pages internet s'ouvrent seules windows vista

Question

Bonjour,
j'ai un petit probleme sur mon pc c'est quand j'ouvre une page internet une autre page s'ouvre avec c'est trés ennuyeux svp aidez moi j'ai le programme vista
merci d'avance

Saiyen75 · Answer

Salut,

Désactiver le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection): 

---> Démarrer 
---> Panneau de configuration 
---> Double Clique sur l'icône "Comptes d'utilisateurs" 
---> Clique ensuite sur désactiver 
---> Valider

_____________________________________________________

- Télécharger et installer AVG Anti-Spyware 7.5 (si tu ne l'as pas déjà si tu l'as vérifie bien les paramètres).

https://www.avg.com/en-ww/free-antivirus-download 

Lancer AVG Anti-Spyware. 
Cliquer sur le menu Mise à jour. 
Dans le paragraphe "Mise à jour manuelle", cliquer sur le bouton "Commencer la mise à jour". 
Attendre la fin de cette mise à jour puis fermer le programme. 


- Lance AVG Anti-Spyware 7.5 

Cliquer sur le menu" Analyse" (de la barre d'outils). 
Cliquer sur l'onglet "Paramètres". 
Dans "Comment réagir"? cliquer sur "Actions recommandées" et choisir "Quarantaine". 
Dans Comment faire l'analyse ? et dans Programmes potentiellement dangereux, vérifier que toutes les cases soient cochées. 
Vérifier que le bouton-radio "Générer un rapport après chaque analyse" soit aussi coché. 
Dans l'onglet "Analyse" 
Cliquer sur "Analyse complète du système". 
Important : Ne pas ouvrir de fenêtre, ne pas lancer de programme pendant l'exécution de AVG Anti-Spyware, car cela pourrait interférer avec le processus de recherche. 
Très important : A la fin de l'analyse, cocher tout ce qui a été trouvé puis cliquer sur " Appliquer toutes les actions" 
Ensuite. 
Cliquer sur "Enregistrer le rapport". Ceci génère un rapport en fichier texte qui se trouve dans le dossier Reports du dossier d'AVG Anti-Spyware. 
(C:\Programfiles\Grisoft\AVG Antispyware 7.5\Reports ) 
Puis fermer AVG Anti-Spyware. 

_____________________________________________________

Colle un Log hijackthis :

télécharge HijackThis ici : 
http://telechargement.zebulon.fr/138-hijackthis-1991.html 

 Dézippe  le dans un dossier 
Par exemple C:\hijackthis < Enregistre le bien dans c:\

Lance le puis: 
clique sur  "do a system scan and save logfile"  
faire un copier coller du log et le poster sur le forum

Tuto ici: http://cybersecurite.xooit.com/t138-HijackThis-2-0-2.htm

_____________________________________________________

riadh09 · Answer

merci saiyen75 de votre reponse voila j'ai fais ce que vous m'avaez demandé de faire:
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 08:37:09, on 20/02/2008
Platform: Windows Vista  (WinNT 6.00.1904)
Boot mode: Normal

Running processes:
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Windows\System32undll32.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Valve\Steam\Steam.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - Études DVD\EDICT.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\System32undll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: BrowsingAdvisor - {F1E96EDC-E0C8-BE98-1F15-C29DBED83B53} - C:\Program Files\BrowsingAdvisor\BrowsingAdvisor-2.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Valve\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [L08FXLRD_80990087] "C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - Études DVD\EDICT.EXE" -m
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O13 - Gopher Prefix: 
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: @%SystemRoot%\system32\aelupsvc.dll,-1 (AeLookupSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe
O23 - Service: @%systemroot%\system32\appinfo.dll,-100 (Appinfo) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\audiosrv.dll,-204 (AudioEndpointBuilder) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\audiosrv.dll,-200 (Audiosrv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: @%SystemRoot%\system32\bfe.dll,-1001 (BFE) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\qmgr.dll,-1000 (BITS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\browser.dll,-100 (Browser) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\certprop.dll,-11 (CertPropSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: @%SystemRoot%\system32\cryptsvc.dll,-1001 (CryptSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @oleres.dll,-5012 (DcomLaunch) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\dhcpcsvc.dll,-100 (Dhcp) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\dnsapi.dll,-101 (Dnscache) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\dot3svc.dll,-1102 (dot3svc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\dps.dll,-500 (DPS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\eapsvc.dll,-1 (EapHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\ehome\ehrecvr.exe,-101 (ehRecvr) - Unknown owner - C:\Windows\ehome\ehRecvr.exe
O23 - Service: @%SystemRoot%\ehome\ehsched.exe,-101 (ehSched) - Unknown owner - C:\Windows\ehome\ehsched.exe
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\emdmgmt.dll,-1000 (EMDMgmt) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wevtsvc.dll,-200 (Eventlog) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @comres.dll,-2450 (EventSystem) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\fdPHost.dll,-100 (fdPHost) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\fdrespub.dll,-100 (FDResPub) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @gpapi.dll,-112 (gpsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\hidserv.dll,-101 (hidserv) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\kmsvc.dll,-6 (hkmsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: @%SystemRoot%\system32\ikeext.dll,-501 (IKEEXT) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\IPBusEnum.dll,-102 (IPBusEnum) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\iphlpsvc.dll,-200 (iphlpsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe
O23 - Service: @comres.dll,-2946 (KtmRm) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\srvsvc.dll,-100 (LanmanServer) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\wkssvc.dll,-100 (LanmanWorkstation) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: @%SystemRoot%\system32\lltdres.dll,-1 (lltdsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\lmhsvc.dll,-101 (lmhosts) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\mmcss.dll,-100 (MMCSS) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\FirewallAPI.dll,-23090 (MpsSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe
O23 - Service: @%SystemRoot%\system32\iscsidsc.dll,-5000 (MSiSCSI) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\msimsg.dll,-27 (msiserver) - Unknown owner - C:\Windows\system32\msiexec.exe
O23 - Service: @%SystemRoot%\system32\qagentrt.dll,-6 (napagent) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32
etlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe
O23 - Service: @%SystemRoot%\system32
etman.dll,-109 (Netman) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32
etprof.dll,-246 (netprofm) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32
lasvc.dll,-1 (NlaSvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32
sisvc.dll,-200 (nsi) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\p2psvc.dll,-8004 (p2pimsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\p2psvc.dll,-8006 (p2psvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: @%SystemRoot%\system32\pcasvc.dll,-1 (PcaSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\pla.dll,-500 (pla) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\umpnpmgr.dll,-100 (PlugPlay) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\p2psvc.dll,-8002 (PNRPAutoReg) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\p2psvc.dll,-8000 (PNRPsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\polstore.dll,-5010 (PolicyAgent) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\profsvc.dll,-300 (ProfSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32asauto.dll,-200 (RasAuto) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32asmans.dll,-200 (RasMan) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @regsvc.dll,-1 (RemoteRegistry) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe
O23 - Service: @oleres.dll,-5010 (RpcSs) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe
O23 - Service: @%SystemRoot%\System32\SCardSvr.dll,-1 (SCardSvr) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\schedsvc.dll,-100 (Schedule) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\certprop.dll,-13 (SCPolicySvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\sdrsvc.dll,-107 (SDRSVC) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\Sens.dll,-200 (SENS) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\SessEnv.dll,-1026 (SessionEnv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\ipnathlp.dll,-106 (SharedAccess) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\shsvcs.dll,-12288 (ShellHWDetection) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe
O23 - Service: @%SystemRoot%\system32\SLUINotify.dll,-103 (SLUINotify) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe
O23 - Service: @%systemroot%\system32\ssdpsrv.dll,-100 (SSDPSRV) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\wiaservc.dll,-9 (stisvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: @%SystemRoot%\System32\swprv.dll,-103 (swprv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\sysmain.dll,-1000 (SysMain) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\TabSvc.dll,-100 (TabletInputService) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32	apisrv.dll,-10100 (TapiSrv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32	bssvc.dll,-100 (TBS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32	ermsrv.dll,-268 (TermService) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\shsvcs.dll,-8192 (Themes) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\mmcss.dll,-102 (THREADORDER) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32	rkwks.dll,-1 (TrkWks) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\servicing\TrustedInstaller.exe,-100 (TrustedInstaller) - Unknown owner - C:\Windows\servicing\TrustedInstaller.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe
O23 - Service: @%systemroot%\system32\upnphost.dll,-213 (upnphost) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\dwm.exe,-2000 (UxSms) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe
O23 - Service: @%SystemRoot%\system32\w32time.dll,-200 (W32Time) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wcncsvc.dll,-3 (wcncsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\WcsPlugInService.dll,-200 (WcsPlugInService) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\wdi.dll,-502 (WdiServiceHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\wdi.dll,-500 (WdiSystemHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\webclnt.dll,-100 (WebClient) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wecsvc.dll,-200 (Wecsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wercplsupport.dll,-101 (wercplsupport) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wersvc.dll,-100 (WerSvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%ProgramFiles%\Windows Defender\MsMpRes.dll,-103 (WinDefend) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\winhttp.dll,-100 (WinHttpAutoProxySvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wbem\wmisvc.dll,-205 (Winmgmt) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wsmsvc.dll,-101 (WinRM) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wlansvc.dll,-257 (Wlansvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\wmpnetwk.exe
O23 - Service: @%SystemRoot%\system32\wpcsvc.dll,-100 (WPCSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wpdbusenum.dll,-100 (WPDBusEnum) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wscsvc.dll,-200 (wscsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\SearchIndexer.exe,-103 (WSearch) - Unknown owner - C:\Windows\system32\SearchIndexer.exe
O23 - Service: @%systemroot%\system32\wuaueng.dll,-105 (wuauserv) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wudfsvc.dll,-1000 (wudfsvc) - Unknown owner - C:\Windows\system32\svchost.exe

riadh09 · Answer

désolé j'ai oublié de vous dire que l'analyse avec AVG j'ai rien trouvé(rien a signalé) et depuis hier avec les pages qui s'ouvrent seules y a meme un programme qui veut s'exécuté

Saiyen75 · Answer

Salut,

Jolie infection :)

Télécharge bien la version d'HijackThis que je t'ai donné. (dernière version)
http://telechargement.zebulon.fr/138-hijackthis-1991.html 
Tuto ici: http://cybersecurite.xooit.com/t138-HijackThis-2-0-2.htm

Aprés enchaine avec :

SDFix :

Télécharger sur le bureau :
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

= Double-clic SDFix. 
= Clic Install 

= Redémarrer en mode Sans Échec (le démarrage peut prendre plusieurs minutes).
Attention, pas d’accès à internet dans ce mode. Enregistrer ou imprimer les consignes. 

Pour démarrer en mode sans échec : 

1/ -Démarrez Windows, ou s’il s’exécute, fermez Windows puis éteignez l'ordinateur. 
2/ -Redémarrez l’ordinateur.
3/ -Au début du chargement du BIOS (mais pas trop tôt), commencez à appuyer sur la touche F8 de votre clavier plusieurs fois de suite. Procédez ainsi jusqu'à ce que le menu des options avancées de Windows apparaissent.
4/ -En utilisant les flèches de votre clavier, sélectionnez "Mode sans échec" dans le menu puis appuyez sur Entrée.

Une fois sous windows :

------ 
= Double-clic SDFix. 
= Clic Install 
= Double-clic sur le nouveau dossier SDFix qui est dans C:\ 
= Double-clic RunThis 
= Presser Y 
= A l’invitation ==> appuyer sur une touche pour redémarrer 
= Redémarrage ( qui sera plus long ,car nettoyage en cours ) 
Continuer si un message d’erreurs apparaît ,dans ce cas aller directement au rapport dans SDfix 
= apparition de Finished 
= Appuyer sur une touche 
= Dans SDFix , un rapport est généré, Report.txt
= Copier/Coller sur le forum.

_____________________________________________________

riadh09 · Answer

salut j'ai fait ce que vous m'avez dit  mais quand je fais un double clique sur runthis ça repond pas y a rien qui se passe merci de me repondre

Saiyen75 · Answer

Re, erreur de ma part, SDFix non-compatible avec Vista.
Tu peux supprimer SDFix

Navilog1 :

Télécharger et Install Navilog1 sur le bureau :
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe

= double-clic dessus pour l'installer et le lancer 
Quand installé 
= taper F 
= Appuyer sur une touche jusqu' arriver aux options 
= Choisir option 1 ( = taper 1 ) 
ne pas utiliser les autres sans avis , il peut y avoir des processus légitimes 

un rapport : fixnavi.txt 
dans ==> C : 
le copier/coller dans la réponse 

_____________________________________________________

Refait un Log HijackThis avec la derniere version.

riadh09 · Answer

Search Navipromo version 3.4.5 commencé le 20/02/2008 à 18:54:09,19

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1
Mise à jour le 20.02.2008 à 18h00 par IL-MAFIOSO

Microsoft Windows Vista 6.0.6000 
Internet Explorer : 7.0.6000.16609 
Système de fichiers : NTFS

Executé en mode normal

*** Recherche Programmes installés ***




*** Recherche dossiers dans C:\Windows ***



*** Recherche dossiers dans C:\Program Files ***


*** Recherche dossiers dans C:\ProgramData ***


*** Recherche dossiers dans C:\ProgramData\Microsoft\Windows\Start Menu\Programs ***


*** Recherche dossiers dans C:\Usersiadh\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs ***


*** Recherche dossiers dans C:\Usersiadh\AppData\Local\virtualstore\Program Files ***



*** Recherche dossiers dans C:\Usersiadh\AppData\Roaming ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun Fichier trouvé



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans C:\Windows\system32 *

Saiyen75 · Answer

Re

Refait un Navilog1, mais post le rapport complet (il ne l'est pas)

Merci

En suivant fait ça :

VundoFix :

Télécharge VundoFix.exe sur ton Bureau. 
http://www.atribune.org/ccount/click.php?id=4 

Double-clique VundoFix.exe afin de le lancer. 
Coche Run VundoFix as a task. 
Un message t'avertira que l'outil va se fermer et s'ouvrir à nouveau : clique Ok 
Clique sur le bouton Scan for Vundo. 
Lorsque le scan est complété, clique sur le bouton Remove Vundo. 
Une invite te demandera si tu veux supprimer les fichiers, clique YES 
Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers. 
Tu verras une invite qui t'annonce que ton PC va s'éteindre ("shutdown") ; clique OK 
Démarre ton PC à nouveau. 
Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse. 

-----------------------------------------------------------

Télécharge VirtumondoBegone : 
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

Lance le, et poste le rapport dans le forum.

_____________________________________________________

++

riadh09 · Answer

Search Navipromo version 3.4.5 commencé le 20/02/2008 à 19:34:25,58

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1
Mise à jour le 20.02.2008 à 18h00 par IL-MAFIOSO

Microsoft Windows Vista 6.0.6000 
Internet Explorer : 7.0.6000.16609 
Système de fichiers : NTFS

Executé en mode normal

*** Recherche Programmes installés ***




*** Recherche dossiers dans C:\Windows ***



*** Recherche dossiers dans C:\Program Files ***


*** Recherche dossiers dans C:\ProgramData ***


*** Recherche dossiers dans C:\ProgramData\Microsoft\Windows\Start Menu\Programs ***


*** Recherche dossiers dans C:\Usersiadh\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs ***


*** Recherche dossiers dans C:\Usersiadh\AppData\Local\virtualstore\Program Files ***



*** Recherche dossiers dans C:\Usersiadh\AppData\Roaming ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun Fichier trouvé



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans C:\Windows\system32 *

* Recherche dans C:\Usersiadh\AppData\Local\Microsoft *

* Recherche dans C:\Usersiadh\AppData\Local\virtualstore\windows\system32 *

* Recherche dans C:\Usersiadh\AppData\Local *



*** Recherche fichiers *** 




*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans C:\Windows\system32 :


* Dans C:\Usersiadh\AppData\Local\Microsoft :


* Dans C:\Usersiadh\AppData\Local\virtualstore\windows\system32 :


* Dans C:\Usersiadh\AppData\Local :


3)Recherche Certificats :

Certificat Egroup absent !

4)Recherche fichiers connus :



*** Analyse terminée le 20/02/2008 à 19:45:17,04 ***









Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:07:46, on 20/02/2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Windows\System32undll32.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Valve\Steam\Steam.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - Études DVD\EDICT.EXE
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32undll32.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\conime.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\explorer.exe
C:\HijackThis.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: BrowsingAdvisor - {F1E96EDC-E0C8-BE98-1F15-C29DBED83B53} - C:\Program Files\BrowsingAdvisor\BrowsingAdvisor-2.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Valve\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [L08FXLRD_80990087] "C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - Études DVD\EDICT.EXE" -m
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O13 - Gopher Prefix: 
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

riadh09 · Answer

le vundofix  n'a rien trouvé

Saiyen75 · Answer

bitdefender en ligne : 

Utilise Internet Explorer
accepte l'active X
la barre anti pop-up du SP2 (en haut) se met à clignoter, clic dessus et choisis "accepter l'active X"

http://www.bitdefender.fr/scan_fr/scan8/ie.html 

- Cliquer sur J'accepte
- Start Scan
- Une fois terminé, Dans l'onglet "Problèmes détectés"
- "Cliquer ici pour exporter le rapport"
- Enregistrer sur le bureau (choisir un nom)
- Fermer le scan
- Ouvrir le fichier enregistré le copier/coller sur le forum.

_____________________________________________________

riadh09 · Answer

BitDefender Online Scanner
  
  
 
Scan report generated at: Wed, Feb 20, 2008 - 22:59:08
 
 
  
  
 
Scan path: C:\;D:\;E:\;
  
  
 
 
  
  
 
Statistics
 
Time
 00:51:54
 
Files
 294943
 
Folders
 14019
 
Boot Sectors
 3
 
Archives
 3098
 
Packed Files
 22850
 
  
  
 
Results
 
Identified Viruses 
 1
 
Infected Files 
 1
 
Suspect Files 
 0
 
Warnings
 0
 
Disinfected
 0
 
Deleted Files
 1
 
  
  
 
Engines Info
 
Virus Definitions
 982513
 
Engine build
 AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)
 
Scan plugins
 16
 
Archive plugins
 41
 
Unpack plugins
 7
 
E-mail plugins
 6
 
System plugins
 5
 
  
  
 
Scan Settings
 
First Action
 Désinfecté
 
Second Action
 Supprimé
 
Heuristics
 Oui
 
Enable Warnings
 Oui
 
Scanned Extensions
 *;
 
Exclude Extensions
  
 
Scan Emails
 Oui
 
Scan Archives
 Oui
 
Scan Packed
 Oui
 
Scan Files
 Oui
 
Scan Boot
 Oui
 
  
  
 
  Scanned File
  Status
 
C:\Program Files\Common Files\ErreurChasseur\strpmon.exe
 Détecté avec: Adware.SystemErrorFixer.B
 
C:\Program Files\Common Files\ErreurChasseur\strpmon.exe
 Supprimé
 
C:\Program Files\Common Files\System\Ole DB\msdaosp.dll
 Nettoyé
 
C:\Program Files\Common Files\System\Ole DB\msdaps.dll
 Nettoyé
 
C:\Program Files\Common Files\System\Ole DB\msdasc.dll
 Nettoyé
 
C:\Program Files\Common Files\System\Ole DB\msdasql.dll
 Nettoyé
 
C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll
 Nettoyé
 
C:\Program Files\Common Files\System\Ole DB\msdatl3.dll
 Nettoyé
 
C:\Program Files\Common Files\System\Ole DB\msdatt.dll
 Nettoyé
 
C:\Program Files\Common Files\System\Ole DB\msdaurl.dll
 Nettoyé
 
C:\Program Files\Common Files\System\Ole DB\MSDMENG.DLL
 Nettoyé
 
C:\Program Files\Common Files\System\Ole DB\MSDMINE.DLL
 Nettoyé
 
C:\Program Files\Common Files\System\Ole DB\MSMDCB80.DLL
 Nettoyé
 
C:\Program Files\Common Files\System\Ole DB\MSMDGD80.DLL
 Nettoyé
 
C:\Program Files\Common Files\System\Ole DB\msmdlocal.dll
 Nettoyé
 
C:\Program Files\Common Files\System\Ole DB\MSMDUN80.DLL
 Nettoyé
 
C:\Program Files\Common Files\System\Ole DB\msmgdsrv.dll
 Nettoyé
 
C:\Program Files\Common Files\System\Ole DB\MSOLAP80.DLL
 Nettoyé
 
C:\Program Files\Common Files\System\Ole DB\msolap90.dll
 Nettoyé
 
C:\Program Files\Common Files\System\Ole DB\MSOLUI80.DLL
 Nettoyé
 
C:\Program Files\Common Files\WindowsLiveInstaller\MsiSources\Install_{BADF6744-3787-48F6-B8C9-4C4995401D65}.msi=>(Embedded CAB)=>msnmsgrexe
 Nettoyé
 
C:\Program Files\Common Files\WindowsLiveInstaller\MsiSources\Install_{BADF6744-3787-48F6-B8C9-4C4995401D65}.msi=>(Embedded CAB)=>msncoredll
 Nettoyé
 
C:\Program Files\Common Files\WindowsLiveInstaller\MsiSources\Install_{BADF6744-3787-48F6-B8C9-4C4995401D65}.msi=>(Embedded CAB)=>ctxUXdll
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/UsingHelp.htm=>(JAVASCRIPT 11)
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/What_Youll_Need.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/Browsing_Your_Computer_for_Music.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/Browsing_Your_Computer_for_Music.htm=>(JAVASCRIPT 1)
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/Browsing_Your_Computer_for_Music.htm=>(JAVASCRIPT 7)
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/Legal_Information.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/Getting_Started2.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/Getting_Started2.htm=>(JAVASCRIPT 1)
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/Getting_Started2.htm=>(JAVASCRIPT 6)
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/Extracting_audio_from_CD.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/The_List_Pane.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/The_Source_Pane.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/Transferring_Files_to_Your_Memory_Stick.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/Viewing_the_Contents_of_Your_Memory_Stick.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/Viewing_the_Contents_of_Your_Memory_Stick.htm=>(JAVASCRIPT 1)
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/Viewing_the_Contents_of_Your_Memory_Stick.htm=>(JAVASCRIPT 8)
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/The_Disc2Phone_Window.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/The_Disc2Phone_Window.htm=>(JAVASCRIPT 1)
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/The_Disc2Phone_Window.htm=>(JAVASCRIPT 5)
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/Modifying_Disc2Phone_Options.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/Modifying_Disc2Phone_Options.htm=>(JAVASCRIPT 1)
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/Modifying_Disc2Phone_Options.htm=>(JAVASCRIPT 14)
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/Selecting,_Shuffling,_and_Automatically_Transferring_a_Random_Collection_of_Tracks.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/Manually_Selecting_Tracks.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/Selecting_and_shuffling_a_random_collection_of_tracks.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/Getting_CD_Information.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/Getting_CD_Information.htm=>(JAVASCRIPT 1)
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/Getting_CD_Information.htm=>(JAVASCRIPT 11)
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/The_Destination_Pane.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/eHelp.xml
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/RoboHHRE.lng
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/D2P.brs
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/#BSSC
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/help.css
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/remove_all.gif
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/D2P_logo.jpg
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/play.gif
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/page.gif
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.chm=>/BUTTON.GIF
 Nettoyé
 
C:\Program Files\Disc2Phone\de\D2P.resources.dll
 Nettoyé
 
C:\Program Files\Disc2Phone\es\
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/#SYSTEM
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/Welcome.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/support.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/UsingHelp.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/UsingHelp.htm=>(JAVASCRIPT 1)
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/UsingHelp.htm=>(JAVASCRIPT 11)
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/What_Youll_Need.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/Browsing_Your_Computer_for_Music.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/Browsing_Your_Computer_for_Music.htm=>(JAVASCRIPT 1)
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/Browsing_Your_Computer_for_Music.htm=>(JAVASCRIPT 7)
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/Legal_Information.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/Getting_Started2.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/Getting_Started2.htm=>(JAVASCRIPT 1)
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/Getting_Started2.htm=>(JAVASCRIPT 6)
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/Extracting_audio_from_CD.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/The_List_Pane.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/The_Source_Pane.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/Transferring_Files_to_Your_Memory_Stick.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/Viewing_the_Contents_of_Your_Memory_Stick.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/Viewing_the_Contents_of_Your_Memory_Stick.htm=>(JAVASCRIPT 1)
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/Viewing_the_Contents_of_Your_Memory_Stick.htm=>(JAVASCRIPT 8)
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/The_Disc2Phone_Window.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/The_Disc2Phone_Window.htm=>(JAVASCRIPT 1)
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/The_Disc2Phone_Window.htm=>(JAVASCRIPT 5)
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/Modifying_Disc2Phone_Options.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/Modifying_Disc2Phone_Options.htm=>(JAVASCRIPT 1)
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/Modifying_Disc2Phone_Options.htm=>(JAVASCRIPT 14)
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/Selecting,_Shuffling,_and_Automatically_Transferring_a_Random_Collection_of_Tracks.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/Manually_Selecting_Tracks.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/Selecting_and_shuffling_a_random_collection_of_tracks.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/Getting_CD_Information.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/Getting_CD_Information.htm=>(JAVASCRIPT 1)
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/Getting_CD_Information.htm=>(JAVASCRIPT 11)
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/The_Destination_Pane.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/eHelp.xml
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/RoboHHRE.lng
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/D2P.brs
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/#BSSC
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/help.css
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/page.gif
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/tableleft.gif
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/NOTE.GIF
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/options.gif
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.chm=>/destinationfolder.gif
 Nettoyé
 
C:\Program Files\Disc2Phone\es\D2P.resources.dll
 Nettoyé
 
C:\Program Files\Disc2Phone\fi\
 Nettoyé
 
C:\Program Files\Disc2Phone\fi\D2P.chm
 Nettoyé
 
C:\Program Files\Disc2Phone\fi\D2P.chm=>/#SYSTEM
 Nettoyé
 
C:\Program Files\Disc2Phone\fi\D2P.chm=>/Welcome.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\fi\D2P.chm=>/support.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\fi\D2P.chm=>/UsingHelp.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\fi\D2P.chm=>/UsingHelp.htm=>(JAVASCRIPT 1)
 Nettoyé
 
C:\Program Files\Disc2Phone\fi\D2P.chm=>/UsingHelp.htm=>(JAVASCRIPT 11)
 Nettoyé
 
C:\Program Files\Disc2Phone\fi\D2P.chm=>/What_Youll_Need.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\fi\D2P.chm=>/Browsing_Your_Computer_for_Music.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\fi\D2P.chm=>/Browsing_Your_Computer_for_Music.htm=>(JAVASCRIPT 1)
 Nettoyé
 
C:\Program Files\Disc2Phone\fi\D2P.chm=>/Browsing_Your_Computer_for_Music.htm=>(JAVASCRIPT 7)
 Nettoyé
 
C:\Program Files\Disc2Phone\fi\D2P.chm=>/Legal_Information.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\fi\D2P.chm=>/Getting_Started2.htm
 Nettoyé
 
C:\Program Files\Disc2Phone\fi\D2P.chm=>/Getting_Started2.htm=>(JAVASCRIPT 1)
 Nettoyé
 
C:\Program Files\Disc2Phone\fi\D2P.chm=>/Getting_Started2.htm=>(JAVASCRIPT 6)
 Nettoyé
 
C:\Program Files\Disc2Phone\fi\D2P.chm=>/Extracting_audio_from_CD.htm
 Nettoyé

Saiyen75 · Answer

Re

Tu utilise quoi comme antivirus ? En verrsion payante ?

La suite :

Fixe les lignes dans Hijackthis :

Relance HijackThis, choisis  "do a scan only"  coche la case devant les lignes ci-dessous et clic en bas sur "fix checked". 

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot 
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe 
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" 
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe 

S'il te demande un redémarrage, relance ton PC.
_____________________________________________________

Avira Rootkit Detection 1.0.1.17 :

Télécharger Avira Rootkit :
http://dl.antivir.de/down/windows/antivir_rootkit.zip

Double clic sur le fichier téléchargé
Ceci va lancer l'installation.
Une fois installé, le lancer
Cliquer sur "Start Scan"

une fois le Scan terminé, cliquer sur : "View report"
un rapport va s'ouvrir dans le bloc note.
Copier/Coller ce rapport sur le forum :

Edition
Selectionner tout
Edition
Copier
Aller sur le forum et le coller.

Fermer le bloc note (pas obligé de l'enregistrer) puis
Si des fichiers sont trouvés ----> "Quarantine all"
Fermer Avira Anti-Rootkit.

_____________________________________________________

Si tu n'utilise pas d'Antivirus :

Pour installer Antivir : 

Telecharge Antivir:  http://www.commentcamarche.net/telecharger/telecharger 55 antivir 

Installe le. 
Pendant l'installation, cocher la case "generate random serial..."
Lance Antivir, 
fais les mises à jours, puis lance un scan (si des virus sont découverts, mets les en quarantaine. Si tu ne peux pas alors supprime les). 
A la fin du scan clique sur 'report', enregistre ce rapport sur le bureau (fichier => enregistrer sous), puis fait un copier/coller de ce rapport dans ton prochain message. 

----> Relance ton PC 


Tutos : https://www.malekal.com/avira-free-security-antivirus-gratuit/

Si problème - mise à jour :
Telecharge la licence sur le site officiel :
http://dl1.avgate.net/down/windows/hbedv.key
Une fois telechargé, déplace le fichier téléchargé (hbedv.key) dans le dossier Antivir. 
Par defaut : C:\Program Files\AntiVir PersonalEdition Classic

Refait la mise à jour, puis il ne sera plus périmé.
Et fait le scan comme indiqué plus haut.

_____________________________________________________

++

riadh09 · Answer

21.02.2008 00:03:16 - Installation Directory: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
21.02.2008 00:03:16 - Backup Directory: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\BACKUP\
21.02.2008 00:03:16 - Temp Directory: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\
21.02.2008 00:03:17 - Start the Update GUI... Displaymode: 0

21.02.2008 00:03:16 - Installation Directory: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
21.02.2008 00:03:16 - Backup Directory: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\BACKUP\
21.02.2008 00:03:16 - Temp Directory: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\
21.02.2008 00:03:17 - Start the Update GUI... Displaymode: 0

21.02.2008 00:03:19 - Keyfile: OK [FULL Mode]

21.02.2008 00:03:19 - Avira AntiVir PersonalEdition Classic

21.02.2008 00:03:20 - Master IDX file has changed
21.02.2008 00:03:25 - Keyfile: OK [FULL Mode]

21.02.2008 00:03:25 - Downloading the product.info file from http://dl8.freeav.net/upd/idx/classic-nt-en.info.gz
21.02.2008 00:03:26 - File basic-nt/2k/avgntflt.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:03:26 - File basic-nt/avgio64.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:03:26 - File basic-nt/imp64b.exe's operating system doesn't match the current one. File ignored.
21.02.2008 00:03:26 - File basic-nt/psapi.dll's operating system doesn't match the current one. File ignored.
21.02.2008 00:03:26 - File basic-nt/shlext64.dll's operating system doesn't match the current one. File ignored.
21.02.2008 00:03:26 - File basic-nt/vista64/avgntflt.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:03:26 - File basic-nt/xp64/avgntflt.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:03:26 - File basic-nt/2k/avgntdd.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:03:26 - File basic-nt/2k/avgntmgr.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:03:26 - File basic-nt/nt/avgntdd.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:03:26 - File basic-nt/nt/avgntmgr.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:03:26 - File basic-nt/vista64/avgntflt.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:03:26 - Downloading the product.info file from http://dl8.freeav.net/upd/idx/vdf.info.gz
21.02.2008 00:03:29 - Keyfile: OK [FULL Mode]

21.02.2008 00:03:29 - Downloading the product.info file from http://dl8.freeav.net/upd/idx/specvir-nt.info.gz
21.02.2008 00:03:29 - Downloading the product.info file from http://dl8.freeav.net/upd/idx/engine.info.gz
21.02.2008 00:03:30 - Downloading the product.info file from http://dl8.freeav.net/upd/idx/engine-nt-en.info.gz
21.02.2008 00:03:31 - Module: SELFUPDATE Source: winwks\en\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 15
21.02.2008 00:03:31 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\updlib.dll 1.2.10.20 < 1.2.10.21
21.02.2008 00:03:31 - Module: MAIN Source: winwks\en\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 77
21.02.2008 00:03:31 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe 7.2.0.12 < 7.2.0.14
21.02.2008 00:03:31 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe 7.2.0.13 < 7.2.0.16
21.02.2008 00:03:31 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe 7.0.0.81 < 7.0.0.82
21.02.2008 00:03:31 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\ccguard.dll 7.0.1.34 < 7.0.1.35
21.02.2008 00:03:31 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\preupd.exe 7.0.0.34 < 7.0.0.36
21.02.2008 00:03:32 - Module: COMMAPPDATA Source: winwks\en\ Destination: C:\ProgramData\ Files: 1
21.02.2008 00:03:32 - Module: TEXT Source: winwks\en\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 3
21.02.2008 00:03:32 - Module: VDF Source: vdf\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 4
21.02.2008 00:03:32 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\antivir1.vdf 7.0.0.0 < 7.0.1.95
21.02.2008 00:03:32 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\antivir2.vdf 7.0.0.1 < 7.0.2.113
21.02.2008 00:03:32 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\antivir3.vdf 7.0.0.2 < 7.0.2.169
21.02.2008 00:03:32 - Module: AVREP_NT Source: engine
t\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 1
21.02.2008 00:03:32 - Module: ENGINE Source: engine\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 2
21.02.2008 00:03:32 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avewin32.dll 7.6.0.15 < 7.6.0.67
21.02.2008 00:03:32 - Module: ENGINE_NT_EN Source: engine
t\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 1
21.02.2008 00:03:32 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avpack32.dll 7.3.0.15 < 7.6.0.3
21.02.2008 00:03:32 - Module: DRV Source: winwks\en\ Destination: C:\Windows\SYSTEM32\drivers\ Files: 4
21.02.2008 00:03:32 - C:\Windows\SYSTEM32\drivers\avipbb.sys 1.0.2.11 < 1.0.2.13
21.02.2008 00:03:32 - Minifilter is installed

21.02.2008 00:03:32 - Minifilter is possible

21.02.2008 00:03:32 - Reading registry value successful: Software\Avira\AntiVir PersonalEdition Classic | FilterType

21.02.2008 00:03:32 - File basic-nt/xp/avgntdd.sys which was recognized as modified, must not be updated
21.02.2008 00:03:32 - File basic-nt/xp/avgntmgr.sys which was recognized as modified, must not be updated
21.02.2008 00:03:32 - Initialize avnotify.exe

21.02.2008 00:03:32 - Starting avnotify.exe successful

21.02.2008 00:03:32 - Preparing to download files
21.02.2008 00:03:32 - 13 files need to be downloaded / copied from http://dl8.freeav.net/upd/
21.02.2008 00:03:32 - #1: Downloading and extracting http://dl8.freeav.net/upd/winwks/en/basic-nt/updlib.dll.gz to C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt/updlib.dll
21.02.2008 00:03:35 - #2: Downloading and extracting http://dl8.freeav.net/upd/winwks/en/basic-nt/avcenter.exe.gz to C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt/avcenter.exe
21.02.2008 00:03:38 - #3: Downloading and extracting http://dl8.freeav.net/upd/winwks/en/basic-nt/avgnt.exe.gz to C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt/avgnt.exe
21.02.2008 00:03:40 - #4: Downloading and extracting http://dl8.freeav.net/upd/winwks/en/basic-nt/avguard.exe.gz to C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt/avguard.exe
21.02.2008 00:03:42 - #5: Downloading and extracting http://dl8.freeav.net/upd/winwks/en/basic-nt/ccguard.dll.gz to C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt/ccguard.dll
21.02.2008 00:03:44 - #6: Downloading and extracting http://dl8.freeav.net/upd/winwks/en/basic-nt/preupd.exe.gz to C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt/preupd.exe
21.02.2008 00:03:45 - #7: Downloading and extracting http://dl8.freeav.net/upd/winwks/en/basic-nt/addr_file.html.gz to C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt/addr_file.html
21.02.2008 00:03:46 - #8: Downloading and extracting http://dl8.freeav.net/upd/vdf/antivir1.vdf.gz to C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\vdf\antivir1.vdf
21.02.2008 00:04:34 - #9: Downloading and extracting http://dl8.freeav.net/upd/vdf/antivir2.vdf.gz to C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\vdf\antivir2.vdf
21.02.2008 00:04:55 - #10: Downloading and extracting http://dl8.freeav.net/upd/vdf/antivir3.vdf.gz to C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\vdf\antivir3.vdf
21.02.2008 00:04:59 - #11: Downloading and extracting http://dl8.freeav.net/upd/engine/avewin32.dll.gz to C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\engine\avewin32.dll
21.02.2008 00:05:12 - #12: Downloading and extracting http://dl8.freeav.net/upd/engine/nt/avpack32.dll.gz to C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\engine
t\avpack32.dll
21.02.2008 00:05:14 - #13: Downloading and extracting http://dl8.freeav.net/upd/winwks/en/basic-nt/avipbb.sys.gz to C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt/avipbb.sys
21.02.2008 00:05:22 - Service AVEService is not installed

21.02.2008 00:05:22 - Service AntiVirMailService is not installed

21.02.2008 00:05:22 - Initialize fwinst.exe

21.02.2008 00:05:22 - Initialize fwinst.exe

21.02.2008 00:05:22 - Service AntiVirFirewallService is not installed

21.02.2008 00:05:22 - Service antivirwebservice is not installed

21.02.2008 00:05:22 - Status of service AntiVirService is running

21.02.2008 00:05:22 - Initialize avgnt.exe

21.02.2008 00:05:22 - Status of service AntiVirScheduler is running

21.02.2008 00:05:22 - Minifilter is installed

21.02.2008 00:05:22 - Minifilter is possible

21.02.2008 00:05:22 - Initialize avscan.exe

21.02.2008 00:05:22 - Initialize avconfig.cpl

21.02.2008 00:05:22 - Initialize avcenter.exe

21.02.2008 00:05:22 - shell extension is installed

21.02.2008 00:05:22 - Reading registry value successful: Software\Avira\AntiVir PersonalEdition Classic | RootkitsInstalled

21.02.2008 00:05:22 - Reading registry value successful: Software\Avira\AntiVir PersonalEdition Classic | RootkitsInstalled

21.02.2008 00:05:22 - Service AVEService is not installed

21.02.2008 00:05:22 - Service AntiVirMailService is not installed

21.02.2008 00:05:22 - Initialize fwinst.exe

21.02.2008 00:05:22 - Initialize fwinst.exe

21.02.2008 00:05:22 - Service AntiVirFirewallService is not installed

21.02.2008 00:05:22 - shell extension is installed

21.02.2008 00:05:22 - Initialize regsvr32.exe

21.02.2008 00:05:22 - shell extension removed successfully

21.02.2008 00:05:22 - avgnt.exe closed.

21.02.2008 00:05:22 - Status of service AntiVirScheduler is running

21.02.2008 00:05:23 - Service AntiVirScheduler successfully stopped

21.02.2008 00:05:23 - Status of service AntiVirService is running

21.02.2008 00:05:24 - Service AntiVirService successfully stopped

21.02.2008 00:05:24 - Starting to install
21.02.2008 00:05:24 - Processing module SELFUPDATE Source: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
21.02.2008 00:05:25 - Current Direcory:C:\Program Files\Avira\AntiVir PersonalEdition Classic, About to execute C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\SelfUpdateTemp\update.exe --log-template="${DAY}.${MONTH}.${YEAR} ${HOUR}:${MINUTE}:${SECOND} - ${MSG}".Self Update helper
21.02.2008 00:05:26 - Installation Directory: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
21.02.2008 00:05:26 - Backup Directory: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\BACKUP\
21.02.2008 00:05:26 - Temp Directory: C:\Windows\TEMP\Update_Temp\
21.02.2008 00:05:26 - Avira AntiVir PersonalEdition Classic

21.02.2008 00:05:26 - Self update: Copying file C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt/updlib.dll to C:\Program Files\Avira\AntiVir PersonalEdition Classic\updlib.dll
21.02.2008 00:05:26 - Executing original update application
21.02.2008 00:05:26 - Current Direcory:C:\Program Files\Avira\AntiVir PersonalEdition Classic, About to execute C:\Program Files\Avira\AntiVir PersonalEdition Classic\update.exe  --config-file="C:\ProgramData\Avira\AntiVir PersonalEdition Classic\update.conf" --install-path="C:\Program Files\Avira\AntiVir PersonalEdition Classic" --log-template="${DAY}.${MONTH}.${YEAR} ${HOUR}:${MINUTE}:${SECOND} - ${MSG}"  --NoSelfUpdate "--TmpDir=C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4" "--LogFile=C:\ProgramData\Avira\AntiVir PersonalEdition Classic\LOGFILES\Upd-2008-02-21-00-03-16.log" "--TmpFilesList=C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\ToRemove.txt".Executing original update application
21.02.2008 00:05:26 - Installation Directory: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
21.02.2008 00:05:26 - Backup Directory: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\BACKUP\
21.02.2008 00:05:26 - Temp Directory: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\
21.02.2008 00:05:27 - Start the Update GUI... Displaymode: 0

21.02.2008 00:05:27 - Avira AntiVir PersonalEdition Classic

21.02.2008 00:05:27 - Master IDX file has changed
21.02.2008 00:05:27 - File basic-nt/2k/avgntflt.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:05:27 - File basic-nt/avgio64.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:05:27 - File basic-nt/imp64b.exe's operating system doesn't match the current one. File ignored.
21.02.2008 00:05:27 - File basic-nt/psapi.dll's operating system doesn't match the current one. File ignored.
21.02.2008 00:05:27 - File basic-nt/shlext64.dll's operating system doesn't match the current one. File ignored.
21.02.2008 00:05:27 - File basic-nt/vista64/avgntflt.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:05:27 - File basic-nt/xp64/avgntflt.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:05:27 - File basic-nt/2k/avgntdd.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:05:27 - File basic-nt/2k/avgntmgr.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:05:27 - File basic-nt/nt/avgntdd.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:05:27 - File basic-nt/nt/avgntmgr.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:05:27 - File basic-nt/vista64/avgntflt.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:05:27 - Downloading the product.info file from http://dl5.avgate.net/upd/idx/vdf.info.gz
21.02.2008 00:05:27 - Downloading the product.info file from http://dl5.avgate.net/upd/idx/specvir-nt.info.gz
21.02.2008 00:05:27 - Downloading the product.info file from http://dl5.avgate.net/upd/idx/engine.info.gz
21.02.2008 00:05:27 - Downloading the product.info file from http://dl5.avgate.net/upd/idx/engine-nt-en.info.gz
21.02.2008 00:05:27 - Module: SELFUPDATE Source: winwks\en\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 15
21.02.2008 00:05:27 - Module: MAIN Source: winwks\en\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 77
21.02.2008 00:05:28 - Module: COMMAPPDATA Source: winwks\en\ Destination: C:\ProgramData\ Files: 1
21.02.2008 00:05:28 - Module: TEXT Source: winwks\en\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 3
21.02.2008 00:05:28 - Module: VDF Source: vdf\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 4
21.02.2008 00:05:28 - Module: AVREP_NT Source: engine
t\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 1
21.02.2008 00:05:28 - Module: ENGINE Source: engine\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 2
21.02.2008 00:05:28 - Module: ENGINE_NT_EN Source: engine
t\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 1
21.02.2008 00:05:28 - Module: DRV Source: winwks\en\ Destination: C:\Windows\SYSTEM32\drivers\ Files: 4
21.02.2008 00:05:28 - Minifilter is installed

21.02.2008 00:05:28 - Minifilter is possible

21.02.2008 00:05:28 - Reading registry value successful: Software\Avira\AntiVir PersonalEdition Classic | FilterType

21.02.2008 00:05:28 - File basic-nt/xp/avgntdd.sys which was recognized as modified, must not be updated
21.02.2008 00:05:28 - File basic-nt/xp/avgntmgr.sys which was recognized as modified, must not be updated
21.02.2008 00:05:28 - Preparing to download files
21.02.2008 00:05:28 - 12 files need to be downloaded / copied from http://dl5.avgate.net/upd/
21.02.2008 00:05:28 - File C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt\avcenter.exe.gz already exists in temporary folder and it will not be downloaded again
21.02.2008 00:05:29 - File C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt\avgnt.exe.gz already exists in temporary folder and it will not be downloaded again
21.02.2008 00:05:29 - File C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt\avguard.exe.gz already exists in temporary folder and it will not be downloaded again
21.02.2008 00:05:29 - File C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt\ccguard.dll.gz already exists in temporary folder and it will not be downloaded again
21.02.2008 00:05:29 - File C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt\preupd.exe.gz already exists in temporary folder and it will not be downloaded again
21.02.2008 00:05:29 - File C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt\addr_file.html.gz already exists in temporary folder and it will not be downloaded again
21.02.2008 00:05:30 - File C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\vdf\antivir1.vdf.gz already exists in temporary folder and it will not be downloaded again
21.02.2008 00:05:31 - File C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\vdf\antivir2.vdf.gz already exists in temporary folder and it will not be downloaded again
21.02.2008 00:05:31 - File C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\vdf\antivir3.vdf.gz already exists in temporary folder and it will not be downloaded again
21.02.2008 00:05:31 - File C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\engine\avewin32.dll.gz already exists in temporary folder and it will not be downloaded again
21.02.2008 00:05:32 - File C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\engine
t\avpack32.dll.gz already exists in temporary folder and it will not be downloaded again
21.02.2008 00:05:32 - File C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt\avipbb.sys.gz already exists in temporary folder and it will not be downloaded again
21.02.2008 00:05:32 - Starting to install
21.02.2008 00:05:32 - Processing module MAIN Source: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
21.02.2008 00:05:32 - File C:\ProgramData\addr_file.html will not be backed up because it doesn't exist
21.02.2008 00:05:32 - Processing module COMMAPPDATA Source: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\ Destination: C:\ProgramData\
21.02.2008 00:05:32 - Processing module VDF Source: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\vdf\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
21.02.2008 00:05:32 - Processing module ENGINE Source: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\engine\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
21.02.2008 00:05:32 - Processing module ENGINE_NT_EN Source: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\engine
t\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
21.02.2008 00:05:32 - Processing module DRV Source: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\ Destination: C:\Windows\SYSTEM32\drivers\
21.02.2008 00:05:32 - A total of 12 files were updated
21.02.2008 00:05:32 - Registry entry created successfully: Software\Avira\AntiVir PersonalEdition Classic |UpdateInProgress

21.02.2008 00:05:32 - Service AVEService is not installed

21.02.2008 00:05:32 - Service AntiVirMailService is not installed

21.02.2008 00:05:32 - Initialize fwinst.exe

21.02.2008 00:05:32 - Initialize fwinst.exe

21.02.2008 00:05:32 - Service AntiVirFirewallService is not installed

21.02.2008 00:05:32 - Service antivirwebservice is not installed

21.02.2008 00:05:32 - Status of service AntiVirService is stopped

21.02.2008 00:05:32 - Initialize avgnt.exe

21.02.2008 00:05:32 - Status of service AntiVirScheduler is stopped

21.02.2008 00:05:32 - Minifilter is installed

21.02.2008 00:05:32 - Minifilter is possible

21.02.2008 00:05:32 - Initialize avscan.exe

21.02.2008 00:05:32 - Initialize avconfig.cpl

21.02.2008 00:05:32 - Initialize avcenter.exe

21.02.2008 00:05:32 - shell extension is installed

21.02.2008 00:05:32 - Reading registry value successful: Software\Avira\AntiVir PersonalEdition Classic | RootkitsInstalled

21.02.2008 00:05:32 - Reading registry value successful: Software\Avira\AntiVir PersonalEdition Classic | RootkitsInstalled

21.02.2008 00:05:37 - Service AntiVirService successfully started

21.02.2008 00:05:38 - Starting avgnt.exe successful

21.02.2008 00:05:41 - Service AntiVirScheduler successfully started

21.02.2008 00:05:41 - shell extension is installed

21.02.2008 00:05:41 - Initialize regsvr32.exe

21.02.2008 00:05:41 - installation of shell extension successful

21.02.2008 00:05:41 - Cannot start the service antivirwebservice

21.02.2008 00:05:41 - Dialup: 0

21.02.2008 00:05:41 - Downloaded bytes: 7550798

21.02.2008 00:05:41 - Downloaded file(s): 13

21.02.2008 00:05:41 - Downloaded file(s): updlib.dll; avcenter.exe; avgnt.exe; avguard.exe; ccguard.dll; preupd.exe; addr_file.html; antivir1.vdf; antivir2.vdf; antivir3.vdf; avewin32.dll; avpack32.dll; avipbb.sys

21.02.2008 00:05:41 - Engine version local   : 7.6.0.15

21.02.2008 00:05:41 - Engine version internet: 7.6.0.67

21.02.2008 00:05:41 - 0. VDF version local   : 6.40.0.0

21.02.2008 00:05:41 - 0. VDF version internet: 6.40.0.0

21.02.2008 00:05:41 - 1. VDF version local   : 7.0.0.0

21.02.2008 00:05:41 - 1. VDF version internet: 7.0.1.95

21.02.2008 00:05:41 - 2. VDF version local   : 7.0.0.1

21.02.2008 00:05:41 - 2. VDF version internet: 7.0.2.113

21.02.2008 00:05:41 - 3. VDF version local   : 7.0.0.2

21.02.2008 00:05:41 - 3. VDF version internet: 7.0.2.169

21.02.2008 00:05:41 - Required time: 00:14

21.02.2008 00:05:41 - Registry entry created successfully: Software\Avira\AntiVir PersonalEdition Classic |LastUpdate

21.02.2008 00:05:42 - Update finished successfully

riadh09 · Answer

21.02.2008 00:03:16 - Installation Directory: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
21.02.2008 00:03:16 - Backup Directory: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\BACKUP\
21.02.2008 00:03:16 - Temp Directory: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\
21.02.2008 00:03:17 - Start the Update GUI... Displaymode: 0

21.02.2008 00:03:16 - Installation Directory: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
21.02.2008 00:03:16 - Backup Directory: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\BACKUP\
21.02.2008 00:03:16 - Temp Directory: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\
21.02.2008 00:03:17 - Start the Update GUI... Displaymode: 0

21.02.2008 00:03:19 - Keyfile: OK [FULL Mode]

21.02.2008 00:03:19 - Avira AntiVir PersonalEdition Classic

21.02.2008 00:03:20 - Master IDX file has changed
21.02.2008 00:03:25 - Keyfile: OK [FULL Mode]

21.02.2008 00:03:25 - Downloading the product.info file from http://dl8.freeav.net/upd/idx/classic-nt-en.info.gz
21.02.2008 00:03:26 - File basic-nt/2k/avgntflt.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:03:26 - File basic-nt/avgio64.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:03:26 - File basic-nt/imp64b.exe's operating system doesn't match the current one. File ignored.
21.02.2008 00:03:26 - File basic-nt/psapi.dll's operating system doesn't match the current one. File ignored.
21.02.2008 00:03:26 - File basic-nt/shlext64.dll's operating system doesn't match the current one. File ignored.
21.02.2008 00:03:26 - File basic-nt/vista64/avgntflt.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:03:26 - File basic-nt/xp64/avgntflt.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:03:26 - File basic-nt/2k/avgntdd.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:03:26 - File basic-nt/2k/avgntmgr.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:03:26 - File basic-nt/nt/avgntdd.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:03:26 - File basic-nt/nt/avgntmgr.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:03:26 - File basic-nt/vista64/avgntflt.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:03:26 - Downloading the product.info file from http://dl8.freeav.net/upd/idx/vdf.info.gz
21.02.2008 00:03:29 - Keyfile: OK [FULL Mode]

21.02.2008 00:03:29 - Downloading the product.info file from http://dl8.freeav.net/upd/idx/specvir-nt.info.gz
21.02.2008 00:03:29 - Downloading the product.info file from http://dl8.freeav.net/upd/idx/engine.info.gz
21.02.2008 00:03:30 - Downloading the product.info file from http://dl8.freeav.net/upd/idx/engine-nt-en.info.gz
21.02.2008 00:03:31 - Module: SELFUPDATE Source: winwks\en\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 15
21.02.2008 00:03:31 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\updlib.dll 1.2.10.20 < 1.2.10.21
21.02.2008 00:03:31 - Module: MAIN Source: winwks\en\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 77
21.02.2008 00:03:31 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe 7.2.0.12 < 7.2.0.14
21.02.2008 00:03:31 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe 7.2.0.13 < 7.2.0.16
21.02.2008 00:03:31 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe 7.0.0.81 < 7.0.0.82
21.02.2008 00:03:31 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\ccguard.dll 7.0.1.34 < 7.0.1.35
21.02.2008 00:03:31 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\preupd.exe 7.0.0.34 < 7.0.0.36
21.02.2008 00:03:32 - Module: COMMAPPDATA Source: winwks\en\ Destination: C:\ProgramData\ Files: 1
21.02.2008 00:03:32 - Module: TEXT Source: winwks\en\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 3
21.02.2008 00:03:32 - Module: VDF Source: vdf\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 4
21.02.2008 00:03:32 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\antivir1.vdf 7.0.0.0 < 7.0.1.95
21.02.2008 00:03:32 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\antivir2.vdf 7.0.0.1 < 7.0.2.113
21.02.2008 00:03:32 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\antivir3.vdf 7.0.0.2 < 7.0.2.169
21.02.2008 00:03:32 - Module: AVREP_NT Source: engine
t\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 1
21.02.2008 00:03:32 - Module: ENGINE Source: engine\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 2
21.02.2008 00:03:32 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avewin32.dll 7.6.0.15 < 7.6.0.67
21.02.2008 00:03:32 - Module: ENGINE_NT_EN Source: engine
t\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 1
21.02.2008 00:03:32 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avpack32.dll 7.3.0.15 < 7.6.0.3
21.02.2008 00:03:32 - Module: DRV Source: winwks\en\ Destination: C:\Windows\SYSTEM32\drivers\ Files: 4
21.02.2008 00:03:32 - C:\Windows\SYSTEM32\drivers\avipbb.sys 1.0.2.11 < 1.0.2.13
21.02.2008 00:03:32 - Minifilter is installed

21.02.2008 00:03:32 - Minifilter is possible

21.02.2008 00:03:32 - Reading registry value successful: Software\Avira\AntiVir PersonalEdition Classic | FilterType

21.02.2008 00:03:32 - File basic-nt/xp/avgntdd.sys which was recognized as modified, must not be updated
21.02.2008 00:03:32 - File basic-nt/xp/avgntmgr.sys which was recognized as modified, must not be updated
21.02.2008 00:03:32 - Initialize avnotify.exe

21.02.2008 00:03:32 - Starting avnotify.exe successful

21.02.2008 00:03:32 - Preparing to download files
21.02.2008 00:03:32 - 13 files need to be downloaded / copied from http://dl8.freeav.net/upd/
21.02.2008 00:03:32 - #1: Downloading and extracting http://dl8.freeav.net/upd/winwks/en/basic-nt/updlib.dll.gz to C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt/updlib.dll
21.02.2008 00:03:35 - #2: Downloading and extracting http://dl8.freeav.net/upd/winwks/en/basic-nt/avcenter.exe.gz to C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt/avcenter.exe
21.02.2008 00:03:38 - #3: Downloading and extracting http://dl8.freeav.net/upd/winwks/en/basic-nt/avgnt.exe.gz to C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt/avgnt.exe
21.02.2008 00:03:40 - #4: Downloading and extracting http://dl8.freeav.net/upd/winwks/en/basic-nt/avguard.exe.gz to C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt/avguard.exe
21.02.2008 00:03:42 - #5: Downloading and extracting http://dl8.freeav.net/upd/winwks/en/basic-nt/ccguard.dll.gz to C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt/ccguard.dll
21.02.2008 00:03:44 - #6: Downloading and extracting http://dl8.freeav.net/upd/winwks/en/basic-nt/preupd.exe.gz to C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt/preupd.exe
21.02.2008 00:03:45 - #7: Downloading and extracting http://dl8.freeav.net/upd/winwks/en/basic-nt/addr_file.html.gz to C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt/addr_file.html
21.02.2008 00:03:46 - #8: Downloading and extracting http://dl8.freeav.net/upd/vdf/antivir1.vdf.gz to C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\vdf\antivir1.vdf
21.02.2008 00:04:34 - #9: Downloading and extracting http://dl8.freeav.net/upd/vdf/antivir2.vdf.gz to C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\vdf\antivir2.vdf
21.02.2008 00:04:55 - #10: Downloading and extracting http://dl8.freeav.net/upd/vdf/antivir3.vdf.gz to C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\vdf\antivir3.vdf
21.02.2008 00:04:59 - #11: Downloading and extracting http://dl8.freeav.net/upd/engine/avewin32.dll.gz to C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\engine\avewin32.dll
21.02.2008 00:05:12 - #12: Downloading and extracting http://dl8.freeav.net/upd/engine/nt/avpack32.dll.gz to C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\engine
t\avpack32.dll
21.02.2008 00:05:14 - #13: Downloading and extracting http://dl8.freeav.net/upd/winwks/en/basic-nt/avipbb.sys.gz to C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt/avipbb.sys
21.02.2008 00:05:22 - Service AVEService is not installed

21.02.2008 00:05:22 - Service AntiVirMailService is not installed

21.02.2008 00:05:22 - Initialize fwinst.exe

21.02.2008 00:05:22 - Initialize fwinst.exe

21.02.2008 00:05:22 - Service AntiVirFirewallService is not installed

21.02.2008 00:05:22 - Service antivirwebservice is not installed

21.02.2008 00:05:22 - Status of service AntiVirService is running

21.02.2008 00:05:22 - Initialize avgnt.exe

21.02.2008 00:05:22 - Status of service AntiVirScheduler is running

21.02.2008 00:05:22 - Minifilter is installed

21.02.2008 00:05:22 - Minifilter is possible

21.02.2008 00:05:22 - Initialize avscan.exe

21.02.2008 00:05:22 - Initialize avconfig.cpl

21.02.2008 00:05:22 - Initialize avcenter.exe

21.02.2008 00:05:22 - shell extension is installed

21.02.2008 00:05:22 - Reading registry value successful: Software\Avira\AntiVir PersonalEdition Classic | RootkitsInstalled

21.02.2008 00:05:22 - Reading registry value successful: Software\Avira\AntiVir PersonalEdition Classic | RootkitsInstalled

21.02.2008 00:05:22 - Service AVEService is not installed

21.02.2008 00:05:22 - Service AntiVirMailService is not installed

21.02.2008 00:05:22 - Initialize fwinst.exe

21.02.2008 00:05:22 - Initialize fwinst.exe

21.02.2008 00:05:22 - Service AntiVirFirewallService is not installed

21.02.2008 00:05:22 - shell extension is installed

21.02.2008 00:05:22 - Initialize regsvr32.exe

21.02.2008 00:05:22 - shell extension removed successfully

21.02.2008 00:05:22 - avgnt.exe closed.

21.02.2008 00:05:22 - Status of service AntiVirScheduler is running

21.02.2008 00:05:23 - Service AntiVirScheduler successfully stopped

21.02.2008 00:05:23 - Status of service AntiVirService is running

21.02.2008 00:05:24 - Service AntiVirService successfully stopped

21.02.2008 00:05:24 - Starting to install
21.02.2008 00:05:24 - Processing module SELFUPDATE Source: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
21.02.2008 00:05:25 - Current Direcory:C:\Program Files\Avira\AntiVir PersonalEdition Classic, About to execute C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\SelfUpdateTemp\update.exe --log-template="${DAY}.${MONTH}.${YEAR} ${HOUR}:${MINUTE}:${SECOND} - ${MSG}".Self Update helper
21.02.2008 00:05:26 - Installation Directory: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
21.02.2008 00:05:26 - Backup Directory: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\BACKUP\
21.02.2008 00:05:26 - Temp Directory: C:\Windows\TEMP\Update_Temp\
21.02.2008 00:05:26 - Avira AntiVir PersonalEdition Classic

21.02.2008 00:05:26 - Self update: Copying file C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt/updlib.dll to C:\Program Files\Avira\AntiVir PersonalEdition Classic\updlib.dll
21.02.2008 00:05:26 - Executing original update application
21.02.2008 00:05:26 - Current Direcory:C:\Program Files\Avira\AntiVir PersonalEdition Classic, About to execute C:\Program Files\Avira\AntiVir PersonalEdition Classic\update.exe  --config-file="C:\ProgramData\Avira\AntiVir PersonalEdition Classic\update.conf" --install-path="C:\Program Files\Avira\AntiVir PersonalEdition Classic" --log-template="${DAY}.${MONTH}.${YEAR} ${HOUR}:${MINUTE}:${SECOND} - ${MSG}"  --NoSelfUpdate "--TmpDir=C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4" "--LogFile=C:\ProgramData\Avira\AntiVir PersonalEdition Classic\LOGFILES\Upd-2008-02-21-00-03-16.log" "--TmpFilesList=C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\ToRemove.txt".Executing original update application
21.02.2008 00:05:26 - Installation Directory: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
21.02.2008 00:05:26 - Backup Directory: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\BACKUP\
21.02.2008 00:05:26 - Temp Directory: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\
21.02.2008 00:05:27 - Start the Update GUI... Displaymode: 0

21.02.2008 00:05:27 - Avira AntiVir PersonalEdition Classic

21.02.2008 00:05:27 - Master IDX file has changed
21.02.2008 00:05:27 - File basic-nt/2k/avgntflt.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:05:27 - File basic-nt/avgio64.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:05:27 - File basic-nt/imp64b.exe's operating system doesn't match the current one. File ignored.
21.02.2008 00:05:27 - File basic-nt/psapi.dll's operating system doesn't match the current one. File ignored.
21.02.2008 00:05:27 - File basic-nt/shlext64.dll's operating system doesn't match the current one. File ignored.
21.02.2008 00:05:27 - File basic-nt/vista64/avgntflt.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:05:27 - File basic-nt/xp64/avgntflt.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:05:27 - File basic-nt/2k/avgntdd.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:05:27 - File basic-nt/2k/avgntmgr.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:05:27 - File basic-nt/nt/avgntdd.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:05:27 - File basic-nt/nt/avgntmgr.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:05:27 - File basic-nt/vista64/avgntflt.sys's operating system doesn't match the current one. File ignored.
21.02.2008 00:05:27 - Downloading the product.info file from http://dl5.avgate.net/upd/idx/vdf.info.gz
21.02.2008 00:05:27 - Downloading the product.info file from http://dl5.avgate.net/upd/idx/specvir-nt.info.gz
21.02.2008 00:05:27 - Downloading the product.info file from http://dl5.avgate.net/upd/idx/engine.info.gz
21.02.2008 00:05:27 - Downloading the product.info file from http://dl5.avgate.net/upd/idx/engine-nt-en.info.gz
21.02.2008 00:05:27 - Module: SELFUPDATE Source: winwks\en\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 15
21.02.2008 00:05:27 - Module: MAIN Source: winwks\en\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 77
21.02.2008 00:05:28 - Module: COMMAPPDATA Source: winwks\en\ Destination: C:\ProgramData\ Files: 1
21.02.2008 00:05:28 - Module: TEXT Source: winwks\en\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 3
21.02.2008 00:05:28 - Module: VDF Source: vdf\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 4
21.02.2008 00:05:28 - Module: AVREP_NT Source: engine
t\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 1
21.02.2008 00:05:28 - Module: ENGINE Source: engine\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 2
21.02.2008 00:05:28 - Module: ENGINE_NT_EN Source: engine
t\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 1
21.02.2008 00:05:28 - Module: DRV Source: winwks\en\ Destination: C:\Windows\SYSTEM32\drivers\ Files: 4
21.02.2008 00:05:28 - Minifilter is installed

21.02.2008 00:05:28 - Minifilter is possible

21.02.2008 00:05:28 - Reading registry value successful: Software\Avira\AntiVir PersonalEdition Classic | FilterType

21.02.2008 00:05:28 - File basic-nt/xp/avgntdd.sys which was recognized as modified, must not be updated
21.02.2008 00:05:28 - File basic-nt/xp/avgntmgr.sys which was recognized as modified, must not be updated
21.02.2008 00:05:28 - Preparing to download files
21.02.2008 00:05:28 - 12 files need to be downloaded / copied from http://dl5.avgate.net/upd/
21.02.2008 00:05:28 - File C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt\avcenter.exe.gz already exists in temporary folder and it will not be downloaded again
21.02.2008 00:05:29 - File C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt\avgnt.exe.gz already exists in temporary folder and it will not be downloaded again
21.02.2008 00:05:29 - File C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt\avguard.exe.gz already exists in temporary folder and it will not be downloaded again
21.02.2008 00:05:29 - File C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt\ccguard.dll.gz already exists in temporary folder and it will not be downloaded again
21.02.2008 00:05:29 - File C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt\preupd.exe.gz already exists in temporary folder and it will not be downloaded again
21.02.2008 00:05:29 - File C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt\addr_file.html.gz already exists in temporary folder and it will not be downloaded again
21.02.2008 00:05:30 - File C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\vdf\antivir1.vdf.gz already exists in temporary folder and it will not be downloaded again
21.02.2008 00:05:31 - File C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\vdf\antivir2.vdf.gz already exists in temporary folder and it will not be downloaded again
21.02.2008 00:05:31 - File C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\vdf\antivir3.vdf.gz already exists in temporary folder and it will not be downloaded again
21.02.2008 00:05:31 - File C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\engine\avewin32.dll.gz already exists in temporary folder and it will not be downloaded again
21.02.2008 00:05:32 - File C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\engine
t\avpack32.dll.gz already exists in temporary folder and it will not be downloaded again
21.02.2008 00:05:32 - File C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\basic-nt\avipbb.sys.gz already exists in temporary folder and it will not be downloaded again
21.02.2008 00:05:32 - Starting to install
21.02.2008 00:05:32 - Processing module MAIN Source: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
21.02.2008 00:05:32 - File C:\ProgramData\addr_file.html will not be backed up because it doesn't exist
21.02.2008 00:05:32 - Processing module COMMAPPDATA Source: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\ Destination: C:\ProgramData\
21.02.2008 00:05:32 - Processing module VDF Source: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\vdf\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
21.02.2008 00:05:32 - Processing module ENGINE Source: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\engine\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
21.02.2008 00:05:32 - Processing module ENGINE_NT_EN Source: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\engine
t\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
21.02.2008 00:05:32 - Processing module DRV Source: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47bcb1b4\winwks\en\ Destination: C:\Windows\SYSTEM32\drivers\
21.02.2008 00:05:32 - A total of 12 files were updated
21.02.2008 00:05:32 - Registry entry created successfully: Software\Avira\AntiVir PersonalEdition Classic |UpdateInProgress

21.02.2008 00:05:32 - Service AVEService is not installed

21.02.2008 00:05:32 - Service AntiVirMailService is not installed

21.02.2008 00:05:32 - Initialize fwinst.exe

21.02.2008 00:05:32 - Initialize fwinst.exe

21.02.2008 00:05:32 - Service AntiVirFirewallService is not installed

21.02.2008 00:05:32 - Service antivirwebservice is not installed

21.02.2008 00:05:32 - Status of service AntiVirService is stopped

21.02.2008 00:05:32 - Initialize avgnt.exe

21.02.2008 00:05:32 - Status of service AntiVirScheduler is stopped

21.02.2008 00:05:32 - Minifilter is installed

21.02.2008 00:05:32 - Minifilter is possible

21.02.2008 00:05:32 - Initialize avscan.exe

21.02.2008 00:05:32 - Initialize avconfig.cpl

21.02.2008 00:05:32 - Initialize avcenter.exe

21.02.2008 00:05:32 - shell extension is installed

21.02.2008 00:05:32 - Reading registry value successful: Software\Avira\AntiVir PersonalEdition Classic | RootkitsInstalled

21.02.2008 00:05:32 - Reading registry value successful: Software\Avira\AntiVir PersonalEdition Classic | RootkitsInstalled

21.02.2008 00:05:37 - Service AntiVirService successfully started

21.02.2008 00:05:38 - Starting avgnt.exe successful

21.02.2008 00:05:41 - Service AntiVirScheduler successfully started

21.02.2008 00:05:41 - shell extension is installed

21.02.2008 00:05:41 - Initialize regsvr32.exe

21.02.2008 00:05:41 - installation of shell extension successful

21.02.2008 00:05:41 - Cannot start the service antivirwebservice

21.02.2008 00:05:41 - Dialup: 0

21.02.2008 00:05:41 - Downloaded bytes: 7550798

21.02.2008 00:05:41 - Downloaded file(s): 13

21.02.2008 00:05:41 - Downloaded file(s): updlib.dll; avcenter.exe; avgnt.exe; avguard.exe; ccguard.dll; preupd.exe; addr_file.html; antivir1.vdf; antivir2.vdf; antivir3.vdf; avewin32.dll; avpack32.dll; avipbb.sys

21.02.2008 00:05:41 - Engine version local   : 7.6.0.15

21.02.2008 00:05:41 - Engine version internet: 7.6.0.67

21.02.2008 00:05:41 - 0. VDF version local   : 6.40.0.0

21.02.2008 00:05:41 - 0. VDF version internet: 6.40.0.0

21.02.2008 00:05:41 - 1. VDF version local   : 7.0.0.0

21.02.2008 00:05:41 - 1. VDF version internet: 7.0.1.95

21.02.2008 00:05:41 - 2. VDF version local   : 7.0.0.1

21.02.2008 00:05:41 - 2. VDF version internet: 7.0.2.113

21.02.2008 00:05:41 - 3. VDF version local   : 7.0.0.2

21.02.2008 00:05:41 - 3. VDF version internet: 7.0.2.169

21.02.2008 00:05:41 - Required time: 00:14

21.02.2008 00:05:41 - Registry entry created successfully: Software\Avira\AntiVir PersonalEdition Classic |LastUpdate

21.02.2008 00:05:42 - Update finished successfully

Saiyen75 · Answer

Ce que tu m'as envoyé, c'est la mise à jour d'Antivir.
Maintenant fait un scan et post le rapport comme je t'ai indiqué plus haut.
Suis bien les indications, dans le bon ordre. N'oulibe pas le Avira antirootkit.

Je vais me coucher, je regarderai les rapports demain,

bonne nuit

++

riadh09 · Answer

bonne nuit merci beaucoup de votre aide c'est trés gentille

riadh09 · Answer

AntiVir PersonalEdition Classic
Report file date: jeudi 21 février 2008  00:10

Scanning for 1118450 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows Vista
Windows version:  (plain)  [6.0.6000]
Username:         SYSTEM
Computer name:    PC-DE-RIADH

Version information:
BUILD.DAT    : 270           15603 Bytes  19/09/2007 13:32:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes  23/08/2007 13:16:29
AVSCAN.DLL   : 7.0.6.0       49192 Bytes  16/08/2007 12:23:51
LUKE.DLL     : 7.0.5.3      147496 Bytes  14/08/2007 15:32:47
LUKERES.DLL  : 7.0.6.1       10280 Bytes  21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes  18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.1.95    3367424 Bytes  14/12/2007 23:05:32
ANTIVIR2.VDF : 7.0.2.113   1673728 Bytes  08/02/2008 23:05:32
ANTIVIR3.VDF : 7.0.2.169    308736 Bytes  20/02/2008 23:05:32
AVEWIN32.DLL : 7.6.0.67    3293696 Bytes  20/02/2008 23:05:32
AVWINLL.DLL  : 1.0.0.7       14376 Bytes  26/02/2007 10:36:26
AVPREF.DLL   : 7.0.2.2       25640 Bytes  18/07/2007 07:39:17
AVREP.DLL    : 7.0.0.1      155688 Bytes  16/04/2007 13:16:24
AVPACK32.DLL : 7.6.0.3      360488 Bytes  20/02/2008 23:05:32
AVREG.DLL    : 7.0.1.6       30760 Bytes  18/07/2007 07:17:06
AVARKT.DLL   : 1.0.0.20     278568 Bytes  28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes  18/07/2007 07:10:18
NETNT.DLL    : 7.0.0.0        7720 Bytes  08/03/2007 11:09:42
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes  07/08/2007 12:38:13
RCTEXT.DLL   : 7.0.62.0      86056 Bytes  21/08/2007 12:50:37
SQLITE3.DLL  : 3.3.17.1     339968 Bytes  23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: D:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: jeudi 21 février 2008  00:10

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'notepad.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'VSSVC.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'conime.exe' - '1' Module(s) have been scanned
Scan process 'HPHC_Service.exe' - '1' Module(s) have been scanned
Scan process 'SteamService.exe' - '1' Module(s) have been scanned
Scan process 'unsecapp.exe' - '1' Module(s) have been scanned
Scan process 'HpqToaster.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'wmpnetwk.exe' - '1' Module(s) have been scanned
Scan process 'WmiPrvSE.exe' - '1' Module(s) have been scanned
Scan process 'taskeng.exe' - '1' Module(s) have been scanned
Scan process 'CLSched.exe' - '1' Module(s) have been scanned
Scan process 'hpqwmiex.exe' - '1' Module(s) have been scanned
Scan process 'SearchIndexer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned
Scan process 'CLCapSvc.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '0' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'ehmsas.exe' - '1' Module(s) have been scanned
Scan process 'EDICT.EXE' - '1' Module(s) have been scanned
Scan process 'wmpnscfg.exe' - '1' Module(s) have been scanned
Scan process 'Skype.exe' - '1' Module(s) have been scanned
Scan process 'NMBgMonitor.exe' - '1' Module(s) have been scanned
Scan process 'Steam.exe' - '1' Module(s) have been scanned
Scan process 'ehtray.exe' - '1' Module(s) have been scanned
Scan process 'LightScribeControlPanel.exe' - '1' Module(s) have been scanned
Scan process 'sidebar.exe' - '1' Module(s) have been scanned
Scan process 'avgas.exe' - '1' Module(s) have been scanned
Scan process 'realsched.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned
Scan process 'WiFiMsg.exe' - '1' Module(s) have been scanned
Scan process 'HPWAMain.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'QLBCTRL.exe' - '1' Module(s) have been scanned
Scan process 'QPService.exe' - '1' Module(s) have been scanned
Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned
Scan process 'MSASCui.exe' - '1' Module(s) have been scanned
Scan process 'dwm.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'taskeng.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'SLsvc.exe' - '1' Module(s) have been scanned
Scan process 'audiodg.exe' - '0' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'lsm.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'wininit.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
71 processes with 71 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
      [NOTE]      No virus was found!
Boot sector 'D:\'
      [NOTE]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '14' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
      [WARNING]   The file could not be opened!
Begin scan in 'D:\' <HP_RECOVERY>


End of the scan: jeudi 21 février 2008  00:56
Used time: 46:03 min

The scan has been done completely.

  14442 Scanning directories
 310542 Files were scanned
      0 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      1 Files cannot be scanned
 310542 Files not concerned
   2426 Archives were scanned
      1 Warnings
     12 Notes

Saiyen75 · Answer

Salut,

Y'a pas de problème pour l'aide :)
Trés bien, à présent j'attend le rapport Avira Antirootkit.

++

riadh09 · Answer

bonjour saiyen merci pour ton aide normalement maintenant les ne s'ouvreent pas j'ai éssayé plusier fois(j'espere) mais avant de t'ecrire ce message une page bleu apparait c'etait marqué le systeme a un prob et d'un coup il c'est redemarré tout seul j'ai remarqué que le pc est devenu trop lent il resté 5min  au demarrage  repond moi stp dit moi pourquoi
et pour le rapport avira je te l'ai envoyé ce matin si c pas ça dit moi quoi faire merci

riadh09 · Answer

le probleme est revenu les pages s'ouvrent encore j'en ai mar est ce que y aura une solution?

Saiyen75 · Answer

Re

Utilise Combofix, Fait bien les étapes dans l'ordre, C'est trés important, ce logiciel est trés puissant.

ComboFix :

Télécharge combofix.exe(par sUBs) sur ton Bureau : 

http://download.bleepingcomputer.com/sUBs/ComboFix.exe 

* Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.
* Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil. 



Une fois fait, sur ton bureau double-clic sur Combofix.exe. 

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc. 

/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes. /!\

- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire. 

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt) 

* Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet. 

* Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message. 

_____________________________________________________

riadh09 · Answer

ComboFix 08-02-21 - riadh 2008-02-21 14:53:33.1 - NTFSx86 Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.345 [GMT 1:00] Endroit: C:\Users iadh\Desktop\ComboFix.exe * Création d'un nouveau point de restauration . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat ----- BITS: Possible sites infectés ----- hxxp://www.tucows.com . ((((((((((((((((((((((((((((( Fichiers créés 2008-01-21 to 2008-02-21 )))))))))))))))))))))))))))))))))))) . Pas de nouveau fichier créé dans cet espace de temps . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-21 10:53 --------- d-----w C:\Users iadh\AppData\Roaming\Skype 2008-02-21 10:27 27,335 ----a-w C:\Users iadh\AppData\Roaming vModes.dat 2008-02-21 10:18 --------- d-----w C:\Program Files\BrowsingAdvisor 2008-02-20 23:02 --------- d-----w C:\ProgramData\Avira 2008-02-20 23:02 --------- d-----w C:\Program Files\Avira 2008-02-20 21:10 --------- d-----w C:\Program Files\Common Files\ErreurChasseur 2008-02-20 18:47 --------- d-----w C:\Program Files\Navilog1 2008-02-20 15:50 --------- d-----w C:\Program Files\FBrowsingAdvisor 2008-02-20 15:50 --------- d-----w C:\Program Files\FBrowserAdvisor 2008-02-20 07:50 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-02-20 07:34 --------- d-----w C:\ProgramData\Spybot - Search & Destroy 2008-02-20 07:19 --------- d-----w C:\Users iadh\AppData\Roaming\Grisoft 2008-02-20 07:19 --------- d-----w C:\ProgramData\Grisoft 2008-02-20 07:03 --------- d-----w C:\Users iadh\AppData\Roaming\skypePM 2008-02-17 21:51 --------- d-----w C:\Users iadh\AppData\Roaming\LimeWire 2008-02-16 16:40 --------- d-----w C:\Program Files\Microsoft Etudes 2008-02-16 16:25 --------- d-----w C:\Program Files\Learning Essentials 2008-02-15 12:06 --------- d-----w C:\ProgramData\CyberLink 2008-02-15 09:54 --------- d-----w C:\ProgramData\Messenger Plus! 2008-02-15 09:45 --------- d-----w C:\Program Files\Messenger Plus! Live 2008-02-15 08:49 --------- d-----w C:\Program Files\Common Files\Steam 2008-02-14 02:09 194,560 ----a-w C:\Windows\System32\WebClnt.dll 2008-02-14 02:09 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys 2008-02-14 02:04 803,328 ----a-w C:\Windows\system32\drivers cpip.sys 2008-02-13 23:16 32 ----a-w C:\Users\All Users\ezsid.dat 2008-02-13 23:16 32 ----a-w C:\ProgramData\ezsid.dat 2008-02-13 23:13 --------- d-----w C:\ProgramData\Skype 2008-02-13 23:13 --------- d-----w C:\Program Files\Skype 2008-02-13 23:13 --------- d-----w C:\Program Files\Common Files\Skype 2008-02-13 21:17 --------- d-----w C:\ProgramData\Microsoft Help 2008-02-13 20:58 824,832 ----a-w C:\Windows\System32\wininet.dll 2008-02-13 20:58 56,320 ----a-w C:\Windows\System32\iesetup.dll 2008-02-13 20:58 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll 2008-02-13 20:58 26,624 ----a-w C:\Windows\System32\ieUnatt.exe 2008-02-13 20:57 1,244,672 ----a-w C:\Windows\System32\mcmde.dll 2008-02-11 13:37 --------- d-----w C:\Program Files\Common Files\Adobe 2008-02-11 12:19 --------- d-----w C:\Program Files\Disc2Phone 2008-02-06 18:22 --------- d-----w C:\Users iadh\AppData\Roaming\Ahead 2008-02-06 18:19 --------- d-----w C:\Program Files\Nero 2008-02-06 18:19 --------- d-----w C:\Program Files\Common Files\Ahead 2008-02-04 18:25 --------- d-----w C:\ProgramData\Downloaded Installations 2008-02-03 21:12 --------- d-----w C:\Users iadh\AppData\Roaming\dvdcss 2008-02-02 16:58 --------- d-----w C:\Program Files\Valve 2008-01-23 07:43 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-23 07:41 --------- d-----w C:\Program Files\Windows Sidebar 2008-01-23 07:41 --------- d-----w C:\Program Files\Windows Defender 2008-01-23 07:41 --------- d-----w C:\Program Files\Common Files\LightScribe 2008-01-21 22:01 --------- d-----w C:\Program Files\Windows Photo Gallery 2008-01-21 22:01 --------- d-----w C:\Program Files\Windows Mail 2008-01-21 22:01 --------- d-----w C:\Program Files\Windows Journal 2008-01-21 22:01 --------- d-----w C:\Program Files\Windows Calendar 2008-01-21 21:43 --------- d-----w C:\Program Files\Panda Software 2008-01-21 21:42 --------- d-----w C:\Program Files\Common Files\Panda Software 2008-01-17 17:18 --------- d-----w C:\Users iadh\AppData\Roaming\Template 2008-01-17 09:49 --------- d-----w C:\ProgramData\Kaspersky Lab 2008-01-15 13:43 --------- d-----w C:\Program Files\CONEXANT 2008-01-14 12:04 --------- d---a-w C:\ProgramData\TEMP 2008-01-14 12:01 --------- d-----w C:\Users iadh\AppData\Roaming\Roxio 2008-01-14 12:01 --------- d-----w C:\ProgramData\Sonic 2008-01-14 12:00 --------- d-----w C:\Program Files\Windows Live 2008-01-10 08:52 211,000 ----a-w C:\Windows\system32\drivers\volsnap.sys 2008-01-10 08:52 1,060,920 ----a-w C:\Windows\system32\drivers tfs.sys 2008-01-10 08:51 11,776 ----a-w C:\Windows\System32\sbunattend.exe 2008-01-09 14:22 --------- d-----w C:\Program Files\Java 2008-01-09 12:26 --------- d-----w C:\Users iadh\AppData\Roaming\InstallShield 2008-01-05 23:13 --------- d-----w C:\ProgramData\LightScribe 2008-01-03 19:14 --------- d-----w C:\Program Files\1stbenison 2007-12-25 15:44 260,632 ----a-w C:\Users iadh\AppData\Roaming\setup_fr[1].exe 2007-12-25 15:36 --------- d-----w C:\Program Files\Real 2007-12-25 15:36 --------- d-----w C:\Program Files\Common Files\xing shared 2007-12-25 15:36 --------- d-----w C:\Program Files\Common Files\Real 2007-12-23 18:52 80,097 ----a-w C:\Windows\System32\dcads-remove.exe 2007-12-23 18:52 77,360 ----a-w C:\Windows\System32\dcads_sidebar_uninstall.exe 2007-12-23 18:52 40,734 ----a-w C:\Windows\System32\superiorads-uninst.exe 2007-12-23 18:52 --------- d-----w C:\Program Files\Dcads Games Collection 2007-12-18 14:35 0 ----a-w C:\Users iadh\AppData\Roaming\wklnhst.dat 2007-12-12 23:17 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL 2007-12-12 23:17 223,232 ----a-w C:\Windows\System32\WMASF.DLL 2007-12-12 23:17 1,327,104 ----a-w C:\Windows\System32\quartz.dll 2007-12-04 21:26 174 --sha-w C:\Program Files\desktop.ini 2007-12-04 21:18 704,000 ----a-w C:\Windows\System32\PhotoScreensaver.scr 2007-12-04 21:18 67,584 ----a-w C:\Windows\System32\wlanhlp.dll 2007-12-04 21:18 542,720 ----a-w C:\Windows\System32\sysmain.dll 2007-12-04 21:18 502,784 ----a-w C:\Windows\System32\wlansvc.dll 2007-12-04 21:18 47,104 ----a-w C:\Windows\System32\wlanapi.dll 2007-12-04 21:18 297,984 ----a-w C:\Windows\System32\wlansec.dll 2007-12-04 21:18 290,816 ----a-w C:\Windows\System32\wlanmsm.dll 2007-12-04 21:18 24,064 ----a-w C:\Windows\System32\wtsapi32.dll 2007-12-04 21:18 2,923,520 ----a-w C:\Windows\explorer.exe 2007-12-04 21:18 2,027,008 ----a-w C:\Windows\System32\win32k.sys 2007-12-04 21:14 8,147,968 ----a-w C:\Windows\System32\wmploc.DLL 2007-12-04 21:14 7,680 ----a-w C:\Windows\System32\spwmp.dll 2007-12-04 21:14 4,096 ----a-w C:\Windows\System32\dxmasf.dll 2007-12-04 21:14 356,864 ----a-w C:\Windows\System32\MediaMetadataHandler.dll 2007-12-04 21:13 86,016 ----a-w C:\Windows\System32\icfupgd.dll 2007-12-04 21:13 61,952 ----a-w C:\Windows\System32\cmifw.dll 2007-12-04 21:13 396,800 ----a-w C:\Windows\System32\MPSSVC.dll 2007-12-04 21:13 392,192 ----a-w C:\Windows\System32\FirewallAPI.dll 2007-12-04 21:13 178,688 ----a-w C:\Windows\System32\iphlpsvc.dll 2007-12-04 21:13 16,896 ----a-w C:\Windows\System32\wfapigp.dll . [code]

----a-w           325,204 2006-12-21 19:56:28  C:\SwSetup\SP34746\WCAMC\FW_210_Silence Install .exe

/code ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F1E96EDC-E0C8-BE98-1F15-C29DBED83B53}] 2007-12-30 21:49 1019904 --a------ C:\Program Files\BrowsingAdvisor\BrowsingAdvisor-2.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-10 09:51 1232896] "LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-04-19 12:26 484904] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 13:35 125440] "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184] "Steam"="C:\Program Files\Valve\Steam\Steam.exe" [2008-02-02 18:04 1266936] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2005-09-03 15:18 94208] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-01 17:22 21898024] "L08FXLRD_80990087"="C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - Études DVD\EDICT.exe" [2007-06-12 21:34 351000] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-08-18 00:07 1006264] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-13 04:36 827392] "QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2007-04-23 17:11 176128] "QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-02-13 10:38 159744] "HP Health Check Scheduler"="C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 10:54 50696] "NvSvc"="C:\Windows\system32 vsvc.dll" [2007-07-09 03:57 86016] "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-07-09 03:57 8433664] "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-07-09 03:57 81920] "hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 12:18 472776] "WAWifiMessage"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 15:12 317128] "HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 22:11 49152] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "NWEReboot"="" [] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-21 00:05 249896] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "Launcher"="%WINDIR%\SMINST\launcher.exe" [ ] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableLockWorkstation"= 0 (0x0) "DisableChangePassword"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoLogoff"= 0 (0x0) R1 ShldDrv;Panda File Shield Driver;C:\Windows\system32\drivers\ShldDrv.sys [2005-08-29 13:23] R3 nvsmu;nvsmu;C:\Windows\system32\DRIVERS vsmu.sys [2007-02-17 00:50] S2 PavProc;Panda Process Protection Driver;C:\Windows\system32\DRIVERS\PavProc.sys [2006-04-25 16:02] S3 BCM43XV;Pilote de la carte réseau extensible Broadcom 802.11;C:\Windows\system32\DRIVERS\bcmwl6.sys [2007-01-03 16:43] S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-02-15 09:48] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{19741992-d7cf-11dc-a9a6-001b249c2134}] \shell\AutoRun\command - G:\RavMon.exe \shell\explore\Command - G:\RavMon.exe -e \shell\open\Command - G:\RavMon.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{24c2b8b5-a20b-11dc-bb19-001b249c2134}] \shell\AutoRun\command - F:\RavMon.exe \shell\explore\Command - F:\RavMon.exe -e \shell\open\Command - F:\RavMon.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3155a2c2-a487-11dc-9360-001b249c2134}] \shell\AutoRun\command - G:\RavMon.exe \shell\explore\Command - G:\RavMon.exe -e \shell\open\Command - G:\RavMon.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e0839e6f-cf69-11dc-b823-001b249c2134}] \shell\AutoRun\command - F:\RavMon.exe \shell\explore\Command - F:\RavMon.exe -e \shell\open\Command - F:\RavMon.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eaf9d9ad-bf59-11dc-8f37-001b249c2134}] \shell\AutoRun\command - G:\RavMon.exe \shell\explore\Command - G:\RavMon.exe -e \shell\open\Command - G:\RavMon.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eaf9d9b3-bf59-11dc-8f37-001b249c2134}] \shell\AutoRun\command - H:\RavMon.exe \shell\explore\Command - H:\RavMon.exe -e \shell\open\Command - H:\RavMon.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe" . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2008-02-20 17:49:38 C:\Windows\Tasks\User_Feed_Synchronization-{5241619B-39BB-4141-9720-870AAC505CB4}.job" - C:\Windows\system32\msfeedssync.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-21 14:56:30 Windows 6.0.6000 NTFS Balayage processus cachés ... Balayage caché autostart entries ... Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** . Temps d'accomplissement: 2008-02-21 14:57:28 ComboFix-quarantined-files.txt 2008-02-21 13:57:26 . 2008-02-15 02:03:27 --- E O F --- les pages s'ouvrent encore aprés le scan

Saiyen75 · Answer

Re

Va sur ce site : https://www.virustotal.com/gui/ 

Ensuite tu Clique sur parcourir, tu recherche la première ligne : 

C:\Users\All Users\ezsid.dat

Ensuite tu clique sur Envoyer le fichier 
un rapport va etre generé (peut prendre plusieurs minutes) 
Fait pareil pour les 3 fichiers 
Puis  poste  le rapport du fichier. 

/!\ N'oublie pas qu'il y a 1 rapport par fichier. /!\
_____________________________________________________

riadh09 · Answer

j'ai pas trouvé      C:\Users\All Users\ezsid.dat

Saiyen75 · Answer

j'ai pas trouvé C:\Users\All Users\ezsid.dat
Comment ça ? en faisant parcourir ?

riadh09 · Answer

oui je l'ai pas trouvé

Saiyen75 · Answer

Pour afficher les Fichiers et Dossiers Caché :

* Ouvrir poste de travail
* outils
* Options des dossiers
* Onglet "Affichage"
* Dans fichiers et dossiers caché, coché la case "Afficher les fichiers et dossiers cachés"

Ensuite un peu plus bas, décocher les case "Masquer les fichiers protégés du systeème d'exploitation"

/!\ ATTENTION : Faire attention de ne pas supprimer involontairement un fichier système, car ça peut endomager votre système d'exploitation ! /!\

_____________________________________________________

riadh09 · Answer

j'ai vista pas xp

Saiyen75 · Answer

C'est pareil, la seule différence, c'est ça :
remplace Poste de travail ---> Ordinateur (qui se trouve sur le bureau)

riadh09 · Answer

c quoi les 3fichiers que tu m'avais dit avant pour les envoyé g trouvé ezsid

riadh09 · Answer

il a rien trouvé

riadh09 · Answer

est ce que y a un moyen de ce parlé plus rapidement?c'est mieu!et pour ne pas vous ennuyez une semaine dsl

Pages internet s'ouvrent seules windows vista

33 réponses

Newsletters