Virus msn dsc01497

timsoul -  
 timsoul -
Bonjour,
bonjour a tous,
mon ordi a été infecté par le meme virus: dsc01497, je vous envoi l'annalyse si quelqu'un peu m'aider s'il vous plait.

MSNFix 1.674

J:\lea\MSNFix\MSNFix
Fix exécuté le 03/03/2008 - 14:34:25,82 By lea
mode normal

************************ Recherche les fichiers présents

... H:\WINDOWS\system32\dllcache\spoolms.exe
... H:\WINDOWS\DSC01497.zip

************************ Recherche les dossiers présents

Aucun dossier trouvé

************************ Suppression des fichiers

.. OK ... H:\WINDOWS\system32\dllcache\spoolms.exe
.. OK ... H:\WINDOWS\DSC01497.zip

************************ Nettoyage du registre

************************ Fichiers suspects

/!\ ces fichiers nécessitent un avis expérimenté avant toute intervention

[H:\DivXWebPlayerInstallerBeta2.exe] DCE3F6C01CC68AD3CB85C50D3F4AD8AD

[color=#FF0000][b]==>/b/color SVP merci d'envoyer le fichier [b] H:\DOCUME~1\lea\Desktop\Upload_Me.zip /b sur http://upload.changelog.fr

Les fichiers et clés de registre supprimés ont été sauvegardés dans le fichier 03032008_14364714.zip

------------------------------------------------------------------------
Auteur : !aur3n7 Contact: https://www.ionos.fr/
------------------------------------------------------------------------

--------------------------------------------- END ---------------------------------------------
Répondre à timsoul11

Ce message vous semble utile, votez !Signaler ce message aux modérateurs Par timsoul, le lundi 3 mars 2008 à 21:48:26

voiila la deuxieme etape

MSNFix 1.674

J:\lea\MSNFix\MSNFix
Fix exécuté le 03/03/2008 - 14:34:25,82 By lea
mode normal

************************ Recherche les fichiers présents

... H:\WINDOWS\system32\dllcache\spoolms.exe
... H:\WINDOWS\DSC01497.zip

************************ Recherche les dossiers présents

Aucun dossier trouvé

************************ Suppression des fichiers

.. OK ... H:\WINDOWS\system32\dllcache\spoolms.exe
.. OK ... H:\WINDOWS\DSC01497.zip

************************ Nettoyage du registre

************************ Fichiers suspects

/!\ ces fichiers nécessitent un avis expérimenté avant toute intervention

[H:\DivXWebPlayerInstallerBeta2.exe] DCE3F6C01CC68AD3CB85C50D3F4AD8AD

[color=#FF0000][b]==>/b/color SVP merci d'envoyer le fichier [b] H:\DOCUME~1\lea\Desktop\Upload_Me.zip /b sur http://upload.changelog.fr

Les fichiers et clés de registre supprimés ont été sauvegardés dans le fichier 03032008_14364714.zip

------------------------------------------------------------------------
Auteur : !aur3n7 Contact: https://www.ionos.fr/
------------------------------------------------------------------------

--------------------------------------------- END ---------------------------------------------
Configuration: Windows XP
Internet Explorer 6.0

4 réponses

  1. timsoul
     
    voila la deuxieme etape

    SmitFraudFix v2.300

    Scan done at 21:46:41,29, 03/03/2008
    Run from J:\lea\SmitfraudFix
    OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
    The filesystem type is NTFS
    Fix run in normal mode

    »»»»»»»»»»»»»»»»»»»»»»»» Process

    H:\WINDOWS\System32\smss.exe
    H:\WINDOWS\system32\csrss.exe
    H:\WINDOWS\system32\winlogon.exe
    H:\WINDOWS\system32\services.exe
    H:\WINDOWS\system32\lsass.exe
    H:\WINDOWS\system32\svchost.exe
    H:\WINDOWS\system32\svchost.exe
    H:\WINDOWS\System32\svchost.exe
    H:\WINDOWS\system32\svchost.exe
    H:\WINDOWS\system32\svchost.exe
    H:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    H:\Program Files\Alwil Software\Avast4\ashServ.exe
    H:\WINDOWS\system32\spoolsv.exe
    H:\WINDOWS\system32\drivers\CDAC11BA.EXE
    H:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    H:\Program Files\Spyware Doctor\pctsAuxs.exe
    H:\Program Files\Spyware Doctor\pctsSvc.exe
    H:\WINDOWS\system32\svchost.exe
    H:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    H:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    H:\WINDOWS\System32\alg.exe
    H:\Program Files\Spyware Doctor\pctsTray.exe
    H:\WINDOWS\system32\WgaTray.exe
    H:\WINDOWS\Explorer.EXE
    H:\Program Files\VIA\RAID\raid_tool.exe
    H:\WINDOWS\system32\VTTimer.exe
    H:\WINDOWS\system32\VTtrayp.exe
    H:\Program Files\VIAudioi\SBADeck\ADeck.exe
    H:\WINDOWS\VM303_STI.EXE
    H:\Program Files\Common Files\Real\Update_OB\realsched.exe
    H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    H:\Program Files\Internet Explorer\iexplore.exe
    H:\Program Files\Google\Google Updater\GoogleUpdater.exe
    H:\Program Files\Internet Explorer\IEXPLORE.EXE
    H:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    H:\Program Files\Internet Explorer\iexplore.exe
    H:\WINDOWS\system32\NOTEPAD.EXE
    H:\WINDOWS\system32\cmd.exe
    H:\WINDOWS\system32\wbem\wmiprvse.exe

    »»»»»»»»»»»»»»»»»»»»»»»» hosts

    »»»»»»»»»»»»»»»»»»»»»»»» H:\

    »»»»»»»»»»»»»»»»»»»»»»»» H:\WINDOWS

    »»»»»»»»»»»»»»»»»»»»»»»» H:\WINDOWS\system

    »»»»»»»»»»»»»»»»»»»»»»»» H:\WINDOWS\Web

    »»»»»»»»»»»»»»»»»»»»»»»» H:\WINDOWS\system32

    »»»»»»»»»»»»»»»»»»»»»»»» H:\WINDOWS\system32\LogFiles

    »»»»»»»»»»»»»»»»»»»»»»»» H:\Documents and Settings\lea

    »»»»»»»»»»»»»»»»»»»»»»»» H:\Documents and Settings\lea\Application Data

    »»»»»»»»»»»»»»»»»»»»»»»» Start Menu

    »»»»»»»»»»»»»»»»»»»»»»»» H:\DOCUME~1\lea\FAVORI~1

    »»»»»»»»»»»»»»»»»»»»»»»» Desktop

    »»»»»»»»»»»»»»»»»»»»»»»» H:\Program Files

    »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

    »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
    "Source"="About:Home"
    "SubscribedURL"="About:Home"
    "FriendlyName"="My Current Home Page"

    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
    !!!Attention, following keys are not inevitably infected!!!

    IEDFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» VACFix
    !!!Attention, following keys are not inevitably infected!!!

    VACFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"=""

    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "System"=""

    »»»»»»»»»»»»»»»»»»»»»»»» Rustock

    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    Description: VIA Compatable Fast Ethernet Adapter - Packet Scheduler Miniport
    DNS Server Search Order: 212.27.53.252
    DNS Server Search Order: 212.27.54.252

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{1519102C-A040-441B-A643-AE1CAD41603F}: DhcpNameServer=212.27.53.252 212.27.54.252
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{1519102C-A040-441B-A643-AE1CAD41603F}: DhcpNameServer=212.27.53.252 212.27.54.252
    HKLM\SYSTEM\CS2\Services\Tcpip\..\{1519102C-A040-441B-A643-AE1CAD41603F}: DhcpNameServer=212.27.53.252 212.27.54.252
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252
    HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252

    »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

    »»»»»»»»»»»»»»»»»»»»»»»» End
    0
  2. timsoul
     
    apres avoir nettoyé en safe mode, voila le nouveau rapport:
    SmitFraudFix v2.300

    Scan done at 22:19:06,01, 03/03/2008
    Run from J:\lea\SmitfraudFix
    OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
    The filesystem type is NTFS
    Fix run in safe mode

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» Killing process

    »»»»»»»»»»»»»»»»»»»»»»»» hosts

    127.0.0.1 localhost
    127.0.0.1 bin.errorprotector.com ## added by CiD
    127.0.0.1 br.errorsafe.com ## added by CiD
    127.0.0.1 br.winantivirus.com ## added by CiD
    127.0.0.1 br.winfixer.com ## added by CiD
    127.0.0.1 cdn.drivecleaner.com ## added by CiD
    127.0.0.1 cdn.errorsafe.com ## added by CiD
    127.0.0.1 cdn.winsoftware.com ## added by CiD
    127.0.0.1 de.errorsafe.com ## added by CiD
    127.0.0.1 de.winantivirus.com ## added by CiD
    127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
    127.0.0.1 download.cdn.errorsafe.com ## added by CiD
    127.0.0.1 download.cdn.winsoftware.com ## added by CiD
    127.0.0.1 download.errorsafe.com ## added by CiD
    127.0.0.1 download.systemdoctor.com ## added by CiD
    127.0.0.1 download.winantispyware.com ## added by CiD
    127.0.0.1 download.windrivecleaner.com ## added by CiD
    127.0.0.1 download.winfixer.com ## added by CiD
    127.0.0.1 drivecleaner.com ## added by CiD
    127.0.0.1 dynamique.drivecleaner.com ## added by CiD
    127.0.0.1 errorprotector.com ## added by CiD
    127.0.0.1 errorsafe.com ## added by CiD
    127.0.0.1 es.winantivirus.com ## added by CiD
    127.0.0.1 fr.winantivirus.com ## added by CiD
    127.0.0.1 fr.winfixer.com ## added by CiD
    127.0.0.1 go.drivecleaner.com ## added by CiD
    127.0.0.1 go.errorsafe.com ## added by CiD
    127.0.0.1 go.winantispyware.com ## added by CiD
    127.0.0.1 go.winantivirus.com ## added by CiD
    127.0.0.1 hk.winantivirus.com ## added by CiD
    127.0.0.1 instlog.errorsafe.com ## added by CiD
    127.0.0.1 instlog.winantivirus.com ## added by CiD
    127.0.0.1 instlog.winfixer.com ## added by CiD
    127.0.0.1 jsp.drivecleaner.com ## added by CiD
    127.0.0.1 kb.errorsafe.com ## added by CiD
    127.0.0.1 kb.winantivirus.com ## added by CiD
    127.0.0.1 nl.errorsafe.com ## added by CiD
    127.0.0.1 se.errorsafe.com ## added by CiD
    127.0.0.1 secure.drivecleaner.com ## added by CiD
    127.0.0.1 secure.errorsafe.com ## added by CiD
    127.0.0.1 secure.winantispam.com ## added by CiD
    127.0.0.1 secure.winantispy.com ## added by CiD
    127.0.0.1 secure.winantivirus.com ## added by CiD
    127.0.0.1 support.winantivirus.com ## added by CiD
    127.0.0.1 trial.updates.winsoftware.com ## added by CiD
    127.0.0.1 ulog.winantivirus.com ## added by CiD
    127.0.0.1 utils.errorsafe.com ## added by CiD
    127.0.0.1 utils.winantivirus.com ## added by CiD
    127.0.0.1 utils.winfixer.com ## added by CiD
    127.0.0.1 winantispyware.com ## added by CiD
    127.0.0.1 winantivirus.com ## added by CiD
    127.0.0.1 winfixer.com ## added by CiD
    127.0.0.1 winfixer2006.com ## added by CiD
    127.0.0.1 winsoftware.com ## added by CiD
    127.0.0.1 www.drivecleaner.com ## added by CiD
    127.0.0.1 www.errorprotector.com ## added by CiD
    127.0.0.1 www.errorsafe.com ## added by CiD
    127.0.0.1 www.systemdoctor.com ## added by CiD
    127.0.0.1 www.utils.winfixer.com ## added by CiD
    127.0.0.1 www.win-anti-virus-pro.com ## added by CiD
    127.0.0.1 www.win-virus-pro.com ## added by CiD
    127.0.0.1 www.winantispam.com ## added by CiD
    127.0.0.1 www.winantispy.com ## added by CiD
    127.0.0.1 www.winantispyware.com ## added by CiD
    127.0.0.1 www.winantivirus.com ## added by CiD
    127.0.0.1 www.winantiviruspro.com ## added by CiD
    127.0.0.1 www.windrivecleaner.com ## added by CiD
    127.0.0.1 www.windrivesafe.com ## added by CiD
    127.0.0.1 www.winfixer.com ## added by CiD
    127.0.0.1 www.winfixer2006.com ## added by CiD
    127.0.0.1 www.winsoftware.com ## added by CiD

    »»»»»»»»»»»»»»»»»»»»»»»» VACFix

    VACFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

    S!Ri's WS2Fix: LSP not Found.

    »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

    GenericRenosFix by S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix

    IEDFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{1519102C-A040-441B-A643-AE1CAD41603F}: DhcpNameServer=212.27.53.252 212.27.54.252
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{1519102C-A040-441B-A643-AE1CAD41603F}: DhcpNameServer=212.27.53.252 212.27.54.252
    HKLM\SYSTEM\CS2\Services\Tcpip\..\{1519102C-A040-441B-A643-AE1CAD41603F}: DhcpNameServer=212.27.53.252 212.27.54.252
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252
    HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252

    »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "System"=""

    »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

    Registry Cleaning done.

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» End
    0
  3. timsoul
     
    j'ai aussi un virus depuis plusieurs mois, j'ai pleins de publicités qui s'ouvre toutes seules, j'espere que quelqu'un va pouvoir m'aider.

    merci beaucoup
    0
  4. twister2 Messages postés 223 Statut Membre 44
     
    bonsoir timsoul

    télécharge Hijackthis et poste le log sur le forum.
    Le lien suivant est un tutorial en français et te donne aussi un lien de téléchargement.
    https://www.bleepingcomputer.com/tutorials/comment-utiliser-hijackthis/

    @+twister2
    0
    1. timsoul
       
      voila:

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 14:24:31, on 03/03/2008
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
      Boot mode: Normal

      Running processes:
      H:\WINDOWS\System32\smss.exe
      H:\WINDOWS\system32\csrss.exe
      H:\WINDOWS\system32\winlogon.exe
      H:\WINDOWS\system32\services.exe
      H:\WINDOWS\system32\lsass.exe
      H:\WINDOWS\system32\svchost.exe
      H:\WINDOWS\system32\svchost.exe
      H:\WINDOWS\System32\svchost.exe
      H:\WINDOWS\system32\svchost.exe
      H:\WINDOWS\system32\svchost.exe
      H:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      H:\Program Files\Alwil Software\Avast4\ashServ.exe
      H:\WINDOWS\system32\spoolsv.exe
      H:\WINDOWS\system32\drivers\CDAC11BA.EXE
      H:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      H:\WINDOWS\Explorer.EXE
      H:\Program Files\Spyware Doctor\pctsAuxs.exe
      H:\Program Files\VIA\RAID\raid_tool.exe
      H:\WINDOWS\system32\VTTimer.exe
      H:\WINDOWS\system32\VTtrayp.exe
      H:\Program Files\VIAudioi\SBADeck\ADeck.exe
      H:\WINDOWS\VM303_STI.EXE
      H:\Program Files\Common Files\Real\Update_OB\realsched.exe
      H:\Program Files\Spyware Doctor\pctsTray.exe
      H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      H:\WINDOWS\system32\dllcache\spoolms.exe
      H:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
      H:\Program Files\Google\Google Updater\GoogleUpdater.exe
      H:\Program Files\Internet Explorer\iexplore.exe
      H:\WINDOWS\system32\dllcache\spoolms.exe
      H:\WINDOWS\system32\svchost.exe
      H:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      H:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      H:\WINDOWS\System32\alg.exe
      H:\Program Files\Spyware Doctor\pctsSvc.exe
      H:\WINDOWS\system32\WgaTray.exe
      H:\Program Files\Windows Live\Messenger\usnsvc.exe
      H:\WINDOWS\system32\rsvp.exe
      H:\Program Files\Internet Explorer\IEXPLORE.EXE
      H:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
      H:\Program Files\Internet Explorer\iexplore.exe
      J:\lea\HiJackThis\HijackThis.exe
      H:\WINDOWS\system32\wbem\wmiprvse.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://update.zonelabs.com/downloadrequest?updtConfId=45&updtReqId=2021596296
      R3 - URLSearchHook: Share Accelerator Toolbar - {f5c93451-2609-4723-a053-5c19516be1a8} - H:\Program Files\Share_Accelerator\tbSha1.dll
      R3 - URLSearchHook: Multi Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - H:\Program Files\Multi_Media\tbMul1.dll
      O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - H:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - H:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - h:\program files\google\googletoolbar1.dll
      O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - H:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
      O2 - BHO: Multi Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - H:\Program Files\Multi_Media\tbMul1.dll
      O2 - BHO: Share Accelerator Toolbar - {f5c93451-2609-4723-a053-5c19516be1a8} - H:\Program Files\Share_Accelerator\tbSha1.dll
      O3 - Toolbar: Share Accelerator Toolbar - {f5c93451-2609-4723-a053-5c19516be1a8} - H:\Program Files\Share_Accelerator\tbSha1.dll
      O3 - Toolbar: Multi Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - H:\Program Files\Multi_Media\tbMul1.dll
      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - h:\program files\google\googletoolbar1.dll
      O4 - HKLM\..\Run: [RaidTool] H:\Program Files\VIA\RAID\raid_tool.exe
      O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
      O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
      O4 - HKLM\..\Run: [AudioDeck] H:\Program Files\VIAudioi\SBADeck\ADeck.exe 1
      O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] H:\Program Files\Labtec\Desktop\V5.1\moffice.exe
      O4 - HKLM\..\Run: [OFFICEKB] H:\Program Files\Labtec\Desktop\V5.1\kbdap32a.exe
      O4 - HKLM\..\Run: [QuickTime Task] "H:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [BigDog303] H:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
      O4 - HKLM\..\Run: [SDTray] "H:\Program Files\Spyware Doctor\SDTrayApp.exe"
      O4 - HKLM\..\Run: [TkBellExe] "H:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [ISTray] "H:\Program Files\Spyware Doctor\pctsTray.exe"
      O4 - HKLM\..\Run: [avast!] H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      O4 - HKLM\..\Run: [Base frag grid bows] H:\Documents and Settings\All Users\Application Data\Cast ping base frag\Safe Manager.exe
      O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "H:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
      O4 - HKLM\..\Run: [spoolms] H:\WINDOWS\system32\dllcache\spoolms.exe
      O4 - HKCU\..\Run: [bird eggs] H:\DOCUME~1\lea\APPLIC~1\SITEOK~1\junkjoy.exe
      O4 - HKCU\..\Run: [MsnMsgr] "H:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [atcueeosn] h:\documents and settings\lea\local settings\application data\atcueeosn.exe atcueeosn
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
      O4 - Global Startup: Outil de mise à jour Google.lnk = H:\Program Files\Google\Google Updater\GoogleUpdater.exe
      O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
      O8 - Extra context menu item: E&xport to Microsoft Excel - res://H:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
      O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
      O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
      O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
      O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
      O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
      O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
      O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - H:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      O23 - Service: avast! Antivirus - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashServ.exe
      O23 - Service: avast! Mail Scanner - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      O23 - Service: avast! Web Scanner - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      O23 - Service: Boonty Games - BOONTY - H:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
      O23 - Service: C-DillaCdaC11BA - Macrovision - H:\WINDOWS\system32\drivers\CDAC11BA.EXE
      O23 - Service: Google Updater Service (gusvc) - Google - H:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - H:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
      O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - H:\Program Files\Spyware Doctor\pctsAuxs.exe
      O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - H:\Program Files\Spyware Doctor\pctsSvc.exe
      0

Discussions similaires

symboles et écritures pour nick msn
Pando -
roro -

20 réponses
Chrome://newtab
Nova -
snoopy35_ -

14 réponses
Softonic,est-ce un virus ?
techmel1 -
techmel1 -

6 réponses
Désinstaller Softonic
Diguimette -
lilidurhone -

5 réponses