pub cidFermé

Question

Bonjour,
voila depuis quelque temp je recois des pub cid apres avoir telecharger spyware doctor qui ne ma pas resolu mon probleme g fait un scLogfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:11:39, on 28/04/2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Users\magali\Downloads\HiJackThis.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\IEUser.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://format.packardbell.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live OneCare Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Contrôle parental\fssbho.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: EoBho Class - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb126\SearchSettings.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Afficher Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [MODE FREE BIRD SURF] "C:\ProgramData\Ford cast balm.69dku"
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD40/JSCDL/jre/6u5-b19/jinstall-6u5-windows-i586-jc.cab?AuthParam=1208210985_9816c0e94647e4efc34418179931d2c0&GroupName=JSC&BHost=javadl.sun.com&FilePath=/ESD40/JSCDL/jre/6u5-b19/jinstall-6u5-windows-i586-jc.cab&File=jinstall-6u5-windows-i586-jc.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Planificateur LiveUpdate automatique (Automatic LiveUpdate Scheduler) - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

Utilisateur anonyme · Answer

Salut fais ceci:

Première méthode : utiliser navilog (d'Il Mafioso) (Sous XP)Faire un clic droit sur ce lien : http://perso.orange.fr/il.mafioso/Navifix/Navilog1.zip 
Enregistrez la cible (du lien) sous... et enregistrez-le sur le bureau. 
Faire un clic droit sur navilog1.zip et choisir "tout extraire" 
Double-cliquez sur navilog1.exe 
Arriver au menu principal, choisir l'option 1 et valider. 
Patientez jusqu'au message : Analyse Termine le ... 
Le rapport sera en outre sauvegardé à la racine du disque (fixnavi.txt)

louloute48 · Answer

et ca ne me le fait que sur ma session cel des invite il n y a aucun probleme

louloute48 · Answer

g desinstaler messenger plus pour l instant rien arrive

lebrestois · Answer

bonjour, a tu téléchargé msm live plus.

louloute48 · Answer

oui mais je les desinstaler

gil le fantom · Answer

bonsoir a tous
louloute as tu encore des pub cid ?

gil le fantom · Answer

tu télécharge Lop S&D.exe sur ton Bureau.https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2

* Double-clique dessus pour lancer l'installation
* Puis double-clique sur le raccourci Lop S&D présent sur ton Bureau
* Séléctionne la langue souhaitée , puis choisis l'option 1 (Recherche)
* Patiente jusqu'à la fin du scan
* Poste le rapport généré (C:\lopR.txt)

louloute48 · Answer

-----------------------[  Lop S&D 4.2.0-2  XP/Vista  ]---------------------

   [ Windows 'Longhorn' (NT 6.0) Workstation Build 6000 ]
   [ USER : magali ] [ "C:\Lop SD" ] [ Selection : 1 ]
   [ 29/04/2008 | 20:29:43,00 ] [ PC : PC-DE-MAGALI ]
   [ MAJ : 27-04-2008 | 11:15 ]
   [ UAC => 0 ]
 
   -------------[ Listing des dossiers dans Application Data ]------------  

   [06/03/2008|14:18] C:\Users\magali\AppData\Roaming\Adobe\Flash Player
   [07/01/2008|20:29] C:\Users\magali\AppData\Roaming\Adobe\Linguistics
   [13/12/2007|13:24] C:\Users\magali\AppData\Roaming\Adobe\Acrobat
   [07/12/2007|00:14] C:\Users\magali\AppData\Roaming\Adobe\AUM
   [07/12/2007|00:14] C:\Users\magali\AppData\Roaming\Adobe\Online Services
   [07/12/2007|00:06] C:\Users\magali\AppData\Roaming\Adobe\Photoshop Album


   [04/02/2008|14:07] C:\Users\magali\AppData\Roaming\ange-1156546189.zip\ange-1156546189.zip

   [07/12/2007|00:22] C:\Users\magali\AppData\Roaming\Apple Computer\QuickTime

   [05/12/2007|19:23] C:\Users\magali\AppData\Roaming\ATI\ACE

   [07/03/2008|21:05] C:\Users\magali\AppData\Roaming\AVS4YOU\AVSAudioConverter
   [06/03/2008|21:48] C:\Users\magali\AppData\Roaming\AVS4YOU\AVSVideoConverter

   [23/04/2008|17:50] C:\Users\magali\AppData\Roaming\BT\BT Softphone 2

   [05/12/2007|19:24] C:\Users\magali\AppData\Roaming\CyberLink\MagicSports

   [13/03/2008|18:39] C:\Users\magali\AppData\Roaming\EoRezo\user.cyp
   [13/03/2008|18:39] C:\Users\magali\AppData\Roaming\EoRezo\cache
   [13/03/2008|18:34] C:\Users\magali\AppData\Roaming\EoRezo\EoWeather.cfg
   [13/03/2008|18:34] C:\Users\magali\AppData\Roaming\EoRezo\eoDesktop
   [13/03/2008|18:34] C:\Users\magali\AppData\Roaming\EoRezo\db
   [13/03/2008|18:34] C:\Users\magali\AppData\Roaming\EoRezo\cmhost.cyp
   [13/03/2008|18:34] C:\Users\magali\AppData\Roaming\EoRezo\host.cyp
   [13/03/2008|17:25] C:\Users\magali\AppData\Roaming\EoRezo\ConfMedia.cyp
   [13/03/2008|17:25] C:\Users\magali\AppData\Roaming\EoRezo\ConfMedia.cyp.old
   [12/03/2008|20:13] C:\Users\magali\AppData\Roaming\EoRezo	owns.cfg
   [12/03/2008|20:08] C:\Users\magali\AppData\Roaming\EoRezo\EoWeather

   [20/04/2008|21:41] C:\Users\magali\AppData\Roaming\GDIPFONTCACHEV1.DAT\GDIPFONTCACHEV1.DAT


   [06/12/2007|00:37] C:\Users\magali\AppData\Roaming\Hemera\69820
   [06/12/2007|00:37] C:\Users\magali\AppData\Roaming\Hemera\Hemera Collections

   [05/12/2007|19:22] C:\Users\magali\AppData\Roaming\Identities\{DDCB69D8-6E3E-4615-AA44-DEBD689DBEBE}

   [06/12/2007|11:33] C:\Users\magali\AppData\Roaming\InstallShield\UpdateService

   [13/03/2008|12:57] C:\Users\magali\AppData\Roaming\ItsLabel\ItsTV

   [26/01/2008|13:18] C:\Users\magali\AppData\Roaming\Macromedia\Flash Player


   [20/04/2008|21:55] C:\Users\magali\AppData\Roaming\Microsoft\ModŠles
   [20/04/2008|21:55] C:\Users\magali\AppData\Roaming\Microsoft\Word
   [10/04/2008|14:22] C:\Users\magali\AppData\Roaming\Microsoft\HTML Help
   [05/04/2008|14:04] C:\Users\magali\AppData\Roaming\Microsoft\MSN Messenger
   [19/03/2008|13:06] C:\Users\magali\AppData\Roaming\Microsoft\Templates
   [26/02/2008|18:16] C:\Users\magali\AppData\Roaming\Microsoft\Outlook
   [26/02/2008|18:14] C:\Users\magali\AppData\Roaming\Microsoft\digital locker
   [24/02/2008|23:39] C:\Users\magali\AppData\Roaming\Microsoft\Office
   [24/02/2008|23:39] C:\Users\magali\AppData\Roaming\Microsoft\preuve
   [24/02/2008|23:38] C:\Users\magali\AppData\Roaming\Microsoft\Excel
   [24/02/2008|23:38] C:\Users\magali\AppData\Roaming\Microsoft\Forms
   [22/02/2008|23:56] C:\Users\magali\AppData\Roaming\Microsoft\Windows Photo Gallery
   [22/02/2008|22:16] C:\Users\magali\AppData\Roaming\Microsoft\Media Player
   [09/01/2008|00:21] C:\Users\magali\AppData\Roaming\Microsoft\Crypto
   [08/01/2008|19:36] C:\Users\magali\AppData\Roaming\Microsoft\Windows Live Call
   [08/01/2008|19:36] C:\Users\magali\AppData\Roaming\Microsoft\IdentityCRL
   [07/01/2008|15:02] C:\Users\magali\AppData\Roaming\Microsoft\WLTB Custom Buttons
   [07/01/2008|13:20] C:\Users\magali\AppData\Roaming\Microsoft\Internet Explorer
   [01/01/2008|14:21] C:\Users\magali\AppData\Roaming\Microsoft\Macros compl‚mentaires
   [06/12/2007|22:39] C:\Users\magali\AppData\Roaming\Microsoft\Windows
   [06/12/2007|22:35] C:\Users\magali\AppData\Roaming\Microsoft\Speech
   [06/12/2007|11:36] C:\Users\magali\AppData\Roaming\Microsoft\MMC
   [06/12/2007|03:19] C:\Users\magali\AppData\Roaming\Microsoft\UProof
   [06/12/2007|03:18] C:\Users\magali\AppData\Roaming\Microsoft\OneNote
   [06/12/2007|02:48] C:\Users\magali\AppData\Roaming\Microsoft\eHome
   [06/12/2007|01:02] C:\Users\magali\AppData\Roaming\Microsoft\Proof
   [06/12/2007|01:00] C:\Users\magali\AppData\Roaming\Microsoft\Document Building Blocks
   [06/12/2007|00:26] C:\Users\magali\AppData\Roaming\Microsoft\AddIns
   [05/12/2007|21:48] C:\Users\magali\AppData\Roaming\Microsoft\Works
   [05/12/2007|19:24] C:\Users\magali\AppData\Roaming\Microsoft\CLR Security Config
   [05/12/2007|19:23] C:\Users\magali\AppData\Roaming\Microsoft\SystemCertificates
   [05/12/2007|19:22] C:\Users\magali\AppData\Roaming\Microsoft\Protect
   [05/12/2007|19:13] C:\Users\magali\AppData\Roaming\Microsoft\Credentials

   [12/03/2008|18:56] C:\Users\magali\AppData\Roaming\Mozilla\Firefox

   [19/03/2008|16:04] C:\Users\magali\AppData\Roaming\Nero\Nero8

   [26/01/2008|13:40] C:\Users\magali\AppData\Roaming\Nokia\Music Manager
   [26/01/2008|13:27] C:\Users\magali\AppData\Roaming\Nokia\PCSync
   [26/01/2008|13:26] C:\Users\magali\AppData\Roaming\Nokia\GetConnectedWizard
   [26/01/2008|13:25] C:\Users\magali\AppData\Roaming\Nokia\ContactsEditor

   [29/04/2008|20:30] C:\Users\magali\AppData\Roaming\Packard Bell\Setup my PC
   [26/02/2008|16:59] C:\Users\magali\AppData\Roaming\Packard Bell\Smart Restore
   [05/12/2007|19:24] C:\Users\magali\AppData\Roaming\Packard Bell\IDCard

   [26/01/2008|13:26] C:\Users\magali\AppData\Roaming\PC Suite\Settings

   [26/04/2008|14:41] C:\Users\magali\AppData\Roaming\PC Tools\Spyware Doctor

   [05/12/2007|21:31] C:\Users\magali\AppData\Roaming\Roxio\MediaManager9
   [05/12/2007|19:35] C:\Users\magali\AppData\Roaming\Roxio\RoxioCentral
   [05/12/2007|19:35] C:\Users\magali\AppData\Roaming\Roxio\RoxioCentral33

   [16/12/2007|01:28] C:\Users\magali\AppData\Roaming\SecuROM\UserData

   [26/04/2008|15:11] C:\Users\magali\AppData\Roaming\Skinux\BTSoftphone2


   [27/02/2008|15:31] C:\Users\magali\AppData\Roaming\Symantec\NPMDataStore
   [26/02/2008|12:56] C:\Users\magali\AppData\Roaming\Symantec\Cleanup

   [05/12/2007|19:36] C:\Users\magali\AppData\Roaming\Talkback\MozillaOrg

   [24/01/2007|05:02] C:\Users\magali\AppData\Roaming\Template\Normal.wpt

   [22/03/2008|12:25] C:\Users\magali\AppData\Roaming\TomTom\HOME

   [26/12/2007|07:22] C:\Users\magali\AppData\Roaming\UserTile.png\UserTile.png

   [29/04/2008|19:24] C:\Users\magali\AppData\Roaming\vlc\vlcrc
   [27/03/2008|12:04] C:\Users\magali\AppData\Roaming\vlc\cache

   [14/04/2008|16:50] C:\Users\magali\AppData\Roaming\wklnhst.dat\wklnhst.dat
 
   ----------------[ Tâches planifiées dans C:\Windows	asks ]---------------

   [29/04/2008 10:10][--a------] C:\Windows	asks\Norton Internet Security Online - Effectuer une analyse complŠte du systŠme - magali.job
   [07/01/2008 12:11][--a------] C:\Windows	asks\V‚rifier les mises … jour de Windows Live Toolbar.job
   [29/04/2008 15:56][--ah-----] C:\Windows	asks\User_Feed_Synchronization-{E709A7D3-715C-43AD-A5DB-9DCB63E7F0F6}.job
   [29/04/2008 20:30][--a------] C:\Windows	asks\Extension de garantie.job
   [29/04/2008 20:30][--a------] C:\Windows	asks\Recovery DVD Creator.job
   [29/04/2008 20:28][--ah-----] C:\Windows	asks\SA.DAT
   [29/04/2008 20:27][--a------] C:\Windows	asks\SCHEDLGU.TXT
  
   ------[ Listing des dossiers dans C:\ProgramData ]------
   
   [23/08/2007|11:03] C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
   [20/04/2008|10:40] C:\ProgramData\118300.34
   [20/04/2008|19:23] C:\ProgramData\Adobe
   [07/12/2007|00:07] C:\ProgramData\Apple Computer
   [02/11/2006|15:02] C:\ProgramData\Application Data 
   [23/08/2007|10:37] C:\ProgramData\Atheros
   [06/03/2008|22:25] C:\ProgramData\AVS4YOU
   [31/03/2008|18:51] C:\ProgramData\beep axis mode free
   [19/04/2008|10:50] C:\ProgramData\Beep Mapi Mapi.2uong2
   [31/03/2008|18:51] C:\ProgramData\Beep Mapi Mapi.meu38tg
   [31/03/2008|18:51] C:\ProgramData\Beep Mapi Mapi.sw7k6ep
   [23/04/2008|17:49] C:\ProgramData\BT
   [05/12/2007|19:09] C:\ProgramData\Bureau 
   [23/08/2007|10:52] C:\ProgramData\CyberLink
   [02/11/2006|15:02] C:\ProgramData\Desktop 
   [02/11/2006|15:02] C:\ProgramData\Documents 
   [17/03/2008|02:45] C:\ProgramData\eMule
   [05/12/2007|19:09] C:\ProgramData\Favoris 
   [02/11/2006|15:02] C:\ProgramData\Favorites 
   [31/03/2008|18:51] C:\ProgramData\Ford cast balm.69dku
   [07/04/2008|16:17] C:\ProgramData\GamesBar
   [29/02/2008|19:24] C:\ProgramData\GESTAN
   [09/12/2007|19:55] C:\ProgramData\Google
   [14/04/2008|14:41] C:\ProgramData\Grisoft
   [26/01/2008|13:20] C:\ProgramData\Installations
   [23/08/2007|10:50] C:\ProgramData\InstallShield
   [23/04/2008|19:22] C:\ProgramData\Lavasoft
   [05/12/2007|19:09] C:\ProgramData\Menu D‚marrer 
   [24/02/2008|03:20] C:\ProgramData\Microsoft
   [09/04/2008|22:14] C:\ProgramData\Microsoft Help
   [05/12/2007|19:09] C:\ProgramData\ModŠles 
   [26/03/2008|23:23] C:\ProgramData\Nero
   [26/01/2008|13:27] C:\ProgramData\PC Suite
   [26/04/2008|15:05] C:\ProgramData\PC Tools
   [23/08/2007|11:07] C:\ProgramData\Roxio
   [29/03/2008|11:25] C:\ProgramData\Skype
   [25/02/2008|15:48] C:\ProgramData\Sonic
   [26/04/2008|15:23] C:\ProgramData\Spybot - Search & Destroy
   [02/11/2006|15:02] C:\ProgramData\Start Menu 
   [29/04/2008|18:33] C:\ProgramData\Symantec
   [29/04/2008|20:29] C:\ProgramData\TEMP
   [02/11/2006|15:02] C:\ProgramData\Templates 
   [09/03/2008|19:43] C:\ProgramData\WLInstaller
   [07/04/2008|16:52] C:\ProgramData\Yahoo! Companion
 
   ---------------[ Listing des dossiers dans C:\Program Files ]--------------
 
   [23/08/2007|11:03] C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
   [20/04/2008|19:23] C:\Program Files\Adobe
   [26/02/2008|18:27] C:\Program Files\Alwil Software
   [10/03/2008|14:57] C:\Program Files\Architecte 3D Silver
   [21/04/2008|13:29] C:\Program Files\a-squared Anti-Malware
   [23/08/2007|10:37] C:\Program Files\Atheros
   [23/08/2007|10:31] C:\Program Files\ATI
   [23/08/2007|10:34] C:\Program Files\ATI Technologies
   [23/08/2007|10:29] C:\Program Files\ATK Hotkey
   [24/03/2008|17:42] C:\Program Files\AviSynth 2.5
   [09/03/2008|00:59] C:\Program Files\A-Z
   [26/04/2008|15:37] C:\Program Files\BT Softphone 2
   [07/04/2008|16:32] C:\Program Files\CCleaner
   [26/04/2008|15:20] C:\Program Files\Common Files
   [23/08/2007|10:51] C:\Program Files\CyberLink
   [07/01/2008|23:14] C:\Program Files\desktop.ini
   [26/01/2008|13:25] C:\Program Files\DIFX
   [10/03/2008|20:03] C:\Program Files\eMule
   [05/12/2007|19:09] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
   [07/03/2008|21:23] C:\Program Files\Free Audio Pack
   [27/03/2008|20:28] C:\Program Files\Free Easy Burner
   [07/03/2008|19:32] C:\Program Files\Free Video Converter
   [07/04/2008|16:18] C:\Program Files\Gamenext
   [07/04/2008|16:17] C:\Program Files\GamesBar
   [29/02/2008|19:21] C:\Program Files\GESTAN
   [09/12/2007|22:42] C:\Program Files\Google
   [23/08/2007|10:42] C:\Program Files\HDReg
   [20/04/2008|13:16] C:\Program Files\InstallShield Installation Information
   [09/04/2008|22:31] C:\Program Files\Internet Explorer
   [15/04/2008|00:11] C:\Program Files\Java
   [09/03/2008|00:07] C:\Program Files\Kingdia Software
   [15/12/2007|23:59] C:\Program Files\Logitech
   [02/11/2006|14:37] C:\Program Files\Microsoft Games
   [01/01/2008|14:11] C:\Program Files\Microsoft Office
   [23/08/2007|11:01] C:\Program Files\Microsoft Works
   [23/08/2007|11:01] C:\Program Files\Microsoft.NET
   [23/08/2007|19:48] C:\Program Files\Movie Maker
   [07/04/2008|17:15] C:\Program Files\Mozilla Firefox
   [02/11/2006|14:37] C:\Program Files\MSBuild
   [02/11/2006|14:37] C:\Program Files\MSN
   [07/01/2008|22:35] C:\Program Files\MSXML 4.0
   [12/03/2008|19:46] C:\Program Files\Nero
   [26/02/2008|17:17] C:\Program Files\Norton 360
   [01/03/2008|03:40] C:\Program Files\Norton Internet Security
   [13/03/2008|00:44] C:\Program Files\Packard Bell
   [26/01/2008|13:23] C:\Program Files\PC Connectivity Solution
   [23/08/2007|11:03] C:\Program Files\Picasa2
   [24/03/2008|18:16] C:\Program Files\pspvideo9
   [07/12/2007|00:08] C:\Program Files\QuickTime
   [09/03/2008|00:38] C:\Program Files\Red Kawa
   [02/11/2006|14:37] C:\Program Files\Reference Assemblies
   [23/08/2007|10:49] C:\Program Files\Roxio
   [07/03/2008|19:36] C:\Program Files\Search Settings
   [26/04/2008|15:23] C:\Program Files\Spybot - Search & Destroy
   [29/04/2008|20:29] C:\Program Files\Spyware Doctor
   [15/04/2008|00:12] C:\Program Files\Sun
   [29/02/2008|12:00] C:\Program Files\Symantec
   [23/08/2007|10:31] C:\Program Files\Synaptics
   [02/11/2006|15:01] C:\Program Files\Uninstall Information
   [25/02/2008|21:42] C:\Program Files\VideoLAN
   [07/01/2008|23:08] C:\Program Files\Windows Calendar
   [23/08/2007|19:48] C:\Program Files\Windows Collaboration
   [23/08/2007|19:57] C:\Program Files\Windows Defender
   [23/08/2007|19:48] C:\Program Files\Windows Journal
   [28/02/2008|04:02] C:\Program Files\Windows Live
   [07/01/2008|12:11] C:\Program Files\Windows Live Toolbar
   [09/04/2008|22:31] C:\Program Files\Windows Mail
   [22/02/2008|14:57] C:\Program Files\Windows Media Components
   [07/01/2008|23:08] C:\Program Files\Windows Media Player
   [05/12/2007|19:09] C:\Program Files\Windows NT
   [23/08/2007|19:48] C:\Program Files\Windows Photo Gallery
   [09/01/2008|16:43] C:\Program Files\Windows Sidebar
   [07/04/2008|16:32] C:\Program Files\Yahoo!
  
   ------[ Listing des dossiers dans C:\Program Files\Common Files ]------
   
   [20/04/2008|19:23] C:\Program Files\Common Files\Adobe
   [08/03/2008|23:56] C:\Program Files\Common Files\AVSMedia
   [23/08/2007|11:01] C:\Program Files\Common Files\DESIGNER
   [23/08/2007|10:51] C:\Program Files\Common Files\InstallShield
   [08/01/2008|10:39] C:\Program Files\Common Files\Java
   [15/12/2007|23:59] C:\Program Files\Common Files\Logitech
   [12/03/2008|19:42] C:\Program Files\Common Files\microsoft shared
   [26/03/2008|23:23] C:\Program Files\Common Files\Nero
   [29/02/2008|19:20] C:\Program Files\Common Files\PC SOFT
   [26/04/2008|15:00] C:\Program Files\Common Files\PC Tools
   [23/08/2007|10:49] C:\Program Files\Common Files\Roxio Shared
   [02/11/2006|13:18] C:\Program Files\Common Files\Services
   [23/08/2007|10:49] C:\Program Files\Common Files\Sonic Shared
   [02/11/2006|13:18] C:\Program Files\Common Files\SpeechEngines
   [23/08/2007|10:49] C:\Program Files\Common Files\SureThing Shared
   [27/03/2008|12:11] C:\Program Files\Common Files\Symantec Shared
   [07/01/2008|23:08] C:\Program Files\Common Files\System
   [26/02/2008|12:56] C:\Program Files\Common Files\WindowsLiveInstaller

   ---------------------------[ Process ]--------------------------

   ... 60

   iexplore.exe ~ [2664]

   ----------------------[ Recherche avec S_Lop ]---------------------

   C:\ProgramData\Beep Mapi Mapi.2uong2
   C:\ProgramData\Beep Mapi Mapi.meu38tg
   C:\ProgramData\Beep Mapi Mapi.sw7k6ep
   C:\ProgramData\Ford cast balm.69dku
   C:\ProgramData\Beep Mapi Mapi.2uong2
   C:\ProgramData\Beep Mapi Mapi.meu38tg
   C:\ProgramData\Beep Mapi Mapi.sw7k6ep
 
   -----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------

   Aucun fichier / dossier Lop trouvé ! 
 
   ----------------------[ Verification du Registre ]----------------------
 
   ..... OK !

   --------------------[ Verification du fichier Hosts ]---------------------

   Fichier Hosts PROPRE


   ----------------[ Recherche de fichiers avec Catchme ]-----------------
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-04-29 20:31:49
   Windows 6.0.6000  NTFS
   detected NTDLL code modification:
   ZwClose
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------[ Recherche d'autres infections ]---------------------

   C:\Users\magali\AppData\Local\bllortbe_navps.dat  
   C:\Users\magali\AppData\Local\bllortbe_nav.dat 
   C:\Users\magali\AppData\Local\bllortbe.dat  
   [b]! EGDACCESS !/b
 


   /!\ [Fich:28][Doss:5] C:\Users\magali\AppData\Local\Temp
   /!\ [Fich:88][Doss:1] C:\Users\magali\AppData\Roaming\MICROS~1\Windows\Cookies
   /!\ [Fich:159][Doss:5] C:\Users\magali\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5

   [ UAC => 1 ]

   --------------------[ Fin du rapport a 20:34:02,76  ]----------------------

gil le fantom · Answer

Relance Lop S&D


* Choisis cette fois ci l'Option 2 (Suppression)
* Ne ferme pas la fenêtre lors de la suppression !
* Poste le rapport généré (C:\lopR.txt)


(Si le Bureau ne réapparaît pas, presse Ctrl + Alt + Suppr , Onglet Fichier , Nouvelle tâche , tape explorer.exe et valide)

louloute48 · Answer

-----------------------[  Lop S&D 4.2.0-2  XP/Vista  ]---------------------

   [ Windows 'Longhorn' (NT 6.0) Workstation Build 6000 ]
   [ USER : magali ] [ "C:\Lop SD" ] [ Selection : 2 ]
   [ 29/04/2008 | 20:45:45,03 ] [ PC : PC-DE-MAGALI ]
   [ MAJ : 27-04-2008 | 11:15 ]
   [ UAC => 0 ]


   \\\\\\\\\\\\\\\ SUPPRESSION /////////////////////////////

   Supprimé! - C:\ProgramData\Beep Mapi Mapi.2uong2
   Supprimé! - C:\ProgramData\Beep Mapi Mapi.meu38tg
   Supprimé! - C:\ProgramData\Beep Mapi Mapi.sw7k6ep
   Supprimé! - C:\ProgramData\Ford cast balm.69dku
   Restauré! - Fichier Hosts
 
   //////////////////////////////////////-\\\\\\\\\\\\\\\\\\\\ 

 
   -------------[ Listing des dossiers dans Application Data ]------------  

   [06/03/2008|14:18] C:\Users\magali\AppData\Roaming\Adobe\Flash Player
   [07/01/2008|20:29] C:\Users\magali\AppData\Roaming\Adobe\Linguistics
   [13/12/2007|13:24] C:\Users\magali\AppData\Roaming\Adobe\Acrobat
   [07/12/2007|00:14] C:\Users\magali\AppData\Roaming\Adobe\AUM
   [07/12/2007|00:14] C:\Users\magali\AppData\Roaming\Adobe\Online Services
   [07/12/2007|00:06] C:\Users\magali\AppData\Roaming\Adobe\Photoshop Album


   [04/02/2008|14:07] C:\Users\magali\AppData\Roaming\ange-1156546189.zip\ange-1156546189.zip

   [07/12/2007|00:22] C:\Users\magali\AppData\Roaming\Apple Computer\QuickTime

   [05/12/2007|19:23] C:\Users\magali\AppData\Roaming\ATI\ACE

   [07/03/2008|21:05] C:\Users\magali\AppData\Roaming\AVS4YOU\AVSAudioConverter
   [06/03/2008|21:48] C:\Users\magali\AppData\Roaming\AVS4YOU\AVSVideoConverter

   [23/04/2008|17:50] C:\Users\magali\AppData\Roaming\BT\BT Softphone 2

   [05/12/2007|19:24] C:\Users\magali\AppData\Roaming\CyberLink\MagicSports

   [13/03/2008|18:39] C:\Users\magali\AppData\Roaming\EoRezo\user.cyp
   [13/03/2008|18:39] C:\Users\magali\AppData\Roaming\EoRezo\cache
   [13/03/2008|18:34] C:\Users\magali\AppData\Roaming\EoRezo\EoWeather.cfg
   [13/03/2008|18:34] C:\Users\magali\AppData\Roaming\EoRezo\eoDesktop
   [13/03/2008|18:34] C:\Users\magali\AppData\Roaming\EoRezo\db
   [13/03/2008|18:34] C:\Users\magali\AppData\Roaming\EoRezo\cmhost.cyp
   [13/03/2008|18:34] C:\Users\magali\AppData\Roaming\EoRezo\host.cyp
   [13/03/2008|17:25] C:\Users\magali\AppData\Roaming\EoRezo\ConfMedia.cyp
   [13/03/2008|17:25] C:\Users\magali\AppData\Roaming\EoRezo\ConfMedia.cyp.old
   [12/03/2008|20:13] C:\Users\magali\AppData\Roaming\EoRezo	owns.cfg
   [12/03/2008|20:08] C:\Users\magali\AppData\Roaming\EoRezo\EoWeather

   [20/04/2008|21:41] C:\Users\magali\AppData\Roaming\GDIPFONTCACHEV1.DAT\GDIPFONTCACHEV1.DAT


   [06/12/2007|00:37] C:\Users\magali\AppData\Roaming\Hemera\69820
   [06/12/2007|00:37] C:\Users\magali\AppData\Roaming\Hemera\Hemera Collections

   [05/12/2007|19:22] C:\Users\magali\AppData\Roaming\Identities\{DDCB69D8-6E3E-4615-AA44-DEBD689DBEBE}

   [06/12/2007|11:33] C:\Users\magali\AppData\Roaming\InstallShield\UpdateService

   [13/03/2008|12:57] C:\Users\magali\AppData\Roaming\ItsLabel\ItsTV

   [26/01/2008|13:18] C:\Users\magali\AppData\Roaming\Macromedia\Flash Player


   [20/04/2008|21:55] C:\Users\magali\AppData\Roaming\Microsoft\ModŠles
   [20/04/2008|21:55] C:\Users\magali\AppData\Roaming\Microsoft\Word
   [10/04/2008|14:22] C:\Users\magali\AppData\Roaming\Microsoft\HTML Help
   [05/04/2008|14:04] C:\Users\magali\AppData\Roaming\Microsoft\MSN Messenger
   [19/03/2008|13:06] C:\Users\magali\AppData\Roaming\Microsoft\Templates
   [26/02/2008|18:16] C:\Users\magali\AppData\Roaming\Microsoft\Outlook
   [26/02/2008|18:14] C:\Users\magali\AppData\Roaming\Microsoft\digital locker
   [24/02/2008|23:39] C:\Users\magali\AppData\Roaming\Microsoft\Office
   [24/02/2008|23:39] C:\Users\magali\AppData\Roaming\Microsoft\preuve
   [24/02/2008|23:38] C:\Users\magali\AppData\Roaming\Microsoft\Excel
   [24/02/2008|23:38] C:\Users\magali\AppData\Roaming\Microsoft\Forms
   [22/02/2008|23:56] C:\Users\magali\AppData\Roaming\Microsoft\Windows Photo Gallery
   [22/02/2008|22:16] C:\Users\magali\AppData\Roaming\Microsoft\Media Player
   [09/01/2008|00:21] C:\Users\magali\AppData\Roaming\Microsoft\Crypto
   [08/01/2008|19:36] C:\Users\magali\AppData\Roaming\Microsoft\Windows Live Call
   [08/01/2008|19:36] C:\Users\magali\AppData\Roaming\Microsoft\IdentityCRL
   [07/01/2008|15:02] C:\Users\magali\AppData\Roaming\Microsoft\WLTB Custom Buttons
   [07/01/2008|13:20] C:\Users\magali\AppData\Roaming\Microsoft\Internet Explorer
   [01/01/2008|14:21] C:\Users\magali\AppData\Roaming\Microsoft\Macros compl‚mentaires
   [06/12/2007|22:39] C:\Users\magali\AppData\Roaming\Microsoft\Windows
   [06/12/2007|22:35] C:\Users\magali\AppData\Roaming\Microsoft\Speech
   [06/12/2007|11:36] C:\Users\magali\AppData\Roaming\Microsoft\MMC
   [06/12/2007|03:19] C:\Users\magali\AppData\Roaming\Microsoft\UProof
   [06/12/2007|03:18] C:\Users\magali\AppData\Roaming\Microsoft\OneNote
   [06/12/2007|02:48] C:\Users\magali\AppData\Roaming\Microsoft\eHome
   [06/12/2007|01:02] C:\Users\magali\AppData\Roaming\Microsoft\Proof
   [06/12/2007|01:00] C:\Users\magali\AppData\Roaming\Microsoft\Document Building Blocks
   [06/12/2007|00:26] C:\Users\magali\AppData\Roaming\Microsoft\AddIns
   [05/12/2007|21:48] C:\Users\magali\AppData\Roaming\Microsoft\Works
   [05/12/2007|19:24] C:\Users\magali\AppData\Roaming\Microsoft\CLR Security Config
   [05/12/2007|19:23] C:\Users\magali\AppData\Roaming\Microsoft\SystemCertificates
   [05/12/2007|19:22] C:\Users\magali\AppData\Roaming\Microsoft\Protect
   [05/12/2007|19:13] C:\Users\magali\AppData\Roaming\Microsoft\Credentials

   [12/03/2008|18:56] C:\Users\magali\AppData\Roaming\Mozilla\Firefox

   [19/03/2008|16:04] C:\Users\magali\AppData\Roaming\Nero\Nero8

   [26/01/2008|13:40] C:\Users\magali\AppData\Roaming\Nokia\Music Manager
   [26/01/2008|13:27] C:\Users\magali\AppData\Roaming\Nokia\PCSync
   [26/01/2008|13:26] C:\Users\magali\AppData\Roaming\Nokia\GetConnectedWizard
   [26/01/2008|13:25] C:\Users\magali\AppData\Roaming\Nokia\ContactsEditor

   [29/04/2008|20:30] C:\Users\magali\AppData\Roaming\Packard Bell\Setup my PC
   [26/02/2008|16:59] C:\Users\magali\AppData\Roaming\Packard Bell\Smart Restore
   [05/12/2007|19:24] C:\Users\magali\AppData\Roaming\Packard Bell\IDCard

   [26/01/2008|13:26] C:\Users\magali\AppData\Roaming\PC Suite\Settings

   [26/04/2008|14:41] C:\Users\magali\AppData\Roaming\PC Tools\Spyware Doctor

   [05/12/2007|21:31] C:\Users\magali\AppData\Roaming\Roxio\MediaManager9
   [05/12/2007|19:35] C:\Users\magali\AppData\Roaming\Roxio\RoxioCentral
   [05/12/2007|19:35] C:\Users\magali\AppData\Roaming\Roxio\RoxioCentral33

   [16/12/2007|01:28] C:\Users\magali\AppData\Roaming\SecuROM\UserData

   [26/04/2008|15:11] C:\Users\magali\AppData\Roaming\Skinux\BTSoftphone2


   [27/02/2008|15:31] C:\Users\magali\AppData\Roaming\Symantec\NPMDataStore
   [26/02/2008|12:56] C:\Users\magali\AppData\Roaming\Symantec\Cleanup

   [05/12/2007|19:36] C:\Users\magali\AppData\Roaming\Talkback\MozillaOrg

   [24/01/2007|05:02] C:\Users\magali\AppData\Roaming\Template\Normal.wpt

   [22/03/2008|12:25] C:\Users\magali\AppData\Roaming\TomTom\HOME

   [26/12/2007|07:22] C:\Users\magali\AppData\Roaming\UserTile.png\UserTile.png

   [29/04/2008|19:24] C:\Users\magali\AppData\Roaming\vlc\vlcrc
   [27/03/2008|12:04] C:\Users\magali\AppData\Roaming\vlc\cache

   [14/04/2008|16:50] C:\Users\magali\AppData\Roaming\wklnhst.dat\wklnhst.dat
 
   ----------------[ Tâches planifiées dans C:\Windows	asks ]---------------

   [29/04/2008 10:10][--a------] C:\Windows	asks\Norton Internet Security Online - Effectuer une analyse complŠte du systŠme - magali.job
   [07/01/2008 12:11][--a------] C:\Windows	asks\V‚rifier les mises … jour de Windows Live Toolbar.job
   [29/04/2008 15:56][--ah-----] C:\Windows	asks\User_Feed_Synchronization-{E709A7D3-715C-43AD-A5DB-9DCB63E7F0F6}.job
   [29/04/2008 20:30][--a------] C:\Windows	asks\Extension de garantie.job
   [29/04/2008 20:30][--a------] C:\Windows	asks\Recovery DVD Creator.job
   [29/04/2008 20:45][--ah-----] C:\Windows	asks\SA.DAT
   [29/04/2008 20:44][--a------] C:\Windows	asks\SCHEDLGU.TXT
  
   ------[ Listing des dossiers dans C:\ProgramData ]------
   
   [23/08/2007|11:03] C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
   [20/04/2008|10:40] C:\ProgramData\118300.34
   [20/04/2008|19:23] C:\ProgramData\Adobe
   [07/12/2007|00:07] C:\ProgramData\Apple Computer
   [02/11/2006|15:02] C:\ProgramData\Application Data 
   [23/08/2007|10:37] C:\ProgramData\Atheros
   [06/03/2008|22:25] C:\ProgramData\AVS4YOU
   [31/03/2008|18:51] C:\ProgramData\beep axis mode free
   [23/04/2008|17:49] C:\ProgramData\BT
   [05/12/2007|19:09] C:\ProgramData\Bureau 
   [23/08/2007|10:52] C:\ProgramData\CyberLink
   [02/11/2006|15:02] C:\ProgramData\Desktop 
   [02/11/2006|15:02] C:\ProgramData\Documents 
   [17/03/2008|02:45] C:\ProgramData\eMule
   [05/12/2007|19:09] C:\ProgramData\Favoris 
   [02/11/2006|15:02] C:\ProgramData\Favorites 
   [07/04/2008|16:17] C:\ProgramData\GamesBar
   [29/02/2008|19:24] C:\ProgramData\GESTAN
   [09/12/2007|19:55] C:\ProgramData\Google
   [14/04/2008|14:41] C:\ProgramData\Grisoft
   [26/01/2008|13:20] C:\ProgramData\Installations
   [23/08/2007|10:50] C:\ProgramData\InstallShield
   [23/04/2008|19:22] C:\ProgramData\Lavasoft
   [05/12/2007|19:09] C:\ProgramData\Menu D‚marrer 
   [24/02/2008|03:20] C:\ProgramData\Microsoft
   [09/04/2008|22:14] C:\ProgramData\Microsoft Help
   [05/12/2007|19:09] C:\ProgramData\ModŠles 
   [26/03/2008|23:23] C:\ProgramData\Nero
   [26/01/2008|13:27] C:\ProgramData\PC Suite
   [26/04/2008|15:05] C:\ProgramData\PC Tools
   [23/08/2007|11:07] C:\ProgramData\Roxio
   [29/03/2008|11:25] C:\ProgramData\Skype
   [25/02/2008|15:48] C:\ProgramData\Sonic
   [26/04/2008|15:23] C:\ProgramData\Spybot - Search & Destroy
   [02/11/2006|15:02] C:\ProgramData\Start Menu 
   [29/04/2008|18:33] C:\ProgramData\Symantec
   [29/04/2008|20:45] C:\ProgramData\TEMP
   [02/11/2006|15:02] C:\ProgramData\Templates 
   [09/03/2008|19:43] C:\ProgramData\WLInstaller
   [07/04/2008|16:52] C:\ProgramData\Yahoo! Companion
 
   ---------------[ Listing des dossiers dans C:\Program Files ]--------------
 
   [23/08/2007|11:03] C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
   [20/04/2008|19:23] C:\Program Files\Adobe
   [26/02/2008|18:27] C:\Program Files\Alwil Software
   [10/03/2008|14:57] C:\Program Files\Architecte 3D Silver
   [21/04/2008|13:29] C:\Program Files\a-squared Anti-Malware
   [23/08/2007|10:37] C:\Program Files\Atheros
   [23/08/2007|10:31] C:\Program Files\ATI
   [23/08/2007|10:34] C:\Program Files\ATI Technologies
   [23/08/2007|10:29] C:\Program Files\ATK Hotkey
   [24/03/2008|17:42] C:\Program Files\AviSynth 2.5
   [09/03/2008|00:59] C:\Program Files\A-Z
   [26/04/2008|15:37] C:\Program Files\BT Softphone 2
   [07/04/2008|16:32] C:\Program Files\CCleaner
   [26/04/2008|15:20] C:\Program Files\Common Files
   [23/08/2007|10:51] C:\Program Files\CyberLink
   [07/01/2008|23:14] C:\Program Files\desktop.ini
   [26/01/2008|13:25] C:\Program Files\DIFX
   [10/03/2008|20:03] C:\Program Files\eMule
   [05/12/2007|19:09] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
   [07/03/2008|21:23] C:\Program Files\Free Audio Pack
   [27/03/2008|20:28] C:\Program Files\Free Easy Burner
   [07/03/2008|19:32] C:\Program Files\Free Video Converter
   [07/04/2008|16:18] C:\Program Files\Gamenext
   [07/04/2008|16:17] C:\Program Files\GamesBar
   [29/02/2008|19:21] C:\Program Files\GESTAN
   [09/12/2007|22:42] C:\Program Files\Google
   [23/08/2007|10:42] C:\Program Files\HDReg
   [20/04/2008|13:16] C:\Program Files\InstallShield Installation Information
   [09/04/2008|22:31] C:\Program Files\Internet Explorer
   [15/04/2008|00:11] C:\Program Files\Java
   [09/03/2008|00:07] C:\Program Files\Kingdia Software
   [15/12/2007|23:59] C:\Program Files\Logitech
   [02/11/2006|14:37] C:\Program Files\Microsoft Games
   [01/01/2008|14:11] C:\Program Files\Microsoft Office
   [23/08/2007|11:01] C:\Program Files\Microsoft Works
   [23/08/2007|11:01] C:\Program Files\Microsoft.NET
   [23/08/2007|19:48] C:\Program Files\Movie Maker
   [07/04/2008|17:15] C:\Program Files\Mozilla Firefox
   [02/11/2006|14:37] C:\Program Files\MSBuild
   [02/11/2006|14:37] C:\Program Files\MSN
   [07/01/2008|22:35] C:\Program Files\MSXML 4.0
   [12/03/2008|19:46] C:\Program Files\Nero
   [26/02/2008|17:17] C:\Program Files\Norton 360
   [01/03/2008|03:40] C:\Program Files\Norton Internet Security
   [13/03/2008|00:44] C:\Program Files\Packard Bell
   [26/01/2008|13:23] C:\Program Files\PC Connectivity Solution
   [23/08/2007|11:03] C:\Program Files\Picasa2
   [24/03/2008|18:16] C:\Program Files\pspvideo9
   [07/12/2007|00:08] C:\Program Files\QuickTime
   [09/03/2008|00:38] C:\Program Files\Red Kawa
   [02/11/2006|14:37] C:\Program Files\Reference Assemblies
   [23/08/2007|10:49] C:\Program Files\Roxio
   [07/03/2008|19:36] C:\Program Files\Search Settings
   [26/04/2008|15:23] C:\Program Files\Spybot - Search & Destroy
   [29/04/2008|20:44] C:\Program Files\Spyware Doctor
   [15/04/2008|00:12] C:\Program Files\Sun
   [29/02/2008|12:00] C:\Program Files\Symantec
   [23/08/2007|10:31] C:\Program Files\Synaptics
   [02/11/2006|15:01] C:\Program Files\Uninstall Information
   [25/02/2008|21:42] C:\Program Files\VideoLAN
   [07/01/2008|23:08] C:\Program Files\Windows Calendar
   [23/08/2007|19:48] C:\Program Files\Windows Collaboration
   [23/08/2007|19:57] C:\Program Files\Windows Defender
   [23/08/2007|19:48] C:\Program Files\Windows Journal
   [28/02/2008|04:02] C:\Program Files\Windows Live
   [07/01/2008|12:11] C:\Program Files\Windows Live Toolbar
   [09/04/2008|22:31] C:\Program Files\Windows Mail
   [22/02/2008|14:57] C:\Program Files\Windows Media Components
   [07/01/2008|23:08] C:\Program Files\Windows Media Player
   [05/12/2007|19:09] C:\Program Files\Windows NT
   [23/08/2007|19:48] C:\Program Files\Windows Photo Gallery
   [09/01/2008|16:43] C:\Program Files\Windows Sidebar
   [07/04/2008|16:32] C:\Program Files\Yahoo!
  
   ------[ Listing des dossiers dans C:\Program Files\Common Files ]------
   
   [20/04/2008|19:23] C:\Program Files\Common Files\Adobe
   [08/03/2008|23:56] C:\Program Files\Common Files\AVSMedia
   [23/08/2007|11:01] C:\Program Files\Common Files\DESIGNER
   [23/08/2007|10:51] C:\Program Files\Common Files\InstallShield
   [08/01/2008|10:39] C:\Program Files\Common Files\Java
   [15/12/2007|23:59] C:\Program Files\Common Files\Logitech
   [12/03/2008|19:42] C:\Program Files\Common Files\microsoft shared
   [26/03/2008|23:23] C:\Program Files\Common Files\Nero
   [29/02/2008|19:20] C:\Program Files\Common Files\PC SOFT
   [26/04/2008|15:00] C:\Program Files\Common Files\PC Tools
   [23/08/2007|10:49] C:\Program Files\Common Files\Roxio Shared
   [02/11/2006|13:18] C:\Program Files\Common Files\Services
   [23/08/2007|10:49] C:\Program Files\Common Files\Sonic Shared
   [02/11/2006|13:18] C:\Program Files\Common Files\SpeechEngines
   [23/08/2007|10:49] C:\Program Files\Common Files\SureThing Shared
   [27/03/2008|12:11] C:\Program Files\Common Files\Symantec Shared
   [07/01/2008|23:08] C:\Program Files\Common Files\System
   [26/02/2008|12:56] C:\Program Files\Common Files\WindowsLiveInstaller

   ---------------------------[ Process ]--------------------------

   ... 52

   ... OK !

   ----------------------[ Recherche avec S_Lop ]---------------------

   Aucun fichier / dossier Lop trouvé ! 
 
   -----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------

   Aucun fichier / dossier Lop trouvé ! 
 
   ----------------------[ Verification du Registre ]----------------------
 
   ..... OK !

   --------------------[ Verification du fichier Hosts ]---------------------

   Fichier Hosts PROPRE


   ----------------[ Recherche de fichiers avec Catchme ]-----------------
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-04-29 20:47:22
   Windows 6.0.6000  NTFS
   detected NTDLL code modification:
   ZwClose
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------[ Recherche d'autres infections ]---------------------

   C:\Users\magali\AppData\Local\bllortbe_navps.dat  
   C:\Users\magali\AppData\Local\bllortbe_nav.dat 
   C:\Users\magali\AppData\Local\bllortbe.dat  
   [b]! EGDACCESS !/b
 


   /!\ [Fich:28][Doss:5] C:\Users\magali\AppData\Local\Temp
   /!\ [Fich:95][Doss:1] C:\Users\magali\AppData\Roaming\MICROS~1\Windows\Cookies
   /!\ [Fich:333][Doss:5] C:\Users\magali\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5

   [ UAC => 1 ]

   --------------------[ Fin du rapport a 20:50:15,55  ]----------------------

gil le fantom · Answer

as tu encore des pub cid?

louloute48 · Answer

j ai plus de pub cid pour le momen c est trop bien merci merci mervi vraiment

gil le fantom · Answer

c'est pas fini

Malwarebytes' Anti-Malware (MBAM)

Avantage : très bon antimalware à conserver et faire utiliser régulièrement.

Le mode d'emploi :

1) Imprime ces instructions car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.

2) Télécharge Malwarebytes' Anti-Malware (MBAM) et enregistre le sur ton Bureau à partir de ce lien :

https://www.malwarebytes.com/

3) A la fin du téléchargement, ferme toutes les fenêtres et programmes, y compris celui-ci.

4) Double-clique sur l'icône Download_mbam-setup.exe sur ton bureau pour démarrer le programme d'installation.

5) Pendant l'installation, suis les indications (en particulier le choix de la langue et l'autorisation d'accession à Internet). N'apporte aucune modification aux réglages par défaut et, en fin d'installation, vérifie que les options Update Malwarebytes' Anti-Malware et Launch Malwarebytes' Anti-Malware sont cochées.

6) MBAM démarrera automatiquement et enverra un message demandant à mettre à jour le programme avant de lancer une analyse. Comme MBAM se met automatiquement à jour en fin d'installation, clique sur OK pour fermer la boîte de dialogue. La fenêtre principale de MBAM s'affiche :

7) Dans l'onglet analyse, vérifie que "Exécuter un examen complet" est coché et clique sur le bouton Rechercher pour démarrer l'analyse.

8) MBAM analyse ton ordinateur. L'analyse peut prendre un certain temps. Il suffit de vérifier de temps en temps son avancement.

9) A la fin de l'analyse, un message s'affiche indiquant la fin de l'analyse. Clique sur OK pour poursuivre.

10) Si des malwares ont été détectés, leur liste s'affiche.
En cliquant sur Suppression (?) , MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.

11) MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Ferme le Bloc-notes. (Le rapport peut être retrouvé sous l'onglet Rapports/logs)

12) Ferme MBAM en cliquant sur Quitter.

13) Poste le rapport dans ta réponse

louloute48 · Answer

Malwarebytes' Anti-Malware 1.11
Version de la base de données: 697

Type de recherche: Examen rapide
Eléments examinés: 33714
Temps écoulé: 8 minute(s), 24 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware-Secure (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware-Secure\Spyware-Secure trial.lnk (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware-Secure\Website.lnk (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.

gil le fantom · Answer

je t"ai demander un examen complet stp

louloute48 · Answer

oui je suis desole j avais cliquer pourtant examen complet et je m en suis appercu quand j ai lu le rapport ici j ai relancer le scan desole encore une fois

louloute48 · Answer

voila
Malwarebytes' Anti-Malware 1.11
Version de la base de données: 697

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 146477
Temps écoulé: 1 hour(s), 20 minute(s), 21 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

gil le fantom · Answer

bonjour
poste un nouveau rapport hijackthis stp

louloute48 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:43:48, on 30/04/2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\svchost.exe
C:\Program Files\ATK Hotkey\ASLDRSrv.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\ATK Hotkey\Hcontrol.exe
C:\Program Files\ATK Hotkey\ATKOSD.exe
C:\Program Files\Windows Live\Contrôle parental\fsssvc.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Windows\system32\svchost.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\dfrgui.exe
C:\Windows\system32\defrag.exe
C:\Windows\system32\DfrgNtfs.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Users\magali\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live OneCare Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Contrôle parental\fssbho.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: EoBho Class - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb126\SearchSettings.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Afficher Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [MODE FREE BIRD SURF] "C:\ProgramData\Ford cast balm.69dku"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD40/JSCDL/jre/6u5-b19/jinstall-6u5-windows-i586-jc.cab?AuthParam=1208210985_9816c0e94647e4efc34418179931d2c0&GroupName=JSC&BHost=javadl.sun.com&FilePath=/ESD40/JSCDL/jre/6u5-b19/jinstall-6u5-windows-i586-jc.cab&File=jinstall-6u5-windows-i586-jc.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Planificateur LiveUpdate automatique (Automatic LiveUpdate Scheduler) - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

gil le fantom · Answer

Télécharge BTFix de Bibi26 
http://cluster1.easy-hebergement.net/ 
Dézippe l'archive sur ton Bureau. 
Ouvre le dossier BTFix. 
Double clique sur BTFix.exe. 
Clique sur Rechercher. 
Un rapport va apparaître, copie/colle-le dans ta prochaine réponse.

louloute48 · Answer

ca ne marche pas j arrive pas a le telecharger desole

louloute48 · Answer

ca ne marche pas j arrive pas a le telecharger desole

gil le fantom · Answer

pour vista

Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection): 

- Va dans démarrer puis panneau de configuration 
- Double Clique sur l'icône "Comptes d'utilisateurs" 
- Clique ensuite sur désactiver et valide.

BTFix n'est pas infecté ! Il peut être détecté à tort comme étant une toolbar indésirable ou un trojan. Pensez à désactiver temporairement votre antivirus lors du téléchargement.

Télécharge BTFix de Bibi26
http://cluster1.easy-hebergement.net/

louloute48 · Answer

c est mon lecteur vlc qui l ouvre !!!

gil le fantom · Answer

bonjour
on va faire autrement
Clic sur démarrer, poste de travail, C:, program files et supprime le dossier : 

EoRezo 

**Si un fichier/dossier persiste lors de la suppression fait ceci: 
- Redémarre ton PC. Dès l'allumage de celui-ci tapote la touche F8 (ou F5 si F8 ne fonctionne pas), à l'écran qui va apparaître choisis "mode sans echec" attends un peu.. 
Puis va supprimer les fichiers/dossiers, vide ta corbeille et redémarre ton PC normalement. 

relance hijackthis 
selectionne do a system scan only 
et coches les lignes suivantes: 

O2 - BHO: EoBho Class - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb126\SearchSettings.dll

puis clic sur le bouton "Fix Checked" 
puis tu me repost un rapport hijackthis.

ton antivirus norton est il actif ?

louloute48 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:44:50, on 01/05/2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\wuauclt.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32	askeng.exe
C:\Program Files\VideoLAN\VLC\vlc.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Users\magali\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://format.packardbell.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live OneCare Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Contrôle parental\fssbho.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: EoBho Class - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb126\SearchSettings.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Afficher Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [MODE FREE BIRD SURF] "C:\ProgramData\Ford cast balm.69dku"
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD40/JSCDL/jre/6u5-b19/jinstall-6u5-windows-i586-jc.cab?AuthParam=1208210985_9816c0e94647e4efc34418179931d2c0&GroupName=JSC&BHost=javadl.sun.com&FilePath=/ESD40/JSCDL/jre/6u5-b19/jinstall-6u5-windows-i586-jc.cab&File=jinstall-6u5-windows-i586-jc.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Planificateur LiveUpdate automatique (Automatic LiveUpdate Scheduler) - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

Pub cid

26 réponses

Discussions similaires

Newsletters