Infections trojan, win32 + pop-ups CiD Résolu/Fermé

Question

Bonjour,
Bonne année à tous.
La mienne commence bien avec la détection de plusieurs infections (win32 et Trojan.Obfus.6.Gen) et la présence de fenêtres popups CiD qui a débuté le jour où mon ado de fille s'est mis en tête de téléchrager Windows Live Messenger Plus (avec sponsor bien sûr) sans me consulter: j'ai depuis tout désinstallé mais le pbm persiste (en moins agressif, d'accord, mais quand même)
J'ai suivi les étapes de la Méthode Préliminaire de Désinfection fournie par ce site...
Voici donc les rapports de Bitfender et de Hijack:

BITFENDER
Scanned File
  Status
 
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Quarantine\{00004260-0001-0000-5440-CEF965501B4B}\DATA.CAB=>RESOURCE1
 Infected with: Exploit.Win32.WMF-PFV.G
 
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Quarantine\{00004260-0001-0000-5440-CEF965501B4B}\DATA.CAB=>RESOURCE1
 Disinfection failed
 
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Quarantine\{00004260-0001-0000-5440-CEF965501B4B}\DATA.CAB=>RESOURCE1
 Deleted
 
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Quarantine\{00004260-0001-0000-5440-CEF965501B4B}\DATA.CAB
 Update failed
 
C:\Documents and Settings\viovio\Application Data\Draw Pure\jygchclj.exe
 Infected with: Trojan.Obfus.6.Gen
 
C:\Documents and Settings\viovio\Application Data\Draw Pure\jygchclj.exe
 Disinfection failed
 
C:\Documents and Settings\viovio\Application Data\Draw Pure\jygchclj.exe
 Deleted
 
C:\System Volume Information\_restore{86E11626-5203-4B6B-99A3-889F6E4C5699}\RP264\A0119238.exe
 Infected with: Trojan.Obfus.6.Gen
 
C:\System Volume Information\_restore{86E11626-5203-4B6B-99A3-889F6E4C5699}\RP264\A0119238.exe
 Disinfection failed
 
C:\System Volume Information\_restore{86E11626-5203-4B6B-99A3-889F6E4C5699}\RP264\A0119238.exe
 Deleted
 
C:\System Volume Information\_restore{86E11626-5203-4B6B-99A3-889F6E4C5699}\RP264\A0119254.exe
 Infected with: Trojan.Obfus.6.Gen
 
C:\System Volume Information\_restore{86E11626-5203-4B6B-99A3-889F6E4C5699}\RP264\A0119254.exe
 Disinfection failed
 
C:\System Volume Information\_restore{86E11626-5203-4B6B-99A3-889F6E4C5699}\RP264\A0119254.exe
 Deleted
 
C:\System Volume Information\_restore{86E11626-5203-4B6B-99A3-889F6E4C5699}\RP264\A0119693.exe
 Infected with: Trojan.Obfus.6.Gen
 
C:\System Volume Information\_restore{86E11626-5203-4B6B-99A3-889F6E4C5699}\RP264\A0119693.exe
 Disinfection failed
 
C:\System Volume Information\_restore{86E11626-5203-4B6B-99A3-889F6E4C5699}\RP264\A0119693.exe
 Deleted
 
C:\System Volume Information\_restore{86E11626-5203-4B6B-99A3-889F6E4C5699}\RP264\A0119709.exe
 Infected with: Trojan.Obfus.6.Gen
 
C:\System Volume Information\_restore{86E11626-5203-4B6B-99A3-889F6E4C5699}\RP264\A0119709.exe
 Disinfection failed
 
C:\System Volume Information\_restore{86E11626-5203-4B6B-99A3-889F6E4C5699}\RP264\A0119709.exe
 Deleted
 
C:\System Volume Information\_restore{86E11626-5203-4B6B-99A3-889F6E4C5699}\RP264\A0119752.exe
 Infected with: Trojan.Obfus.6.Gen
 
C:\System Volume Information\_restore{86E11626-5203-4B6B-99A3-889F6E4C5699}\RP264\A0119752.exe
 Disinfection failed
 
C:\System Volume Information\_restore{86E11626-5203-4B6B-99A3-889F6E4C5699}\RP264\A0119752.exe
 Deleted
 
C:\System Volume Information\_restore{86E11626-5203-4B6B-99A3-889F6E4C5699}\RP264\A0119862.exe
 Infected with: Trojan.Obfus.6.Gen
 
C:\System Volume Information\_restore{86E11626-5203-4B6B-99A3-889F6E4C5699}\RP264\A0119862.exe
 Disinfection failed
 
C:\System Volume Information\_restore{86E11626-5203-4B6B-99A3-889F6E4C5699}\RP264\A0119862.exe
 Deleted
 
C:\System Volume Information\_restore{86E11626-5203-4B6B-99A3-889F6E4C5699}\RP264\A0119878.exe
 Infected with: Trojan.Obfus.6.Gen
 
C:\System Volume Information\_restore{86E11626-5203-4B6B-99A3-889F6E4C5699}\RP264\A0119878.exe
 Disinfection failed
 
C:\System Volume Information\_restore{86E11626-5203-4B6B-99A3-889F6E4C5699}\RP264\A0119878.exe
 Deleted
 
C:\System Volume Information\_restore{86E11626-5203-4B6B-99A3-889F6E4C5699}\RP264\A0120880.exe
 Infected with: Trojan.Obfus.6.Gen
 
C:\System Volume Information\_restore{86E11626-5203-4B6B-99A3-889F6E4C5699}\RP264\A0120880.exe
 Disinfection failed
 
C:\System Volume Information\_restore{86E11626-5203-4B6B-99A3-889F6E4C5699}\RP264\A0120880.exe
 Deleted
 
C:\System Volume Information\_restore{86E11626-5203-4B6B-99A3-889F6E4C5699}\RP265\A0120941.exe
 Infected with: Trojan.Obfus.6.Gen
 
C:\System Volume Information\_restore{86E11626-5203-4B6B-99A3-889F6E4C5699}\RP265\A0120941.exe
 Disinfection failed
 
C:\System Volume Information\_restore{86E11626-5203-4B6B-99A3-889F6E4C5699}\RP265\A0120941.exe
 Deleted

 
HIJACK  
 
 Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hphmon06.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\system32\keyhook.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32undll32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\TMMEducation\Apps\HttpServer\HttpServer.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q404&bd=pavilion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q404&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q404&bd=pavilion&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.1.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [TiscaliParam] C:\Program Files\Tiscali\Dialer\bootparam.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [Cloneur Expert Monitor] "C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [bend logo clock film] C:\Documents and Settings\All Users\Application Data\Frag great bend logo\Burn Joy.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HELPAN~1\Pavilion\XPHWWBF4\plugin\bin\PCHButton.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-3636313864-4027070454-1807119305-1008\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background (User 'viovio')
O4 - HKUS\S-1-5-21-3636313864-4027070454-1807119305-1008\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" (User 'viovio')
O4 - HKUS\S-1-5-21-3636313864-4027070454-1807119305-1008\..\Run: [BORE LIST] C:\DOCUME~1\viovio\APPLIC~1\DRAWPU~1\WEBLESS.exe (User 'viovio')
O4 - S-1-5-21-3636313864-4027070454-1807119305-1008 Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe (User 'viovio')
O4 - S-1-5-21-3636313864-4027070454-1807119305-1008 Startup: Registration Alexandra Ledermann 8.LNK = E:\Support\Register\RegistrationReminder.exe (User 'viovio')
O4 - S-1-5-21-3636313864-4027070454-1807119305-1008 User Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe (User 'viovio')
O4 - S-1-5-21-3636313864-4027070454-1807119305-1008 User Startup: Registration Alexandra Ledermann 8.LNK = E:\Support\Register\RegistrationReminder.exe (User 'viovio')
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx2.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab
O16 - DPF: {63308B48-F435-42FD-AB0A-3564C7BEF9D7} (Toontown Installer ActiveX Control French) - https://iplay.fr.toontown.com/download/sv1.5.15.9/ttinst-french.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
O16 - DPF: {D28C3640-A6D7-4668-A53C-07A9CF67D157} (CFnacComposantCtrl Object) - http://www.fnacmusic.com/telechargementFnacmusic/FnacComposant.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TELL ME MORE 7 EDUCATION - Auralog - C:\TMMEducation\Apps\HttpServer\HttpServer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

green day · Answer

Salut

Télécharge ceci: (by Moe) : 

http://sosvirus.changelog.fr/Green_day/Lopxpsetup.exe 

Double clic sur Lopxpsetup.exe pour lancer l'installation 
Au menu, choisir l'option 1 
Patienter jusqu'à que l'on demande d'appuyer sur une touche, appuyer ! 
Une rapport sera alors crée, à copie/colle en entier sur le forum.

zader · Answer

Greenday, merci pour ta réponse...J'ai essayé  de suivre la procédure que tu recommandes mais qd je lance l'option 1, mon AVG Anti Spyware s'affole et me dit que le programme que j'essaie de lancer est ou contient un malware!!! Excuse, mais je ne voudrais pas aggraver encore mon cas en ajoutant encore une autre 'saloperie' à mon ordi... 
QQn d'autre ou toi-même (si tu es bien intentionné?... ;-)) aurait-il une autre idée pour m'aider?
Merci.

green day · Answer

Salut

 si je suis bien intentionnée, c'est à dire ??

 merci, super sympa, j'ai pas l'impression de perdre mon temps là ...

l'alerte que tu as avec avg s'appelle un "faux-positif", ça arrive très souvent avec les fixs, et je peux t'affirmer que ce fix n'a rien de dangereux, bien au contraire ! je connais très bien son auteur et c'est tout sauf un pirate !! d'ailleurs ce fix a été utilisé et réutiliser depuis des années et avec succès, il est même téléchargeable dans la section téléchargement de ce site, tu pense bien que le webmaster l'aurait virer s'il y avait eu le moindre soucis ...

tu peux donc le télécharger, sans prendre en compte ce message d'alerte !

@+

zader · Answer

ok, mille excuses pour la remise en cause de ce que tu me conseillais: prends ça comme une méfiance mal placée d'une néophyte ...
Je tente la procédure et je publie le rapport de cepas.
Merci.

moe · Answer

Salut zader, green day :-)

Certains fichiers contenus dans Lopxp, comme dans beaucoups d'autres outils qui recherchent des infections ciblées, peuvent parfois être détectés par des logiciels anti-virus ou anti-spywares comme étant des "outils potentiellement indésirables" ou "à risque", voire comme "cheval de Troie" alors que ce n'est pas le cas. 

Ces outils qui ont été créés et testés par des experts, aident à rendre possible et à faciliter certaines étapes de recherches ou de désinfection.
Leur utilisation  peut être au niveau d'une interaction avec le registre pour y recueillir une informations précise par exemple, en passant par  la gestion des processus actifs, etc..

La détection de ces outils est tout à fait normale, car ton anti-virus ou anti-spywares, eux, ne sont pas sensés faire la distinction entre une bonne ou une mauvaise utilisation de ces programmes.
C'est donc pour cette raison qu'ils t'alertent, à toi ensuite avant d'autoriser leur utilisation et effectivement celon ta confiance en la personne qui te demande d'utiliser de tels programmes, de poser la question sur ces alertes comme tu viens judicieusement de le faire.
A nous en réponse de t'en expliquer les raisons. :-)

Dans ce cas bien précis, ces alertes sont ce qu'on appelle un "Faux Positif"

Tu pourras trouver ici, plus d'informations sur les différents programmes employés par Lopxp :

- Swreg.exe de SteelWerx: 
https://fstaal01.home.xs4all.nl/swreg-us.html

- pv.exe de Igor Nys
http://www.teamcti.com/pview/prcview.htm

- lstask.exe de Frank Brown (Bamboo Software)
http://www.inwa.net/~frog/bamboo.htm

- str.exe de Bill Stewart
http://www.westmesatech.com/sst.html

Si malgré tout tu as des réticences à utiliser cet outil, tu peux utiliser à sa place lopxpMH2 qui recherche le même type d'infection.
http://www.alt-shift-return.org/Info/Fichiers/lopxpMH2.zip

Cordialement, moe.

zader · Answer

hello greenday,

Voici donc le fameux rapport...

Search Navipromo version 3.3.9 commencé le 13/01/2008 à 14:53:26,82

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1
Mise à jour le 06.01.2008 à 20h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 6.0.2900.2180 
Système de fichiers : NTFS

Executé en mode normal

*** Recherche Programmes installés ***




*** Recherche dossiers dans C:\WINDOWS ***



*** Recherche dossiers dans C:\Program Files ***



*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\APPLIC~1 ***




*** Recherche dossiers dans "C:\Documents and Settings\HP_Propriétaire\application data" *** 



*** Recherche dossiers dans "C:\Documents and Settings\HP_Propriétaire\MENUDM~1\PROGRA~1" *** 


*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1 ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun Fichier trouvé



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans C:\WINDOWS\system32 *

* Recherche dans "C:\Documents and Settings\HP_Propriétaire\local settings\application data" * 



*** Recherche fichiers *** 




*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans C:\WINDOWS\system32 :


* Dans "C:\Documents and Settings\HP_Propriétaire\local settings\application data" : 


3)Recherche Certificats :

Certificat Egroup absent !

4)Recherche fichiers connus :



*** Analyse terminée le 13/01/2008 à 15:12:54,03 ***

Kesako? Le seul truc qui paraît bizarre, c'est l'histoire du certificat absent....mais comme je ne sais pas ce que cela signifie...
Merci encore de m'éclairer de ta lanterne.

zader · Answer

Moe,
Merci infiniment pour toutes ces infos et explications. J'étais effectivement entre temps allée faire un tour sur le site de Navilog1 pour mieux comprendre tout ça (no feelings hurt, Greenday, I hope?).

green day · Answer

Re-salut Zader

 Lu Moe ;-P

non, pas de malaise ! seulement un grand étonnement, mais c'est compréhensible ! :-)

c'est pas navilog, mais lopxp qu'il faut stp :

 http://cjoint.com/data/bnpW50EJhi.htm

@+

zader · Answer

Greenday,

Voici donc le rapport demandé, mais est-ce normal si les fenêtres CiD semblent avoir miraculeusement disparu depuis que j'ai lancé Navilog1?...Je ne vais pas me plaindre ceci dit, et j'espère que cette accalmie est durable...

Rapport Lopxp fait le 13/01/2008 à 16:00:54
Exécuté dans : C:\Program Files\Lopxp



  Killing 'iexplore.exe'
"C:\Program Files\Internet Explorer\iexplore.exe" (3920)
"C:\Program Files\Internet Explorer\iexplore.exe" (176)
"C:\Program Files\Internet Explorer\iexplore.exe" (2212)
"C:\Program Files\Internet Explorer\iexplore.exe" (2784)
"C:\Program Files\Internet Explorer\iexplore.exe"  (3032)

___________________________________________________________________________

=> Tâches planifiées


C:\WINDOWS	asks\AppleSoftwareUpdate.job 
Crée le : 03/04/2007 à 23:01
Fichier exécuté => C:\Program Files\Apple Software Update\SoftwareUpdate.exe -Task

C:\WINDOWS	asks\B5522A9791E9A007.job 
Crée le : 07/01/2008 à 20:22
Fichier exécuté => c:\docume~1\viovio\applic~1\drawpu~1\Style Build Each.exe 

C:\WINDOWS	asks\Vérifier les mises à jour de Windows Live Toolbar.job 
Fichier exécuté => C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE 


___________________________________________________________________________

=> Listing des dossiers Application Data


+- C:\Documents and Settings\Administrateur\Application Data

07/01/2008 17:47:57 ... APPLEC~1 --= Apple Computer
07/01/2008 17:47:57 ... IDENTI~1 --= Identities
07/01/2008 17:47:57 ... INTERV~1 --= Intervideo
07/01/2008 17:47:56 ... MICROS~1 --= Microsoft
07/01/2008 17:47:56 ... SAMPLE~1 --= SampleView
07/01/2008 17:47:56 ... Sun -------= Sun
07/01/2008 17:47:56 ... Symantec --= Symantec

+- C:\Documents and Settings\Administrateur\Local Settings\Application Data

07/01/2008 17:47:56 ... APPLEC~1 --= Apple Computer
07/01/2008 17:47:56 ... APPLIC~1 --= ApplicationHistory
07/01/2008 17:47:56 ... MICROS~1 --= Microsoft
07/01/2008 17:47:56 ... {7148F~1 --= {7148F0A6-6813-11D6-A77B-00B0D0142030}

+- C:\Documents and Settings\All Users\Application Data

01/01/2004 17:39:14 ... Adobe -----= Adobe
23/09/2007 10:36:24 ... Ahead -----= Ahead
04/11/2007 14:10:38 ... ALEXAN~1 --= Alexandra Ledermann 8
03/07/2007 16:17:42 ... Apple -----= Apple
01/01/2004 17:44:49 ... APPLEC~1 --= Apple Computer
06/01/2008 19:03:23 ... FRAGGR~1 --= Frag great bend logo
16/12/2006 18:15:17 ... Google ----= Google
07/01/2008 15:11:26 ... Grisoft ---= Grisoft
01/01/2004 15:51:06 ... HEWLET~1 --= Hewlett-Packard
17/09/2007 19:02:18 ... HP --------= HP
01/01/2004 17:36:12 ... INTERV~1 --= InterVideo
01/01/2004 14:59:17 ... MICROS~1 --= Microsoft
01/01/2004 17:57:01 ... Motive ----= Motive
08/05/2005 12:49:06 ... NVIEW_~1 --= nView_Profiles
28/08/2007 16:23:17 ... OFFICE~1 --= Office Genuine Advantage
01/01/2004 17:44:54 ... QUICKT~1 --= QuickTime
01/01/2004 14:11:16 ... SBSI ------= SBSI
01/01/2004 21:04:29 ... Symantec --= Symantec
18/04/2006 15:03:33 ... WINDOW~1 --= Windows Genuine Advantage
09/01/2007 00:26:44 ... WINDOW~2 --= Windows Live Toolbar
05/10/2007 18:43:51 ... WLINST~1 --= WLInstaller

+- C:\Documents and Settings\Tonin\Application Data

12/06/2005 12:15:15 ... Adobe -----= Adobe
12/06/2005 12:15:40 ... AdobeUM ---= AdobeUM
10/05/2005 18:54:18 ... APPLEC~1 --= Apple Computer
22/12/2006 10:08:08 ... Google ----= Google
15/11/2005 21:10:18 ... Help ------= Help
10/05/2005 18:54:18 ... IDENTI~1 --= Identities
10/05/2005 18:54:18 ... INTERV~1 --= Intervideo
25/04/2006 19:51:56 ... Lavasoft --= Lavasoft
21/09/2005 12:07:59 ... LEADER~1 --= Leadertech
10/05/2005 18:57:05 ... MACROM~1 --= Macromedia
10/05/2005 18:54:18 ... MICROS~1 --= Microsoft
01/07/2005 16:54:49 ... Motive ----= Motive
13/09/2005 16:24:46 ... MSNINS~1 --= MSNInstaller
25/05/2006 17:32:27 ... OPENOF~1.ORG --= OpenOffice.org2
28/02/2006 11:12:50 ... Real ------= Real
10/05/2005 18:54:18 ... SAMPLE~1 --= SampleView
25/12/2005 17:14:01 ... Sierra ----= Sierra
21/09/2005 12:08:14 ... Sonic -----= Sonic
10/05/2005 18:54:18 ... Sun -------= Sun
10/05/2005 18:54:18 ... Symantec --= Symantec

+- C:\Documents and Settings\Tonin\Local Settings\Application Data

12/06/2005 12:15:15 ... Adobe -----= Adobe
10/05/2005 18:54:18 ... APPLEC~1 --= Apple Computer
10/05/2005 18:54:18 ... APPLIC~1 --= ApplicationHistory
22/12/2006 10:08:08 ... Google ----= Google
15/11/2005 21:10:18 ... Help ------= Help
24/05/2005 16:04:53 ... IDENTI~1 --= Identities
10/05/2005 18:54:18 ... MICROS~1 --= Microsoft
04/06/2005 19:16:59 ... WMTOOL~1 --= WMTools Downloaded Files
10/05/2005 18:54:18 ... {7148F~1 --= {7148F0A6-6813-11D6-A77B-00B0D0142030}

+- C:\Documents and Settings	onin.NOM-641695C7437\Application Data

27/04/2007 10:58:32 ... Adobe -----= Adobe
04/02/2007 14:41:59 ... APPLEC~1 --= Apple Computer
09/01/2008 13:39:53 ... DRAWPU~1 --= Draw Pure
29/03/2007 15:27:12 ... Google ----= Google
09/01/2008 13:33:24 ... Grisoft ---= Grisoft
18/09/2007 17:59:20 ... HP --------= HP
04/02/2007 14:41:59 ... IDENTI~1 --= Identities
08/09/2007 18:16:52 ... ijjigame --= ijjigame
30/07/2007 17:52:31 ... INSTAL~1 --= InstallShield
04/02/2007 14:41:59 ... INTERV~1 --= Intervideo
27/06/2007 12:05:44 ... LEADER~1 --= Leadertech
05/02/2007 21:00:52 ... MACROM~1 --= Macromedia
15/11/2007 16:18:13 ... MAILFR~1 --= MailFrontier
04/02/2007 14:41:59 ... MICROS~1 --= Microsoft
20/09/2007 14:50:42 ... Real ------= Real
04/02/2007 14:41:59 ... SAMPLE~1 --= SampleView
17/04/2007 20:04:14 ... Sierra ----= Sierra
27/06/2007 12:12:20 ... Sonic -----= Sonic
04/02/2007 14:41:59 ... Sun -------= Sun
04/02/2007 14:41:59 ... Symantec --= Symantec
06/10/2007 10:11:44 ... WINDOW~1 --= Windows Desktop Search

+- C:\Documents and Settings	onin.NOM-641695C7437\Local Settings\Application Data

27/04/2007 10:58:32 ... Adobe -----= Adobe
04/02/2007 14:41:59 ... APPLEC~1 --= Apple Computer
04/02/2007 14:41:59 ... APPLIC~1 --= ApplicationHistory
29/03/2007 15:27:13 ... Google ----= Google
05/03/2007 17:46:14 ... HP --------= HP
06/10/2007 10:11:51 ... IDENTI~1 --= Identities
05/03/2007 17:46:14 ... ISOLAT~1 --= IsolatedStorage
04/02/2007 14:41:58 ... MICROS~1 --= Microsoft
05/10/2007 19:23:14 ... WINDOW~1 --= Windows Live Writer
04/02/2007 14:41:58 ... {7148F~1 --= {7148F0A6-6813-11D6-A77B-00B0D0142030}

+- C:\Documents and Settings\viovio\Application Data

28/03/2007 13:12:49 ... Adobe -----= Adobe
28/03/2007 13:13:19 ... AdobeUM ---= AdobeUM
26/09/2007 08:55:06 ... Ahead -----= Ahead
04/02/2007 11:42:45 ... APPLEC~1 --= Apple Computer
06/01/2008 19:03:04 ... DRAWPU~1 --= Draw Pure
28/03/2007 11:47:43 ... Google ----= Google
07/01/2008 18:55:31 ... Grisoft ---= Grisoft
18/09/2007 15:57:54 ... HP --------= HP
04/02/2007 11:42:45 ... IDENTI~1 --= Identities
04/11/2007 14:02:32 ... INSTAL~1 --= InstallShield
04/02/2007 11:42:45 ... INTERV~1 --= Intervideo
04/02/2007 11:44:45 ... MACROM~1 --= Macromedia
13/11/2007 17:33:06 ... MAILFR~1 --= MailFrontier
04/02/2007 11:42:45 ... MICROS~1 --= Microsoft
25/04/2007 18:52:35 ... Motive ----= Motive
28/03/2007 11:56:50 ... OPENOF~1.ORG ----= OpenOffice.org2
20/09/2007 18:50:49 ... Real ------= Real
04/02/2007 11:42:45 ... SAMPLE~1 --= SampleView
30/07/2007 14:18:52 ... SecuROM ---= SecuROM
04/02/2007 11:42:45 ... Sun -------= Sun
04/02/2007 11:42:45 ... Symantec --= Symantec
26/09/2007 09:01:13 ... vlc -------= vlc
06/10/2007 11:16:17 ... WINDOW~1 --= Windows Desktop Search

+- C:\Documents and Settings\viovio\Local Settings\Application Data

28/03/2007 13:12:49 ... Adobe -----= Adobe
25/09/2007 18:19:58 ... Ahead -----= Ahead
04/02/2007 11:42:45 ... APPLEC~1 --= Apple Computer
04/02/2007 11:42:45 ... APPLIC~1 --= ApplicationHistory
28/03/2007 11:47:43 ... Google ----= Google
04/02/2007 13:02:25 ... IDENTI~1 --= Identities
04/02/2007 11:42:45 ... MICROS~1 --= Microsoft
05/10/2007 19:07:36 ... WINDOW~1 --= Windows Live Writer
06/10/2007 20:38:34 ... WMTOOL~1 --= WMTools Downloaded Files
04/02/2007 11:42:45 ... {7148F~1 --= {7148F0A6-6813-11D6-A77B-00B0D0142030}

___________________________________________________________________________

=> Listing du dossier ProgramFiles

+- C:\Program Files

16/02/2005 16:05:59 ... 3DO -------= 3DO
13/05/2007 14:41:42 ... ACTIVI~1 --= Activision
01/01/2004 17:39:12 ... Adobe -----= Adobe
18/04/2006 11:52:26 ... ALWILS~1 --= Alwil Software
03/04/2007 23:00:44 ... APPLES~1 --= Apple Software Update
04/07/2007 23:00:04 ... Audacity --= Audacity
22/09/2007 10:13:39 ... AVISYN~1.5 --= AviSynth 2.5
01/01/2005 15:17:12 ... Bullfrog --= Bullfrog
18/10/2006 09:24:37 ... CAMSTU~1 --= CamStudio
16/10/2005 16:20:19 ... Canon -----= Canon
07/01/2008 15:00:06 ... CCleaner --= CCleaner
25/09/2006 14:40:45 ... CHEVAL~1 --= Chevalmag
01/01/2004 14:03:50 ... COMPLU~1 --= ComPlus Applications
18/11/2007 09:12:34 ... Cossacks --= Cossacks
03/07/2006 15:53:53 ... Cyanide ---= Cyanide
29/06/2005 12:10:45 ... directx ---= directx
21/04/2007 18:40:51 ... Disney ----= Disney
02/12/2007 00:45:40 ... Dofus -----= Dofus
07/01/2008 20:21:37 ... DRAWPU~1 --= Draw Pure
22/09/2007 14:05:12 ... DVDFLI~1 --= DVD Flick
31/12/2004 19:14:33 ... EAGAME~1 --= EA GAMES
01/01/2004 18:01:14 ... EASYIN~1 --= Easy Internet signup
22/09/2007 10:12:34 ... ERIGHT~1 --= eRightSoft
01/01/2004 14:59:46 ... FICHIE~1 --= Fichiers communs
19/09/2007 14:36:41 ... FLVPLA~1 --= FLV Player
18/03/2007 11:22:28 ... FNACMU~1 --= Fnacmusic
29/06/2005 11:40:28 ... Fox -------= Fox
25/12/2005 16:59:21 ... GAMESP~1 --= GameSpy Arcade
02/04/2006 22:07:44 ... Google ----= Google
07/01/2008 15:11:23 ... Grisoft ---= Grisoft
24/01/2005 18:51:08 ... HAVASI~1 --= Havas Interactive
01/01/2004 17:53:40 ... HELPAN~1 --= Help and Support Additions
17/09/2007 18:58:39 ... HEWLET~1 --= Hewlett-Packard
04/07/2007 23:04:52 ... HOTPOT~1 --= HotPotatoes6
01/01/2004 15:41:10 ... HP --------= HP
01/01/2004 17:35:58 ... INSTAL~1 --= InstallShield Installation Information
31/01/2005 21:20:55 ... INTERA~1 --= InterActual
01/01/2004 14:04:01 ... INTERN~1 --= Internet Explorer
01/01/2004 17:35:58 ... INTERV~1 --= InterVideo
03/07/2007 16:19:07 ... iPod ------= iPod
03/07/2007 16:19:02 ... iTunes ----= iTunes
01/01/2004 15:07:22 ... Java ------= Java
12/12/2006 19:19:04 ... JSWORL~1 --= JS World
18/04/2006 14:13:56 ... Lavasoft --= Lavasoft
23/04/2006 19:48:08 ... Lexicon ---= Lexicon
13/01/2008 15:58:08 ... Lopxp -----= Lopxp
04/06/2005 16:15:08 ... LUCASA~1 --= LucasArts
10/08/2005 20:00:25 ... MAIET -----= MAIET
03/02/2005 12:54:03 ... Maxis -----= Maxis
01/01/2004 14:03:08 ... MESSEN~1 --= Messenger
02/12/2007 13:21:02 ... MICROA~1 --= Micro Application
01/01/2004 14:06:10 ... MICROS~1 --= microsoft frontpage
15/03/2007 22:14:53 ... MICROS~3 --= Microsoft Games
23/06/2005 13:40:04 ... MICROS~2 --= Microsoft Office
05/10/2007 19:11:27 ... MICROS~4 --= Microsoft SQL Server Compact Edition
03/07/2007 10:22:42 ... MICROS~1.NET --= Microsoft.NET
01/01/2004 14:04:06 ... MOVIEM~1 --= Movie Maker
01/01/2004 14:02:59 ... MSN -------= MSN
01/01/2004 14:03:07 ... MSNGAM~1 --= MSN Gaming Zone
11/05/2005 14:30:51 ... MSNMES~1 --= MSN Messenger
19/11/2006 21:53:42 ... MSXML4~1.0 --= MSXML 4.0
09/01/2008 15:37:07 ... Navilog1 --= Navilog1
01/01/2004 14:04:03 ... NETMEE~1 --= NetMeeting
14/09/2007 16:27:29 ... NHNUSA~1 --= NHN USA
01/01/2004 14:03:13 ... ONLINE~1 --= Online Services
13/03/2006 22:09:29 ... OPENOF~1.0 --= OpenOffice.org 2.0
01/01/2004 14:04:02 ... OUTLOO~1 --= Outlook Express
01/01/2004 17:58:19 ... PC-DOC~1 --= PC-Doctor for Windows
26/09/2007 13:44:39 ... PENSE-~1 --= Pense-bete
26/09/2007 09:03:56 ... PonyGirl --= PonyGirl
03/07/2007 16:15:22 ... QUICKT~1 --= QuickTime
26/02/2006 16:26:52 ... Real ------= Real
29/06/2005 15:20:37 ... REDSTO~1 --= Red Storm Entertainment
30/07/2007 17:54:54 ... SEGA ------= SEGA
01/01/2004 14:04:26 ... SERVIC~1 --= Services en ligne
25/12/2005 16:40:37 ... Sierra ----= Sierra
05/02/2005 11:11:46 ... SIERRA~1 --= Sierra On-Line
02/01/2004 05:59:51 ... SISVGA~1.59E --= SiS VGA Utilities V3.59e
04/02/2006 20:42:44 ... SLAYER~1 --= Slayers Online
25/02/2006 22:23:41 ... SLDCOD~1 --= SLD Codec Pack
04/07/2005 22:42:40 ... SlySoft ---= SlySoft
01/01/2004 17:34:00 ... Sonic -----= Sonic
01/01/2004 17:34:00 ... SONICR~1 --= Sonic RecordNow!
01/01/2004 21:04:31 ... Symantec --= Symantec
17/09/2005 09:47:18 ... Tiscali ---= Tiscali
14/07/2006 19:56:27 ... TISCAL~2 --= Tiscali Triway Wi-Fi
30/07/2005 15:06:53 ... TISCAL~1 --= Tiscali_Triway_WiFi
31/12/2004 17:26:29 ... TOTALW~1 --= Total War
08/01/2008 01:57:38 ... TRENDM~1 --= Trend Micro
23/01/2005 17:49:36 ... UBISOF~1 --= Ubi Soft
23/01/2005 17:40:05 ... UbiSoft ---= UbiSoft
01/01/2004 14:09:08 ... UNINST~1 --= Uninstall Information
28/08/2007 14:04:39 ... VIDEOA~1 --= Video ActiveX Access
30/06/2007 16:36:57 ... VideoLAN --= VideoLAN
31/12/2004 21:24:37 ... WARCRA~1 --= Warcraft III
05/10/2007 19:10:45 ... WI459E~1 --= Windows Desktop Search
05/10/2007 18:44:01 ... WI1F86~1 --= Windows Live
09/01/2007 00:20:48 ... WI81E8~1 --= Windows Live Toolbar
12/07/2007 10:02:59 ... WINDOW~4 --= Windows Media Connect 2
01/01/2004 14:03:13 ... WINDOW~2 --= Windows Media Player
01/01/2004 14:02:59 ... WINDOW~1 --= Windows NT
01/01/2004 14:04:29 ... WINDOW~3 --= WindowsUpdate
05/07/2006 16:09:46 ... WinZip ----= WinZip
18/03/2007 21:55:43 ... Woonoz ----= Woonoz
01/01/2004 14:06:10 ... xerox -----= xerox
16/11/2005 11:29:29 ... Yahoo! ----= Yahoo!
18/04/2006 13:47:17 ... ZONELA~1 --= Zone Labs


___________________________________________________________________________

=> Clés registre

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"bend logo clock film"="C:\Documents and Settings\All Users\Application Data\Frag great bend logo\Burn Joy.exe"


___________________________________________________________________________

=> Bloqueur popups Internet Explorer


+- Liste des popups autorisés :


___________________________________________________________________________

/!\  Suggestion (Nécessite une interprétation.)


+- Dossiers suspects :

C:\Documents and Settings\HP_Propriétaire\Application Data\Draw Pure
C:\Documents and Settings	onin.NOM-641695C7437\Application Data\Draw Pure
C:\Documents and Settings\viovio\Application Data\Draw Pure
C:\Program Files\Draw Pure


+- Tâches planifiées suspectes :

C:\WINDOWS	asks\B5522A9791E9A007.job


+- Registre:

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"bend logo clock film"=-




- Fin du rapport -


Merci encore de ton aide.

green day · Answer

ok, mais je doute que navilog y soit pour quelque chose, puisqu'on a encore rien fait !

télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe (de Old_Timer) sur ton Bureau. 
double-clique sur OTMoveIt.exe pour le lancer. 
copie la liste qui se trouve en ci-dessous en gras, 
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved. 

C:\Documents and Settings\HP_Propriétaire\Application Data\Draw Pure
C:\Documents and Settings	onin.NOM-641695C7437\Application Data\Draw Pure
C:\Documents and Settings\viovio\Application Data\Draw Pure
C:\Program Files\Draw Pure
C:\WINDOWS	asks\B5522A9791E9A007.job
C:\Documents and Settings\All Users\Application Data\Frag great bend logo

clique sur MoveIt! pour lancer la suppression. 
le résultat apparaitra dans le cadre "Results". 
clique sur Exit pour fermer. 
poste le rapport situé dans C:\_OTMoveIt\MovedFiles. 

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes. 

@+

zader · Answer

Mission accomplie; voici le rapport:

C:\Documents and Settings\HP_Propriétaire\Application Data\Draw Pure moved successfully.
C:\Documents and Settings	onin.NOM-641695C7437\Application Data\Draw Pure moved successfully.
C:\Documents and Settings\viovio\Application Data\Draw Pure moved successfully.
C:\Program Files\Draw Pure moved successfully.
C:\WINDOWS	asks\B5522A9791E9A007.job moved successfully.
C:\Documents and Settings\All Users\Application Data\Frag great bend logo moved successfully.
File/Folder  not found.
 
Created on 01/13/2008 17:39:28


Peut-on savoir à quoi correspondent ces fichiers et y a-t-il encore autre chose à faire?
Merci encore.

green day · Answer

ce sont les fichiers infecté lié à lop et responsable des fenêtres cid !

 ok, fais ce qui est indiqué ici stp :

http://www.commentcamarche.net/faq/sujet 3174 virus methode preliminaire de desinfection version fr

++

zader · Answer

oui je me doute bien ...(cette fois-ci c'est moi qui ai un peu l'impression d'être prise pour une ...;-))...
J'ai dû mal formuler ma question.Je voulais dire: a-t-on une idée de comment on choppe ce truc? Est-ce que c'est juste ma fille en téléchargeant msn live plus ou bien ça peut être autre chose? Ma question est sûrement bête mais tant pis. 

Pour ce qui est de la procédure préliminaire de désinfection, je l'avais déjà suivie avant de mettre un post sur ce forum: cela veut-il dire qu'il faut que je recommence? Sans doute encore une question bête :-)

Merci.

green day · Answer

Ah ! autant pour moi, je n'avais pas compris la question, et loin de moi l'idée de te prendre pour une ... ! :)
non, ce n'est pas une question bbébétte ! oui, c'est en téléchargeant msn+ et en acceptant le sponsors que l'on choppe lop responsable des fenêtre cid !

 voir ici : http://www.commentcamarche.net/faq/sujet 5996 comment bloquer les fenetres cid

Pour ce qui est de la procédure préliminaire de désinfection, je l'avais déjà suivie avant de mettre un post sur ce forum: cela veut-il dire qu'il faut que je recommence? 

ça dépend, s'il ne t'a rien trouvé, pas besoin ou s'il t'a trouvé quelque chose et tu veux que je regarde ( si tu as enregistré les rapports ) alors poste les !

 sinon, poste un nouveau hijack et précise l'évolution de la situation

@+

zader · Answer

Mes premiers rapports Bitfender et hijack figurent ds mon premier post mais je vais refaire un hijack pour voir (ou plutôt pour que tu voies, si ça ne te dérange pas )si qqch a changé.
@ +

zader · Answer

Voici donc mon premier rapport hijack:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:58:24, on 08/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hphmon06.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\system32\keyhook.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32undll32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\TMMEducation\Apps\HttpServer\HttpServer.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q404&bd=pavilion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q404&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q404&bd=pavilion&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.1.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [TiscaliParam] C:\Program Files\Tiscali\Dialer\bootparam.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [Cloneur Expert Monitor] "C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [bend logo clock film] C:\Documents and Settings\All Users\Application Data\Frag great bend logo\Burn Joy.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HELPAN~1\Pavilion\XPHWWBF4\plugin\bin\PCHButton.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-3636313864-4027070454-1807119305-1008\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background (User 'viovio')
O4 - HKUS\S-1-5-21-3636313864-4027070454-1807119305-1008\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" (User 'viovio')
O4 - HKUS\S-1-5-21-3636313864-4027070454-1807119305-1008\..\Run: [BORE LIST] C:\DOCUME~1\viovio\APPLIC~1\DRAWPU~1\WEBLESS.exe (User 'viovio')
O4 - S-1-5-21-3636313864-4027070454-1807119305-1008 Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe (User 'viovio')
O4 - S-1-5-21-3636313864-4027070454-1807119305-1008 Startup: Registration Alexandra Ledermann 8.LNK = E:\Support\Register\RegistrationReminder.exe (User 'viovio')
O4 - S-1-5-21-3636313864-4027070454-1807119305-1008 User Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe (User 'viovio')
O4 - S-1-5-21-3636313864-4027070454-1807119305-1008 User Startup: Registration Alexandra Ledermann 8.LNK = E:\Support\Register\RegistrationReminder.exe (User 'viovio')
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx2.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab
O16 - DPF: {63308B48-F435-42FD-AB0A-3564C7BEF9D7} (Toontown Installer ActiveX Control French) - https://iplay.fr.toontown.com/download/sv1.5.15.9/ttinst-french.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
O16 - DPF: {D28C3640-A6D7-4668-A53C-07A9CF67D157} (CFnacComposantCtrl Object) - http://www.fnacmusic.com/telechargementFnacmusic/FnacComposant.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TELL ME MORE 7 EDUCATION - Auralog - C:\TMMEducation\Apps\HttpServer\HttpServer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

green day · Answer

ok, poste un nouveau rapport lopxp stp

++

zader · Answer

ouf! Voici le dernier rapport demandé... Dis-moi ce que tu en penses.


Rapport Lopxp fait le 13/01/2008 à 21:54:22
Exécuté dans : C:\Program Files\Lopxp



  Killing 'iexplore.exe'
"C:\Program Files\Internet Explorer\iexplore.exe"  (6108)
"C:\Program Files\Internet Explorer\iexplore.exe" (6080)

___________________________________________________________________________

=> Tâches planifiées


C:\WINDOWS	asks\AppleSoftwareUpdate.job 
Crée le : 03/04/2007 à 23:01
Fichier exécuté => C:\Program Files\Apple Software Update\SoftwareUpdate.exe -Task

C:\WINDOWS	asks\Vérifier les mises à jour de Windows Live Toolbar.job 
Fichier exécuté => C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE 


___________________________________________________________________________

=> Listing des dossiers Application Data


+- C:\Documents and Settings\Administrateur\Application Data

07/01/2008 17:47:57 ... APPLEC~1 --= Apple Computer
07/01/2008 17:47:57 ... IDENTI~1 --= Identities
07/01/2008 17:47:57 ... INTERV~1 --= Intervideo
07/01/2008 17:47:56 ... MICROS~1 --= Microsoft
07/01/2008 17:47:56 ... SAMPLE~1 --= SampleView
07/01/2008 17:47:56 ... Sun -------= Sun
07/01/2008 17:47:56 ... Symantec --= Symantec

+- C:\Documents and Settings\Administrateur\Local Settings\Application Data

07/01/2008 17:47:56 ... APPLEC~1 --= Apple Computer
07/01/2008 17:47:56 ... APPLIC~1 --= ApplicationHistory
07/01/2008 17:47:56 ... MICROS~1 --= Microsoft
07/01/2008 17:47:56 ... {7148F~1 --= {7148F0A6-6813-11D6-A77B-00B0D0142030}

+- C:\Documents and Settings\All Users\Application Data

01/01/2004 17:39:14 ... Adobe -----= Adobe
23/09/2007 10:36:24 ... Ahead -----= Ahead
04/11/2007 14:10:38 ... ALEXAN~1 --= Alexandra Ledermann 8
03/07/2007 16:17:42 ... Apple -----= Apple
01/01/2004 17:44:49 ... APPLEC~1 --= Apple Computer
16/12/2006 18:15:17 ... Google ----= Google
07/01/2008 15:11:26 ... Grisoft ---= Grisoft
01/01/2004 15:51:06 ... HEWLET~1 --= Hewlett-Packard
17/09/2007 19:02:18 ... HP --------= HP
01/01/2004 17:36:12 ... INTERV~1 --= InterVideo
01/01/2004 14:59:17 ... MICROS~1 --= Microsoft
01/01/2004 17:57:01 ... Motive ----= Motive
08/05/2005 12:49:06 ... NVIEW_~1 --= nView_Profiles
28/08/2007 16:23:17 ... OFFICE~1 --= Office Genuine Advantage
01/01/2004 17:44:54 ... QUICKT~1 --= QuickTime
01/01/2004 14:11:16 ... SBSI ------= SBSI
01/01/2004 21:04:29 ... Symantec --= Symantec
18/04/2006 15:03:33 ... WINDOW~1 --= Windows Genuine Advantage
09/01/2007 00:26:44 ... WINDOW~2 --= Windows Live Toolbar
05/10/2007 18:43:51 ... WLINST~1 --= WLInstaller

+- C:\Documents and Settings\Tonin\Application Data

12/06/2005 12:15:15 ... Adobe -----= Adobe
12/06/2005 12:15:40 ... AdobeUM ---= AdobeUM
10/05/2005 18:54:18 ... APPLEC~1 --= Apple Computer
22/12/2006 10:08:08 ... Google ----= Google
15/11/2005 21:10:18 ... Help ------= Help
10/05/2005 18:54:18 ... IDENTI~1 --= Identities
10/05/2005 18:54:18 ... INTERV~1 --= Intervideo
25/04/2006 19:51:56 ... Lavasoft --= Lavasoft
21/09/2005 12:07:59 ... LEADER~1 --= Leadertech
10/05/2005 18:57:05 ... MACROM~1 --= Macromedia
10/05/2005 18:54:18 ... MICROS~1 --= Microsoft
01/07/2005 16:54:49 ... Motive ----= Motive
13/09/2005 16:24:46 ... MSNINS~1 --= MSNInstaller
25/05/2006 17:32:27 ... OPENOF~1.ORG --= OpenOffice.org2
28/02/2006 11:12:50 ... Real ------= Real
10/05/2005 18:54:18 ... SAMPLE~1 --= SampleView
25/12/2005 17:14:01 ... Sierra ----= Sierra
21/09/2005 12:08:14 ... Sonic -----= Sonic
10/05/2005 18:54:18 ... Sun -------= Sun
10/05/2005 18:54:18 ... Symantec --= Symantec

+- C:\Documents and Settings\Tonin\Local Settings\Application Data

12/06/2005 12:15:15 ... Adobe -----= Adobe
10/05/2005 18:54:18 ... APPLEC~1 --= Apple Computer
10/05/2005 18:54:18 ... APPLIC~1 --= ApplicationHistory
22/12/2006 10:08:08 ... Google ----= Google
15/11/2005 21:10:18 ... Help ------= Help
24/05/2005 16:04:53 ... IDENTI~1 --= Identities
10/05/2005 18:54:18 ... MICROS~1 --= Microsoft
04/06/2005 19:16:59 ... WMTOOL~1 --= WMTools Downloaded Files
10/05/2005 18:54:18 ... {7148F~1 --= {7148F0A6-6813-11D6-A77B-00B0D0142030}

+- C:\Documents and Settings	onin.NOM-641695C7437\Application Data

27/04/2007 10:58:32 ... Adobe -----= Adobe
04/02/2007 14:41:59 ... APPLEC~1 --= Apple Computer
29/03/2007 15:27:12 ... Google ----= Google
09/01/2008 13:33:24 ... Grisoft ---= Grisoft
18/09/2007 17:59:20 ... HP --------= HP
04/02/2007 14:41:59 ... IDENTI~1 --= Identities
08/09/2007 18:16:52 ... ijjigame --= ijjigame
30/07/2007 17:52:31 ... INSTAL~1 --= InstallShield
04/02/2007 14:41:59 ... INTERV~1 --= Intervideo
27/06/2007 12:05:44 ... LEADER~1 --= Leadertech
05/02/2007 21:00:52 ... MACROM~1 --= Macromedia
15/11/2007 16:18:13 ... MAILFR~1 --= MailFrontier
04/02/2007 14:41:59 ... MICROS~1 --= Microsoft
20/09/2007 14:50:42 ... Real ------= Real
04/02/2007 14:41:59 ... SAMPLE~1 --= SampleView
17/04/2007 20:04:14 ... Sierra ----= Sierra
27/06/2007 12:12:20 ... Sonic -----= Sonic
04/02/2007 14:41:59 ... Sun -------= Sun
04/02/2007 14:41:59 ... Symantec --= Symantec
06/10/2007 10:11:44 ... WINDOW~1 --= Windows Desktop Search

+- C:\Documents and Settings	onin.NOM-641695C7437\Local Settings\Application Data

27/04/2007 10:58:32 ... Adobe -----= Adobe
04/02/2007 14:41:59 ... APPLEC~1 --= Apple Computer
04/02/2007 14:41:59 ... APPLIC~1 --= ApplicationHistory
29/03/2007 15:27:13 ... Google ----= Google
05/03/2007 17:46:14 ... HP --------= HP
06/10/2007 10:11:51 ... IDENTI~1 --= Identities
05/03/2007 17:46:14 ... ISOLAT~1 --= IsolatedStorage
04/02/2007 14:41:58 ... MICROS~1 --= Microsoft
05/10/2007 19:23:14 ... WINDOW~1 --= Windows Live Writer
04/02/2007 14:41:58 ... {7148F~1 --= {7148F0A6-6813-11D6-A77B-00B0D0142030}

+- C:\Documents and Settings\viovio\Application Data

28/03/2007 13:12:49 ... Adobe -----= Adobe
28/03/2007 13:13:19 ... AdobeUM ---= AdobeUM
26/09/2007 08:55:06 ... Ahead -----= Ahead
04/02/2007 11:42:45 ... APPLEC~1 --= Apple Computer
28/03/2007 11:47:43 ... Google ----= Google
07/01/2008 18:55:31 ... Grisoft ---= Grisoft
18/09/2007 15:57:54 ... HP --------= HP
04/02/2007 11:42:45 ... IDENTI~1 --= Identities
04/11/2007 14:02:32 ... INSTAL~1 --= InstallShield
04/02/2007 11:42:45 ... INTERV~1 --= Intervideo
04/02/2007 11:44:45 ... MACROM~1 --= Macromedia
13/11/2007 17:33:06 ... MAILFR~1 --= MailFrontier
04/02/2007 11:42:45 ... MICROS~1 --= Microsoft
25/04/2007 18:52:35 ... Motive ----= Motive
28/03/2007 11:56:50 ... OPENOF~1.ORG ----= OpenOffice.org2
20/09/2007 18:50:49 ... Real ------= Real
04/02/2007 11:42:45 ... SAMPLE~1 --= SampleView
30/07/2007 14:18:52 ... SecuROM ---= SecuROM
04/02/2007 11:42:45 ... Sun -------= Sun
04/02/2007 11:42:45 ... Symantec --= Symantec
26/09/2007 09:01:13 ... vlc -------= vlc
06/10/2007 11:16:17 ... WINDOW~1 --= Windows Desktop Search

+- C:\Documents and Settings\viovio\Local Settings\Application Data

28/03/2007 13:12:49 ... Adobe -----= Adobe
25/09/2007 18:19:58 ... Ahead -----= Ahead
04/02/2007 11:42:45 ... APPLEC~1 --= Apple Computer
04/02/2007 11:42:45 ... APPLIC~1 --= ApplicationHistory
28/03/2007 11:47:43 ... Google ----= Google
04/02/2007 13:02:25 ... IDENTI~1 --= Identities
04/02/2007 11:42:45 ... MICROS~1 --= Microsoft
05/10/2007 19:07:36 ... WINDOW~1 --= Windows Live Writer
06/10/2007 20:38:34 ... WMTOOL~1 --= WMTools Downloaded Files
04/02/2007 11:42:45 ... {7148F~1 --= {7148F0A6-6813-11D6-A77B-00B0D0142030}

___________________________________________________________________________

=> Listing du dossier ProgramFiles

+- C:\Program Files

16/02/2005 16:05:59 ... 3DO -------= 3DO
13/05/2007 14:41:42 ... ACTIVI~1 --= Activision
01/01/2004 17:39:12 ... Adobe -----= Adobe
18/04/2006 11:52:26 ... ALWILS~1 --= Alwil Software
03/04/2007 23:00:44 ... APPLES~1 --= Apple Software Update
04/07/2007 23:00:04 ... Audacity --= Audacity
22/09/2007 10:13:39 ... AVISYN~1.5 --= AviSynth 2.5
01/01/2005 15:17:12 ... Bullfrog --= Bullfrog
18/10/2006 09:24:37 ... CAMSTU~1 --= CamStudio
16/10/2005 16:20:19 ... Canon -----= Canon
07/01/2008 15:00:06 ... CCleaner --= CCleaner
25/09/2006 14:40:45 ... CHEVAL~1 --= Chevalmag
01/01/2004 14:03:50 ... COMPLU~1 --= ComPlus Applications
18/11/2007 09:12:34 ... Cossacks --= Cossacks
03/07/2006 15:53:53 ... Cyanide ---= Cyanide
29/06/2005 12:10:45 ... directx ---= directx
21/04/2007 18:40:51 ... Disney ----= Disney
02/12/2007 00:45:40 ... Dofus -----= Dofus
22/09/2007 14:05:12 ... DVDFLI~1 --= DVD Flick
31/12/2004 19:14:33 ... EAGAME~1 --= EA GAMES
01/01/2004 18:01:14 ... EASYIN~1 --= Easy Internet signup
22/09/2007 10:12:34 ... ERIGHT~1 --= eRightSoft
01/01/2004 14:59:46 ... FICHIE~1 --= Fichiers communs
19/09/2007 14:36:41 ... FLVPLA~1 --= FLV Player
18/03/2007 11:22:28 ... FNACMU~1 --= Fnacmusic
29/06/2005 11:40:28 ... Fox -------= Fox
25/12/2005 16:59:21 ... GAMESP~1 --= GameSpy Arcade
02/04/2006 22:07:44 ... Google ----= Google
07/01/2008 15:11:23 ... Grisoft ---= Grisoft
24/01/2005 18:51:08 ... HAVASI~1 --= Havas Interactive
01/01/2004 17:53:40 ... HELPAN~1 --= Help and Support Additions
17/09/2007 18:58:39 ... HEWLET~1 --= Hewlett-Packard
04/07/2007 23:04:52 ... HOTPOT~1 --= HotPotatoes6
01/01/2004 15:41:10 ... HP --------= HP
01/01/2004 17:35:58 ... INSTAL~1 --= InstallShield Installation Information
31/01/2005 21:20:55 ... INTERA~1 --= InterActual
01/01/2004 14:04:01 ... INTERN~1 --= Internet Explorer
01/01/2004 17:35:58 ... INTERV~1 --= InterVideo
03/07/2007 16:19:07 ... iPod ------= iPod
03/07/2007 16:19:02 ... iTunes ----= iTunes
01/01/2004 15:07:22 ... Java ------= Java
12/12/2006 19:19:04 ... JSWORL~1 --= JS World
18/04/2006 14:13:56 ... Lavasoft --= Lavasoft
23/04/2006 19:48:08 ... Lexicon ---= Lexicon
13/01/2008 15:58:08 ... Lopxp -----= Lopxp
04/06/2005 16:15:08 ... LUCASA~1 --= LucasArts
10/08/2005 20:00:25 ... MAIET -----= MAIET
03/02/2005 12:54:03 ... Maxis -----= Maxis
01/01/2004 14:03:08 ... MESSEN~1 --= Messenger
02/12/2007 13:21:02 ... MICROA~1 --= Micro Application
01/01/2004 14:06:10 ... MICROS~1 --= microsoft frontpage
15/03/2007 22:14:53 ... MICROS~3 --= Microsoft Games
23/06/2005 13:40:04 ... MICROS~2 --= Microsoft Office
05/10/2007 19:11:27 ... MICROS~4 --= Microsoft SQL Server Compact Edition
03/07/2007 10:22:42 ... MICROS~1.NET --= Microsoft.NET
01/01/2004 14:04:06 ... MOVIEM~1 --= Movie Maker
01/01/2004 14:02:59 ... MSN -------= MSN
01/01/2004 14:03:07 ... MSNGAM~1 --= MSN Gaming Zone
11/05/2005 14:30:51 ... MSNMES~1 --= MSN Messenger
19/11/2006 21:53:42 ... MSXML4~1.0 --= MSXML 4.0
09/01/2008 15:37:07 ... Navilog1 --= Navilog1
01/01/2004 14:04:03 ... NETMEE~1 --= NetMeeting
14/09/2007 16:27:29 ... NHNUSA~1 --= NHN USA
01/01/2004 14:03:13 ... ONLINE~1 --= Online Services
13/03/2006 22:09:29 ... OPENOF~1.0 --= OpenOffice.org 2.0
01/01/2004 14:04:02 ... OUTLOO~1 --= Outlook Express
01/01/2004 17:58:19 ... PC-DOC~1 --= PC-Doctor for Windows
26/09/2007 13:44:39 ... PENSE-~1 --= Pense-bete
26/09/2007 09:03:56 ... PonyGirl --= PonyGirl
03/07/2007 16:15:22 ... QUICKT~1 --= QuickTime
26/02/2006 16:26:52 ... Real ------= Real
29/06/2005 15:20:37 ... REDSTO~1 --= Red Storm Entertainment
30/07/2007 17:54:54 ... SEGA ------= SEGA
01/01/2004 14:04:26 ... SERVIC~1 --= Services en ligne
25/12/2005 16:40:37 ... Sierra ----= Sierra
05/02/2005 11:11:46 ... SIERRA~1 --= Sierra On-Line
02/01/2004 05:59:51 ... SISVGA~1.59E --= SiS VGA Utilities V3.59e
04/02/2006 20:42:44 ... SLAYER~1 --= Slayers Online
25/02/2006 22:23:41 ... SLDCOD~1 --= SLD Codec Pack
04/07/2005 22:42:40 ... SlySoft ---= SlySoft
01/01/2004 17:34:00 ... Sonic -----= Sonic
01/01/2004 17:34:00 ... SONICR~1 --= Sonic RecordNow!
01/01/2004 21:04:31 ... Symantec --= Symantec
17/09/2005 09:47:18 ... Tiscali ---= Tiscali
14/07/2006 19:56:27 ... TISCAL~2 --= Tiscali Triway Wi-Fi
30/07/2005 15:06:53 ... TISCAL~1 --= Tiscali_Triway_WiFi
31/12/2004 17:26:29 ... TOTALW~1 --= Total War
08/01/2008 01:57:38 ... TRENDM~1 --= Trend Micro
23/01/2005 17:49:36 ... UBISOF~1 --= Ubi Soft
23/01/2005 17:40:05 ... UbiSoft ---= UbiSoft
01/01/2004 14:09:08 ... UNINST~1 --= Uninstall Information
28/08/2007 14:04:39 ... VIDEOA~1 --= Video ActiveX Access
30/06/2007 16:36:57 ... VideoLAN --= VideoLAN
31/12/2004 21:24:37 ... WARCRA~1 --= Warcraft III
05/10/2007 19:10:45 ... WI459E~1 --= Windows Desktop Search
05/10/2007 18:44:01 ... WI1F86~1 --= Windows Live
09/01/2007 00:20:48 ... WI81E8~1 --= Windows Live Toolbar
12/07/2007 10:02:59 ... WINDOW~4 --= Windows Media Connect 2
01/01/2004 14:03:13 ... WINDOW~2 --= Windows Media Player
01/01/2004 14:02:59 ... WINDOW~1 --= Windows NT
01/01/2004 14:04:29 ... WINDOW~3 --= WindowsUpdate
05/07/2006 16:09:46 ... WinZip ----= WinZip
18/03/2007 21:55:43 ... Woonoz ----= Woonoz
01/01/2004 14:06:10 ... xerox -----= xerox
16/11/2005 11:29:29 ... Yahoo! ----= Yahoo!
18/04/2006 13:47:17 ... ZONELA~1 --= Zone Labs


___________________________________________________________________________

=> Clés registre

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"bend logo clock film"="C:\Documents and Settings\All Users\Application Data\Frag great bend logo\Burn Joy.exe"


___________________________________________________________________________

=> Bloqueur popups Internet Explorer


+- Liste des popups autorisés :


___________________________________________________________________________

/!\  Suggestion (Nécessite une interprétation.)


+- Registre:

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"bend logo clock film"=-




- Fin du rapport -


Et encore merci infiniment...

green day · Answer

ok,

Relance HijackThis : choisis " do a scan only" coche la case devant les lignes ci-dessous et clique en bas sur "fix checked" : 


O4 - HKLM\..\Run: [bend logo clock film] C:\Documents and Settings\All Users\Application Data\Frag great bend logo\Burn Joy.exe

ensuite,

va dans : Démarrer > Exécuter puis copier/coller :
"%programfiles%\Lopxp\Lopxp.bat" /Fixme   <= Guillemets y compris
puis valide, et poste le rapport stp

@+

zader · Answer

Bonjour,

Désolée... J'ai dormi un peu entre tps mais voici le rapport après manip' scrupuleusement suivie:

Rapport Lopxp fait le 14/01/2008 à  9:50:17
Exécuté dans : C:\Program Files\Lopxp




___________________________________________________________________________

=> Fixme :

+- Registre :

Nettoyage effectué.

___________________________________________________________________________

=> Tâches planifiées


C:\WINDOWS	asks\AppleSoftwareUpdate.job 
Crée le : 03/04/2007 à 23:01
Fichier exécuté => C:\Program Files\Apple Software Update\SoftwareUpdate.exe -Task

C:\WINDOWS	asks\Vérifier les mises à jour de Windows Live Toolbar.job 
Fichier exécuté => C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE 


___________________________________________________________________________

=> Listing des dossiers Application Data


+- C:\Documents and Settings\Administrateur\Application Data

07/01/2008 17:47:57 ... APPLEC~1 --= Apple Computer
07/01/2008 17:47:57 ... IDENTI~1 --= Identities
07/01/2008 17:47:57 ... INTERV~1 --= Intervideo
07/01/2008 17:47:56 ... MICROS~1 --= Microsoft
07/01/2008 17:47:56 ... SAMPLE~1 --= SampleView
07/01/2008 17:47:56 ... Sun -------= Sun
07/01/2008 17:47:56 ... Symantec --= Symantec

+- C:\Documents and Settings\Administrateur\Local Settings\Application Data

07/01/2008 17:47:56 ... APPLEC~1 --= Apple Computer
07/01/2008 17:47:56 ... APPLIC~1 --= ApplicationHistory
07/01/2008 17:47:56 ... MICROS~1 --= Microsoft
07/01/2008 17:47:56 ... {7148F~1 --= {7148F0A6-6813-11D6-A77B-00B0D0142030}

+- C:\Documents and Settings\All Users\Application Data

01/01/2004 17:39:14 ... Adobe -----= Adobe
23/09/2007 10:36:24 ... Ahead -----= Ahead
04/11/2007 14:10:38 ... ALEXAN~1 --= Alexandra Ledermann 8
03/07/2007 16:17:42 ... Apple -----= Apple
01/01/2004 17:44:49 ... APPLEC~1 --= Apple Computer
16/12/2006 18:15:17 ... Google ----= Google
07/01/2008 15:11:26 ... Grisoft ---= Grisoft
01/01/2004 15:51:06 ... HEWLET~1 --= Hewlett-Packard
17/09/2007 19:02:18 ... HP --------= HP
01/01/2004 17:36:12 ... INTERV~1 --= InterVideo
01/01/2004 14:59:17 ... MICROS~1 --= Microsoft
01/01/2004 17:57:01 ... Motive ----= Motive
08/05/2005 12:49:06 ... NVIEW_~1 --= nView_Profiles
28/08/2007 16:23:17 ... OFFICE~1 --= Office Genuine Advantage
01/01/2004 17:44:54 ... QUICKT~1 --= QuickTime
01/01/2004 14:11:16 ... SBSI ------= SBSI
01/01/2004 21:04:29 ... Symantec --= Symantec
18/04/2006 15:03:33 ... WINDOW~1 --= Windows Genuine Advantage
09/01/2007 00:26:44 ... WINDOW~2 --= Windows Live Toolbar
05/10/2007 18:43:51 ... WLINST~1 --= WLInstaller

+- C:\Documents and Settings\Tonin\Application Data

12/06/2005 12:15:15 ... Adobe -----= Adobe
12/06/2005 12:15:40 ... AdobeUM ---= AdobeUM
10/05/2005 18:54:18 ... APPLEC~1 --= Apple Computer
22/12/2006 10:08:08 ... Google ----= Google
15/11/2005 21:10:18 ... Help ------= Help
10/05/2005 18:54:18 ... IDENTI~1 --= Identities
10/05/2005 18:54:18 ... INTERV~1 --= Intervideo
25/04/2006 19:51:56 ... Lavasoft --= Lavasoft
21/09/2005 12:07:59 ... LEADER~1 --= Leadertech
10/05/2005 18:57:05 ... MACROM~1 --= Macromedia
10/05/2005 18:54:18 ... MICROS~1 --= Microsoft
01/07/2005 16:54:49 ... Motive ----= Motive
13/09/2005 16:24:46 ... MSNINS~1 --= MSNInstaller
25/05/2006 17:32:27 ... OPENOF~1.ORG --= OpenOffice.org2
28/02/2006 11:12:50 ... Real ------= Real
10/05/2005 18:54:18 ... SAMPLE~1 --= SampleView
25/12/2005 17:14:01 ... Sierra ----= Sierra
21/09/2005 12:08:14 ... Sonic -----= Sonic
10/05/2005 18:54:18 ... Sun -------= Sun
10/05/2005 18:54:18 ... Symantec --= Symantec

+- C:\Documents and Settings\Tonin\Local Settings\Application Data

12/06/2005 12:15:15 ... Adobe -----= Adobe
10/05/2005 18:54:18 ... APPLEC~1 --= Apple Computer
10/05/2005 18:54:18 ... APPLIC~1 --= ApplicationHistory
22/12/2006 10:08:08 ... Google ----= Google
15/11/2005 21:10:18 ... Help ------= Help
24/05/2005 16:04:53 ... IDENTI~1 --= Identities
10/05/2005 18:54:18 ... MICROS~1 --= Microsoft
04/06/2005 19:16:59 ... WMTOOL~1 --= WMTools Downloaded Files
10/05/2005 18:54:18 ... {7148F~1 --= {7148F0A6-6813-11D6-A77B-00B0D0142030}

+- C:\Documents and Settings	onin.NOM-641695C7437\Application Data

27/04/2007 10:58:32 ... Adobe -----= Adobe
04/02/2007 14:41:59 ... APPLEC~1 --= Apple Computer
29/03/2007 15:27:12 ... Google ----= Google
09/01/2008 13:33:24 ... Grisoft ---= Grisoft
18/09/2007 17:59:20 ... HP --------= HP
04/02/2007 14:41:59 ... IDENTI~1 --= Identities
08/09/2007 18:16:52 ... ijjigame --= ijjigame
30/07/2007 17:52:31 ... INSTAL~1 --= InstallShield
04/02/2007 14:41:59 ... INTERV~1 --= Intervideo
27/06/2007 12:05:44 ... LEADER~1 --= Leadertech
05/02/2007 21:00:52 ... MACROM~1 --= Macromedia
15/11/2007 16:18:13 ... MAILFR~1 --= MailFrontier
04/02/2007 14:41:59 ... MICROS~1 --= Microsoft
20/09/2007 14:50:42 ... Real ------= Real
04/02/2007 14:41:59 ... SAMPLE~1 --= SampleView
17/04/2007 20:04:14 ... Sierra ----= Sierra
27/06/2007 12:12:20 ... Sonic -----= Sonic
04/02/2007 14:41:59 ... Sun -------= Sun
04/02/2007 14:41:59 ... Symantec --= Symantec
06/10/2007 10:11:44 ... WINDOW~1 --= Windows Desktop Search

+- C:\Documents and Settings	onin.NOM-641695C7437\Local Settings\Application Data

27/04/2007 10:58:32 ... Adobe -----= Adobe
04/02/2007 14:41:59 ... APPLEC~1 --= Apple Computer
04/02/2007 14:41:59 ... APPLIC~1 --= ApplicationHistory
29/03/2007 15:27:13 ... Google ----= Google
05/03/2007 17:46:14 ... HP --------= HP
06/10/2007 10:11:51 ... IDENTI~1 --= Identities
05/03/2007 17:46:14 ... ISOLAT~1 --= IsolatedStorage
04/02/2007 14:41:58 ... MICROS~1 --= Microsoft
05/10/2007 19:23:14 ... WINDOW~1 --= Windows Live Writer
04/02/2007 14:41:58 ... {7148F~1 --= {7148F0A6-6813-11D6-A77B-00B0D0142030}

+- C:\Documents and Settings\viovio\Application Data

28/03/2007 13:12:49 ... Adobe -----= Adobe
28/03/2007 13:13:19 ... AdobeUM ---= AdobeUM
26/09/2007 08:55:06 ... Ahead -----= Ahead
04/02/2007 11:42:45 ... APPLEC~1 --= Apple Computer
28/03/2007 11:47:43 ... Google ----= Google
07/01/2008 18:55:31 ... Grisoft ---= Grisoft
18/09/2007 15:57:54 ... HP --------= HP
04/02/2007 11:42:45 ... IDENTI~1 --= Identities
04/11/2007 14:02:32 ... INSTAL~1 --= InstallShield
04/02/2007 11:42:45 ... INTERV~1 --= Intervideo
04/02/2007 11:44:45 ... MACROM~1 --= Macromedia
13/11/2007 17:33:06 ... MAILFR~1 --= MailFrontier
04/02/2007 11:42:45 ... MICROS~1 --= Microsoft
25/04/2007 18:52:35 ... Motive ----= Motive
28/03/2007 11:56:50 ... OPENOF~1.ORG ----= OpenOffice.org2
20/09/2007 18:50:49 ... Real ------= Real
04/02/2007 11:42:45 ... SAMPLE~1 --= SampleView
30/07/2007 14:18:52 ... SecuROM ---= SecuROM
04/02/2007 11:42:45 ... Sun -------= Sun
04/02/2007 11:42:45 ... Symantec --= Symantec
26/09/2007 09:01:13 ... vlc -------= vlc
06/10/2007 11:16:17 ... WINDOW~1 --= Windows Desktop Search

+- C:\Documents and Settings\viovio\Local Settings\Application Data

28/03/2007 13:12:49 ... Adobe -----= Adobe
25/09/2007 18:19:58 ... Ahead -----= Ahead
04/02/2007 11:42:45 ... APPLEC~1 --= Apple Computer
04/02/2007 11:42:45 ... APPLIC~1 --= ApplicationHistory
28/03/2007 11:47:43 ... Google ----= Google
04/02/2007 13:02:25 ... IDENTI~1 --= Identities
04/02/2007 11:42:45 ... MICROS~1 --= Microsoft
05/10/2007 19:07:36 ... WINDOW~1 --= Windows Live Writer
06/10/2007 20:38:34 ... WMTOOL~1 --= WMTools Downloaded Files
04/02/2007 11:42:45 ... {7148F~1 --= {7148F0A6-6813-11D6-A77B-00B0D0142030}

___________________________________________________________________________

=> Listing du dossier ProgramFiles

+- C:\Program Files

16/02/2005 16:05:59 ... 3DO -------= 3DO
13/05/2007 14:41:42 ... ACTIVI~1 --= Activision
01/01/2004 17:39:12 ... Adobe -----= Adobe
18/04/2006 11:52:26 ... ALWILS~1 --= Alwil Software
03/04/2007 23:00:44 ... APPLES~1 --= Apple Software Update
04/07/2007 23:00:04 ... Audacity --= Audacity
22/09/2007 10:13:39 ... AVISYN~1.5 --= AviSynth 2.5
01/01/2005 15:17:12 ... Bullfrog --= Bullfrog
18/10/2006 09:24:37 ... CAMSTU~1 --= CamStudio
16/10/2005 16:20:19 ... Canon -----= Canon
07/01/2008 15:00:06 ... CCleaner --= CCleaner
25/09/2006 14:40:45 ... CHEVAL~1 --= Chevalmag
01/01/2004 14:03:50 ... COMPLU~1 --= ComPlus Applications
18/11/2007 09:12:34 ... Cossacks --= Cossacks
03/07/2006 15:53:53 ... Cyanide ---= Cyanide
29/06/2005 12:10:45 ... directx ---= directx
21/04/2007 18:40:51 ... Disney ----= Disney
02/12/2007 00:45:40 ... Dofus -----= Dofus
22/09/2007 14:05:12 ... DVDFLI~1 --= DVD Flick
31/12/2004 19:14:33 ... EAGAME~1 --= EA GAMES
01/01/2004 18:01:14 ... EASYIN~1 --= Easy Internet signup
22/09/2007 10:12:34 ... ERIGHT~1 --= eRightSoft
01/01/2004 14:59:46 ... FICHIE~1 --= Fichiers communs
19/09/2007 14:36:41 ... FLVPLA~1 --= FLV Player
18/03/2007 11:22:28 ... FNACMU~1 --= Fnacmusic
29/06/2005 11:40:28 ... Fox -------= Fox
25/12/2005 16:59:21 ... GAMESP~1 --= GameSpy Arcade
02/04/2006 22:07:44 ... Google ----= Google
07/01/2008 15:11:23 ... Grisoft ---= Grisoft
24/01/2005 18:51:08 ... HAVASI~1 --= Havas Interactive
01/01/2004 17:53:40 ... HELPAN~1 --= Help and Support Additions
17/09/2007 18:58:39 ... HEWLET~1 --= Hewlett-Packard
04/07/2007 23:04:52 ... HOTPOT~1 --= HotPotatoes6
01/01/2004 15:41:10 ... HP --------= HP
01/01/2004 17:35:58 ... INSTAL~1 --= InstallShield Installation Information
31/01/2005 21:20:55 ... INTERA~1 --= InterActual
01/01/2004 14:04:01 ... INTERN~1 --= Internet Explorer
01/01/2004 17:35:58 ... INTERV~1 --= InterVideo
03/07/2007 16:19:07 ... iPod ------= iPod
03/07/2007 16:19:02 ... iTunes ----= iTunes
01/01/2004 15:07:22 ... Java ------= Java
12/12/2006 19:19:04 ... JSWORL~1 --= JS World
18/04/2006 14:13:56 ... Lavasoft --= Lavasoft
23/04/2006 19:48:08 ... Lexicon ---= Lexicon
13/01/2008 15:58:08 ... Lopxp -----= Lopxp
04/06/2005 16:15:08 ... LUCASA~1 --= LucasArts
10/08/2005 20:00:25 ... MAIET -----= MAIET
03/02/2005 12:54:03 ... Maxis -----= Maxis
01/01/2004 14:03:08 ... MESSEN~1 --= Messenger
02/12/2007 13:21:02 ... MICROA~1 --= Micro Application
01/01/2004 14:06:10 ... MICROS~1 --= microsoft frontpage
15/03/2007 22:14:53 ... MICROS~3 --= Microsoft Games
23/06/2005 13:40:04 ... MICROS~2 --= Microsoft Office
05/10/2007 19:11:27 ... MICROS~4 --= Microsoft SQL Server Compact Edition
03/07/2007 10:22:42 ... MICROS~1.NET --= Microsoft.NET
01/01/2004 14:04:06 ... MOVIEM~1 --= Movie Maker
01/01/2004 14:02:59 ... MSN -------= MSN
01/01/2004 14:03:07 ... MSNGAM~1 --= MSN Gaming Zone
11/05/2005 14:30:51 ... MSNMES~1 --= MSN Messenger
19/11/2006 21:53:42 ... MSXML4~1.0 --= MSXML 4.0
09/01/2008 15:37:07 ... Navilog1 --= Navilog1
01/01/2004 14:04:03 ... NETMEE~1 --= NetMeeting
14/09/2007 16:27:29 ... NHNUSA~1 --= NHN USA
01/01/2004 14:03:13 ... ONLINE~1 --= Online Services
13/03/2006 22:09:29 ... OPENOF~1.0 --= OpenOffice.org 2.0
01/01/2004 14:04:02 ... OUTLOO~1 --= Outlook Express
01/01/2004 17:58:19 ... PC-DOC~1 --= PC-Doctor for Windows
26/09/2007 13:44:39 ... PENSE-~1 --= Pense-bete
26/09/2007 09:03:56 ... PonyGirl --= PonyGirl
03/07/2007 16:15:22 ... QUICKT~1 --= QuickTime
26/02/2006 16:26:52 ... Real ------= Real
29/06/2005 15:20:37 ... REDSTO~1 --= Red Storm Entertainment
30/07/2007 17:54:54 ... SEGA ------= SEGA
01/01/2004 14:04:26 ... SERVIC~1 --= Services en ligne
25/12/2005 16:40:37 ... Sierra ----= Sierra
05/02/2005 11:11:46 ... SIERRA~1 --= Sierra On-Line
02/01/2004 05:59:51 ... SISVGA~1.59E --= SiS VGA Utilities V3.59e
04/02/2006 20:42:44 ... SLAYER~1 --= Slayers Online
25/02/2006 22:23:41 ... SLDCOD~1 --= SLD Codec Pack
04/07/2005 22:42:40 ... SlySoft ---= SlySoft
01/01/2004 17:34:00 ... Sonic -----= Sonic
01/01/2004 17:34:00 ... SONICR~1 --= Sonic RecordNow!
01/01/2004 21:04:31 ... Symantec --= Symantec
17/09/2005 09:47:18 ... Tiscali ---= Tiscali
14/07/2006 19:56:27 ... TISCAL~2 --= Tiscali Triway Wi-Fi
30/07/2005 15:06:53 ... TISCAL~1 --= Tiscali_Triway_WiFi
31/12/2004 17:26:29 ... TOTALW~1 --= Total War
08/01/2008 01:57:38 ... TRENDM~1 --= Trend Micro
23/01/2005 17:49:36 ... UBISOF~1 --= Ubi Soft
23/01/2005 17:40:05 ... UbiSoft ---= UbiSoft
01/01/2004 14:09:08 ... UNINST~1 --= Uninstall Information
28/08/2007 14:04:39 ... VIDEOA~1 --= Video ActiveX Access
30/06/2007 16:36:57 ... VideoLAN --= VideoLAN
31/12/2004 21:24:37 ... WARCRA~1 --= Warcraft III
05/10/2007 19:10:45 ... WI459E~1 --= Windows Desktop Search
05/10/2007 18:44:01 ... WI1F86~1 --= Windows Live
09/01/2007 00:20:48 ... WI81E8~1 --= Windows Live Toolbar
12/07/2007 10:02:59 ... WINDOW~4 --= Windows Media Connect 2
01/01/2004 14:03:13 ... WINDOW~2 --= Windows Media Player
01/01/2004 14:02:59 ... WINDOW~1 --= Windows NT
01/01/2004 14:04:29 ... WINDOW~3 --= WindowsUpdate
05/07/2006 16:09:46 ... WinZip ----= WinZip
18/03/2007 21:55:43 ... Woonoz ----= Woonoz
01/01/2004 14:06:10 ... xerox -----= xerox
16/11/2005 11:29:29 ... Yahoo! ----= Yahoo!
18/04/2006 13:47:17 ... ZONELA~1 --= Zone Labs


___________________________________________________________________________

=> Clés registre


___________________________________________________________________________

=> Bloqueur popups Internet Explorer


+- Liste des popups autorisés :


___________________________________________________________________________

/!\  Suggestion (Nécessite une interprétation.)



- Fin du rapport -


Est-ce que je suis débarrassée de ce 'lop' pas top?

green day · Answer

ok, poste un nouveau hijack et dis moi si tu as toujours des pub ??

++

zader · Answer

Hello,
Eh bien non je n'ai plus de pubs et ça a redonné un coup de boost à tout mon ordi qui commençait à ramer comme un malade...
De tout coeur, merci et encore sorry pour avoir été un peu dure au début de notre échange...

Voici le rapport Hijack:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:05:40, on 14/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\TMMEducation\Apps\HttpServer\HttpServer.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hphmon06.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\keyhook.exe
C:\WINDOWS\AGRSMMSG.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\HPZipm12.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q404&bd=pavilion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q404&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q404&bd=pavilion&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.1.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [TiscaliParam] C:\Program Files\Tiscali\Dialer\bootparam.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [Cloneur Expert Monitor] "C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HELPAN~1\Pavilion\XPHWWBF4\plugin\bin\PCHButton.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-3636313864-4027070454-1807119305-1008\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background (User 'viovio')
O4 - HKUS\S-1-5-21-3636313864-4027070454-1807119305-1008\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" (User 'viovio')
O4 - HKUS\S-1-5-21-3636313864-4027070454-1807119305-1008\..\Run: [BORE LIST] C:\DOCUME~1\viovio\APPLIC~1\DRAWPU~1\WEBLESS.exe (User 'viovio')
O4 - S-1-5-21-3636313864-4027070454-1807119305-1008 Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe (User 'viovio')
O4 - S-1-5-21-3636313864-4027070454-1807119305-1008 Startup: Registration Alexandra Ledermann 8.LNK = E:\Support\Register\RegistrationReminder.exe (User 'viovio')
O4 - S-1-5-21-3636313864-4027070454-1807119305-1008 User Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe (User 'viovio')
O4 - S-1-5-21-3636313864-4027070454-1807119305-1008 User Startup: Registration Alexandra Ledermann 8.LNK = E:\Support\Register\RegistrationReminder.exe (User 'viovio')
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx2.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab
O16 - DPF: {63308B48-F435-42FD-AB0A-3564C7BEF9D7} (Toontown Installer ActiveX Control French) - https://iplay.fr.toontown.com/download/sv1.5.15.9/ttinst-french.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
O16 - DPF: {D28C3640-A6D7-4668-A53C-07A9CF67D157} (CFnacComposantCtrl Object) - http://www.fnacmusic.com/telechargementFnacmusic/FnacComposant.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TELL ME MORE 7 EDUCATION - Auralog - C:\TMMEducation\Apps\HttpServer\HttpServer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

green day · Answer

oui, je confirme ! :-)

dernière touche :

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/... 

O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe 

O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Cloneur Expert Monitor] "C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe" 

O4 - S-1-5-21-3636313864-4027070454-1807119305-1008 Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe (User 'viovio')

O4 - S-1-5-21-3636313864-4027070454-1807119305-1008 User Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe (User 'viovio')

O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe


O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx2.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab
O16 - DPF: {63308B48-F435-42FD-AB0A-3564C7BEF9D7} (Toontown Installer ActiveX Control French) - https://iplay.fr.toontown.com/download/sv1.5.15.9/ttinst-french.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
O16 - DPF: {D28C3640-A6D7-4668-A53C-07A9CF67D157} (CFnacComposantCtrl Object) - http://www.fnacmusic.com/telechargementFnacmusic/FnacComposant.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab 

 ensuite, passe un coup de ccleaner et ça sera tout bon !

 à lire aussi : http://www.commentcamarche.net/faq/sujet 2432 securite proteger un ordinateur contre les malwares d internet

@+

;-)


Relance HijackThis : choisis " do a scan only" coche la case devant les lignes ci-dessous et clique en bas sur "fix checked" :

zader · Answer

Youpiii!
Merci. Thank you. Danke. Spaciba. Grazie Mille. Obligad. Muchas Gracias et bien d'autres encore...

Je m'attaque de ce pas à la lecture du lien qui mène à d'autres liens qui mènent à d'autres liens.....

Je viens déjà d'apprendre que c'était pas terrible d'utiliser internet explorer et je sens que je vais en apprendre bien d'autres (si j'arrive à tout comprendre)

Au plaisir (enfin bon je ne sais pas si c'est vraiment à souhaiter: ça voudrait dire que ça sent encore la plantade de mon côté...!)

Merci encore ;-)

green day · Answer

;-))

 je suis ravie pour toi !

 bon surf ! 

@+

Infections trojan, win32 + pop-ups CiD

25 réponses

Discussions similaires