Problème Messenger Skinner

Résolu
Timon-dlp Messages postés 27 Statut Membre -  
jlpjlp Messages postés 52399 Statut Contributeur sécurité -
Bonjour,

Comme beaucoup de monde ayant installer puis désinstaller Messenger Skinner, j'ai le probleme de fenetres intempestive qui s'ouvre sous Firefox et Explorer.

Je suis sous Vista Home SP1.

Pourriez-vous m'aider?

Merci.
Configuration: Windows Vista
Firefox 2.0.0.13

32 réponses

  • 1
  • 2
Résumé de la discussion

Des fenêtres intempestives persistent après l'installation puis désinstallation de Messenger Skinner sur Vista, provoquant des affichages dans Firefox et Internet Explorer et nécessitant une solution de sécurité informatique. Plusieurs réponses suggèrent d'examiner les traces via HijackThis et d'observer des indices comme des proxies locaux et des modules publicitaires installés dans le navigateur, afin d'identifier l'infection. La solution évoquée consiste à utiliser Combofix pour nettoyer les éléments malveillants et supprimer les fichiers temporaires, puis à tester le comportement en remettant une image de fond et en vérifiant si le phénomène persiste. Des éléments complémentaires soulignent aussi la nécessité de rétablir les paramètres proxy et de nettoyer les fichiers hosts, afin d'éviter de nouvelles redirections et d'assurer la stabilité du navigateur.

Bobot (l'IA à votre service)
  1. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    slt,

    Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection):

    - Va dans démarrer puis panneau de configuration
    - Double Clique sur l'icône "Comptes d'utilisateurs"
    - Clique ensuite sur désactiver et valide.

    Télécharge maintenant Navilog1 depuis-ce lien :

    http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe

    Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau.
    Ensuite double clique sur navilog1.exe pour lancer l'installation.
    Une fois l'installation terminée, Fais un Clic-droit sur le raccourci Navilog1 présent sur ton bureau et choisis "Exécuter

    en tant qu'administrateur".

    Au menu principal, Fais le choix 1
    Laisse toi guider et patiente.
    Patiente jusqu'au message :
    *** Analyse Termine le ..... ***
    Appuie sur une touche le blocnote va s'ouvrir.
    Copie-colle l'intégralité du rapport dans une réponse.
    Referme le blocnote
    Le rapport fixnavi.txt est en outre sauvegardé dans %systemdrive%.
    0
  2. Timon-dlp Messages postés 27 Statut Membre 6
     
    Voici le rapport après l'analyse :

    Search Navipromo version 3.5.2 commencé le mer. 02/04/2008 à 19:07:06,17

    !!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
    !!! Postez ce rapport sur le forum pour le faire analyser !!!
    !!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

    Outil exécuté depuis C:\Program Files\navilog1
    Session actuelle : "Lolo"

    Mise à jour le 29.03.2008 à 22h00 par IL-MAFIOSO

    Microsoft Windows Vista 6.0.6001
    Internet Explorer : 7.0.6001.18000
    Système de fichiers : NTFS

    Executé en mode normal

    *** Recherche Programmes installés ***

    *** Recherche dossiers dans C:\Windows ***

    *** Recherche dossiers dans C:\Program Files ***

    *** Recherche dossiers dans C:\ProgramData ***

    *** Recherche dossiers dans C:\ProgramData\Microsoft\Windows\Start Menu\Programs ***

    *** Recherche dossiers dans c:\users\lolo\appdata\roaming\microsoft\windows\start menu\programs ***

    *** Recherche dossiers dans C:\Users\Lolo\AppData\Roaming ***

    *** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
    pour + d'infos : http://www.gmer.net

    Aucun Fichier trouvé

    *** Recherche avec GenericNaviSearch ***
    !!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
    !!! A vérifier impérativement avant toute suppression manuelle !!!

    * Recherche dans C:\Windows\system32 *

    * Recherche dans C:\Users\Lolo\AppData\Local\Microsoft *

    * Recherche dans C:\Users\Lolo\AppData\Local *

    * Recherche dans "C:\Users\ADMINI~1\AppData\Local" *

    *** Recherche fichiers ***

    *** Recherche clés spécifiques dans le Registre ***

    *** Module de Recherche complémentaire ***
    (Recherche fichiers spécifiques)

    1)Recherche nouveaux fichiers Instant Access :

    2)Recherche Heuristique :

    * Dans C:\Windows\system32 :

    * Dans C:\Users\Lolo\AppData\Local\Microsoft :

    * Dans C:\Users\Lolo\AppData\Local :

    * Dans "C:\Users\ADMINI~1\AppData\Local" :

    3)Recherche Certificats :

    Certificat Egroup absent !
    Certificat Electronic-Group absent !
    Certificat OOO-Favorit absent !
    Certificat Sunny-Day-Design-Ltd absent !

    4)Recherche fichiers connus :

    *** Analyse terminée le mer. 02/04/2008 à 19:42:21,72 ***
    0
    1. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
       
      Télécharge Combofix de sUBs : Renomme le avant toute installation, par exemple, nomme le "KillBagle". aide ici : https://forum.pcastuces.com/sujet.asp?f=25&s=37315

      http://download.bleepingcomputer.com/sUBs/ComboFix.exe
      Sauvegarde le sur ton bureau et pas ailleurs !

      Aide à l’utilisation de combofix ici: https://bibou0007.forumpro.fr/login?redirect=%2Ft121-topic

      Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider, laisse toi guider.
      Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.

      ____________

      colle un rapport hijackthis


      http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

      manuel :
      http://pagesperso-orange.fr/rginformatique/section%20virus/demohijack.htm
      https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html

      Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo.

      ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste

      Ensuite avec Explorer créer un dossier c:\hijackthis
      Décompresser Hijackthis dans ce dossier.
      C'est important pour les sauvegardes."
      0
  3. Timon-dlp Messages postés 27 Statut Membre 6
     
    Voici le rapport de Combofix :

    ComboFix 08-04-01.2 - Lolo 2008-04-02 21:03:20.1 - NTFSx86
    Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.980 [GMT 2:00]
    Endroit: C:\Users\Lolo\Desktop\KillBagle.exe
    * Création d'un nouveau point de restauration
    * Resident AV is active

    .
    TimedOut: progfile.dat

    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Users\Lolo\AppData\Local\Microsoft\Windows\Temporary Internet Files\101.gif
    C:\Users\Lolo\AppData\Local\Microsoft\Windows\Temporary Internet Files\102.gif
    C:\Users\Lolo\AppData\Local\Microsoft\Windows\Temporary Internet Files\103.gif
    C:\Users\Lolo\AppData\Local\Microsoft\Windows\Temporary Internet Files\104.gif
    C:\Users\Lolo\AppData\Local\Microsoft\Windows\Temporary Internet Files\105.gif
    C:\Users\Lolo\AppData\Local\Microsoft\Windows\Temporary Internet Files\106.gif
    C:\Users\Lolo\AppData\Roaming\inst.exe
    C:\Windows\system32\~.exe

    .
    ((((((((((((((((((((((((((((( Fichiers créés 2008-03-02 to 2008-04-02 ))))))))))))))))))))))))))))))))))))
    .

    2008-04-02 18:34 . 2008-04-02 18:36 <REP> d-------- C:\Program Files\RegCleaner
    2008-04-02 18:32 . 2008-04-02 18:32 553,687 --a------ C:\regcleaner_regcleaner_4.3.0.780_francais_10573.exe
    2008-04-02 03:26 . 2008-04-02 03:26 <REP> d-------- C:\Users\Lolo\AppData\Roaming\Convivea
    2008-04-02 01:38 . 2008-04-02 19:42 <REP> d-------- C:\Program Files\Navilog1
    2008-03-28 21:02 . 2008-04-01 17:54 54,156 --ah----- C:\Windows\QTFont.qfn
    2008-03-28 21:02 . 2008-03-28 21:02 1,409 --a------ C:\Windows\QTFont.for
    2008-03-27 22:09 . 2008-03-27 22:09 <REP> d-------- C:\Program Files\Clean Virus MSN
    2008-03-24 03:39 . 2008-03-24 03:39 <REP> d-------- C:\Users\Lolo\AppData\Roaming\GameHouse
    2008-03-24 03:37 . 2008-03-24 03:37 <REP> d-------- C:\Users\Lolo\AppData\Roaming\Magic Academy
    2008-03-24 03:35 . 2008-03-24 03:35 <REP> d-------- C:\Program Files\BFG
    2008-03-24 03:33 . 2008-03-24 03:33 <REP> d-------- C:\Users\Lolo\AppData\Roaming\Mysteryville2
    2008-03-24 03:23 . 2008-03-24 03:23 <REP> d-------- C:\Program Files\ReflexiveArcade
    2008-03-24 03:16 . 2008-03-24 03:16 <REP> d-------- C:\Users\Lolo\AppData\Roaming\Sandlot Games
    2008-03-24 03:15 . 2008-03-24 03:15 <REP> d-------- C:\Users\All Users\Trymedia
    2008-03-24 03:15 . 2008-03-24 03:15 <REP> d-------- C:\ProgramData\Trymedia
    2008-03-24 03:14 . 2008-03-27 00:05 9,216 --a------ C:\Windows\System32\host.db
    2008-03-24 03:14 . 2008-03-24 03:14 1,426 --a------ C:\Windows\System32\host5.zip
    2008-03-23 13:32 . 2008-03-23 13:32 <REP> d-------- C:\Users\All Users\NannyMania
    2008-03-23 13:32 . 2008-03-23 13:32 <REP> d-------- C:\ProgramData\NannyMania
    2008-03-22 12:27 . 2008-03-22 12:27 <REP> d-------- C:\Users\Lolo\AppData\Roaming\GAMEON
    2008-03-22 02:07 . 2008-03-22 02:11 <REP> d-------- C:\Users\Lolo\AppData\Roaming\Off Road
    2008-03-21 18:27 . 2008-03-21 18:27 <REP> d-------- C:\Program Files\DVD Shrink
    2008-03-20 03:28 . 2008-03-20 02:52 152,576 --a------ C:\Windows\System32\SPWizUI.dll
    2008-03-20 03:28 . 2008-03-20 02:52 47,560 --a------ C:\Windows\System32\SPReview.exe
    2008-03-20 03:05 . 2008-01-19 00:33 193,024 --a------ C:\Windows\System32\recdisc.exe
    2008-03-20 03:05 . 2008-01-19 00:36 6,656 --a------ C:\Windows\System32\sdspres.dll
    2008-03-20 03:04 . 2008-01-19 00:33 599,552 --a------ C:\Windows\System32\vsp1cln.exe
    2008-03-20 03:03 . 2008-01-19 00:36 142,336 --a------ C:\Windows\System32\spp.dll
    2008-03-20 03:03 . 2008-01-19 00:36 28,160 --a------ C:\Windows\System32\sxproxy.dll
    2008-03-20 03:00 . 2008-01-19 00:34 6,103,040 --a------ C:\Windows\System32\chtbrkr.dll
    2008-03-20 02:58 . 2008-01-19 00:36 2,588,160 --a------ C:\Windows\System32\UIHub.dll
    2008-03-20 02:54 . 2008-01-19 00:33 44,032 --a------ C:\Windows\System32\cbsra.exe
    2008-03-20 02:52 . 2008-03-20 03:33 196,608 --a------ C:\Windows\SPInstall.etl
    2008-03-19 11:45 . 2008-03-21 02:10 <REP> d-------- C:\Users\All Users\DVD Shrink
    2008-03-19 11:45 . 2008-03-21 02:10 <REP> d-------- C:\ProgramData\DVD Shrink
    2008-03-19 09:07 . 2008-03-19 09:07 <REP> d-------- C:\Users\All Users\Awem
    2008-03-19 09:07 . 2008-03-19 09:07 <REP> d-------- C:\ProgramData\Awem
    2008-03-19 03:50 . 2008-04-02 03:28 <REP> d-------- C:\Program Files\Bit Che
    2008-03-18 03:53 . 2008-03-24 15:02 <REP> d-------- C:\Program Files\SpeedFan
    2008-03-18 03:52 . 2008-03-18 03:53 45 --a------ C:\Windows\System32\initdebug.nfo
    2008-03-16 11:06 . 2008-03-24 12:13 <REP> d-------- C:\Users\All Users\PlayFirst
    2008-03-16 11:06 . 2008-03-24 12:13 <REP> d-------- C:\ProgramData\PlayFirst
    2008-03-15 11:40 . 2008-03-15 11:59 <REP> d-------- C:\Users\Lolo\AppData\Roaming\Pirateville
    2008-03-15 00:49 . 2008-03-15 00:49 1,817,491 --a------ C:\Columbo Saison 10 & 11.jpg
    2008-03-15 00:48 . 2008-03-15 00:48 1,603,187 --a------ C:\Columbo Saison 6 & 7.jpg
    2008-03-15 00:48 . 2008-03-15 00:48 1,501,361 --a------ C:\Columbo Saison 8 & 9.jpg
    2008-03-15 00:47 . 2008-03-15 00:47 1,780,936 --a------ C:\Columbo Saison 5.jpg
    2008-03-14 17:21 . 2008-03-14 17:21 10,284 --a------ C:\Pour le respect des autres locataires.docx
    2008-03-14 08:51 . 2008-03-24 12:13 <REP> d-------- C:\Users\Lolo\AppData\Roaming\PlayFirst
    2008-03-13 09:04 . 2008-03-13 09:04 <REP> d-------- C:\Users\All Users\MythPeople
    2008-03-13 09:04 . 2008-03-13 09:04 <REP> d-------- C:\ProgramData\MythPeople
    2008-03-10 23:39 . 2008-02-24 19:18 936,953 --a------ C:\Columbo Saison 1.jpg
    2008-03-10 23:32 . 2008-03-13 18:26 4,521,919 --a------ C:\Columbo Saison 3.jpg
    2008-03-10 23:32 . 2008-03-10 23:32 1,519,545 --a------ C:\Columbo Saison 4.jpg
    2008-03-10 20:49 . 2008-03-10 20:49 <REP> d-------- C:\Users\Lolo\AppData\Roaming\My Games
    2008-03-10 08:57 . 2008-03-10 08:57 <REP> d-------- C:\Users\All Users\HipSoft
    2008-03-10 08:57 . 2008-03-10 08:57 <REP> d-------- C:\ProgramData\HipSoft
    2008-03-09 17:07 . 2008-03-09 17:07 <REP> d-------- C:\Users\All Users\Sandlot Games
    2008-03-09 17:07 . 2008-03-09 17:07 <REP> d-------- C:\ProgramData\Sandlot Games
    2008-03-08 19:43 . 2008-03-08 19:43 <REP> d-------- C:\Users\Lolo\AppData\Roaming\Fuzzy Games
    2008-03-08 16:35 . 2008-03-08 16:35 <REP> d-------- C:\Users\Lolo\AppData\Roaming\Serif
    2008-03-08 12:06 . 2008-03-08 12:06 <REP> d-------- C:\Users\All Users\Farm Frenzy
    2008-03-08 12:06 . 2008-03-08 12:06 <REP> d-------- C:\ProgramData\Farm Frenzy
    2008-03-07 16:03 . 2008-03-07 16:03 <REP> d-------- C:\Users\Lolo\AppData\Roaming\Micro Application
    2008-03-06 19:41 . 2008-03-06 19:41 <REP> d-------- C:\Program Files\Lavasoft
    2008-03-06 19:28 . 2008-03-10 23:42 7,912,465 --a------ C:\Columbo Saison 2.jpg
    2008-03-06 18:32 . 2008-03-06 18:32 <REP> d-------- C:\Program Files\Alcohol Soft
    2008-03-06 02:52 . 2008-03-06 02:52 <REP> d-------- C:\Windows\MVUNINST
    2008-03-06 02:52 . 1996-08-24 12:11 289,552 --a------ C:\Windows\System32\temp.003
    2008-03-06 02:52 . 1993-10-14 18:51 28,672 --a------ C:\Windows\System32\temp.002
    2008-03-04 02:06 . 2008-03-04 02:06 <REP> d-------- C:\Program Files\Microsoft Silverlight
    2008-03-03 06:40 . 2008-03-03 06:40 599,552 --a------ C:\Windows\System32\CnxtAp32.dll
    2008-03-03 05:10 . 2008-03-03 05:10 182,272 --a------ C:\Windows\System32\drivers\CHDRT32.sys
    2008-03-02 14:55 . 2008-03-02 14:55 <REP> d-------- C:\Program Files\StuffPlug3
    2008-03-02 14:41 . 2008-03-02 14:41 <REP> d-------- C:\Program Files\MessengerPlus! 3
    2008-03-02 04:00 . 2008-03-02 04:00 <REP> d-------- C:\Users\Lolo\AppData\Roaming\Droppix
    2008-03-02 04:00 . 2004-06-05 20:33 139,264 --a------ C:\Windows\System32\RLAPEDec.ax
    2008-03-02 04:00 . 2004-04-27 17:05 98,304 --a------ C:\Windows\System32\RLMPCDec.ax
    2008-03-02 03:59 . 2008-03-02 04:01 <REP> d-------- C:\Users\All Users\Droppix
    2008-03-02 03:59 . 2008-03-02 04:01 <REP> d-------- C:\ProgramData\Droppix

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-04-02 18:59 --------- d-----w C:\Users\Lolo\AppData\Roaming\utorrent
    2008-04-02 18:56 41,520 ----a-w C:\Users\Lolo\AppData\Roaming\nvModes.dat
    2008-04-02 14:06 --------- d---a-w C:\ProgramData\TEMP
    2008-04-02 01:00 --------- d-----w C:\Users\Lolo\AppData\Roaming\DMCache
    2008-04-02 00:16 --------- d-----w C:\ProgramData\WLInstaller
    2008-04-01 14:43 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-03-31 16:00 --------- d-----w C:\Program Files\Messenger Plus! Live
    2008-03-31 02:01 --------- d-----w C:\Program Files\Zylom Games
    2008-03-31 01:56 --------- d-----w C:\Users\Lolo\AppData\Roaming\Zylom
    2008-03-22 12:07 --------- d-----w C:\Program Files\DVD-RB PRO
    2008-03-20 21:05 --------- d-----w C:\Program Files\Windows Live
    2008-03-20 02:19 --------- d-----w C:\ProgramData\NVIDIA
    2008-03-20 02:17 174 --sha-w C:\Program Files\desktop.ini
    2008-03-20 02:05 --------- d-----w C:\Program Files\Windows Sidebar
    2008-03-20 02:05 --------- d-----w C:\Program Files\Windows Photo Gallery
    2008-03-20 02:05 --------- d-----w C:\Program Files\Windows Mail
    2008-03-20 02:05 --------- d-----w C:\Program Files\Windows Journal
    2008-03-20 02:05 --------- d-----w C:\Program Files\Windows Defender
    2008-03-20 02:05 --------- d-----w C:\Program Files\Windows Collaboration
    2008-03-20 02:05 --------- d-----w C:\Program Files\Windows Calendar
    2008-03-20 01:40 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
    2008-03-20 01:39 82,432 ----a-w C:\Windows\System32\axaltocm.dll
    2008-03-15 00:52 --------- d-----w C:\Program Files\Custom Technology
    2008-03-12 13:39 --------- d-----w C:\Program Files\Common Files\Adobe
    2008-03-11 19:37 --------- d-----w C:\ProgramData\Microsoft Help
    2008-03-11 01:41 --------- d-----w C:\Program Files\Ripp-it_AM
    2008-03-08 14:34 --------- d-----w C:\Program Files\Micro Application
    2008-03-06 17:41 --------- d-----w C:\ProgramData\Lavasoft
    2008-03-06 17:40 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-03-06 16:28 716,272 ----a-w C:\Windows\system32\drivers\sptd.sys
    2008-03-06 00:52 --------- d-----w C:\Program Files\Common Files\SureThing Shared
    2008-03-02 02:19 --------- d-----w C:\Program Files\DAEMON Tools Pro
    2008-03-01 00:01 --------- d-----w C:\Users\Lolo\AppData\Roaming\DAEMON Tools Pro
    2008-02-23 08:51 --------- d-----w C:\Users\Lolo\AppData\Roaming\Wildfire
    2008-02-20 20:51 --------- d-----w C:\Program Files\FairUse Wizard 2 Full Edition
    2008-02-14 16:04 --------- d-----w C:\Program Files\DivX
    2008-02-13 14:03 --------- d-----w C:\Users\Lolo\AppData\Roaming\Camfrog
    2008-02-13 02:09 6,656 ----a-w C:\Windows\System32\kbd106n.dll
    2008-02-10 02:44 --------- d-----w C:\Program Files\K-Lite Codec Pack
    2008-02-10 02:42 13,904,959 ----a-w C:\klcodec375f.exe
    2008-02-10 02:35 --------- d-----w C:\Users\Lolo\AppData\Roaming\Uniblue
    2008-02-10 02:18 --------- d-----w C:\Users\Lolo\AppData\Roaming\Download Manager
    2008-02-10 02:10 36,734 ----a-w C:\Windows\System32\OggDSuninst.exe
    2008-02-09 23:56 47,360 ----a-w C:\Users\Lolo\AppData\Roaming\pcouffin.sys
    2008-02-09 23:56 --------- d-----w C:\Users\Lolo\AppData\Roaming\Vso
    2008-02-09 02:04 43,698 ----a-w C:\Windows\System32\xvid-uninstall.exe
    2008-02-09 02:04 --------- d-----w C:\Program Files\Gabest
    2008-02-09 02:04 --------- d-----w C:\Program Files\AviSynth 2.5
    2008-02-09 02:04 --------- d-----w C:\Program Files\AutoGK
    2008-02-08 23:49 --------- d-----w C:\Program Files\VirtualDJ
    2008-02-07 22:05 --------- d-----w C:\Program Files\ESET
    2008-02-07 00:41 --------- d-----w C:\Program Files\GV Everest Pokernet
    2008-02-07 00:37 --------- d-----w C:\Program Files\Everest Poker
    2008-02-04 12:35 --------- d-----w C:\Users\Lolo\AppData\Roaming\dvdcss
    2008-02-04 01:26 202,240 ----a-w C:\Windows\System32\ratatouille_screensaver.scr
    2008-02-04 00:18 --------- d-----w C:\Program Files\Common Files\Canopus Shared
    2008-02-04 00:06 --------- d-----w C:\Users\Lolo\AppData\Roaming\Grass Valley
    2008-02-04 00:05 --------- d-----w C:\ProgramData\Grass Valley
    2008-02-03 19:10 9,282 ----a-w C:\Windows\System32\Pvt.tmp
    2008-02-03 19:10 34,308 ----a-w C:\Windows\System32\Chip.dll
    2008-02-01 10:17 587,264 ----a-w C:\Windows\WLXPGSS.SCR
    2008-01-26 16:52 47,227,312 ----a-w C:\Lexmark 1290 Vista.exe
    2008-01-25 22:52 21,764 ----a-w C:\Windows\System32\CoreAAC-uninstall.exe.vir
    2008-01-25 01:55 229,376 ----a-w C:\Windows\System32\UCI32A27.dll
    2008-01-24 17:27 1,614 ----a-w C:\Users\Lolo\AppData\Roaming\filterclsid.dat
    2008-01-18 22:44 986,680 ----a-w C:\Windows\System32\winload.exe
    2008-01-18 22:44 926,776 ----a-w C:\Windows\System32\winresume.exe
    2008-01-18 22:43 614,968 ----a-w C:\Windows\System32\ci.dll
    2008-01-18 22:43 376,376 ----a-w C:\Windows\System32\mcupdate_GenuineIntel.dll
    2008-01-18 22:43 3,600,440 ----a-w C:\Windows\System32\ntkrnlpa.exe
    2008-01-18 22:43 3,548,728 ----a-w C:\Windows\System32\ntoskrnl.exe
    2008-01-18 22:43 247,352 ----a-w C:\Windows\System32\clfs.sys
    2008-01-18 22:42 94,776 ----a-w C:\Windows\System32\MigAutoPlay.exe
    2008-01-18 22:42 51,768 ----a-w C:\Windows\System32\PSHED.DLL
    2008-01-18 22:42 177,208 ----a-w C:\Windows\System32\halmacpi.dll
    2008-01-18 22:42 141,880 ----a-w C:\Windows\System32\halacpi.dll
    2008-01-18 22:41 24,120 ----a-w C:\Windows\System32\BOOTVID.DLL
    2008-01-18 22:41 21,560 ----a-w C:\Windows\System32\kdusb.dll
    2008-01-18 22:41 19,512 ----a-w C:\Windows\System32\kdcom.dll
    2008-01-18 22:38 46,080 ----a-w C:\Windows\System32\NAPCRYPT.DLL
    2008-01-18 22:38 4,595,712 ----a-w C:\Windows\System32\AuthFWSnapin.dll
    2008-01-18 22:38 242,744 ----a-w C:\Windows\System32\rsaenh.dll
    2008-01-18 22:38 155,704 ----a-w C:\Windows\System32\dssenh.dll
    2008-01-18 22:38 131,640 ----a-w C:\Windows\System32\basecsp.dll
    2008-01-18 22:38 103,936 ----a-w C:\Windows\System32\NAPHLPR.DLL
    2008-01-18 22:38 1,203,792 ----a-w C:\Windows\System32\ntdll.dll
    2008-01-18 22:36 99,840 ----a-w C:\Windows\System32\ulib.dll
    2008-01-18 22:35 98,304 ----a-w C:\Windows\System32\mssitlb.dll
    2008-01-18 22:34 98,816 ----a-w C:\Windows\System32\mfps.dll
    2008-01-18 22:33 98,304 ----a-w C:\Windows\System32\makecab.exe
    2008-01-18 22:32 258,048 ----a-w C:\Windows\System32\winspool.drv
    2008-01-18 22:32 21,504 ----a-w C:\Windows\System32\msacm32.drv
    2008-01-18 22:32 166,912 ----a-w C:\Windows\System32\wdmaud.drv
    2008-01-18 22:32 1,370,624 ----a-w C:\Windows\System32\Aurora.scr
    2008-01-18 22:31 7,680 ----a-w C:\Windows\System32\spwizres.dll
    2008-01-18 22:31 57,856 ----a-w C:\Windows\System32\nlsbres.dll
    2008-01-18 22:31 118,272 ----a-w C:\Windows\System32\RDPENCDD.dll
    2008-01-18 22:30 17,920 ----a-w C:\Windows\System32\netevent.dll
    2008-01-18 22:29 705,536 ----a-w C:\Windows\System32\imagesp1.dll
    2008-01-18 22:29 58,880 ----a-w C:\Windows\System32\msobjs.dll
    2007-02-20 12:52 22 --sha-w C:\Windows\SMINST\HPCD.sys
    .
    [code]<pre>
    ----a-w 325,204 2006-12-21 19:56:28 C:\SwSetup\SP34746\WCAMC\FW_210_Silence Install .exe
    </pre>/code

    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 00:33 1233920]
    "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 00:33 125952]
    "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2006-05-16 11:58 213936]
    "LaunchList"="C:\Program Files\Pinnacle\Studio 11\LaunchList2.exe" [2007-03-21 15:41 145496]
    "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-02-22 17:58 217544]
    "ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-05-16 11:58 213936]
    "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 00:33 202240]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-01-19 00:38 1008184]
    "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-09-15 02:50 1021224]
    "HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 00:11 49152]
    "QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-11-06 11:58 159744]
    "WAWifiMessage"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2006-10-18 10:56 317152]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0\bin\jusched.exe" [2006-12-24 08:06 77824]
    "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-02-22 21:37 949376]
    "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-05-16 11:58 86960]
    "RemoteControl"="C:\Program Files\PowerDVD\PDVDServ.exe" [2007-02-07 16:24 71216]
    "LanguageShortcut"="C:\Program Files\PowerDVD\Language\Language.exe" [2007-02-07 16:21 54832]
    "SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 02:29 102400]
    "ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-05-16 11:58 213936]
    "lxczbmgr.exe"="C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe" [2007-04-19 16:45 74672]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
    "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-11-07 01:05 86016]
    "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-11-07 01:05 8534560]
    "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-11-07 01:05 81920]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [ ]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableLUA"= 0 (0x0)
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
    "WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "beidsystemtray"=C:\Program Files\Belgium Identity Card\beidsystemtray.exe
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    "NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    "HP Health Check Scheduler"=C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
    "hpWirelessAssistant"=%ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
    "CloneCDTray"="C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1897857066-2759574336-2263923183-1000]
    "EnableNotificationsRef"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "{72853EFD-30BD-4E06-8425-703415C3B68E}"= UDP:C:\Program Files\HP\QuickPlay\QP.exe:QP
    "{220BE648-9BC4-4083-83A0-98A30EFE77BB}"= TCP:C:\Program Files\HP\QuickPlay\QP.exe:QP
    "{E517C793-9D77-4476-9073-BC434F1A2224}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
    "TCP Query User{9DB41400-601B-4225-AE87-460A33E11CC3}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
    "UDP Query User{6CB26672-6B31-452D-B9CA-9C98FB8D3CBA}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
    "{23DDEF48-4AA5-4F2E-9576-1932BF79BE30}"= UDP:C:\Program Files\utorrent\utorrent.exe:µTorrent
    "{8458CC8D-BF30-4652-9F1D-EB1C29BC2722}"= TCP:C:\Program Files\utorrent\utorrent.exe:µTorrent
    "{AD9E0DBF-7721-4D2B-9580-CC27B4BAF9A8}"= UDP:C:\Program Files\utorrent\utorrent.exe:µTorrent
    "{EC1DA4BB-01B9-4C86-B67F-91E9C77618C0}"= TCP:C:\Program Files\utorrent\utorrent.exe:µTorrent
    "TCP Query User{B5A370BB-2C23-4F05-8C96-1D1BD4103A93}D:\\jeux\\trackmania united\\tmunited.exe"= UDP:D:\jeux\trackmania united\tmunited.exe:TmUnited
    "UDP Query User{DFBF639C-DBC0-4111-9B5C-BBE5C03699CB}D:\\jeux\\trackmania united\\tmunited.exe"= TCP:D:\jeux\trackmania united\tmunited.exe:TmUnited
    "TCP Query User{6764DDE2-3A3B-46C3-AC21-87CAA934B206}D:\\jeux\\trackmania united\\tmunited.exe"= UDP:D:\jeux\trackmania united\tmunited.exe:TmUnited
    "UDP Query User{AB210022-020B-4C44-9699-8CFDCEE7FC33}D:\\jeux\\trackmania united\\tmunited.exe"= TCP:D:\jeux\trackmania united\tmunited.exe:TmUnited
    "TCP Query User{F5292BF5-38F2-4B2F-BF91-9C78B7F27172}D:\\jeux\\test drive unlimited\\testdriveunlimited.exe"= UDP:D:\jeux\test drive unlimited\testdriveunlimited.exe:Test Drive Unlimited
    "UDP Query User{05D5F671-39EC-4640-8C7F-49F60A55369A}D:\\jeux\\test drive unlimited\\testdriveunlimited.exe"= TCP:D:\jeux\test drive unlimited\testdriveunlimited.exe:Test Drive Unlimited
    "TCP Query User{9F688DB2-89E4-4F4C-961D-2276D001B8EF}D:\\jeux\\test drive unlimited\\testdriveunlimited.exe"= UDP:D:\jeux\test drive unlimited\testdriveunlimited.exe:Test Drive Unlimited
    "UDP Query User{3AEFF2CA-4AE3-40E5-8D40-35D3F31F18AD}D:\\jeux\\test drive unlimited\\testdriveunlimited.exe"= TCP:D:\jeux\test drive unlimited\testdriveunlimited.exe:Test Drive Unlimited
    "TCP Query User{79B02069-80A1-4B16-AC21-5A9D371DB6C0}D:\\jeux\\tom clancy's rainbow six vegas\\binaries\\r6vegas_game.exe"= UDP:D:\jeux\tom clancy's rainbow six vegas\binaries\r6vegas_game.exe:R6Vegas_Game
    "UDP Query User{D1E3D494-58A9-4505-8A90-8B0F609C43D5}D:\\jeux\\tom clancy's rainbow six vegas\\binaries\\r6vegas_game.exe"= TCP:D:\jeux\tom clancy's rainbow six vegas\binaries\r6vegas_game.exe:R6Vegas_Game
    "TCP Query User{70BD6710-FC39-4A87-9742-FF5F666D3908}C:\\users\\lolo\\appdata\\local\\temp\\occ.exe"= UDP:C:\users\lolo\appdata\local\temp\occ.exe:occ.exe
    "UDP Query User{5CB8F39D-0C4D-43E9-9422-45A49BDB80FE}C:\\users\\lolo\\appdata\\local\\temp\\occ.exe"= TCP:C:\users\lolo\appdata\local\temp\occ.exe:occ.exe
    "TCP Query User{B2C17496-55D4-4A04-A53E-D5E4F51A3BFE}D:\\race driver 3\\rd3.exe"= UDP:D:\race driver 3\rd3.exe:RaceDriver 3 Application
    "UDP Query User{CB935976-F0B9-4BD1-9C25-A8A9ACB1B887}D:\\race driver 3\\rd3.exe"= TCP:D:\race driver 3\rd3.exe:RaceDriver 3 Application
    "TCP Query User{48D1C7EE-DCD2-4170-8E88-E3A28EFE38DC}D:\\jeux\\need for speed underground 2\\speed2.exe"= UDP:D:\jeux\need for speed underground 2\speed2.exe:speed2
    "UDP Query User{F6AC4EBC-6DD9-49E7-8589-8639B4886096}D:\\jeux\\need for speed underground 2\\speed2.exe"= TCP:D:\jeux\need for speed underground 2\speed2.exe:speed2
    "{3AED6A77-3AB4-4669-B60B-B1E001DD6D1C}"= UDP:C:\Program Files\Pinnacle\Studio 10\programs\RM.exe:Render Manager
    "{4CB40EFB-A50B-4BFF-851B-3149DC22FE12}"= TCP:C:\Program Files\Pinnacle\Studio 10\programs\RM.exe:Render Manager
    "{24066E41-9C59-4590-AC61-4B124BD38FBB}"= UDP:C:\Program Files\Pinnacle\Studio 10\programs\Studio.exe:Studio
    "{E375C2B2-E078-48F7-A494-321BC6D5825F}"= TCP:C:\Program Files\Pinnacle\Studio 10\programs\Studio.exe:Studio
    "{36149FD5-9B94-48D1-96C8-8A9F057E92F1}"= UDP:C:\Program Files\Pinnacle\Studio 10\programs\PMSRegisterFile.exe:PMSRegisterFile
    "{DFA4D09D-78C1-4B20-AFBC-82F69BA6CEC5}"= TCP:C:\Program Files\Pinnacle\Studio 10\programs\PMSRegisterFile.exe:PMSRegisterFile
    "{E18FBB1D-2E26-4CE1-A6A5-2837E1893540}"= UDP:C:\Program Files\Pinnacle\Studio 10\programs\umi.exe:umi
    "{2D9D6CB1-D5D0-45ED-A9C9-D26B1215BADE}"= TCP:C:\Program Files\Pinnacle\Studio 10\programs\umi.exe:umi
    "{7ED7C847-EC45-43A0-A521-771675D52F00}"= UDP:C:\Program Files\Pinnacle\Studio 11\programs\RM.exe:Render Manager
    "{8CDF0DC6-539F-476F-8CA3-364287AE8782}"= TCP:C:\Program Files\Pinnacle\Studio 11\programs\RM.exe:Render Manager
    "{94362A2E-B603-4E6B-ADB9-35868F28BE7B}"= UDP:C:\Program Files\Pinnacle\Studio 11\programs\PMSRegisterFile.exe:PMSRegisterFile
    "{AECC4C16-FA01-4F40-ABE3-B4F844556BD7}"= TCP:C:\Program Files\Pinnacle\Studio 11\programs\PMSRegisterFile.exe:PMSRegisterFile
    "{A488C665-AAF5-4A09-8305-A53A54D0F054}"= UDP:C:\Program Files\Pinnacle\Studio 11\programs\umi.exe:umi
    "{F99CCE3B-5BB0-49D8-B804-DFBBBDABAB61}"= TCP:C:\Program Files\Pinnacle\Studio 11\programs\umi.exe:umi
    "{4FD19E50-CBED-4113-AB0D-50B5FB9D2EE2}"= C:\Program Files\PowerDVD\PowerDVD.EXE:CyberLink PowerDVD
    "TCP Query User{03741388-B074-4DC0-A0C6-A8C71B40C70E}C:\\program files\\pando networks\\pando\\pando.exe"= UDP:C:\program files\pando networks\pando\pando.exe:pando
    "UDP Query User{087C0B24-A738-4156-8DAC-30DC6DF2800E}C:\\program files\\pando networks\\pando\\pando.exe"= TCP:C:\program files\pando networks\pando\pando.exe:pando
    "{B87CA749-1B6C-43F0-83E0-39291B7826BC}"= UDP:C:\Program Files\Internet Explorer\iexplore.exe:Internet Explorer
    "{C306F3A0-F76D-496A-BDC9-B3C26DB824CF}"= TCP:C:\Program Files\Internet Explorer\iexplore.exe:Internet Explorer
    "{C293549C-5256-431A-8009-39D8EDD68697}"= UDP:D:\Jeux\Sega Rally\SEGA Rally.exe:SEGA Rally
    "{36CBF181-10E9-4733-95D2-6488D8BFE2CE}"= TCP:D:\Jeux\Sega Rally\SEGA Rally.exe:SEGA Rally
    "{1487782C-1723-4876-B12D-46AF2CB3C61E}"= UDP:D:\Jeux\Sega Rally\SEGA Rally_SSE1.exe:SEGA Rally
    "{637B940C-F099-46D4-999F-6EA93FB385FE}"= TCP:D:\Jeux\Sega Rally\SEGA Rally_SSE1.exe:SEGA Rally
    "TCP Query User{5EC4E0EC-7446-4054-8283-A754ACD258F6}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
    "UDP Query User{D04127CE-6F94-4242-8E16-A94F31F9E39B}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
    "TCP Query User{01333095-B341-4992-A9D2-48138D70631D}C:\\program files\\colin mc rae dirt\\dirt.exe"= UDP:C:\program files\colin mc rae dirt\dirt.exe:DiRT Executable
    "UDP Query User{AABEF87C-8644-4726-B1F7-550364ED9CD8}C:\\program files\\colin mc rae dirt\\dirt.exe"= TCP:C:\program files\colin mc rae dirt\dirt.exe:DiRT Executable
    "TCP Query User{0A81F0E7-528E-41FD-B3AA-EB2CE12BBA4E}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
    "UDP Query User{F597D0C0-4DC9-453F-A91B-8C42973E64A5}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
    "TCP Query User{CAC9F6EC-9A5F-4FCB-AC79-E633859DC3B0}C:\\program files\\bittornado\\btdownloadgui.exe"= UDP:C:\program files\bittornado\btdownloadgui.exe:btdownloadgui
    "UDP Query User{A0DB91F0-4CA7-45C5-BE53-EF1B68759E0B}C:\\program files\\bittornado\\btdownloadgui.exe"= TCP:C:\program files\bittornado\btdownloadgui.exe:btdownloadgui
    "TCP Query User{D4218A78-66A0-4B1D-A9BB-D52D77AA9C58}D:\\jeux\\counter-strike source\\hl2.exe"= UDP:D:\jeux\counter-strike source\hl2.exe:hl2
    "UDP Query User{AA379E76-D70E-49F5-AB76-31E8AFA7F049}D:\\jeux\\counter-strike source\\hl2.exe"= TCP:D:\jeux\counter-strike source\hl2.exe:hl2
    "TCP Query User{009B3D83-471A-4EE2-99DD-68F56DB64B44}C:\\program files\\azureus\\azureus.exe"= UDP:C:\program files\azureus\azureus.exe:Azureus
    "UDP Query User{F567359C-56B6-4822-8090-404FB1DFEDCA}C:\\program files\\azureus\\azureus.exe"= TCP:C:\program files\azureus\azureus.exe:Azureus
    "TCP Query User{3B12DC92-D7ED-4685-BE59-C6D1B2BB5C67}C:\\program files\\ip anonymizer\\ip anonymizer.exe"= UDP:C:\program files\ip anonymizer\ip anonymizer.exe:IP Anonymizer
    "UDP Query User{A777F77D-2105-43D3-BF0B-E37938CDBA53}C:\\program files\\ip anonymizer\\ip anonymizer.exe"= TCP:C:\program files\ip anonymizer\ip anonymizer.exe:IP Anonymizer
    "TCP Query User{6BA67CAB-E47F-4151-85E9-AACEAC5A1DD3}D:\\jeux\\timeshift\\bin\\timeshift.exe"= UDP:D:\jeux\timeshift\bin\timeshift.exe:TimeShift
    "UDP Query User{E699186E-FC28-45E6-8DF7-DB26E79D7269}D:\\jeux\\timeshift\\bin\\timeshift.exe"= TCP:D:\jeux\timeshift\bin\timeshift.exe:TimeShift
    "TCP Query User{9F32F731-B115-4D4B-A927-ADD1237B57FF}D:\\jeux\\wsop 2008\\wsopbftb.exe"= UDP:D:\jeux\wsop 2008\wsopbftb.exe:WSOPBFTB
    "UDP Query User{95D19295-EC2B-4B53-A44A-46EF771E592E}D:\\jeux\\wsop 2008\\wsopbftb.exe"= TCP:D:\jeux\wsop 2008\wsopbftb.exe:WSOPBFTB
    "TCP Query User{6186C069-9CAE-4529-936B-BA012B36F5A5}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox
    "UDP Query User{6C798A3B-7029-4836-BBE2-6BAC392769B4}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox
    "{EF633D9E-75DB-4124-B206-92AAB6D50A07}"= UDP:C:\Program Files\Pinnacle\Studio 11\programs\Studio.exe:Studio
    "{5572A77E-EE1F-45FC-97DB-96513EC6C10E}"= TCP:C:\Program Files\Pinnacle\Studio 11\programs\Studio.exe:Studio
    "TCP Query User{EBAAE7DA-6B37-4B97-B8F3-542FD7FA0152}C:\\program files\\hp\\hp software update\\hpwucli.exe"= UDP:C:\program files\hp\hp software update\hpwucli.exe:HP Software Update Client
    "UDP Query User{942474FE-BB69-454D-86B5-A2B1747E9B58}C:\\program files\\hp\\hp software update\\hpwucli.exe"= TCP:C:\program files\hp\hp software update\hpwucli.exe:HP Software Update Client
    "{AD7C4758-B804-441F-8D8A-DDDD646FCA6D}"= UDP:C:\Windows\System32\lxczcoms.exe:Lexmark Communications System
    "{01922C27-5CB7-4423-A249-64CE76B6138F}"= TCP:C:\Windows\System32\lxczcoms.exe:Lexmark Communications System
    "{E6E31F8A-5F7F-4575-8065-6866D2812E43}"= UDP:C:\Windows\System32\lxczcoms.exe:Lexmark Communications System
    "{14CA88A2-957B-4419-876D-299C3C8214B2}"= TCP:C:\Windows\System32\lxczcoms.exe:Lexmark Communications System
    "{1465CABD-CCD6-45AB-A57B-35E6BC924A12}"= UDP:C:\Windows\System32\spool\drivers\w32x86\3\lxczpswx.exe:Printer Status Window
    "{6D2970C5-005A-4FE8-BD33-7921A1039FB0}"= TCP:C:\Windows\System32\spool\drivers\w32x86\3\lxczpswx.exe:Printer Status Window
    "TCP Query User{18984BD9-9232-4E93-924F-5BBC4A9BD037}C:\\program files\\warez\\warez.exe"= UDP:C:\program files\warez\warez.exe:Warez
    "UDP Query User{0A184DFF-8667-4A17-8038-BC0F7BB6D02B}C:\\program files\\warez\\warez.exe"= TCP:C:\program files\warez\warez.exe:Warez
    "TCP Query User{94A66FD9-AB7A-49AC-A8D9-0A7FD1AE8DAC}C:\\program files\\camfrog\\camfrog video chat\\camfrog video chat.exe"= UDP:C:\program files\camfrog\camfrog video chat\camfrog video chat.exe:Camfrog Client Module
    "UDP Query User{F3012F8D-DE4F-4A57-A416-54CCEE315C49}C:\\program files\\camfrog\\camfrog video chat\\camfrog video chat.exe"= TCP:C:\program files\camfrog\camfrog video chat\camfrog video chat.exe:Camfrog Client Module
    "{56866078-4E35-4AF0-8005-EC6E028D9062}"= C:\Program Files\Windows Live\Messenger\wlcsdk.exe:Windows Live Messenger (Phone)
    "TCP Query User{DB25FD8B-4723-4D4A-9F21-4BD2BD2387E2}C:\\program files\\emule hardstyle xs\\emule.exe"= UDP:C:\program files\emule hardstyle xs\emule.exe:eMule
    "UDP Query User{73059536-DC7E-4647-80E4-A3C6AEE600E5}C:\\program files\\emule hardstyle xs\\emule.exe"= TCP:C:\program files\emule hardstyle xs\emule.exe:eMule
    "{01B03A99-5322-40CC-8B17-93A745EE1EEC}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
    "{DB8FBF3C-AF4D-49E2-99E0-A070C1C27011}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
    "{19F41D87-5416-442E-AC08-20EE75904277}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

    R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};C:\Program Files\PowerDVD\[u]0/u00.fcl [2006-11-02 16:51]
    R2 eID CRL Service;eID CRL Service;C:\Windows\system32\beidservicecrl.exe [2006-06-20 13:38]
    R2 lxcz_device;lxcz_device;C:\Windows\system32\lxczcoms.exe [2007-04-19 16:43]
    R2 UxTuneUp;TuneUp Extension de thème;C:\Windows\System32\svchost.exe [2008-01-19 00:33]
    R2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys [2007-07-10 06:27]
    R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service;C:\Windows\system32\drivers\CHDRT32.sys [2008-03-03 05:10]
    R3 R5U870FLx86;R5U870 UVC Lower Filter ;C:\Windows\system32\Drivers\R5U870FLx86.sys [2006-12-18 23:31]
    R3 R5U870FUx86;R5U870 UVC Upper Filter ;C:\Windows\system32\Drivers\R5U870FUx86.sys [2006-12-18 23:31]
    S3 ACSSCR;ACR38 Smart Card Reader;C:\Windows\system32\DRIVERS\a38usbxp.sys [2004-04-30 14:35]
    S3 BCM43XV;Pilote de la carte réseau extensible Broadcom 802.11;C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-11-02 09:30]
    S3 eID Privacy Service;eID Privacy Service;C:\Windows\system32\beidservicepcsc.exe [2006-06-21 09:47]
    S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\Windows\system32\DRIVERS\ss_bus.sys [2007-05-02 12:11]
    S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\Windows\system32\DRIVERS\ss_mdfl.sys [2007-05-02 12:11]
    S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\Windows\system32\DRIVERS\ss_mdm.sys [2007-05-02 12:11]
    S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\Windows\System32\TuneUpDefragService.exe [2008-01-14 02:22]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    bthsvcs REG_MULTI_SZ BthServ

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
    UxTuneUp

    *Newly Created Service* - CATCHME
    .
    Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
    "2008-03-28 20:21:09 C:\Windows\Tasks\Maintenance en 1 clic.job"
    - C:\Program Files\TuneUp Utilities 2008\OneClick.exe
    "2008-04-01 19:18:25 C:\Windows\Tasks\User_Feed_Synchronization-{BEF72AAC-735F-47EE-8E3F-4BD6E692961A}.job"
    - C:\Windows\system32\msfeedssync.exe
    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-04-02 21:07:21
    Windows 6.0.6001 Service Pack 1 NTFS

    Balayage processus cachés ...

    Balayage caché autostart entries ...

    Balayage des fichiers cachés ...

    Scan terminé avec succès
    Les fichiers cachés: 0

    **************************************************************************
    .
    Temps d'accomplissement: 2008-04-02 21:08:02
    ComboFix-quarantined-files.txt 2008-04-02 19:07:59
    Pre-Run: 26,544,562,176 octets libres
    Post-Run: 26,507,583,488 octets libres
    .
    2008-03-26 00:18:33 --- E O F ---
    0
  4. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    colle un rapport hijackthis

    http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

    manuel :
    http://pagesperso-orange.fr/rginformatique/section%20virus/demohijack.htm
    https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html

    Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo.

    ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste

    Ensuite avec Explorer créer un dossier c:\hijackthis
    Décompresser Hijackthis dans ce dossier.
    C'est important pour les sauvegardes."k
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. Timon-dlp Messages postés 27 Statut Membre 6
     
    Et voici le rapport de Hijackthis :

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:13:32, on 2/04/2008
    Platform: Windows Vista SP1 (WinNT 6.00.1905)
    MSIE: Internet Explorer v7.00 (7.00.6001.18000)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
    C:\Program Files\Java\jre1.6.0\bin\jusched.exe
    C:\Program Files\ESET\nod32kui.exe
    C:\Program Files\PowerDVD\PDVDServ.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
    C:\Program Files\Lexmark 1200 Series\LXCZbmgr.exe
    C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Windows\system32\conime.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\Explorer.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\hijackthis\eden.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O1 - Hosts: 66.98.148.65 auto.search.msn.com
    O1 - Hosts: 66.98.148.65 auto.search.msn.es127.255.255.255 serial.alcohol-soft.com
    O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
    O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
    O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
    O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\PowerDVD\Language\Language.exe"
    O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
    O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
    O4 - HKLM\..\Run: [lxczbmgr.exe] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
    O4 - HKCU\..\Run: [LaunchList] C:\Program Files\Pinnacle\Studio 11\LaunchList2.exe
    O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
    O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'Default user')
    O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
    O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
    O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
    O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
    O13 - Gopher Prefix:
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqemea/downloads/sysinfo.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-BE/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
    O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
    O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
    O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://timon-dlp.spaces.live.com/PhotoUpload/VistaMsnPUpldfr-be.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
    O23 - Service: eID CRL Service - Zetes - C:\Windows\system32\beidservicecrl.exe
    O23 - Service: eID Privacy Service - Zetes - C:\Windows\system32\beidservicepcsc.exe
    O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
    O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: lxcz_device - - C:\Windows\system32\lxczcoms.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
    O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
    O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
    O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
    O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
    O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
    0
  7. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    ok

    c'est pas finit tu es détourné quand tu surf

    telecharge et lance rhost

    http://siri.urz.free.fr/RHosts.php

    puis recolle moi un hijackhtis
    0
  8. Timon-dlp Messages postés 27 Statut Membre 6
     
    rhost ne fonctionne pas avec mon Vista, je fais quoi?
    0
  9. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    essaye de desactiver le compte utilisateur avant

    sinon

    # télécharger Hoster :
    http://www.funkytoad.com/download/HostsXpert.zip

    # Dézipper le dossier sur le bureau.
    # Lancer Hoster et cliquer sur Restore Microsoft's Hosts File
    0
  10. Timon-dlp Messages postés 27 Statut Membre 6
     
    Voici le rapport apres avoir restaurer avec HostsXpert :

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:22:37, on 2/04/2008
    Platform: Windows Vista SP1 (WinNT 6.00.1905)
    MSIE: Internet Explorer v7.00 (7.00.6001.18000)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
    C:\Program Files\Java\jre1.6.0\bin\jusched.exe
    C:\Program Files\ESET\nod32kui.exe
    C:\Program Files\PowerDVD\PDVDServ.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
    C:\Program Files\Lexmark 1200 Series\LXCZbmgr.exe
    C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Windows\system32\conime.exe
    C:\Windows\Explorer.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\hijackthis\eden.exe
    C:\Windows\system32\DllHost.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
    O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
    O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
    O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\PowerDVD\Language\Language.exe"
    O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
    O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
    O4 - HKLM\..\Run: [lxczbmgr.exe] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
    O4 - HKCU\..\Run: [LaunchList] C:\Program Files\Pinnacle\Studio 11\LaunchList2.exe
    O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
    O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'Default user')
    O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
    O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
    O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
    O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
    O13 - Gopher Prefix:
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqemea/downloads/sysinfo.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-BE/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
    O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
    O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
    O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://timon-dlp.spaces.live.com/PhotoUpload/VistaMsnPUpldfr-be.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
    O23 - Service: eID CRL Service - Zetes - C:\Windows\system32\beidservicecrl.exe
    O23 - Service: eID Privacy Service - Zetes - C:\Windows\system32\beidservicepcsc.exe
    O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
    O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: lxcz_device - - C:\Windows\system32\lxczcoms.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
    O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
    O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
    O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
    O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
    O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
    0
  11. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    ok le rapport est clean

    par sureté:

    colle le rapport d'un scan en ligne
    avec un des suivants:

    bitdefender en ligne :
    http://www.bitdefender.fr/scan_fr/scan8/ie.html

    Panda en ligne :
    http://pandasoftware.fr

    Kaspersky en ligne
    https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

    secuser en ligne :
    http://www.secuser.com/outils/antivirus.htm

    scan en ligne firefox

    https://www.trendmicro.com/fr_fr/business.html
    0
  12. Timon-dlp Messages postés 27 Statut Membre 6
     
    Je fais une analyse avec Bit Defender en ligne mais ca risque de prendre un peu de temps ;)

    Je post le rapport une fois terminer.
    0
  13. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    oui par prudence! même si il doit y passer la nuit!
    0
  14. Timon-dlp Messages postés 27 Statut Membre 6
     
    Ok mais je viens de voir que j'ai encore des fenetres publicitaires qui s'ouvre et mon fond d'ecran qui est tout noir.

    Est-ce normal?
    0
  15. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    non pas normal? c'est depuis quand? depuis combofix???

    ______________

    smit fraud fix (colle le rapport)

    1/ telecharger :

    http://siri.urz.free.fr/Fix/SmitfraudFix.php

    2/ double clique sur smitfraudfix. puis sélectionne 1 et appuyer sur entrée afin de créer le rapport des infection présentes.
    0
  16. Timon-dlp Messages postés 27 Statut Membre 6
     
    SmitFraudFix v2.309

    Scan done at 21:46:55,18, mer. 02/04/2008
    Run from C:\Users\Lolo\Desktop\SmitfraudFix
    OS: Microsoft Windows [version 6.0.6001] - Windows_NT
    The filesystem type is NTFS
    Fix run in normal mode

    »»»»»»»»»»»»»»»»»»»»»»»» Process

    C:\Windows\system32\csrss.exe
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\services.exe
    C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\winlogon.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\beidservicecrl.exe
    C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
    C:\Program Files\Java\jre1.6.0\bin\jusched.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\ESET\nod32kui.exe
    C:\Windows\system32\lxczcoms.exe
    C:\Program Files\PowerDVD\PDVDServ.exe
    C:\Program Files\Eset\nod32krn.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Cyberlink\Shared files\RichVideo.exe
    C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\MsPMSPSv.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
    C:\Program Files\Lexmark 1200 Series\LXCZbmgr.exe
    C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\ehome\ehtray.exe
    C:\Windows\system32\DRIVERS\xaudio.exe
    C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Windows\system32\conime.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\Explorer.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\cmd.exe
    C:\Windows\system32\wbem\wmiprvse.exe

    »»»»»»»»»»»»»»»»»»»»»»»» hosts

    »»»»»»»»»»»»»»»»»»»»»»»» C:\

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Lolo

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Lolo\Application Data

    »»»»»»»»»»»»»»»»»»»»»»»» Start Menu

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Lolo\FAVORI~1

    »»»»»»»»»»»»»»»»»»»»»»»» Desktop

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

    »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

    »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
    !!!Attention, following keys are not inevitably infected!!!

    IEDFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» VACFix
    !!!Attention, following keys are not inevitably infected!!!

    VACFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"=""

    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "Userinit"="C:\\Windows\\system32\\userinit.exe,"
    "System"=""

    »»»»»»»»»»»»»»»»»»»»»»»» Rustock

    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    Description: Intel(R) PRO/Wireless 3945ABG Network Connection #2
    DNS Server Search Order: 212.68.193.110
    DNS Server Search Order: 192.168.0.1

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{252C82CB-31D7-4F3B-9711-0793C85412B6}: DhcpNameServer=212.68.193.110 192.168.0.1
    HKLM\SYSTEM\CCS\Services\Tcpip\..\{5BCB9D9D-71DF-489C-83C0-19299FEBC6A6}: DhcpNameServer=212.68.193.110 192.168.0.1
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{252C82CB-31D7-4F3B-9711-0793C85412B6}: DhcpNameServer=212.68.193.110 192.168.0.1
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{5BCB9D9D-71DF-489C-83C0-19299FEBC6A6}: DhcpNameServer=212.68.193.110 192.168.0.1
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{252C82CB-31D7-4F3B-9711-0793C85412B6}: DhcpNameServer=212.68.193.110 192.168.0.1
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{5BCB9D9D-71DF-489C-83C0-19299FEBC6A6}: DhcpNameServer=212.68.193.110 192.168.0.1
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.68.193.110 192.168.0.1
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.68.193.110 192.168.0.1
    HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=212.68.193.110 192.168.0.1

    »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

    »»»»»»»»»»»»»»»»»»»»»»»» End
    0
  17. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    non pas normal? c'est depuis quand? depuis combofix???
    0
  18. Timon-dlp Messages postés 27 Statut Membre 6
     
    Oui, il me semble :(

    N'oublie pas que je suis sur Vista SP1 !
    0
  19. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    ok combofix a viré des images , essaye des remettre une nouvelle image en fond d'ecran et dis si ca persiste
    0
  20. Timon-dlp Messages postés 27 Statut Membre 6
     
    Ok, ca refonctionne, j'ai remis le theme Vista.

    Je fais quoi maintenant?
    0
  21. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    tu vire combofix et smitfraudfix de ton ordi

    puis

    colle le rapport d'un scan en ligne
    avec un des suivants:

    bitdefender en ligne :
    http://www.bitdefender.fr/scan_fr/scan8/ie.html

    Panda en ligne :
    http://pandasoftware.fr

    Kaspersky en ligne
    https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

    secuser en ligne :
    http://www.secuser.com/outils/antivirus.htm

    scan en ligne firefox

    https://www.trendmicro.com/fr_fr/business.html
    0
  • 1
  • 2

Discussions similaires

impossible d envoyer message a un contact sans être bloquée
vic -
bazfile -

1 réponse
Echec d'envoi message sur Messenger
Kris68 -
Colibri -

2 réponses
Restriction Messenger
Laetitia -
CCMBot -

2 réponses
Désinstaller et réinstaller Messenger
MayLyn -
MaxGix -

1 réponse
Mention « invitation par message »
Louloute.lg -
Radinoz -

1 réponse