Fenêtres intempestives sous firefox
Résolu
jg92
-
jlpjlp Messages postés 52399 Statut Contributeur sécurité -
jlpjlp Messages postés 52399 Statut Contributeur sécurité -
Bonjour,
Voici mon log, car j'ai des ouverture de fenêtres intempestives sous firefox, que dois-je faire, merci d'avance.
Jacques
Logfile of HijackThis v1.99.1
Scan saved at 12:55:35, on 22/04/2008
Platform: Unknown Windows (WinNT 6.00.1905 SP1, v.668)
MSIE: Internet Explorer v7.00 (7.00.6001.17052)
Running processes:
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Cobian Backup 8\cbInterface.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
C:\Program Files\SWF Printer Pro\swfpagent.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Cordial\DLL_32\Integration_Cordial.exe
C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
C:\Program Files\Orange\Logiciel de Synchronisation Orange\Voxsync.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\vghd\vghd.exe
C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Orange\Logiciel de Synchronisation Orange\SyncManager.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\vghd\VirtuaGirl_downloader.exe
C:\Program Files\TechSmith\SnagIt 8\TSCHelp.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\jacques\AppData\Local\Temp\Rar$EX00.262\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.bing.com/spresults.aspx
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com/spresults.aspx
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowslive.fr/hotmail/default.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.bing.com/spresults.aspx
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: SYSTRAN Toolbar - {95daa571-4def-4a6d-97d8-98a346672a24} - mscoree.dll (file missing)
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [Cobian Backup 8 interface] "C:\Program Files\Cobian Backup 8\cbInterface.exe" -service
O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [WrtMon.exe] C:\Windows\system32\spool\drivers\w32x86\3\WrtMon.exe
O4 - HKLM\..\Run: [SWF Printer Agent] "C:\Program Files\SWF Printer Pro\swfpagent.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [ScanSoft OmniPage 16-reminder] "C:\Program Files\ScanSoft\OmniPage16\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\OmniPage 16\Ereg\Ereg.ini"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart
O4 - HKCU\..\Run: [ISUSPM Startup] "c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Integration de Cordial] C:\PROGRAM FILES\CORDIAL\DLL_32\INTEGRATION_CORDIAL.EXE
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [OpAgent] "OpAgent.exe" /agent
O4 - Startup: MSN Pictures Displayer.lnk = C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Startup: VirtuaGirl HD.LNK = C:\Program Files\vghd\vghd.exe
O4 - Global Startup: Google Calendar Sync.lnk = C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
O4 - Global Startup: Logiciel de Synchronisation Orange.lnk = ?
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: SnagIt 8.lnk = C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
O8 - Extra context menu item: &Point&&Go - C:\Program Files\Common Files\Expert System\PGPlatform\PGPlatform.htm
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Consulter les dictionnaires (SYSTRAN) - res://C:\Program Files\SYSTRAN\6\\GUIres.dll/lookup.js
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O8 - Extra context menu item: Traduire (SYSTRAN) - res://C:\Program Files\SYSTRAN\6\\GUIres.dll/translate.js
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - https://www.f-secure.com/en/home/support
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: Cobian Backup 8 service (CobBMService) - Luis Cobian - C:\Program Files\Cobian Backup 8\cbService.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe" /service (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe" /service (file missing)
Voici mon log, car j'ai des ouverture de fenêtres intempestives sous firefox, que dois-je faire, merci d'avance.
Jacques
Logfile of HijackThis v1.99.1
Scan saved at 12:55:35, on 22/04/2008
Platform: Unknown Windows (WinNT 6.00.1905 SP1, v.668)
MSIE: Internet Explorer v7.00 (7.00.6001.17052)
Running processes:
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Cobian Backup 8\cbInterface.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
C:\Program Files\SWF Printer Pro\swfpagent.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Cordial\DLL_32\Integration_Cordial.exe
C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
C:\Program Files\Orange\Logiciel de Synchronisation Orange\Voxsync.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\vghd\vghd.exe
C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Orange\Logiciel de Synchronisation Orange\SyncManager.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\vghd\VirtuaGirl_downloader.exe
C:\Program Files\TechSmith\SnagIt 8\TSCHelp.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\jacques\AppData\Local\Temp\Rar$EX00.262\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.bing.com/spresults.aspx
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com/spresults.aspx
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowslive.fr/hotmail/default.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.bing.com/spresults.aspx
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: SYSTRAN Toolbar - {95daa571-4def-4a6d-97d8-98a346672a24} - mscoree.dll (file missing)
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [Cobian Backup 8 interface] "C:\Program Files\Cobian Backup 8\cbInterface.exe" -service
O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [WrtMon.exe] C:\Windows\system32\spool\drivers\w32x86\3\WrtMon.exe
O4 - HKLM\..\Run: [SWF Printer Agent] "C:\Program Files\SWF Printer Pro\swfpagent.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [ScanSoft OmniPage 16-reminder] "C:\Program Files\ScanSoft\OmniPage16\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\OmniPage 16\Ereg\Ereg.ini"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart
O4 - HKCU\..\Run: [ISUSPM Startup] "c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Integration de Cordial] C:\PROGRAM FILES\CORDIAL\DLL_32\INTEGRATION_CORDIAL.EXE
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [OpAgent] "OpAgent.exe" /agent
O4 - Startup: MSN Pictures Displayer.lnk = C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Startup: VirtuaGirl HD.LNK = C:\Program Files\vghd\vghd.exe
O4 - Global Startup: Google Calendar Sync.lnk = C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
O4 - Global Startup: Logiciel de Synchronisation Orange.lnk = ?
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: SnagIt 8.lnk = C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
O8 - Extra context menu item: &Point&&Go - C:\Program Files\Common Files\Expert System\PGPlatform\PGPlatform.htm
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Consulter les dictionnaires (SYSTRAN) - res://C:\Program Files\SYSTRAN\6\\GUIres.dll/lookup.js
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O8 - Extra context menu item: Traduire (SYSTRAN) - res://C:\Program Files\SYSTRAN\6\\GUIres.dll/translate.js
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - https://www.f-secure.com/en/home/support
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: Cobian Backup 8 service (CobBMService) - Luis Cobian - C:\Program Files\Cobian Backup 8\cbService.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe" /service (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe" /service (file missing)
Configuration: Windows Vista Firefox 2.0.0.14
7 réponses
-
slt,
Télécharge Combofix de sUBs : Renomme le avant toute installation, par exemple, nomme le "KillBagle". aide ici : https://forum.pcastuces.com/sujet.asp?f=25&s=37315
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs !
Aide à l’utilisation de combofix ici: https://bibou0007.forumpro.fr/login?redirect=%2Ft121-topic
Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider, laisse toi guider.
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.
_______________
Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection):
- Va dans démarrer puis panneau de configuration
- Double Clique sur l'icône "Comptes d'utilisateurs"
- Clique ensuite sur désactiver et valide.
Télécharge maintenant Navilog1 depuis-ce lien :
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe
Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau.
Ensuite double clique sur navilog1.exe pour lancer l'installation.
Une fois l'installation terminée, Fais un Clic-droit sur le raccourci Navilog1 présent sur ton bureau et choisis "Exécuter
en tant qu'administrateur".
Au menu principal, Fais le choix 1
Laisse toi guider et patiente.
Patiente jusqu'au message :
*** Analyse Termine le ..... ***
Appuie sur une touche le blocnote va s'ouvrir.
Copie-colle l'intégralité du rapport dans une réponse.
Referme le blocnote
Le rapport fixnavi.txt est en outre sauvegardé dans %systemdrive%.
-
Salut fais ceci:
Utiliser navilog.bat (d'Il Mafioso) (Sous Vista)Désactiver le contrôle des comptes utilisateurs (le réactiver à la fin de la désinfection) :
Aller dans démarrer puis panneau de configuration
Double Cliquer sur l'icône "Comptes d'utilisateurs"
Cliquer ensuite sur désactiver et valider.
Faire un clic droit sur ce lien : http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe
Enregistrez la cible (du lien) sous... et enregistrez-le sur le bureau.
Ensuite double cliquer sur navilog1.exe pour lancer l'installation.
Une fois l'installation terminée, Faire un clic-droit sur le raccourci Navilog1 présent sur le bureau et choisir Exécuter en tant qu'administrateur
Arriver au menu principal, choisir l'option 1 et valider.
Patientez jusqu'au message : Analyse Termine le ...
Appuyer sur une touche, le blocnote s'ouvre, enregistrer le rapport manière à le retrouver.
Le rapport fixnavi.txt est en outre sauvegardé dans %systemdrive%. ( Cf : Exemple d'un rapport contenant des fichiers infectés plus haut ).
De même que pour XP, une fois toutes les précautions prises :
Faire un clic-droit sur le raccourci Navilog1 présent sur le bureau et choisir "Exécuter en tant qu'administrateur".
Arriver au menu principal, choisir l'option 2 et valider.
Le fix demandera ensuite le redémarrer le PC, fermer toutes les fenêtres ouvertes et enregistrer les documents personnels ouverts, et appuyer sur une touche comme demandé.(si le Pc ne redémarre pas automatiquement, le faire manuellement)
Au redémarrage du PC, choisir la session habituelle si nécessaire.
Patienter jusqu'au message : Nettoyage Termine le ...
Sauvegarder le rapport de manière à le retrouver, puis fermer le blocnote, le bureau réapparaîtra
Réactiver le contrôle des comptes utilisateurs (UAC)--
Un travail réglé et des victoires après des victoires, voilà sans doute la formule du bonheur. -
Voici le premier log avec comboFix, merci de ton aide
ComboFix 08-04-20.5 - jacques 2008-04-22 16:51:00.1 - NTFSx86
Microsoft® Windows Vista™ Professionnel 6.0.6001.1.1252.1.1036.18.952 [GMT 2:00]
Endroit: C:\Users\jacques\Desktop\killmy.exe
* Création d'un nouveau point de restauration
* Resident AV is active
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\internetgamebox
C:\Program Files\internetgamebox\InternetGameBox.exe
C:\Program Files\internetgamebox\language
C:\Program Files\internetgamebox\ressources\AttenteOff.html
C:\Program Files\internetgamebox\ressources\AttenteOn.html
C:\Program Files\internetgamebox\ressources\configv2_en.xml
C:\Program Files\internetgamebox\ressources\configv2_es.xml
C:\Program Files\internetgamebox\ressources\configv2_fr.xml
C:\Program Files\internetgamebox\ressources\favoris\defaultv2.swf
C:\Program Files\internetgamebox\ressources\NoS2F.bin
C:\Program Files\internetgamebox\skins\skinv2.skn
C:\Program Files\internetgamebox\uninst.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InternetGameBox
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InternetGameBox\Conditions générales.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InternetGameBox\Confidentialité.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InternetGameBox\Désinstaller.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InternetGameBox\InternetGameBox.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InternetGameBox\Website.url
C:\Users\jacques\AppData\Local\tyvygi.dat
C:\Users\jacques\AppData\Local\tyvygi.exe
c:\Users\jacques\AppData\Local\tyvygi_nav.dat
C:\Users\jacques\AppData\Local\tyvygi_navps.dat
.
((((((((((((((((((((((((((((( Fichiers créés 2008-03-22 to 2008-04-22 ))))))))))))))))))))))))))))))))))))
.
2008-04-22 16:35 . 2008-04-22 16:35 <REP> d-------- C:\Program Files\fabFORCE
2008-04-22 16:35 . 2008-04-22 16:35 <REP> d-------- C:\Program Files\Common Files\fabFORCE
2008-04-22 13:59 . 2008-04-22 16:49 <REP> d-------- C:\327882R2FWJFW
2008-04-22 13:08 . 2008-04-22 13:08 457,728 --a------ C:\Windows\BBPAssoc.dll
2008-04-21 23:35 . 2008-04-21 23:35 <REP> d-------- C:\Users\jacques\AppData\Roaming\Voxmobili
2008-04-21 09:03 . 2008-04-21 09:03 75 -r-hs---- C:\Windows\FFSSET.BIN
2008-04-20 22:33 . 2008-04-20 22:33 <REP> d-------- C:\fsaua.data
2008-04-17 23:14 . 2008-04-17 23:14 <REP> d-------- C:\Users\jacques\AppData\Roaming\Nvu
2008-04-14 22:46 . 2008-04-14 22:48 1,905 --a------ C:\Windows\diagwrn.xml
2008-04-14 22:46 . 2008-04-14 22:48 1,905 --a------ C:\Windows\diagerr.xml
2008-04-14 22:31 . 2008-04-14 22:31 <REP> d-------- C:\Users\All Users\Windows Genuine Advantage
2008-04-13 21:15 . 2008-04-13 21:15 244 --ah----- C:\sqmnoopt13.sqm
2008-04-13 21:15 . 2008-04-13 21:15 232 --ah----- C:\sqmdata13.sqm
2008-04-13 20:41 . 2008-04-13 20:41 <REP> d-------- C:\Users\jacques\AppData\Roaming\vlc
2008-04-13 20:40 . 2008-04-13 20:40 <REP> d-------- C:\Program Files\VideoLAN
2008-04-13 16:46 . 2008-04-13 16:46 <REP> d-------- C:\Users\jacques\AppData\Roaming\PlayFirst
2008-04-13 12:38 . 2008-04-13 12:38 848 --ahs---- C:\Windows\System32\KGyGaAvL.sys
2008-04-13 11:41 . 2008-04-13 11:50 <REP> d-------- C:\Users\jacques\.SmileBook
2008-04-13 11:40 . 2008-04-13 16:25 <REP> d-------- C:\Program Files\SmileBook
2008-04-13 10:30 . 2008-04-13 10:30 <REP> d-------- C:\Program Files\Connective Tools
2008-04-13 10:22 . 2008-04-13 10:22 395 --a------ C:\Windows\MAXLINK.INI
2008-04-13 10:18 . 2008-04-13 10:18 <REP> d-------- C:\Program Files\ScanSoft
2008-04-12 20:36 . 2008-04-12 20:36 <REP> d-------- C:\Windows\Documalis Free Scanner 1.0
2008-04-12 20:36 . 2008-04-12 20:36 <REP> d-------- C:\Program Files\Documalis Free
2008-04-12 20:33 . 2008-04-12 20:37 <REP> d-------- C:\Program Files\MB Softs
2008-04-12 20:21 . 2008-04-12 20:21 <REP> d-------- C:\Users\jacques\AppData\Roaming\Zeon
2008-04-12 17:26 . 2008-04-12 17:26 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdRapi_01_00_00.Wdf
2008-04-11 22:49 . 2008-04-11 22:49 <REP> d-------- C:\Program Files\Unlocker
2008-04-11 18:19 . 2008-04-11 18:19 <REP> d-------- C:\Users\All Users\TechSmith
2008-04-11 18:19 . 2008-04-11 18:19 <REP> d-------- C:\ProgramData\TechSmith
2008-04-11 18:19 . 2008-04-11 18:19 <REP> d-------- C:\Program Files\TechSmith
2008-04-11 18:17 . 2008-04-11 18:17 <REP> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-11 08:39 . 2008-04-11 08:39 <REP> d-------- C:\Users\jacques\AppData\Roaming\Apple Computer
2008-04-10 21:44 . 2008-04-10 21:44 <REP> d-------- C:\Program Files\Tropical Fish 3D Screensaver
2008-04-10 21:41 . 2008-04-10 21:41 <REP> d-------- C:\Program Files\Nature 3D Screensaver
2008-04-10 21:37 . 2008-04-10 21:37 <REP> d-------- C:\Program Files\Lagoon 3D Screensaver
2008-04-10 21:37 . 2006-10-06 15:51 10,638,336 --a------ C:\Windows\System32\Lagoon 3D Screensaver.exe
2008-04-10 21:37 . 2006-10-06 15:51 883,200 --a------ C:\Windows\System32\Lagoon_3D_Screensaver.scr
2008-04-10 21:37 . 2006-09-29 07:28 7,070 --a------ C:\Windows\Lagoon 3D Screensaver.html
2008-04-10 21:34 . 2008-04-10 21:34 <REP> d-------- C:\Program Files\Earth 3D Screensaver
2008-04-10 21:31 . 2008-04-10 21:31 <REP> d-------- C:\Program Files\Fireplace 3D Screensaver
2008-04-10 20:48 . 2008-04-10 20:48 <REP> d-------- C:\Windows\System32\3Planesoft
2008-04-10 20:48 . 2008-04-10 20:48 <REP> d-------- C:\Program Files\Ancient Castle 3D Screensaver
2008-04-10 20:48 . 2008-04-10 21:37 <REP> d-------- C:\Program Files\3Planesoft Screensaver Manager
2008-04-09 22:17 . 2008-04-09 22:17 <REP> d-------- C:\Users\jacques\AppData\Roaming\vghd
2008-04-09 22:17 . 2008-04-09 22:19 <REP> d-------- C:\Program Files\vghd
2008-04-09 07:49 . 2008-04-09 07:49 <REP> d-------- C:\Program Files\Belarc
2008-04-09 07:49 . 2005-04-07 16:18 3,840 --a------ C:\Windows\System32\drivers\BANTExt.sys
2008-04-06 16:50 . 2008-04-06 16:50 <REP> d-------- C:\Users\All Users\Alawar Stargaze
2008-04-06 16:50 . 2008-04-06 16:50 <REP> d-------- C:\ProgramData\Alawar Stargaze
2008-04-06 16:50 . 2008-04-06 16:50 <REP> d-------- C:\Program Files\Hyperballoid 2 RUS
2008-04-04 15:04 . 2008-04-11 21:22 <REP> d-------- C:\Program Files\Common Files\Symantec Shared
2008-04-04 15:03 . 2008-04-04 15:03 <REP> d-------- C:\Users\All Users\Symantec
2008-04-04 15:03 . 2008-04-04 15:03 <REP> d-------- C:\ProgramData\Symantec
2008-04-02 22:15 . 2008-04-13 21:49 13 --a------ C:\Windows\FFINI.ini
2008-04-02 22:10 . 2008-04-02 22:10 43 --a------ C:\Windows\FFS10EnuReg.ini
2008-04-02 22:09 . 2008-04-21 09:02 <REP> d-------- C:\Program Files\Reallusion
2008-04-02 18:17 . 2008-04-02 18:17 <REP> d-------- C:\Program Files\KC Softwares
2008-04-02 12:33 . 2008-04-02 12:33 <REP> d-------- C:\Program Files\Virtual Earth 3D
2008-04-02 08:34 . 2008-04-13 15:40 <REP> d-------- C:\Program Files\SWF Printer Pro
2008-04-02 08:34 . 2007-08-11 14:57 1,720,216 --a------ C:\Windows\System32\SWFPresentationScout.DLL
2008-04-02 08:34 . 2007-06-14 09:47 26,624 --a------ C:\Windows\System32\swfppm.dll
2008-04-02 08:33 . 2008-04-02 08:33 <REP> d-------- C:\Users\jacques\AppData\Roaming\NewSoft
2008-04-02 08:21 . 2008-04-02 08:21 <REP> d-------- C:\Users\jacques\AppData\Roaming\cYo
2008-04-02 08:21 . 2008-04-06 14:00 <REP> d-------- C:\Program Files\ComicRack
2008-04-01 22:56 . 2008-04-01 22:56 <REP> d-------- C:\Users\jacques\AppData\Roaming\Pixmantec
2008-03-31 21:12 . 2008-03-31 21:12 <REP> d-------- C:\Users\All Users\WindowsSearch
2008-03-31 21:12 . 2008-03-31 21:12 <REP> d-------- C:\ProgramData\WindowsSearch
2008-03-30 20:50 . 2008-03-30 20:50 <REP> d-------- C:\Program Files\BVRP Software
2008-03-30 20:48 . 2008-03-30 20:48 <REP> d-------- C:\Program Files\LiveUpdate
2008-03-30 20:40 . 2008-03-30 20:40 <REP> d-------- C:\Program Files\Theme Generator
2008-03-30 20:33 . 2008-03-30 20:33 <REP> d-------- C:\Program Files\Theme Generator Smartphone
2008-03-30 19:39 . 2008-03-30 19:39 268 --ah----- C:\sqmdata12.sqm
2008-03-30 19:39 . 2008-03-30 19:39 244 --ah----- C:\sqmnoopt12.sqm
2008-03-29 19:18 . 2008-03-29 19:27 <REP> d-------- C:\Users\jacques\AppData\Roaming\BVS Solitaire Collection
2008-03-29 15:54 . 2008-03-29 15:54 <REP> d-------- C:\Program Files\Hyperspace Invader
2008-03-29 15:52 . 2008-03-29 15:52 <REP> d-------- C:\Program Files\Brickquest
2008-03-29 15:49 . 2008-03-29 15:49 <REP> d-------- C:\Program Files\Big City Adventure - San Francisco
2008-03-29 15:44 . 2008-03-29 15:44 <REP> d-------- C:\Program Files\Travelogue 360 Paris
2008-03-29 15:27 . 2008-03-29 15:27 <REP> d-------- C:\Program Files\Travelogue 360 - Rome
2008-03-29 15:11 . 2008-03-29 15:11 <REP> d-------- C:\Program Files\Sweetopia
2008-03-29 15:08 . 2008-04-13 16:46 <REP> d-------- C:\Program Files\Poker Pop
2008-03-29 15:06 . 2008-03-29 15:06 <REP> d-------- C:\Program Files\BVS Solitaire Collection
2008-03-29 15:04 . 2008-03-29 15:04 <REP> d-------- C:\Program Files\Flip Words
2008-03-29 15:04 . 2008-03-29 15:04 <REP> d-------- C:\Program Files\Azada
2008-03-29 14:51 . 2008-03-29 14:51 <REP> d-------- C:\Program Files\Granny in Paradise
2008-03-29 14:49 . 2008-03-29 14:49 <REP> d-------- C:\Program Files\Bliss Island
2008-03-29 14:45 . 2008-03-29 14:46 <REP> d-------- C:\Program Files\Fairway Solitaire
2008-03-29 14:33 . 2008-04-21 13:45 <REP> d-------- C:\Program Files\Ricochet - Infinity
2008-03-29 14:20 . 2008-03-29 14:20 <REP> d-------- C:\Program Files\Mahjong Towers Eternity
2008-03-29 14:18 . 2008-03-29 14:18 <REP> d-------- C:\Program Files\Elf Bowling 7 1-7 - The Last Insult
2008-03-29 11:37 . 2008-03-29 11:37 <REP> d-------- C:\Program Files\Pharaoh`s Mystery
2008-03-29 11:32 . 2008-03-29 11:32 <REP> d-------- C:\Program Files\Fairy Treasure
2008-03-29 11:23 . 2008-03-29 11:24 <REP> d-------- C:\Program Files\Atlantis Sky Patrol
2008-03-29 11:11 . 2008-03-29 11:11 <REP> d-------- C:\Program Files\Peggle Deluxe
2008-03-29 11:00 . 2008-03-29 11:00 <REP> d-------- C:\Program Files\bfgclient
2008-03-28 19:40 . 2008-03-28 19:40 <REP> d-------- C:\Users\jacques\AppData\Roaming\JAlbum
2008-03-28 19:38 . 2008-03-28 19:39 <REP> d-------- C:\Program Files\JAlbumWin
2008-03-28 16:12 . 2008-03-28 16:12 <REP> d-------- C:\Users\jacques\AppData\Roaming\Corel
2008-03-28 16:11 . 2008-03-28 16:11 <REP> d-------- C:\Users\jacques\AppData\Roaming\ArcSoft
2008-03-27 23:43 . 2008-03-27 23:50 <REP> d-------- C:\Program Files\Mgtweak
2008-03-27 23:43 . 2008-03-27 23:46 815 --a------ C:\Windows\mgreg.ini
2008-03-27 23:43 . 2008-03-27 23:43 30 --a------ C:\Windows\mgwin.ini
2008-03-27 23:32 . 2008-04-01 23:33 <REP> d-------- C:\Program Files\FaceOnBody
2008-03-27 10:10 . 2008-03-27 10:10 <REP> d-------- C:\Users\jacques\AppData\Roaming\SYSTRAN
2008-03-27 10:08 . 2008-03-27 10:08 <REP> d-------- C:\Program Files\SYSTRAN
2008-03-27 10:08 . 2008-03-27 10:08 878,080 --a------ C:\Windows\System32\iconv.dll
2008-03-27 10:08 . 2008-03-27 10:08 721,920 --a------ C:\Windows\System32\libxml2.dll
2008-03-27 10:08 . 2008-03-27 10:08 170,432 --a------ C:\Windows\System32\libsyslic1.pd
2008-03-27 10:08 . 2008-03-27 10:08 150,016 --a------ C:\Windows\System32\libxslt.dll
2008-03-27 10:08 . 2008-03-27 10:08 144,896 --a------ C:\Windows\System32\libsyslic1.dll
2008-03-27 10:08 . 2008-03-27 10:08 51,200 --a------ C:\Windows\System32\libexslt.dll
2008-03-27 10:08 . 2008-04-20 22:30 280 --a------ C:\Windows\System32\libsyslic1.ls
2008-03-27 10:06 . 2008-03-27 10:06 <REP> d-------- C:\Windows\System32\Adobe
2008-03-27 10:06 . 2008-04-02 12:35 953 --a------ C:\Windows\mozver.dat
2008-03-27 10:04 . 2008-03-27 10:04 <REP> dr------- C:\Windows\System32\config\systemprofile\Videos
2008-03-27 10:04 . 2008-03-27 10:04 <REP> dr------- C:\Windows\System32\config\systemprofile\Searches
2008-03-27 10:04 . 2008-03-27 10:04 <REP> dr------- C:\Windows\System32\config\systemprofile\Saved Games
2008-03-27 10:04 . 2008-03-27 10:04 <REP> dr------- C:\Windows\System32\config\systemprofile\Pictures
2008-03-27 10:04 . 2008-03-27 10:04 <REP> dr------- C:\Windows\System32\config\systemprofile\Music
2008-03-27 10:04 . 2008-03-27 10:04 <REP> dr------- C:\Windows\System32\config\systemprofile\Links
2008-03-27 10:04 . 2008-03-27 10:04 <REP> dr------- C:\Windows\System32\config\systemprofile\Downloads
2008-03-27 10:04 . 2008-04-13 21:47 <REP> dr------- C:\Windows\System32\config\systemprofile\Documents
2008-03-27 10:02 . 2008-03-27 10:02 <REP> d-------- C:\Windows\System32\URTTEMP
2008-03-26 23:59 . 2008-03-26 23:59 <REP> d-------- C:\Program Files\eToro
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-22 09:33 262,144 ----a-w C:\ntuser.dat
2008-04-22 09:30 0 ----a-w C:\Windows\system32\drivers\lvuvc.hs
2008-04-22 09:27 --------- d-----w C:\Program Files\FileZilla Client
2008-04-22 09:00 --------- d-----w C:\Users\jacques\AppData\Roaming\MailWasherPro
2008-04-21 23:28 --------- d-----w C:\ProgramData\Google Updater
2008-04-21 21:34 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-21 21:34 --------- d-----w C:\Program Files\Orange
2008-04-21 11:46 --------- d---a-w C:\ProgramData\TEMP
2008-04-21 05:52 --------- d-----w C:\Users\jacques\AppData\Roaming\Vista Start Menu
2008-04-20 16:59 --------- d-----w C:\Users\jacques\AppData\Roaming\GrabIt
2008-04-13 18:38 --------- d-----w C:\Program Files\Tracker Software
2008-04-13 12:19 --------- d-----w C:\Program Files\Corel
2008-04-12 14:28 --------- d-----w C:\Program Files\Picasa2
2008-04-09 05:54 --------- d-----w C:\Users\jacques\AppData\Roaming\GoodSync
2008-04-09 01:05 --------- d-----w C:\ProgramData\Microsoft Help
2008-04-03 20:18 --------- d-----w C:\Program Files\Google
2008-04-03 18:57 --------- d-----w C:\Program Files\Siber Systems
2008-03-30 06:02 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-03-27 07:52 --------- d-----w C:\Program Files\GrabIt
2008-03-23 14:55 --------- d-----w C:\Program Files\Real
2008-03-23 13:59 --------- d-----w C:\ProgramData\eMule
2008-03-23 07:44 --------- d-----w C:\Program Files\Common Files\Real
2008-03-23 07:00 --------- d-----w C:\Program Files\Canon
2008-03-22 12:43 --------- d-----w C:\Program Files\Macromedia
2008-03-22 12:43 --------- d-----w C:\Program Files\Common Files\Macromedia Shared
2008-03-20 07:36 --------- d-----w C:\Users\jacques\AppData\Roaming\Netscape
2008-03-20 07:36 --------- d-----w C:\Program Files\Photodex Presenter
2008-03-20 07:35 --------- d-----w C:\Users\jacques\AppData\Roaming\Photodex
2008-03-20 07:35 --------- d-----w C:\Program Files\Photodex
2008-03-20 07:32 --------- d-----w C:\Program Files\SourceTec
2008-03-20 07:32 --------- d-----w C:\Program Files\Common Files\SourceTec
2008-03-20 07:25 --------- d-----w C:\Users\jacques\AppData\Roaming\Bradsoft.com
2008-03-20 07:22 --------- d-----w C:\Program Files\Common Files\Macromedia
2008-03-20 07:22 --------- d-----w C:\Program Files\Bradbury
2008-03-20 07:20 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-03-20 07:19 --------- d-----w C:\Program Files\Dictionnaire
2008-03-20 02:02 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-03-18 17:07 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-18 17:05 --------- d-----w C:\ProgramData\WLInstaller
2008-03-18 17:05 --------- d-----w C:\Program Files\Windows Live
2008-03-18 07:21 --------- d-----w C:\Program Files\Cordial
2008-03-18 07:16 --------- d-----w C:\Program Files\Synapse Développement
2008-03-18 07:16 --------- d-----w C:\Program Files\Common Files\Expert System
2008-03-17 21:15 --------- d-----w C:\Program Files\Protectis
2008-03-17 21:08 --------- d-----w C:\Program Files\Free-info
2008-03-17 20:51 --------- d-----w C:\Users\jacques\AppData\Roaming\Généatique2007
2008-03-17 18:15 --------- d-----w C:\Program Files\Comptes et Budget V5.0
2008-03-17 17:45 --------- d-----w C:\Users\jacques\AppData\Roaming\Canon
2008-03-17 12:47 --------- d-----w C:\Users\jacques\AppData\Roaming\Talkback
2008-03-17 07:18 --------- d-----w C:\Users\jacques\AppData\Roaming\BitDefender
2008-03-17 07:18 --------- d-----w C:\ProgramData\BitDefender
2008-03-17 07:03 --------- d-----w C:\Program Files\Common Files\BitDefender
2008-03-17 07:03 --------- d-----w C:\Program Files\BitDefender
2008-03-17 07:00 --------- d-----w C:\ProgramData\Spybot - Search & Destroy
2008-03-17 07:00 --------- d-----w C:\Program Files\Geneatique2007
2008-03-17 06:56 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-03-17 06:55 --------- d-----w C:\Program Files\MesNews
2008-03-17 06:45 --------- d-----w C:\Program Files\CCleaner
2008-03-17 06:42 --------- d-----w C:\Program Files\Passbox2007
2008-03-16 18:16 --------- d-----w C:\Program Files\Firetrust
2008-03-16 17:27 --------- d-----w C:\Program Files\MSN Pictures Displayer
2008-03-16 17:01 --------- d-----w C:\Program Files\Spyware Doctor
2008-03-16 12:21 --------- d-----w C:\Program Files\RocketDock
2008-03-16 11:45 --------- d-----w C:\Program Files\SlySoft
2008-03-16 10:19 --------- d-----w C:\Program Files\Pixmantec
2008-03-16 10:02 --------- d-----w C:\ProgramData\InstallShield
2008-03-16 09:59 --------- d-----w C:\Program Files\Common Files\Corel
2008-03-16 08:43 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-16 08:41 --------- d-----w C:\Program Files\Common Files\xing shared
2008-03-16 08:39 --------- d-----w C:\Users\jacques\AppData\Roaming\PC Tools
2008-03-16 08:20 0 ---ha-w C:\Windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-03-16 07:11 --------- d-----w C:\Program Files\LeConjugueur
2008-03-16 07:10 --------- d-----w C:\ProgramData\Apple Computer
2008-03-16 07:10 --------- d-----w C:\Program Files\QuickTime
2008-03-16 07:09 --------- d-----w C:\Program Files\OLYMPUS
2008-03-16 07:09 --------- d-----w C:\Program Files\MSXML 4.0
2008-03-15 22:06 --------- d-----w C:\Users\jacques\AppData\Roaming\MSN Pictures Displayer
2008-03-15 22:06 --------- d-----w C:\Users\jacques\AppData\Roaming\ENJOY Plus!
2008-03-15 22:06 --------- d-----w C:\ProgramData\ENJOY Plus!
2008-03-15 22:06 --------- d-----w C:\Program Files\ENJOY Plus!
2008-03-15 22:00 --------- d-----w C:\ProgramData\Messenger Plus!
2008-03-15 21:56 --------- d-----w C:\Program Files\Nicolas MERLET
2008-03-15 21:26 --------- d-----w C:\Program Files\Nvu
2008-03-15 16:39 174 --sha-w C:\Program Files\desktop.ini
2008-03-15 16:33 --------- d-----w C:\Program Files\Windows Sidebar
2008-03-15 16:33 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-03-15 16:33 --------- d-----w C:\Program Files\Windows Mail
2008-03-15 16:33 --------- d-----w C:\Program Files\Windows Journal
2008-03-15 16:33 --------- d-----w C:\Program Files\Windows Defender
2008-03-15 16:33 --------- d-----w C:\Program Files\Windows Collaboration
2008-03-15 16:33 --------- d-----w C:\Program Files\Windows Calendar
2008-03-15 15:56 --------- d-----w C:\Users\jacques\AppData\Roaming\Yahoo!
2008-03-15 15:56 --------- d-----w C:\ProgramData\Yahoo! Companion
2008-03-15 15:56 --------- d-----w C:\Program Files\Vista Start Menu
2008-03-15 15:55 --------- d-----w C:\Program Files\Stardock
2008-03-15 15:55 --------- d-----w C:\Program Files\Common Files\Stardock
2008-03-15 15:52 --------- d--h--w C:\Program Files\CanonBJ
2008-03-15 15:49 --------- d-----w C:\Users\jacques\AppData\Roaming\Logitech
2008-03-15 15:48 --------- d-----w C:\Program Files\Yahoo!
2008-03-15 15:48 --------- d-----w C:\Program Files\Common Files\Logitech
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2007-11-30 05:07 1233920]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2008-03-18 20:48 5724184]
"OM2_Monitor"="C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2007-09-04 15:52 95536]
"ISUSPM Startup"="c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-03-20 18:34 213936]
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 14:58 495616]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 12:43 2097488]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2007-11-30 05:07 202240]
"Integration de Cordial"="C:\PROGRAM FILES\CORDIAL\DLL_32\INTEGRATION_CORDIAL.EXE" [2006-12-13 17:18 450560]
"RoboForm"="C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-03-22 11:07 160592]
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-03-20 18:34 213936]
"OpAgent"="OpAgent.exe" []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-07-25 17:06 2027792]
"Cobian Backup 8 interface"="C:\Program Files\Cobian Backup 8\cbInterface.exe" [2007-09-27 13:37 2425856]
"Windows Mobile-based device management"="%windir%\WindowsMobile\wmdc.exe" [ ]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-03-16 10:35 1836544]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-03-16 10:41 185632]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-03-20 18:34 86960]
"BitDefender Antiphishing Helper"="C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe" [2007-10-09 16:46 61440]
"BDAgent"="C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe" [2008-02-16 18:45 360448]
"CloneCDTray"="C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" [2005-05-19 15:47 57344]
"WrtMon.exe"="C:\Windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 09:35 20480]
"SWF Printer Agent"="C:\Program Files\SWF Printer Pro\swfpagent.exe" [2007-06-14 07:45 90112]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2008-03-01 07:10 15872]
"ScanSoft OmniPage 16-reminder"="C:\Program Files\ScanSoft\OmniPage16\Ereg\Ereg.exe" [2007-08-31 09:02 328992]
C:\Users\jacques\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
MSN Pictures Displayer.lnk - C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe [2008-03-16 00:03:53 4571136]
Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [2008-03-15 17:55:54 3450608]
VirtuaGirl HD.LNK - C:\Program Files\vghd\vghd.exe [2008-04-09 22:19:06 11756864]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Google Calendar Sync.lnk - C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe [2008-03-21 04:26:50 542192]
Logiciel de Synchronisation Orange.lnk - C:\Program Files\Orange\Logiciel de Synchronisation Orange\Voxsync.exe [2008-04-21 23:34:12 684032]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-03-15 17:48:10 692224]
Outil de mise … jour Google.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-03-16 10:35:30 125624]
SnagIt 8.lnk - C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe [2006-05-10 08:02:00 5517312]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{BC9E97A2-A4B2-42F1-A7BA-FA467CABF718}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"TCP Query User{16225431-C1FF-4DD0-8DA7-5BBB4227F3D7}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{9A273C64-1EB2-4209-8D4D-92AD9DC4642C}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"TCP Query User{0569C56C-C5DF-4844-A817-EEE08488D7E8}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{5F3F678A-B976-4EBE-AFDE-E32FBD168DBE}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"{92EE0CCF-435E-4340-9E52-001B992AAF6C}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{C9D53203-0105-43D1-A0C0-170A5E704346}"= UDP:5721:LocalSubnet:LocalSubnet|IF={D15822B0-CEF0-4CCC-A985-DA3F22F5CD96}:@%systemroot%\WindowsMobile\wmdc.exe,-4002
"{85FFB1AB-FD21-43E1-A264-C3B306A05AC3}"= UDP:1034:LocalSubnet:LocalSubnet|IF={D15822B0-CEF0-4CCC-A985-DA3F22F5CD96}:@%systemroot%\WindowsMobile\wmdc.exe,-4003
"{81564126-A615-40AC-A344-8974012ED03B}"= UDP:5678:LocalSubnet:LocalSubnet|IF={D15822B0-CEF0-4CCC-A985-DA3F22F5CD96}|%systemroot%\WindowsMobile\wmdHost.exe:@%systemroot%\WindowsMobile\wmdc.exe,-4004
"{7A56BDF3-2AC4-4561-99F5-005AFBC9EBA9}"= UDP:999:LocalSubnet:LocalSubnet|IF={D15822B0-CEF0-4CCC-A985-DA3F22F5CD96}|%systemroot%\WindowsMobile\wmdHost.exe:@%systemroot%\WindowsMobile\wmdc.exe,-4005
"{48B5C621-D083-41F2-BD5D-ED051D4C96DE}"= UDP:26675:LocalSubnet:LocalSubnet|IF={D15822B0-CEF0-4CCC-A985-DA3F22F5CD96}:@%systemroot%\WindowsMobile\wmdc.exe,-4006
"{80804AC7-4F57-4E26-BC78-AA35E4145A54}"= UDP:990:LocalSubnet:LocalSubnet|IF={D15822B0-CEF0-4CCC-A985-DA3F22F5CD96}|%SystemRoot%\system32\svchost.exe|Svc=rapimgr:@%systemroot%\WindowsMobile\wmdc.exe,-4001
"{508F2EDE-359A-42BD-9B51-C67A7C665931}"= UDP:5721:LocalSubnet:LocalSubnet|IF={8D9AC832-E965-4DB8-A32A-43FB54289002}:@%systemroot%\WindowsMobile\wmdc.exe,-4002
"{4E717FEF-CE49-4973-9F54-87DBCDE525BB}"= UDP:1034:LocalSubnet:LocalSubnet|IF={8D9AC832-E965-4DB8-A32A-43FB54289002}:@%systemroot%\WindowsMobile\wmdc.exe,-4003
"{EE157CEE-DE82-4200-8580-D7BCA96BB39A}"= UDP:5678:LocalSubnet:LocalSubnet|IF={8D9AC832-E965-4DB8-A32A-43FB54289002}|%systemroot%\WindowsMobile\wmdHost.exe:@%systemroot%\WindowsMobile\wmdc.exe,-4004
"{F3959967-FF18-4DD3-A1A6-CD2F7B95FD1D}"= UDP:999:LocalSubnet:LocalSubnet|IF={8D9AC832-E965-4DB8-A32A-43FB54289002}|%systemroot%\WindowsMobile\wmdHost.exe:@%systemroot%\WindowsMobile\wmdc.exe,-4005
"{9EFD718D-E940-4769-886B-98A88A9EF897}"= UDP:26675:LocalSubnet:LocalSubnet|IF={8D9AC832-E965-4DB8-A32A-43FB54289002}:@%systemroot%\WindowsMobile\wmdc.exe,-4006
"{78F450EB-733C-434E-91E2-CD1B028FEE1A}"= UDP:990:LocalSubnet:LocalSubnet|IF={8D9AC832-E965-4DB8-A32A-43FB54289002}|%SystemRoot%\system32\svchost.exe|Svc=rapimgr:@%systemroot%\WindowsMobile\wmdc.exe,-4001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
R2 RapiMgr;Connectivité de l'appareil Windows Mobile;C:\Windows\system32\svchost.exe [2007-11-30 05:07]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2008-01-28 12:43]
R2 WcesComm;Connectivité de l'appareil Windows Mobile 2003;C:\Windows\system32\svchost.exe [2007-11-30 05:07]
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;C:\Windows\system32\DRIVERS\bdfndisf.sys [2008-01-25 16:40]
R3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-02 09:36]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
bdx REG_MULTI_SZ scan
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\shell\AutoRun\command - E:\setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{558fb7f8-f3f4-11dc-967a-0019d1387982}]
\shell\AutoRun\command - N:\PortableRoboForm.exe
\shell\RoboForm2Go\command - N:\PortableRoboForm.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{558fb87e-f3f4-11dc-967a-0019d1387982}]
\shell\AutoRun\command - L:\PortableRoboForm.exe
\shell\RoboForm2Go\command - L:\PortableRoboForm.exe
*Newly Created Service* - CATCHME
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-04-22 04:46:03 C:\Windows\Tasks\User_Feed_Synchronization-{1E742D1F-C241-4604-92B9-3F1165097C90}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************
Balayage processus cachés ...
Balayage caché autostart entries ...
Balayage des fichiers cachés ...
Scan terminé avec succès
Les fichiers cachés:
**************************************************************************
.
Temps d'accomplissement: 2008-04-22 16:58:16
ComboFix-quarantined-files.txt 2008-04-22 14:58:12
Pre-Run: 10,230,345,728 octets libres
Post-Run: 10,298,671,104 octets libres
370 --- E O F --- 2008-04-09 01:05:45 -
-
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question -
Et voila le deuxième log
Search Navipromo version 3.5.4 commencé le 22/04/2008 à 17:44:15,14
!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!
Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "jacques"
Mise à jour le 15.04.2008 à 18h00 par IL-MAFIOSO
Microsoft Windows Vista 6.0.6001
Internet Explorer : 7.0.6001.17052
Système de fichiers : NTFS
Executé en mode normal
*** Recherche dossiers dans "C:\Windows" ***
*** Recherche dossiers dans "C:\Program Files" ***
*** Recherche dossiers dans "C:\ProgramData" ***
*** Recherche dossiers dans "C:\ProgramData\Microsoft\Windows\Start Menu\Programs" ***
*** Recherche dossiers dans "c:\users\jacques\appdata\roaming\microsoft\windows\start menu\programs" ***
*** Recherche dossiers dans "C:\Users\jacques\AppData\Local\virtualstore\Program Files" ***
*** Recherche dossiers dans "C:\Users\jacques\AppData\Roaming" ***
*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net
Aucun Fichier trouvé
*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!
* Recherche dans "C:\Windows\system32" *
* Recherche dans "C:\Users\jacques\AppData\Local\Microsoft" *
* Recherche dans "C:\Users\jacques\AppData\Local" *
*** Recherche fichiers ***
*** Recherche clés spécifiques dans le Registre ***
*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)
1)Recherche nouveaux fichiers Instant Access :
2)Recherche Heuristique :
* Dans "C:\Windows\system32" :
* Dans "C:\Users\jacques\AppData\Local\Microsoft" :
* Dans "C:\Users\jacques\AppData\Local" :
3)Recherche Certificats :
Certificat Egroup absent !
Certificat Electronic-Group trouvé !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !
4)Recherche fichiers connus :
*** Analyse terminée le 22/04/2008 à 17:59:47,76 *** -
Veille à ce que le contrôle des comptes utilisateurs (UAC) soit désactivé.
Fais un Clic-droit sur le raccourci Navilog1 présent sur ton bureau et choisis "Exécuter en tant qu'administrateur".
Au menu principal, Fais le choix 2
Laisse toi guider et patiente.
Le fix va t'informer qu'il va alors redémarrer ton PC
Ferme toutes les fenêtres ouvertes et enregistre tes documents personnels ouverts
Appuie sur une touche comme demandé.
(si ton Pc ne redémarre pas automatiquement, fais-le toi-même)
Au redémarrage de ton PC, choisis ta session habituelle si nécessaire.
Patiente jusqu'au message :
*** Nettoyage Termine le ..... ***
Le blocnote va s'ouvrir.
Sauvegarde le rapport de manière à le retrouver
Referme le blocnote. Ton bureau va réapparaître
Réactive le contrôle des comptes utilisateurs (UAC)
PS:Si ton bureau ne réapparaît pas, fais CTRL+ALT+SUPP pour ouvrir le gestionnaire de tâches.
Puis rends-toi à l'onglet "processus". Clique en haut à gauche sur fichiers et choisis "exécuter"
Tape explorer et valide. Cela te fera apparaître ton bureau
______________________
encore des pubs????? -
tu peux desisntaller navilog via ton panneau de configuration
bonne suite!
