaborate Bytes\CloneCD" publisher: Elaborate Bytes (Connection Manager) (CopyNow.dll) uninstall cmd: C:\WINDOWS\system32\MSIEXEC.EXE /x {B12665F4-4E93-4AB4-B7FC-37053B524629} CursorXP (CursorXP) uninstall cmd: C:\Program Files\CursorXP\CurXPUtil.exe -u (DataPlugin.dll) uninstall cmd: C:\WINDOWS\system32\MSIEXEC.EXE /x {075473F5-846A-448B-BCB3-104AA1760205} Dell Photo AIO Printer 922 (Dell Photo AIO Printer 922) uninstall cmd: C:\WINDOWS\system32\spool\drivers\w32x86\3\DLBTUNST.EXE -NOLICENSE (DirectAnimation) (DirectDrawEx) (dlatray.exe) uninstall cmd: C:\WINDOWS\system32\MSIEXEC.EXE /x {1206EF92-2E83-4859-ACCB-2048C3CB7DA6} (DS Legends of Aranna 1.0) version (major): 1 install location: C:\Program Files\Microsoft Games\Dungeon Siege publisher: Microsoft Dungeon Siege 2 (DungeonSiege2) install location: C:\Program Files\Microsoft Games\Dungeon Siege 2 uninstall cmd: "C:\Program Files\Microsoft Games\Dungeon Siege 2\UNINSTAL.EXE" /runtemp /uninstall publisher: Microsoft help link: https://support.microsoft.com/en-us readme: C:\Program Files\Microsoft Games\Dungeon Siege 2\Lisezmoi.rtf (DXM_Runtime) Easy Internet Cleaner (Easy Internet Cleaner) uninstall cmd: C:\Program Files\Easy Internet Cleaner\Uninstal.exe (Fontcore) FoxTarot version 4.1.7 (FoxTarot4_is1) install location: C:\Program Files\FoxTarot4\ uninstall cmd: "C:\Program Files\FoxTarot4\unins000.exe" publisher: Fabrice Renard FullProf_Suite March - 2005 (FullProf_Suite) uninstall cmd: C:\Program Files\FullProf_Suite\UnInstall_20338.exe publisher: FullProf Suite GUILD WARS (Guild Wars) uninstall cmd: "C:\Program Files\GUILD WARS\Gw.exe" -uninstall HijackThis 2.0.2 2.0.2 (HijackThis) uninstall cmd: "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall publisher: TrendMicro (ICW) Microsoft Internationalized Domain Names Mitigation APIs (IDNMitigationAPIs) install date: 20061128 uninstall cmd: "C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe" publisher: Microsoft Corporation (IE40) (IE4Data) (IE5BAKEX) Windows Internet Explorer 7 20061107.210142 (ie7) install date: 20061128 uninstall cmd: "C:\WINDOWS\ie7\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/office/internet-explorer-help-23360e49-9cd3-4dda-ba52-705336cc0de2?ui=en-US&rs=en-001&ad=US (IEData) (InstallShield Uninstall Information) High Definition Audio Driver Package - KB835221 20040219.000000 (KB835221WXP) uninstall cmd: C:\WINDOWS\$NtUninstallKB835221WXP$\spuninst\spuninst.exe publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us Correctif Windows XP - KB873339 20041117.092459 (KB873339) publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/873339 (KB884016) Correctif Windows XP - KB885250 20050118.202711 (KB885250) publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/885250 Correctif Windows XP - KB885835 20041027.181713 (KB885835) publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/885835/ms04-044-vulnerabilities-in-windows-kernel-and-lsass-could-allow-eleva Correctif Windows XP - KB885836 20041028.173203 (KB885836) uninstall cmd: C:\WINDOWS\$NtUninstallKB885836$\spuninst\spuninst.exe publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/885836/ms04-041-a-vulnerability-in-wordpad-could-allow-code-execution Correctif Windows XP - KB886185 20041021.090540 (KB886185) uninstall cmd: C:\WINDOWS\$NtUninstallKB886185$\spuninst\spuninst.exe publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/886185 Correctif Windows XP - KB887472 20041014.162858 (KB887472) publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/887472 Correctif Windows XP - KB888113 20041116.131036 (KB888113) publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/888113 Correctif Windows XP - KB888302 20041207.111426 (KB888302) uninstall cmd: C:\WINDOWS\$NtUninstallKB888302$\spuninst\spuninst.exe publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/888302 Correctif Windows XP - KB888310 20041027.095746 (KB888310) publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/888310 Correctif Windows XP - KB889673 20041116.085848 (KB889673) publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/889673 Mise à jour de sécurité pour Windows XP (KB890046) 1 (KB890046) install date: 20060905 uninstall cmd: "C:\WINDOWS\$NtUninstallKB890046$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/890046 Correctif Windows XP - KB890175 20041201.233338 (KB890175) publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/890175/ms05-001-vulnerability-in-html-help-could-allow-code-execution Correctif Windows XP - KB890859 1 (KB890859) install date: 20060905 uninstall cmd: "C:\WINDOWS\$NtUninstallKB890859$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/890859 Correctif Windows XP - KB891781 20050110.165439 (KB891781) publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/891781 Mise à jour de sécurité pour Windows XP (KB893756) 1 (KB893756) install date: 20060905 uninstall cmd: "C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/893756 (KB893803) Windows Installer 3.1 (KB893803) 3.1 (KB893803v2) uninstall cmd: "C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/893803/windows-installer-3-1-v2-3-1-4000-2435-is-available Mise à jour pour Windows XP (KB894391) 1 (KB894391) install date: 20060905 uninstall cmd: "C:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/894391/ Mise à jour de sécurité pour Windows XP (KB896358) 1 (KB896358) install date: 20060905 uninstall cmd: "C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/896358/ms05-026-a-vulnerability-in-html-help-could-allow-remote-code-executio Mise à jour de sécurité pour Windows XP (KB896422) 1 (KB896422) publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/896422/ms05-027-vulnerability-in-server-message-block-could-allow-remote-code Mise à jour de sécurité pour Windows XP (KB896423) 1 (KB896423) install date: 20060905 uninstall cmd: "C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/windows?ui=en-US&rs=en-001&ad=US Mise à jour de sécurité pour Windows XP (KB896424) 1 (KB896424) install date: 20060905 uninstall cmd: "C:\WINDOWS\$NtUninstallKB896424$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/896424 Mise à jour de sécurité pour Windows XP (KB896428) 1 (KB896428) install date: 20060905 uninstall cmd: "C:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/896428 Mise à jour pour Windows XP (KB896727) 1 (KB896727) publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/896727 Mise à jour de sécurité pour Step by Step Interactive Training (KB898458) 20050502.101010 (KB898458) install date: 20060905 uninstall cmd: "C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/898458 Mise à jour pour Windows XP (KB898461) 1 (KB898461) install date: 20060905 uninstall cmd: "C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/898461/ Mise à jour de sécurité pour Windows XP (KB899587) 1 (KB899587) install date: 20060905 uninstall cmd: "C:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/899587 Mise à jour de sécurité pour Windows XP (KB899591) 1 (KB899591) install date: 20060905 uninstall cmd: "C:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/899591 Mise à jour pour Windows XP (KB900485) 2 (KB900485) install date: 20060905 uninstall cmd: "C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/900485 Mise à jour de sécurité pour Windows XP (KB900725) 1 (KB900725) install date: 20060905 uninstall cmd: "C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/900725 Mise à jour de sécurité pour Windows XP (KB901017) 1 (KB901017) install date: 20060905 uninstall cmd: "C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/901017 Mise à jour de sécurité pour Windows XP (KB901214) 1 (KB901214) publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/901214 Mise à jour de sécurité pour Windows XP (KB902400) 1 (KB902400) install date: 20060905 uninstall cmd: "C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/902400/ms05-051-vulnerabilities-in-ms-dtc-and-com-could-allow-remote-code-exe Mise à jour de sécurité pour Windows XP (KB904706) 2 (KB904706) install date: 20060905 uninstall cmd: "C:\WINDOWS\$NtUninstallKB904706$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/904706 Mise à jour pour Windows XP (KB904942) 2 (KB904942) install date: 20061128 uninstall cmd: "C:\WINDOWS\$NtUninstallKB904942$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/904942/authentication-fails-when-you-use-outlook-or-outlook-express-to-try-to Mise à jour de sécurité pour Windows XP (KB905414) 1 (KB905414) install date: 20060905 uninstall cmd: "C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/905414 Mise à jour de sécurité pour Windows XP (KB905749) 1 (KB905749) install date: 20060905 uninstall cmd: "C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/905749 Mise à jour de sécurité pour Windows XP (KB908519) 1 (KB908519) install date: 20060905 uninstall cmd: "C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/908519 Mise à jour pour Windows XP (KB908531) 2 (KB908531) install date: 20060905 uninstall cmd: "C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/908531 Hotfix for Windows XP (KB909394) 1 (KB909394) install date: 20071118 uninstall cmd: "C:\WINDOWS\$NtUninstallKB909394$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/909394 Mise à jour pour Windows XP (KB910437) 1 (KB910437) install date: 20060905 uninstall cmd: "C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/910437 Mise à jour pour Windows XP (KB911280) 2 (KB911280) install date: 20060905 uninstall cmd: "C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/911280 Mise à jour de sécurité pour Windows XP (KB911562) 1 (KB911562) install date: 20060905 uninstall cmd: "C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/911562 Mise à jour de sécurité pour Lecteur Windows Media (KB911564) (KB911564) install date: 20060905 uninstall cmd: "C:\WINDOWS\$NtUninstallKB911564$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/911564 Mise à jour de sécurité pour Windows XP (KB911567) 1 (KB911567) install date: 20060905 uninstall cmd: "C:\WINDOWS\$NtUninstallKB911567$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/911567 Mise à jour de sécurité pour Windows XP (KB911927) 1 (KB911927) install date: 20060905 uninstall cmd: "C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/911927 Mise à jour de sécurité pour Windows XP (KB912919) 1 (KB912919) install date: 20060905 uninstall cmd: "C:\WINDOWS\$NtUninstallKB912919$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/912919 Mise à jour de sécurité pour Windows XP (KB913580) 1 (KB913580) install date: 20060905 uninstall cmd: "C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe" publis

g!rly · Answer

re,

telecharge ce fichier sur ton bureau et dezip le

http://serveur1.archive-host.com/membres/up/1366464061/poulette.rar

quitte internet et double clique sur poulette.reg => tu dois obligatoirement avoir un message "voulez-vous vraiment ajouter les informations contenues dans ce fichier .reg au registre ?"
Si c'est bien le cas, clique sur "oui" 

double-click sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

Citation :

C:\WINDOWS\system32\ywichyua.dllbox
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\ywichyua.dll
C:\WINDOWS\system32\ddcdbcb.dll
C:\WINDOWS\system32\mgjqfvir.dll
C:\WINDOWS\system32\ywichyua.dll
C:\WINDOWS\system32\pmkji.dll

Click sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
click sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.
Ps : il te sera peut-être demander de redémarrer le pc pour achever la suppression. Si c'est le cas accepte par Yes.
http://img137.imageshack.us/img137/3558/refaitjk8.th.jpg 

puis vraiment j´insiste pour que tu remplace avast par antivir

car on va s´en servir pour scanner le pc

il est bien plus performant qu´avast, juge par toi meme

Antivir vs Avast :

->http://forum.malekal.com/ftopic3528.php

antivir :

->https://www.malekal.com/avira-free-security-antivirus-gratuit/

http://mickael.barroux.free.fr/securite/antivir.php <- tutoriel configuration du scanner... 

puis lance le scan complet du pc avec antivir et post le resultat du scan ici avec celui de ot_move it

@+

poulette559 · Answer

voici le genre de demande que me fait spybot:
catégorie: systeme startup user
modif: valuer supprimé
element: spybot deletingB3986
ancienne valeure: command/c del "C:\windows\syste32\ywichyua.dllbox
que faire de ça? autoriser ou refuser?
je faire faire le reste
a+

poulette559 · Answer

voici lle rapport de antivir:


AntiVir PersonalEdition Classic
Report file date: mercredi 28 novembre 2007  22:17

Scanning for 952430 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Username:         Moi
Computer name:    JULIE

Version information:
BUILD.DAT    : 270           15603 Bytes  19/09/2007 13:32:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes  23/08/2007 13:16:29
AVSCAN.DLL   : 7.0.6.0       49192 Bytes  16/08/2007 12:23:51
LUKE.DLL     : 7.0.5.3      147496 Bytes  14/08/2007 15:32:47
LUKERES.DLL  : 7.0.6.1       10280 Bytes  21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes  18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.0.0     1640448 Bytes  13/09/2007 14:26:55
ANTIVIR2.VDF : 7.0.1.0     1393152 Bytes  23/11/2007 21:04:46
ANTIVIR3.VDF : 7.0.1.19     153600 Bytes  28/11/2007 21:04:46
AVEWIN32.DLL : 7.6.0.34    3125760 Bytes  28/11/2007 21:04:46
AVWINLL.DLL  : 1.0.0.7       14376 Bytes  26/02/2007 10:36:26
AVPREF.DLL   : 7.0.2.2       25640 Bytes  18/07/2007 07:39:17
AVREP.DLL    : 7.0.0.1      155688 Bytes  16/04/2007 13:16:24
AVPACK32.DLL : 7.3.0.15     360488 Bytes  03/08/2007 08:46:00
AVREG.DLL    : 7.0.1.6       30760 Bytes  18/07/2007 07:17:06
AVARKT.DLL   : 1.0.0.20     278568 Bytes  28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes  18/07/2007 07:10:18
NETNT.DLL    : 7.0.0.0        7720 Bytes  08/03/2007 11:09:42
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes  07/08/2007 12:38:13
RCTEXT.DLL   : 7.0.62.0      86056 Bytes  21/08/2007 12:50:37
SQLITE3.DLL  : 3.3.17.1     339968 Bytes  23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Local Drives
Configuration file...............: c:\program files\avira\antivir personaledition classic\alldrives.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: L:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: mercredi 28 novembre 2007  22:17

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'guardgui.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'ashWebSv.exe' - '1' Module(s) have been scanned
Scan process 'ashMaiSv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'IAANTMon.exe' - '1' Module(s) have been scanned
Scan process 'CDAC11BA.EXE' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '0' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'reader_sl.exe' - '1' Module(s) have been scanned
Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
Scan process 'SuperCopier2.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'CursorXP.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avgas.exe' - '1' Module(s) have been scanned
Scan process 'ashDisp.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'ashServ.exe' - '1' Module(s) have been scanned
Scan process 'aswUpdSv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
36 processes with 36 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
      [NOTE]      No virus was found!
Boot sector 'F:\'
      [NOTE]      In the drive 'F:\' no data medium is inserted!
Boot sector 'G:\'
      [NOTE]      In the drive 'G:\' no data medium is inserted!
Boot sector 'H:\'
      [NOTE]      In the drive 'H:\' no data medium is inserted!
Boot sector 'J:\'
      [NOTE]      In the drive 'J:\' no data medium is inserted!

Starting to scan the registry.
The registry was scanned ( '31' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\hiberfil.sys
      [WARNING]   The file could not be opened!
C:\pagefile.sys
      [WARNING]   The file could not be opened!
C:\qoobox\Quarantine\C\WINDOWS\system32\pmkji.dll.vir
      [DETECTION] Is the Trojan horse TR/Trash.Gen
      [INFO]      The file was moved to '47b8e737.qua'!
C:\qoobox\Quarantine\C\WINDOWS\system32\pmnlm.dll.vir
      [DETECTION] Is the Trojan horse TR/Trash.Gen
      [INFO]      The file was moved to '47bbe73a.qua'!
C:\VundoFix Backups\eqkrrvtk.dll.bad
      [DETECTION] Is the Trojan horse TR/Vundo.CA
      [INFO]      The file was moved to '47b8e741.qua'!
C:\VundoFix Backups\uqtodzqm.dll.bad
      [DETECTION] Is the Trojan horse TR/Vundo.CA
      [INFO]      The file was moved to '47c1e742.qua'!
C:\WINDOWS\system32\mljgg.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!
C:\WINDOWS\system32\drivers\dtscsi.sys
      [WARNING]   The file could not be opened!
C:\WINDOWS\system32\drivers\sptd.sys
      [WARNING]   The file could not be opened!
C:\WINDOWS\system32\drivers\sptd8157.sys
      [WARNING]   The file could not be opened!
C:\_OTMoveIt\MovedFiles\WINDOWS\system32\cewtlepm.dll
      [DETECTION] Is the Trojan horse TR/Vundo.AU
      [INFO]      The file was moved to '47c4e918.qua'!
C:\_OTMoveIt\MovedFiles\WINDOWS\system32\ckkudhxp.dll
      [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
      [INFO]      The file was moved to '47b8e921.qua'!
C:\_OTMoveIt\MovedFiles\WINDOWS\system32\ftjislot.dll
      [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
      [INFO]      The file was moved to '47b7e92c.qua'!
C:\_OTMoveIt\MovedFiles\WINDOWS\system32\fuukjmwi.exe
      [DETECTION] Is the Trojan horse TR/Fotomoto.F.1
      [INFO]      The file was moved to '47c2e92f.qua'!
C:\_OTMoveIt\MovedFiles\WINDOWS\system32\madtbhiu.exe
      [DETECTION] Is the Trojan horse TR/Fotomoto.F.1
      [INFO]      The file was moved to '47b1e91e.qua'!
C:\_OTMoveIt\MovedFiles\WINDOWS\system32\mgjqfvir.dll
      [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
      [INFO]      The file was moved to '47b7e926.qua'!
C:\_OTMoveIt\MovedFiles\WINDOWS\system32\pwqwssne.dll
      [DETECTION] Is the Trojan horse TR/Vundo.CA
      [INFO]      The file was moved to '47bee938.qua'!
Begin scan in 'F:\'
Search path F:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'G:\'
Search path G:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'H:\'
Search path H:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'J:\'
Search path J:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'D:\'
Search path D:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'E:\'
Search path E:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'K:\' <NWN2>
Begin scan in 'L:\'
Search path L:\ could not be opened!
Le périphérique n'est pas prêt.



End of the scan: mercredi 28 novembre 2007  23:20
Used time:  1:03:05 min

The scan has been done completely.

   4508 Scanning directories
 282238 Files were scanned
     12 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
     11 files were moved to quarantine
      0 files were renamed
      5 Files cannot be scanned
 282226 Files not concerned
   8581 Archives were scanned
      6 Warnings
      2 Notes

et celui de otmove it:
File/Folder C:\WINDOWS\system32\ywichyua.dllbox not found.
C:\WINDOWS\system32\mcrh.tmp moved successfully.
File/Folder C:\WINDOWS\system32\ywichyua.dll not found.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\ddcdbcb.dll
C:\WINDOWS\system32\ddcdbcb.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\ddcdbcb.dll scheduled to be moved on reboot.
File/Folder C:\WINDOWS\system32\mgjqfvir.dll not found.
File/Folder C:\WINDOWS\system32\ywichyua.dll not found.
File/Folder C:\WINDOWS\system32\pmkji.dll not found.
 
Created on 11/28/2007 22:11:54

poulette559 · Answer

je tiens à préciser également que antivir me detecte un trojan à peu prés toute les 30s ,voire moins et que je le mets en quarantaine. Hier au soir j'en étais à 130...
quelles sont les prochaines étapes?

g!rly · Answer

bonjour poulette,

oui je voie antivir n´as pas pu supprimer une dll 

peux tu refaire un scan avec antivir en mode sans echec stp

> Redémarre en mode sans échec : 

   Comment redémarrer en mode sans echec? 

   Tu redemarre le pc et tapote la touche F8 des le début de l allumage sans t´arrêter.
   Une fenêtre sur fond noir va s’ouvrir, tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
   capture d´ecran : http://www.coupdepoucepc.com/images_cdppc4/fichespratiques/windowsxp/modese/modese2.jpg
   Une fois sur le bureau si il n y a pas toutes les couleurs et autres c´est normal!
   Ps : si F8 ne marche pas utilise la touche F5.

et post le rapport ici 

bon courrage a plus

@+

poulette559 · Answer

ok je vais faire ca.
J'ai aussi fait l'autre manip en mode sans echec, il m'a supprimé 5 virus. Pour le moment le pc se comporte mieux, y'a plus ce triangle jaune ni la security tool bar dasn intrenet mais y'a tjs ce ou ces virus detecté tte les 30s par antivir(c'est pas lui qui les genere au moins???lol)
a+
et...merci!

g!rly · Answer

ok 

bon courrage 

@+

poulette559 · Answer

salut voici le rapport de antivir en mode sans echec:


AntiVir PersonalEdition Classic
Report file date: jeudi 29 novembre 2007  20:48

Scanning for 954605 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Username:         Moi
Computer name:    JULIE

Version information:
BUILD.DAT    : 270           15603 Bytes  19/09/2007 13:32:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes  23/08/2007 13:16:29
AVSCAN.DLL   : 7.0.6.0       49192 Bytes  16/08/2007 12:23:51
LUKE.DLL     : 7.0.5.3      147496 Bytes  14/08/2007 15:32:47
LUKERES.DLL  : 7.0.6.1       10280 Bytes  21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes  18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.0.0     1640448 Bytes  13/09/2007 14:26:55
ANTIVIR2.VDF : 7.0.1.0     1393152 Bytes  23/11/2007 19:44:57
ANTIVIR3.VDF : 7.0.1.25     188928 Bytes  29/11/2007 19:44:57
AVEWIN32.DLL : 7.6.0.34    3125760 Bytes  29/11/2007 19:44:57
AVWINLL.DLL  : 1.0.0.7       14376 Bytes  26/02/2007 10:36:26
AVPREF.DLL   : 7.0.2.2       25640 Bytes  18/07/2007 07:39:17
AVREP.DLL    : 7.0.0.1      155688 Bytes  16/04/2007 13:16:24
AVPACK32.DLL : 7.3.0.15     360488 Bytes  03/08/2007 08:46:00
AVREG.DLL    : 7.0.1.6       30760 Bytes  18/07/2007 07:17:06
AVARKT.DLL   : 1.0.0.20     278568 Bytes  28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes  18/07/2007 07:10:18
NETNT.DLL    : 7.0.0.0        7720 Bytes  08/03/2007 11:09:42
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes  07/08/2007 12:38:13
RCTEXT.DLL   : 7.0.62.0      86056 Bytes  21/08/2007 12:50:37
SQLITE3.DLL  : 3.3.17.1     339968 Bytes  23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: jeudi 29 novembre 2007  20:48

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
12 processes with 12 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
      [NOTE]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '31' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
      [WARNING]   The file could not be opened!
C:\qoobox\Quarantine\catchme2007-11-28_124115.70.zip
  [0] Archive type: ZIP
  --> pmnlm.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '47c31f0d.qua'!
C:\qoobox\Quarantine\catchme2007-11-28_191350.14.zip
  [0] Archive type: ZIP
  --> pmkji.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '47c31f10.qua'!
C:\WINDOWS\system32\mljgg.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!
C:\WINDOWS\system32\drivers\dtscsi.sys
      [WARNING]   The file could not be opened!
C:\WINDOWS\system32\drivers\sptd.sys
      [WARNING]   The file could not be opened!
C:\WINDOWS\system32\drivers\sptd8157.sys
      [WARNING]   The file could not be opened!


End of the scan: jeudi 29 novembre 2007  21:24
Used time: 35:35 min

The scan has been done completely.

   4514 Scanning directories
 280017 Files were scanned
      3 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      2 files were moved to quarantine
      0 files were renamed
      4 Files cannot be scanned
 280014 Files not concerned
   8458 Archives were scanned
      5 Warnings
      2 Notes

poulette559 · Answer

là il est en train de faire un autre truc (je suis en mode normal) il fait:unpacking the file et scanning the file

g!rly · Answer

Télécharge VirtumundoBegone sur le bureau:
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

Double clique ensuite sur VirtumundoBeGone.exe et suis les instructions.
Une fois terminé, redémarre et poste le rapport VBG.TXT créé sur le bureau dans ta prochaine réponse avec un nouveau rapport HijackThis.
Ne t'inquiète pas si tu vois un message Ecran bleu "Erreur fatale", c'est normal et attendu

poulette559 · Answer

voici le dernier rapport de antivir en mode normal (il l'a lancé tout seul arpés avoir redemarrer du mode sans echec


AntiVir PersonalEdition Classic
Report file date: jeudi 29 novembre 2007  21:28

Scanning for 954605 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Username:         SYSTEM
Computer name:    JULIE

Version information:
BUILD.DAT    : 270           15603 Bytes  19/09/2007 13:32:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes  23/08/2007 13:16:29
AVSCAN.DLL   : 7.0.6.0       49192 Bytes  16/08/2007 12:23:51
LUKE.DLL     : 7.0.5.3      147496 Bytes  14/08/2007 15:32:47
LUKERES.DLL  : 7.0.6.1       10280 Bytes  21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes  18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.0.0     1640448 Bytes  13/09/2007 14:26:55
ANTIVIR2.VDF : 7.0.1.0     1393152 Bytes  23/11/2007 19:44:57
ANTIVIR3.VDF : 7.0.1.25     188928 Bytes  29/11/2007 19:44:57
AVEWIN32.DLL : 7.6.0.34    3125760 Bytes  29/11/2007 19:44:57
AVWINLL.DLL  : 1.0.0.7       14376 Bytes  26/02/2007 10:36:26
AVPREF.DLL   : 7.0.2.2       25640 Bytes  18/07/2007 07:39:17
AVREP.DLL    : 7.0.0.1      155688 Bytes  16/04/2007 13:16:24
AVPACK32.DLL : 7.3.0.15     360488 Bytes  03/08/2007 08:46:00
AVREG.DLL    : 7.0.1.6       30760 Bytes  18/07/2007 07:17:06
AVARKT.DLL   : 1.0.0.20     278568 Bytes  28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes  18/07/2007 07:10:18
NETNT.DLL    : 7.0.0.0        7720 Bytes  08/03/2007 11:09:42
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes  07/08/2007 12:38:13
RCTEXT.DLL   : 7.0.62.0      86056 Bytes  21/08/2007 12:50:37
SQLITE3.DLL  : 3.3.17.1     339968 Bytes  23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: jeudi 29 novembre 2007  21:28

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avast.setup' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'guardgui.exe' - '1' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'ashWebSv.exe' - '1' Module(s) have been scanned
Scan process 'ashMaiSv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'IAANTMon.exe' - '1' Module(s) have been scanned
Scan process 'CDAC11BA.EXE' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '0' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'reader_sl.exe' - '1' Module(s) have been scanned
Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
Scan process 'SuperCopier2.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'CursorXP.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avgas.exe' - '1' Module(s) have been scanned
Scan process 'ashDisp.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'ashServ.exe' - '1' Module(s) have been scanned
Scan process 'aswUpdSv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
38 processes with 38 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
      [NOTE]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '23' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\hiberfil.sys
      [WARNING]   The file could not be opened!
C:\pagefile.sys
      [WARNING]   The file could not be opened!
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP296\A0044703.exe
      [DETECTION] Is the Trojan horse TR/Crypt.PEC2X.Gen
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP296\A0045787.exe
      [DETECTION] Is the Trojan horse TR/Fotomoto.F.1
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP296\A0045861.dll
      [DETECTION] Is the Trojan horse TR/Vundo.AU
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP296\A0045862.dll
      [DETECTION] Is the Trojan horse TR/Vundo.AU
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP296\A0045878.dll
      [DETECTION] Is the Trojan horse TR/Vundo.CA
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP296\A0045887.dll
      [DETECTION] Is the Trojan horse TR/Vundo.CA
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP297\A0045924.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP300\A0048043.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP302\A0048658.dll
      [DETECTION] Is the Trojan horse TR/Vundo.CA
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP302\A0048665.dll
      [DETECTION] Is the Trojan horse TR/Vundo.CA
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP303\A0048705.dll
      [DETECTION] Is the Trojan horse TR/Vundo.AU
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP303\A0048706.dll
      [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP303\A0048707.dll
      [DETECTION] Is the Trojan horse TR/Vundo.DRK
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP303\A0048708.exe
      [DETECTION] Is the Trojan horse TR/Fotomoto.F.1
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP303\A0048709.exe
      [DETECTION] Is the Trojan horse TR/Fotomoto.F.1
      [INFO]      The file was moved to '477f2d7f.qua'!
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP303\A0048710.dll
      [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
      [INFO]      The file was moved to '477f2d81.qua'!
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP303\A0048711.dll
      [DETECTION] Is the Trojan horse TR/Vundo.CA
      [INFO]      The file was moved to '477f2d83.qua'!
C:\WINDOWS\system32\mljgg.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!
C:\WINDOWS\system32\drivers\dtscsi.sys
      [WARNING]   The file could not be opened!
C:\WINDOWS\system32\drivers\sptd.sys
      [WARNING]   The file could not be opened!
C:\WINDOWS\system32\drivers\sptd8157.sys
      [WARNING]   The file could not be opened!


End of the scan: jeudi 29 novembre 2007  22:29
Used time:  1:01:14 min

The scan has been done completely.

   4594 Scanning directories
 284095 Files were scanned
     18 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
     14 files were deleted
      0 files were repaired
      3 files were moved to quarantine
      0 files were renamed
      5 Files cannot be scanned
 284077 Files not concerned
   8457 Archives were scanned
      6 Warnings
      2 Notes

poulette559 · Answer

voici le rapport hijack:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:56:48, on 29/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\GUARDGUI.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.picasa.com/support/welcome.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1105EDDA-0BE7-4F40-91D0-369944E296A0} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll
O2 - BHO: (no name) - {6365E921-A096-401E-864D-F97874B43D0F} - (no file)
O2 - BHO: (no name) - {7D8D942E-3E5A-46EB-A6E0-6B959E2DFCAE} - C:\WINDOWS\system32\mljgg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: {7fecf0c7-9a57-1b38-0414-a06a53b2e96b} - {b69e2b35-a60a-4140-83b1-75a97c0fcef7} - C:\WINDOWS\system32\mgjqfvir.dll (file missing)
O2 - BHO: (no name) - {E2A9A631-C02F-4B06-9D87-3D7339D32B81} - (no file)
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Enregistrement d'un produit Joint Operations Typhoon Rising.lnk = C:\Documents and Settings\Moi\Local Settings\Temp\{CCFC9AE2-C6A8-4EBA-AD4D-86A557E53170}\{0325F1C1-883A-41AB-8981-B27359ABDFAF}\NOVG.EXE
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcappcapd.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

g!rly · Answer

re,

a l´aide de hijack this coche et fix les lignes suivantes :

O2 - BHO: (no name) - {1105EDDA-0BE7-4F40-91D0-369944E296A0} - (no file)
O2 - BHO: (no name) - {6365E921-A096-401E-864D-F97874B43D0F} - (no file)
O2 - BHO: (no name) - {7D8D942E-3E5A-46EB-A6E0-6B959E2DFCAE} - C:\WINDOWS\system32\mljgg.dll
O2 - BHO: {7fecf0c7-9a57-1b38-0414-a06a53b2e96b} - {b69e2b35-a60a-4140-83b1-75a97c0fcef7} - C:\WINDOWS\system32\mgjqfvir.dll (file missing)
O2 - BHO: (no name) - {E2A9A631-C02F-4B06-9D87-3D7339D32B81} - (no file)
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)

comment fixer :

Tutoriel d´utilisation (video) :

-> http://pageperso.aol.fr/balltrap34/demohijack.htm

Télécharge VundoFix.exe (par Atribune) sur ton Bureau.
http://www.atribune.org/ccount/click.php?id=4

* Lance Vundofix
* Ne clique pas sur "Scan for a vundo"
* Clique droit au milieu de la fenêtre
* Clique sur Add more files ?
* Copie/colle les fichiers ci-dessous ( un par case) :

C:\WINDOWS\system32\mljgg.dll

* Clique sur Add files
* Ensuite clique sur Close Windows
* Enfin, clique sur Remove Vundo ( les fichiers précédents doivent apparaitre dans la fenêtre principale)
* Si l'outils demande un redémarrage, accepte
* Poste le rapport Vundofix

Désactive ta restauration système:
pour cela :
Click droit sur poste de travail, dans l´arborescence sur propriétés; 
dans la nouvelle fenettre click sur l´onglet restauration système;
coche la case désactiver la restauration systèm et applique.
puis redemarre le pc et click droit sur poste de travail, dans l´arborescence sur propriétés; 
dans la nouvelle fenettre click sur l´onglet restauration systèm
décoche la case désactiver la restauration systèm et applique. 

desinstal avast et norton

Desinstalleur Norton:
http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20050414110429924

et

Désinstalleur Avast:
https://www.avast.com/fr-fr/uninstall-utility

et instal kerio 

maintenant ca devrait le faire sans norton...

par feu : kerio

https://www.vulgarisation-informatique.com/kerio.php

Poste le rapport Vundofix avec un nouveau hijack this stp

@+

poulette559 · Answer

voici le nouveau rapoprt hijack:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:48:25, on 30/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.picasa.com/support/welcome.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {32433593-88FA-4D35-B1A4-A03DE4937049} - C:\WINDOWS\system32\mljgg.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {FB2A28BF-43C2-4B49-B3F6-B4713B74D4E0} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [1474aad1] rundll32.exe "C:\WINDOWS\system32\yktesomw.dll",b
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Enregistrement d'un produit Joint Operations Typhoon Rising.lnk = C:\Documents and Settings\Moi\Local Settings\Temp\{CCFC9AE2-C6A8-4EBA-AD4D-86A557E53170}\{0325F1C1-883A-41AB-8981-B27359ABDFAF}\NOVG.EXE
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\ifpnvrxt.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcappcapd.exe

g!rly · Answer

salut poulette,

il faut que tu desinstal avast vu que tu as antivir tu voie...

peux tu remettre un combofix stp

@+

poulette559 · Answer

slut j'ai désinstaller avast et j'ai mis kerio. Maintenant j'ai: spybot,AVG,Antivir et kerio je peux tout garder? Kerio me demande: une application essaie de communiquer avec un ordinateur distant. GENERIC HOST Process for Win32 Services 86.160.219.149 port1219, j'autorise ou je bloque ce truc? lol voici le rapport de combofix: ComboFix 07-11-19.4B - Moi 2007-11-30 20:26:24.4 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.655 [GMT 1:00] Running from: C:\Documents and Settings\Moi\Bureau\ComboFix.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Menu Démarrer\Live Safety Center.lnk C:\Documents and Settings\All Users\Menu Démarrer\Online Security Guide.lnk C:\Documents and Settings\Moi\Favoris\Online Security Guide.lnk . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_DOMAINSERVICE -------\DomainService ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-10-28 to 2007-11-30 )))))))))))))))))))))))))))))))))))) . 2007-11-30 20:18 d-------- C:\Program Files\Kerio 2007-11-30 19:40 d-------- C:\VundoFix Backups 2007-11-30 19:22 78,912 --a------ C:\WINDOWS\system32\jawkxcus.dll 2007-11-29 20:43 d-------- C:\Program Files\Avira 2007-11-29 13:10 d--h----- C:\WINDOWS\PIF 2007-11-28 22:02 d-------- C:\Documents and Settings\All Users\Application Data\Avira 2007-11-28 19:18 245,975 --ahs---- C:\WINDOWS\system32\ggjlm.ini2 2007-11-28 19:18 245,975 --ahs---- C:\WINDOWS\system32\ggjlm.ini 2007-11-28 13:42 d-------- C:\Program Files\Sunbelt Software 2007-11-28 13:05 d-------- C:\WINDOWS\BDOSCAN8 2007-11-27 19:30 d-------- C:\Documents and Settings\Moi\Application Data\Grisoft 2007-11-27 19:30 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-11-27 19:29 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2007-11-27 19:26 d-------- C:\Program Files\Trend Micro 2007-11-26 19:07 d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau 2007-11-26 19:07 d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression 2007-11-26 19:07 d--h----- C:\Documents and Settings\Administrateur\ModŠles 2007-11-26 19:07 dr------- C:\Documents and Settings\Administrateur\Mes documents 2007-11-26 19:07 dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer 2007-11-26 19:07 dr------- C:\Documents and Settings\Administrateur\Favoris 2007-11-26 19:07 d-------- C:\Documents and Settings\Administrateur\Bureau 2007-11-26 19:07 d-------- C:\Documents and Settings\Administrateur\Application Data\You've Got Pictures Screensaver 2007-11-26 19:07 d-------- C:\Documents and Settings\Administrateur\Application Data\Symantec 2007-11-26 19:07 d-------- C:\Documents and Settings\Administrateur\Application Data\Jasc Software Inc 2007-11-24 20:13 d-------- C:\Program Files\Doom 3 2007-11-24 20:11 38,912 --a------ C:\WINDOWS\system32\ddcdbcb.dll.vir 2007-11-24 19:38 d-------- C:\Documents and Settings\All Users\Application Data\POPWWPROFILES 2007-11-18 21:24 d-------- C:\Program Files\ViaMichelin 2007-11-18 21:23 104,576 --a------ C:\WINDOWS\system32\drivers\wceusbsh.sys 2007-11-18 21:21 d-------- C:\Program Files\Microsoft ActiveSync 2007-11-18 21:21 30,592 --------- C:\WINDOWS\system32\drivers ndismpx.sys 2007-11-18 21:21 12,800 --------- C:\WINDOWS\system32\drivers\usb8023x.sys 2007-11-18 21:20 d-------- C:\WINDOWS\Downloaded Installations 2007-10-27 14:25 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-10-27 14:25 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-10-09 00:23 815,480 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-10-09 00:23 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-10-08 21:01 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-29 11:43 --------- d-----w C:\Program Files\Nero Burning ROM v6.0.0.23 Ultra Edition Incl keygen-CORE-Pleasuredome101 2007-11-28 20:57 --------- d-----w C:\Program Files\PowerArchiver 2007-11-28 18:26 --------- d-----w C:\Documents and Settings\Moi\Application Data\Samsung 2007-11-28 18:17 --------- d-----w C:\Documents and Settings\Moi\Application Data\Skype 2007-11-24 23:58 --------- d-----w C:\Documents and Settings\Moi\Application Data\Azureus 2007-11-24 18:38 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-24 18:37 --------- d-----w C:\Program Files\Ubisoft 2007-11-17 16:15 --------- d-----w C:\Program Files\FoxTarot4 2007-10-28 11:59 --------- d-----w C:\Program Files\GUILD WARS 2007-10-27 13:25 --------- d-----w C:\Program Files\Picasa2 2007-01-18 17:33 1,127,307 ----a-w C:\Program Files\wrar362fr.exe 2006-10-03 19:08 9,998,384 ----a-w C:\Program Files ero_nero_6.6.1.4_language_pack_francais_francais_10297.exe 2006-09-11 17:17 8,799,656 ----a-w C:\Program Files\Azureus_2.5.0.0_Win32.setup.exe 1999-04-06 13:27 99,840 ----a-w C:\Program Files\Fichiers communs\IRAABOUT.DLL 1998-12-09 03:53 70,144 ----a-w C:\Program Files\Fichiers communs\IRAMDMTR.DLL 1998-12-09 03:53 48,640 ----a-w C:\Program Files\Fichiers communs\IRALPTTR.DLL 1998-12-09 03:53 31,744 ----a-w C:\Program Files\Fichiers communs\IRAWEBTR.DLL 1998-12-09 03:53 186,368 ----a-w C:\Program Files\Fichiers communs\IRAREG.DLL 1998-12-09 03:53 17,920 ----a-w C:\Program Files\Fichiers communs\IRASRIAL.DLL . ((((((((((((((((((((((((((((( snapshot@2007-11-28_12.42.42.17 ))))))))))))))))))))))))))))))))))))))))) . + 2006-05-25 00:21:00 118,784 ----a-w C:\WINDOWS\BDOSCAN8\bdupd.dll + 2006-05-25 00:21:14 53,248 ----a-w C:\WINDOWS\BDOSCAN8\ipsupd.dll + 2006-05-25 00:22:06 53,248 ----a-w C:\WINDOWS\bdoscandel.exe + 2006-05-25 00:21:00 118,784 ----a-w C:\WINDOWS\Downloaded Program Files\bdupd.dll + 2006-05-25 00:21:14 53,248 ----a-w C:\WINDOWS\Downloaded Program Files\ipsupd.dll + 2007-08-09 12:04:11 40,768 ----a-w C:\WINDOWS\system32\drivers\avgntdd.sys + 2007-07-18 13:22:19 21,312 ----a-w C:\WINDOWS\system32\drivers\avgntmgr.sys + 2007-11-29 19:44:57 61,632 ----a-w C:\WINDOWS\system32\drivers\avipbb.sys + 2004-04-15 10:02:56 147,456 ----a-w C:\WINDOWS\system32\drivers\fwdrv.sys + 2007-03-01 09:34:36 28,352 ----a-w C:\WINDOWS\system32\drivers\ssmdrv.sys . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{32433593-88FA-4D35-B1A4-A03DE4937049}] C:\WINDOWS\system32\mljgg.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FB2A28BF-43C2-4B49-B3F6-B4713B74D4E0}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CursorXP"="C:\Program Files\CursorXP\CursorXP.exe" [2005-01-19 16:34] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00] "SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [2005-03-14 00:37] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-28 18:17] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="RUNDLL32.exe" [2004-08-05 13:00 C:\WINDOWS\system32 undll32.exe] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-11-11 10:28] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-11-29 20:44] "1474aad1"="C:\WINDOWS\system32\yktesomw.dll" [] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00] "ALUAlert"="C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe" [] "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-28 02:17] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"= 0 (0x0) R0 ElbyVCD;ElbyVCD;C:\WINDOWS\system32\DRIVERS\ElbyVCD.sys R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys R1 SSHDRV76;SSHDRV76;\??\C:\WINDOWS\system32\drivers\SSHDRV76.sys R2 litsgt;litsgt;C:\WINDOWS\system32\DRIVERS\litsgt.sys R2 tansgt;tansgt;C:\WINDOWS\system32\DRIVERS ansgt.sys S3 Netdmin;Netdmin;C:\WINDOWS\system32\drivers asacd.sys S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers pf.sys S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys S3 Usblink;Usblink Driver;C:\WINDOWS\system32\Drivers\ulink.sys . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2005-11-18 19:15:04 C:\WINDOWS\Tasks\Rappel d'abonnement 1 auprès de l'ISP.job" . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-30 20:30:12 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-30 20:31:25 - machine was rebooted C:\ComboFix2.txt ... 2007-11-28 19:16 C:\ComboFix3.txt ... 2007-11-28 12:43 . --- E O F ---

g!rly · Answer

re,

cool pour antivir et kerio ;-)

oui accepte : une application essaie de communiquer avec un ordinateur distant. GENERIC HOST Process for Win32 Services 86.160.219.149 port1219, 


Copie le texte se situant dans le cadre ci-dessous :

File::
C:\WINDOWS\system32\jawkxcus.dll
C:\WINDOWS\system32\mljgg.dll
C:\WINDOWS\system32\ggjlm.ini2
C:\WINDOWS\system32\ggjlm.ini
C:\WINDOWS\system32\ddcdbcb.dll.vir
C:\WINDOWS\system32\yktesomw.dll

Folder::
C:\VundoFix Backups
C:\WINDOWS\PIF
C:\Documents and Settings\Administrateur\Application Data\You've Got Pictures Screensaver 

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{32433593-88FA-4D35-B1A4-A03DE4937049}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FB2A28BF-43C2-4B49-B3F6-B4713B74D4E0}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"1474aad1"=-

Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

http://serveur1.archive-host.com/membres/up/1366464061/CFScript.gif

Cela va relancer Combofix, 

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Après redémarrage, poste le contenu du rapport Combofix.txt (C:\ComboFix4) accompagné d'un rapport Hijackthis.

S'il n'y a pas de rédémarrage, poste quand même les rapports.

@+

poulette559 · Answer

voici le rapport de combofix (j'ai du refaire la 1ere fois je l'ai suppirmé en faisant 2 au lieu de 1!! lol) ComboFix 07-11-19.4C - Moi 2007-11-30 22:58:12.5 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.613 [GMT 1:00] Running from: C:\Documents and Settings\Moi\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\Moi\Bureau\CFScript.txt * Created a new restore point FILE C:\WINDOWS\system32\ddcdbcb.dll.vir C:\WINDOWS\system32\ggjlm.ini C:\WINDOWS\system32\ggjlm.ini2 C:\WINDOWS\system32\jawkxcus.dll C:\WINDOWS\system32\mljgg.dll C:\WINDOWS\system32\yktesomw.dll . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Administrateur\Application Data\You've Got Pictures Screensaver C:\WINDOWS\PIF C:\WINDOWS\system32\ddcdbcb.dll.vir C:\WINDOWS\system32\ggjlm.ini C:\WINDOWS\system32\ggjlm.ini2 C:\WINDOWS\system32\jawkxcus.dll . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-10-28 to 2007-11-30 )))))))))))))))))))))))))))))))))))) . 2007-11-30 20:18 d-------- C:\Program Files\Kerio 2007-11-29 20:43 d-------- C:\Program Files\Avira 2007-11-28 22:02 d-------- C:\Documents and Settings\All Users\Application Data\Avira 2007-11-28 13:42 d-------- C:\Program Files\Sunbelt Software 2007-11-28 13:05 d-------- C:\WINDOWS\BDOSCAN8 2007-11-27 19:30 d-------- C:\Documents and Settings\Moi\Application Data\Grisoft 2007-11-27 19:30 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-11-27 19:29 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2007-11-27 19:26 d-------- C:\Program Files\Trend Micro 2007-11-26 19:07 d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau 2007-11-26 19:07 d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression 2007-11-26 19:07 d--h----- C:\Documents and Settings\Administrateur\ModŠles 2007-11-26 19:07 dr------- C:\Documents and Settings\Administrateur\Mes documents 2007-11-26 19:07 dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer 2007-11-26 19:07 dr------- C:\Documents and Settings\Administrateur\Favoris 2007-11-26 19:07 d-------- C:\Documents and Settings\Administrateur\Bureau 2007-11-26 19:07 d-------- C:\Documents and Settings\Administrateur\Application Data\Symantec 2007-11-26 19:07 d-------- C:\Documents and Settings\Administrateur\Application Data\Jasc Software Inc 2007-11-24 20:13 d-------- C:\Program Files\Doom 3 2007-11-24 19:38 d-------- C:\Documents and Settings\All Users\Application Data\POPWWPROFILES 2007-11-18 21:24 d-------- C:\Program Files\ViaMichelin 2007-11-18 21:21 d-------- C:\Program Files\Microsoft ActiveSync 2007-11-18 21:21 30,592 --------- C:\WINDOWS\system32\drivers ndismpx.sys 2007-11-18 21:21 12,800 --------- C:\WINDOWS\system32\drivers\usb8023x.sys 2007-11-18 21:20 d-------- C:\WINDOWS\Downloaded Installations 2007-10-27 14:25 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-10-27 14:25 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-10-09 00:23 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-10-08 21:01 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-29 11:43 --------- d-----w C:\Program Files\Nero Burning ROM v6.0.0.23 Ultra Edition Incl keygen-CORE-Pleasuredome101 2007-11-28 20:57 --------- d-----w C:\Program Files\PowerArchiver 2007-11-28 18:26 --------- d-----w C:\Documents and Settings\Moi\Application Data\Samsung 2007-11-28 18:17 --------- d-----w C:\Documents and Settings\Moi\Application Data\Skype 2007-11-24 23:58 --------- d-----w C:\Documents and Settings\Moi\Application Data\Azureus 2007-11-24 18:38 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-24 18:37 --------- d-----w C:\Program Files\Ubisoft 2007-11-17 16:15 --------- d-----w C:\Program Files\FoxTarot4 2007-10-28 11:59 --------- d-----w C:\Program Files\GUILD WARS 2007-10-27 13:25 --------- d-----w C:\Program Files\Picasa2 2007-01-18 17:33 1,127,307 ----a-w C:\Program Files\wrar362fr.exe 2006-10-03 19:08 9,998,384 ----a-w C:\Program Files ero_nero_6.6.1.4_language_pack_francais_francais_10297.exe 2006-09-11 17:17 8,799,656 ----a-w C:\Program Files\Azureus_2.5.0.0_Win32.setup.exe 1999-04-06 13:27 99,840 ----a-w C:\Program Files\Fichiers communs\IRAABOUT.DLL 1998-12-09 03:53 70,144 ----a-w C:\Program Files\Fichiers communs\IRAMDMTR.DLL 1998-12-09 03:53 48,640 ----a-w C:\Program Files\Fichiers communs\IRALPTTR.DLL 1998-12-09 03:53 31,744 ----a-w C:\Program Files\Fichiers communs\IRAWEBTR.DLL 1998-12-09 03:53 186,368 ----a-w C:\Program Files\Fichiers communs\IRAREG.DLL 1998-12-09 03:53 17,920 ----a-w C:\Program Files\Fichiers communs\IRASRIAL.DLL . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{32433593-88FA-4D35-B1A4-A03DE4937049}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FB2A28BF-43C2-4B49-B3F6-B4713B74D4E0}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CursorXP"="C:\Program Files\CursorXP\CursorXP.exe" [2005-01-19 16:34] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00] "SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [2005-03-14 00:37] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-28 18:17] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="RUNDLL32.exe" [2004-08-05 13:00 C:\WINDOWS\system32 undll32.exe] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-11-11 10:28] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-11-29 20:44] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00] "ALUAlert"="C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe" [] "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-28 02:17] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"= 0 (0x0) R0 ElbyVCD;ElbyVCD;C:\WINDOWS\system32\DRIVERS\ElbyVCD.sys R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys R1 SSHDRV76;SSHDRV76;\??\C:\WINDOWS\system32\drivers\SSHDRV76.sys R2 litsgt;litsgt;C:\WINDOWS\system32\DRIVERS\litsgt.sys R2 tansgt;tansgt;C:\WINDOWS\system32\DRIVERS ansgt.sys S3 Netdmin;Netdmin;C:\WINDOWS\system32\drivers asacd.sys S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers pf.sys S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys S3 Usblink;Usblink Driver;C:\WINDOWS\system32\Drivers\ulink.sys . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2005-11-18 19:15:04 C:\WINDOWS\Tasks\Rappel d'abonnement 1 auprès de l'ISP.job" . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-30 23:01:35 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-30 23:02:54 - machine was rebooted C:\ComboFix2.txt ... 2007-11-30 20:31 C:\ComboFix3.txt ... 2007-11-28 19:16 . --- E O F --- et le hijack: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:05:15, on 30/11/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\CursorXP\CursorXP.exe C:\WINDOWS\system32\drivers\CDAC11BA.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SuperCopier2\SuperCopier2.exe C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\system32 vsvc32.exe C:\Program Files\Adobe\Acrobat 7.0\Reader eader_sl.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32 otepad.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.picasa.com/support/welcome.php R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla fswshx.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Enregistrement d'un produit Joint Operations Typhoon Rising.lnk = C:\Documents and Settings\Moi\Local Settings\Temp\{CCFC9AE2-C6A8-4EBA-AD4D-86A557E53170}\{0325F1C1-883A-41AB-8981-B27359ABDFAF}\NOVG.EXE O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader eader_sl.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin pjpi142_03.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin pjpi142_03.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32 vsvc32.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap pcapd.exe

g!rly · Answer

re,

comment ca va maintenant?

poulette559 · Answer

écoutes, ca va bcp bcp mieux!! oserai'je m'avancer au point de dire que tout est ok..oui je me lance:tout est ok!! Merci bcp pour ton aide!! puis je virer, ou sauvegarder ailleurs tout les petits programme que j'ai téléchargé?
Je peux garder les 2 en meme temps entre spybot et avg?

g!rly · Answer

bonjour poulette,

et bien je suis bien contente que tes soucis soient terminés

oui tu peux supprimer les outils que nous avons utilisés, tu peux garder spybot et avg.

pour parfaire le nettoyge, je te propose ces deux logiciels, l´un (ccleaner) sert a nettoyer les fichiers temporaires et les erreures, et l´autre (regcleaner) sert a nettoyer le registre : tu peux passer ccleaner asser regulierement et regcleaner une fois par mois par exemple.

Ccleaner:

-> Télécharge Ccleaner (n'installe pas la barre d'outil Yahoo):

   http://www.commentcamarche.net/telecharger/telechargement 168 ccleaner

-> L´installer.

-> Une fois installé et lancé :

   Dans la colonne de gauche, click sur :

   ->"erreurs" :

      Coches toutes les cases dans les propriétés du nettoyeur de l´onglet "windows" et "applications", puis click en bas sur "chercher des erreurs" une fois terminé, clic sur "reparer les erreurs", tu auras un message pour sauvegarder ta base de registre, tu click "oui" puis tu recommence jusqu'à ce qu'il ne trouve plus rien.
      
      ps : les sauvegardes que tu auras faites, pourront etre supprimées ulterieurement si tout va bien.

   ->"nettoyeur"
   
      quitte ton navigateur avant de le lancer, décoche la derniere case (Avancé si elle est cochée) puis click sur "lancer le nettoyage" qunand il aura terminé le scan click en bas a droite sur "lancer le nettoyage" et accepte par oui.

-> Tutoriel en image :

   https://www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.php


-> Pour ceux qui voudraient aller plus loin en compagnie de jesses (fonctions avancés) :

   http://perso.orange.fr/jesses/Docs/Logiciels/CCleaner.htm 

telecharge et instal regcleaner:

http://www.01net.com/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/4894.html

tutorial :

http://www.softastuces.com/tuto/maint/regcleaner/

bonne continuation``

poulette559 · Answer

salut 
j'ai fait ccleaner
J'ai installé et accepter le texte pour regcleaner mais aprés rien ne se passe...

g!rly · Answer

tu as bien regarder le tuto?

poulette559 · Answer

salut. 
Je pensais le probleme résolu mais antivir m'a trouvé encore des trojans vundo qq chose comme ca. Je poste le rapport et un nouveau hijack?
a+

g!rly · Answer

salut poulette,

et bien...

oui post un nouveau hijack this

@+

poulette559 · Answer

salut salut voici le rapport hijack:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:29:14, on 12/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.picasa.com/support/welcome.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Enregistrement d'un produit Joint Operations Typhoon Rising.lnk = C:\Documents and Settings\Moi\Local Settings\Temp\{CCFC9AE2-C6A8-4EBA-AD4D-86A557E53170}\{0325F1C1-883A-41AB-8981-B27359ABDFAF}\NOVG.EXE
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcappcapd.exe

g!rly · Answer

re,

tu n´as rien ;-)

ce que antivir a detecté etait la quarantaine de combofix alors supprime la ainsi que combofix et tous les outils que nous avions utilisés

puis l´autre manifestation concerne ta restauration system, alors fais ceci :

Désactive ta restauration système:
pour cela :
Click droit sur poste de travail, dans l´arborescence sur propriétés; 
dans la nouvelle fenettre click sur l´onglet restauration système;
coche la case désactiver la restauration systèm et applique.
puis redemarre le pc et click droit sur poste de travail, dans l´arborescence sur propriétés; 
dans la nouvelle fenettre click sur l´onglet restauration systèm
décoche la case désactiver la restauration systèm et applique. 

voila

@+

g!rly · Answer

--
mouvement de non entraide a suivre très prochainement...

Alertre securité windows

59 réponses