pb trojan Résolu

Question

Bonjour,
je suis manifestement infecté par un trojan (ou plusieurs?!) d'après avast, ou bitdefender
les scans et mises en quarantaine n'y font rien
voici mon hijackthis (merci d'avance pour les réponses):

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:45:32, on 14/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Fichiers communs\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Filseclab\xfilter\xfilter.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Windows Media Player\wmplayer.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\Creative\MEDIAS~1\CTCMS.exe
F:\vundo\VundoFix.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup
C:\Documents and Settings\Roro la pupute!\Bureau\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://lo.st
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [XFILTER] C:\Program Files\Filseclab\xfilter\xfilter.exe
O4 - HKLM\..\Run: [EoEngine] "C:\Program Files\EoRezo\EoEngine.exe"
O4 - HKLM\..\Run: [ItsTV] "C:\Program Files\ItsLabel\ItsTV.exe"
O4 - HKLM\..\Run: [30a685e4] rundll32.exe "C:\WINDOWS\system32\ibbcbggr.dll",b
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [yizqakxel] c:\documents and settings\roro la pupute!\local settings\application data\yizqakxel.exe yizqakxel
O4 - HKCU\..\Run: [Creative MediaSource Go] C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe /SCB
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-f82665215bfa7adf.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (MediaBar) - http://sib1.od2.com/common/musicmanager/installation/MusicManagerPlugin.CAB
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15031/CTPID.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\WINDOWS\system32\CTsvcCDA.EXE (file missing)
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Fichiers communs\BitDefender\BitDefender Communicator\xcommsvr.exe

Utilisateur anonyme · Answer

Salut ,

2 antivirus , c'est trop .
Supprime Avast .

http://www.commentcamarche.net/faq/sujet 8172 desinstaller proprement avast

************************************************

&#8594; Télécharge Navilog1

et enregistre-le sur ton bureau.

&#8594; Ensuite double clique sur navilog1.exe pour lancer l'installation.
Une fois l'installation terminée, le fix s'exécutera automatiquement.
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau).

Laisse-toi guider. Au menu principal, choisis l'option 1 

&#8594;  Pendant le scan ton anti-virus risque de gueuler , ne t'inquiete pas c'est normal ;)

Patiente jusqu'au message 

*** Analyse Termine le ..... ***

Puis poste moi le rapport. 

( rapport situé a la racine du disque ->  C:\Fixnavi.txt  )
(CTRL+A Pour tout selectionner  , CTRL+C pour copier et CTRL+V pour coller )



Ferme Internet Explorer puis fait :
Démarrer > panneau de configuration > options internet
Onglet "Contenu" puis onglet "Certificats" et si tu trouves ceci, en particulier dans "éditeurs approuvés", mais regarde ailleurs :
electronic-group
egroup
Montorgueil
VIP
Sunny Day Design Ltd

&#8594; Tu les supprimes. 

**********************************


&#8594; Télécharge SDFix et sauvegarde le sur ton Bureau.

&#8594; Redémarre en MSE

Autre tutorials pour MSE :

https://www.micro-astuce.com/depannage/demarrer-mode-sans-echec.php
http://www.coupdepoucepc.com/modules/news/article.php?storyid=253

&#8594; Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.cmd ( ou Runthis.bat ) pour lancer le scrïpt.
&#8594; Appuie sur Y pour commencer le processus de nettoyage.
&#8594; Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
&#8594; Appuie sur une touche pour redémarrer le PC.
&#8594; Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
&#8594; Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
&#8594; Appuie sur une touche pour finir l'exécution du scrïpt et charger les icônes de ton Bureau.
&#8594; Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
&#8594; Poste moi le rapport.

(CTRL+A Pour tout selectionner  , CTRL+C pour copier et CTRL+V pour coller )

+++

Utilisateur anonyme · Answer

Re ,,

Relance Navilog1 > option2 > poste le rapport.

************************

Poste le rapport SDFIX.

************************

/!\ Manip crée spécialement pour cet utilisateur , ne pas reproduire chez soi ... /!\


1)Télécharge  OTMoveIt2 ( de Old Timer ) 

2)Une fois téléchargé  double-clique sur OTMoveIt2.exe pour le lancer.

Assure toi que la case Unregister Dll's and Ocx's soit bien cochée

3)puis copie les lignes en gras qui se trouvent en dessous :

C:\WINDOWS\system32\StDKnnmp.ini2


et colle-les dans le cadre de gauche de OTMoveIt :   "Paste List Of Files/Folders to Move."
clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre Results.
clique sur Exit pour fermer.
4) Poste le rapport situé dans C:\_OTMoveIt\MovedFiles.


(CTRL+A Pour tout selectionner  , CTRL+C pour copier et CTRL+V pour coller )

5) Il te sera peut-être demander de redémarrer le pc pour achever la suppression -> Accepte ( si il ne fait pas automatiquement , fait-le toi même )

/!\ Note : Au démarrage ton bureau RISQUE de ne plus apparaître , dans ce cas fait --> CTRL+ALT+SUPP pour ouvrir le Gestionnaire des tâches.
Puis rends toi à l'onglet "Processus". Clique en haut à gauche sur Fichiers et choisis "Exécuter"

Tape explorer.exe et valide. Cela fera re-apparaître le Bureau.

*****************************

3 rapports. 


+++

rototo943 · Answer

rerere,
mon post navilog option2:
Clean Navipromo version 3.5.7 commencé le 15/05/2008 à 21:28:18,06

Outil exécuté depuis C:\Program Files
avilog1
Session actuelle : "Roro la pupute!" 

Mise à jour le 11.05.2008 à 18h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.13
Système de fichiers : NTFS

Mode suppression automatique 
avec prise en charge résultats Catchme et GNS


Nettoyage exécuté au redémarrage de l'ordinateur


 
*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)
 

*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\WINDOWS\System32" *


* Suppression dans "C:\Documents and Settings\Roro la pupute!\locals~1\applic~1" * 


* Suppression dans "C:\DOCUME~1\PROPRI~1\locals~1\applic~1" * 



*** Suppression dossiers dans "C:\WINDOWS" ***


*** Suppression dossiers dans "C:\Program Files" ***


*** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Suppression dossiers dans "c:\docume~1\alluse~1\menudm~1\progra~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\Roro la pupute!\applic~1" *** 


*** Suppression dossiers dans "C:\Documents and Settings\Roro la pupute!\locals~1\applic~1" *** 


*** Suppression dossiers dans "C:\DOCUME~1\PROPRI~1\locals~1\applic~1" *** 


*** Suppression dossiers dans "C:\Documents and Settings\Roro la pupute!\menudm~1\progra~1" *** 



*** Suppression fichiers ***


*** Suppression fichiers temporaires ***

Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\Roro la pupute!\locals~1\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\WINDOWS\system32" *


* Dans "C:\Documents and Settings\Roro la pupute!\locals~1\applic~1" * 

yizqakxel.dat trouvé !
Copie yizqakxel.dat réalisée avec succès !
yizqakxel.dat supprimé !

yizqakxel_navps.dat trouvé !
Copie yizqakxel_navps.dat réalisée avec succès !
yizqakxel_navps.dat supprimé !


* Dans "C:\DOCUME~1\PROPRI~1\locals~1\applic~1" * 


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat OOO-Favorit supprimé !
Certificat Sunny-Day-Design-Ltdt absent !

*** Nettoyage terminé le 15/05/2008 à 21:34:34,70 ***

rototo943 · Answer

rapport SD fix:


[b]SDFix: Version 1.182 [/b]
Run by Roro la pupute! on 15/05/2008 at 20:14

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


[b]Checking Files [/b]: 

No Trojan Files Found






Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1359.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-15 20:30:12
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Orange\Connectivity\ConnectivityManager.exe"="C:\Program Files\Orange\Connectivity\ConnectivityManager.exe:*:enabled:CSS"
"C:\Program Files\Azureus\Azureus.exe"="C:\Program Files\Azureus\Azureus.exe:*:Enabled:Azureus"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Wed 14 May 2008     1,490,272 ..SH. --- "C:\WINDOWS\system32ggbcbbi.tmp"
Wed  7 Nov 2007         4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Fri 19 Oct 2007             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Tue 13 May 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\069dce5b3a6a576c9856befb57fca0a9\BIT2E.tmp"
Wed 14 May 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0a67b6c406b1d7e0f5c1e6f6d44a3f6e\BIT1D.tmp"
Wed 14 May 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\18b19374451d28a8fbaf1939cf31ff45\BIT20.tmp"
Wed 14 May 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\22fb973e059470cc1b5d76c4ae605351\BIT24.tmp"
Thu  8 May 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\24af2a69c06a4de03e35dc89d706475f\BIT4.tmp"
Wed 14 May 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\26924cbc8132a10b438ce6e2b49d4652\BIT1C.tmp"
Wed 14 May 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\2769b111678c52099a3b3123b12f2325\BIT21.tmp"
Wed 14 May 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\30285791903730fbf957a83562db4ff4\BIT1E.tmp"
Sat  8 Mar 2008    10,092,048 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\8b3179d71e82d8085d960408b16ae5bf\BIT66.tmp"
Wed 14 May 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\9e870549834e2bceb796e44a1e3ac6f5\BIT23.tmp"
Wed 14 May 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\cb8921d0c7830b2f33c00fa4c8a10d17\BIT1F.tmp"
Wed 14 May 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\d77b9b5b8fed23dd91f50d167cce60d3\BIT22.tmp"

[b]Finished![/b]

rototo943 · Answer

rapport OTMoveIt2:

C:\WINDOWS\system32\StDKnnmp.ini2 moved successfully.
 
OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 05152008_215129

Utilisateur anonyme · Answer

Re ,,

Poste un rapport Hijackthis.

++

rototo943 · Answer

mon rapport hijackthis,

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:02:29, on 16/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Roro la pupute!\Bureau\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://lo.st
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [EoEngine] "C:\Program Files\EoRezo\EoEngine.exe"
O4 - HKLM\..\Run: [ItsTV] "C:\Program Files\ItsLabel\ItsTV.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Creative MediaSource Go] C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe /SCB
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-f82665215bfa7adf.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (MediaBar) - http://sib1.od2.com/common/musicmanager/installation/MusicManagerPlugin.CAB
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15031/CTPID.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\WINDOWS\system32\CTsvcCDA.EXE (file missing)
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Utilisateur anonyme · Answer

Re ,,

Renomme Hijackthis stp.

********************

Pour vérifier :

&#8594; Imprime ces instructions car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.

&#8594; Télécharge Malwarebytes' Anti-Malware (MBAM) et enregistre le sur ton Bureau.

&#8594; A la fin du téléchargement, ferme toutes les fenêtres et programmes, y compris celui-ci.

&#8594; Double-clique sur l'icône Download_mbam-setup.exe sur ton bureau pour démarrer le programme d'installation.

&#8594; Pendant l'installation, suis les indications (en particulier le choix de la langue et l'autorisation d'accession à Internet). N'apporte aucune modification aux réglages par défaut et, en fin d'installation, vérifie que les options Update Malwarebytes' Anti-Malware et Launch Malwarebytes' Anti-Malware sont cochées.

&#8594; MBAM démarrera automatiquement et enverra un message demandant à mettre à jour le programme avant de lancer une analyse. Comme MBAM se met automatiquement à jour en fin d'installation, clique sur OK pour fermer la boîte de dialogue. La fenêtre principale de MBAM s'affiche :

&#8594; Dans l'onglet analyse, vérifie que "Exécuter un examen complet" est coché et clique sur le bouton Rechercher pour démarrer l'analyse.

&#8594; MBAM analyse ton ordinateur. L'analyse peut prendre un certain temps. Il suffit de vérifier de temps en temps son avancement.

&#8594; A la fin de l'analyse, un message s'affiche indiquant la fin de l'analyse. Clique sur OK pour poursuivre.

&#8594; Si des malwares ont été détectés, leur liste s'affiche.
En cliquant sur Suppression (?) , MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.

&#8594; MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Ferme le Bloc-notes. (Le rapport peut être retrouvé sous l'onglet Rapports/logs)

&#8594; Ferme MBAM en cliquant sur Quitter.

&#8594; Poste le rapport dans ta réponse


A+

rototo943 · Answer

ça veut dire quoi renomme hijackthis??

Utilisateur anonyme · Answer

Re , Désolé j'ai oublié de préciser ... Ceci : *********************************** Renomme l'icône ( clique droit > renommer )' Hijackthis.exe 'située dans le dossier dans C:\ , en ' HJT.exe ' <<<<<<<<< Important !!! <<<<<<< Le chemin d'accés du programme doit être ressemblant à celui-ci : C:\Programme\Trend Micro\Hijackthis\HJT.exe → Ne pas renommer l'icône du raccourci sur le bureau bien entendu ... *********************************** ++

rototo943 · Answer

et hop le MBAM:

Malwarebytes' Anti-Malware 1.12
Version de la base de données: 755

Type de recherche: Examen complet (C:\|E:\|F:\|)
Eléments examinés: 135512
Temps écoulé: 1 hour(s), 15 minute(s), 24 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 9
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 8

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\pmnnKDtS.dll (Trojan.Vundo) -> No action taken.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{78bf2711-59bd-4286-9212-d102dab3c47a} (Trojan.Vundo) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{78bf2711-59bd-4286-9212-d102dab3c47a} (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BM3395b678 (Trojan.Agent) -> No action taken.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\pmnnkdts -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\pmnnkdts  -> No action taken.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\gejguend.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\dneugjeg.ini (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\mwlsvaxy.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\yxavslwm.ini (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\pmnnKDtS.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\StDKnnmp.ini (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\StDKnnmp.ini2 (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\icotmtvm.dll (Trojan.Agent) -> No action taken.

rototo943 · Answer

j'ai renommé Hijackthis, tu ne l'a pas précisé, mais je poste le rapport suite à ça (?):

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:07:11, on 17/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\Azureus\Azureus.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Creative\MediaSource\CTCMS.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HJT.exe
C:\WINDOWS\system32\SearchProtocolHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://lo.st
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {468952AE-8125-4E1E-80B8-9AB475CF0D47} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {8E327C20-5EEC-42FE-B19E-64A4158807A9} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: {7bb69972-7f85-997b-33c4-c8cff9c98f0c} - {c0f89c9f-fc8c-4c33-b799-58f727996bb7} - C:\WINDOWS\system32\wnjftbet.dll
O2 - BHO: (no name) - {d085af9c-c11f-443a-9f92-138e566ee648} - C:\WINDOWS\system32	psbexuk.dll
O2 - BHO: (no name) - {DD4A65C7-61D7-445F-BCF1-5065F765EAF9} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [EoEngine] "C:\Program Files\EoRezo\EoEngine.exe"
O4 - HKLM\..\Run: [ItsTV] "C:\Program Files\ItsLabel\ItsTV.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Creative MediaSource Go] C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe /SCB
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-f82665215bfa7adf.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (MediaBar) - http://sib1.od2.com/common/musicmanager/installation/MusicManagerPlugin.CAB
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15031/CTPID.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\WINDOWS\system32\CTsvcCDA.EXE (file missing)
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Utilisateur anonyme · Answer

Re ,,

Comme tu peux le voir dans le rapport MBAM , 

-->   "  No action taken.   "             Il n'a rien touché.

Tu as loupé cette étape :

&#8594; Si des malwares ont été détectés, leur liste s'affiche.
En cliquant sur Suppression (?) , MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.

&#8594; MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Ferme le Bloc-notes. (Le rapport peut être retrouvé sous l'onglet Rapports/logs) 


Recommence la stp et poste le rapport.
++

rototo943 · Answer

effectivement, il y a eut une c.... dans le rapport, mais g bien supprimé les infections, voici le bon rapport:

Malwarebytes' Anti-Malware 1.12
Version de la base de données: 755

Type de recherche: Examen complet (C:\|E:\|F:\|)
Eléments examinés: 135512
Temps écoulé: 1 hour(s), 15 minute(s), 24 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 9
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 8

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\pmnnKDtS.dll (Trojan.Vundo) -> Unloaded module successfully.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{78bf2711-59bd-4286-9212-d102dab3c47a} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{78bf2711-59bd-4286-9212-d102dab3c47a} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BM3395b678 (Trojan.Agent) -> Delete on reboot.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\pmnnkdts -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\pmnnkdts  -> Delete on reboot.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\gejguend.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dneugjeg.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mwlsvaxy.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\yxavslwm.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pmnnKDtS.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\StDKnnmp.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\StDKnnmp.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\icotmtvm.dll (Trojan.Agent) -> Delete on reboot.

Utilisateur anonyme · Answer

Redémarre ton pc , et reposte un rapport Hijackthis tout frais stp.

++

rototo943 · Answer

ok, voila le post

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:44:42, on 17/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\Trend Micro\HijackThis\HJT.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://lo.st
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O2 - BHO: (no name) - {468952AE-8125-4E1E-80B8-9AB475CF0D47} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {8E327C20-5EEC-42FE-B19E-64A4158807A9} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: {7bb69972-7f85-997b-33c4-c8cff9c98f0c} - {c0f89c9f-fc8c-4c33-b799-58f727996bb7} - C:\WINDOWS\system32\wnjftbet.dll
O2 - BHO: (no name) - {d085af9c-c11f-443a-9f92-138e566ee648} - C:\WINDOWS\system32	psbexuk.dll
O2 - BHO: (no name) - {DD4A65C7-61D7-445F-BCF1-5065F765EAF9} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Creative MediaSource Go] C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe /SCB
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-f82665215bfa7adf.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (MediaBar) - http://sib1.od2.com/common/musicmanager/installation/MusicManagerPlugin.CAB
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15031/CTPID.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\WINDOWS\system32\CTsvcCDA.EXE (file missing)
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Utilisateur anonyme · Answer

Re ,,

On achève les restes du trojan Vundo.

****************************************

Télécharge VundoFix ici -> http://www.atribune.org/ccount/click.php?id=4

lance Vundofix.exe
Coche la case Run VundoFix as a task,
Un pop-up va s'ouvrir , repond ok
Il va se refermer et réouvrir au bout d'une 1 minute environ.
Quand il est réouvert, clique sur Scan for Vundo
Quand le scan est terminé, clique sur Remove Vundo
Réponds Yes à la demande de suppression des fichiers.
Il te sera demandé de redémarrer ton ordinateur, accepte bien sûr.
Colle le rapport situé dans "c:\vundofix.txt" dans ta réponse

(CTRL+A Pour tout selectionner  , CTRL+C pour copier et CTRL+V pour coller )

********************************
a++

rototo943 · Answer

résultat vundofix:


Beginning removal...

Beginning removal...

VundoFix V7.0.3

Scan started at 19:36:50 14/05/2008

Listing files found while scanning....

No infected files were found.


VundoFix V7.0.3

Scan started at 11:13:06 17/05/2008

Listing files found while scanning....

No infected files were found.


Beginning removal...

Utilisateur anonyme · Answer

Re ,


******************************************************

Dans OtmoveIt , copie/colle ces lignes :

C:\WINDOWS\system32\wnjftbet.dll 
C:\WINDOWS\system32	psbexuk.dll
Emptytemp



--> MoveIt !

Poste le rapport.
Il te sera peut-être demander de redémarrer le pc pour achever la suppression -> Accepte ( si il ne fait pas automatiquement , fait-le toi même ) 

************************************

Poste aussi un rapport Hijackthis.


++

rototo943 · Answer

le moveit...

DllUnregisterServer procedure not found in C:\WINDOWS\system32\wnjftbet.dll
C:\WINDOWS\system32\wnjftbet.dll NOT unregistered.
C:\WINDOWS\system32\wnjftbet.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32	psbexuk.dll
C:\WINDOWS\system32	psbexuk.dll NOT unregistered.
C:\WINDOWS\system32	psbexuk.dll moved successfully.
< Emptytemp  >
File delete failed. C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\swt-gdip-win32-3430.dll scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\swt-win32-3430.dll scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\~DFCA83.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\~DFCE4D.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\~DFCEB1.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\~DFDA29.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\~DFDD42.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\~DFF2DE.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\~DFF33B.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\e4j3B.tmp_dir28700\exe4jlib.jar scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\hsperfdata_Roro la pupute!\3976 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\Perflib_Perfdata_748.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\ZLT0221a.TMP scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\ZLT056bd.TMP scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\_avast4_\unp50058713.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
Temp folders emptied.
IE temp folders emptied.
 
OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 05172008_114314

Files moved on Reboot...
DllUnregisterServer procedure not found in C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\swt-gdip-win32-3430.dll
C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\swt-gdip-win32-3430.dll NOT unregistered.
C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\swt-gdip-win32-3430.dll moved successfully.
DllUnregisterServer procedure not found in C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\swt-win32-3430.dll
C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\swt-win32-3430.dll NOT unregistered.
C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\swt-win32-3430.dll moved successfully.
File C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\~DFCA83.tmp not found!
File C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\~DFCE4D.tmp not found!
File C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\~DFCEB1.tmp not found!
File C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\~DFDA29.tmp not found!
File C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\~DFDD42.tmp not found!
File C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\~DFF2DE.tmp not found!
File C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\~DFF33B.tmp not found!
C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\e4j3B.tmp_dir28700\exe4jlib.jar moved successfully.
File C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\hsperfdata_Roro la pupute!\3976 not found!
File C:\WINDOWS	emp\Perflib_Perfdata_748.dat not found!
File C:\WINDOWS	emp\ZLT0221a.TMP not found!
File C:\WINDOWS	emp\ZLT056bd.TMP not found!
File C:\WINDOWS	emp\_avast4_\unp50058713.tmp not found!
File C:\WINDOWS	emp\_avast4_\Webshlock.txt not found!

Utilisateur anonyme · Answer

Re !

Reposte un rapport Hijackthis stp.

++

rototo943 · Answer

...et le hijack:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:49:40, on 17/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS
otepad.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HJT.exe
C:\WINDOWS\system32\SearchProtocolHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://lo.st
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O2 - BHO: (no name) - {468952AE-8125-4E1E-80B8-9AB475CF0D47} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {8E327C20-5EEC-42FE-B19E-64A4158807A9} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: {7bb69972-7f85-997b-33c4-c8cff9c98f0c} - {c0f89c9f-fc8c-4c33-b799-58f727996bb7} - C:\WINDOWS\system32\wnjftbet.dll (file missing)
O2 - BHO: (no name) - {d085af9c-c11f-443a-9f92-138e566ee648} - C:\WINDOWS\system32	psbexuk.dll (file missing)
O2 - BHO: (no name) - {DD4A65C7-61D7-445F-BCF1-5065F765EAF9} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Creative MediaSource Go] C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe /SCB
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-f82665215bfa7adf.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (MediaBar) - http://sib1.od2.com/common/musicmanager/installation/MusicManagerPlugin.CAB
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15031/CTPID.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\WINDOWS\system32\CTsvcCDA.EXE (file missing)
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Utilisateur anonyme · Answer

Re re re :)

**************************************************************

&#8594; Relance hijackthis , en menu principal choisis ' Do a system scan only' Et fixe ces/cette ligne(s) : ( coche la case à leurs gauches )

R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O2 - BHO: (no name) - {468952AE-8125-4E1E-80B8-9AB475CF0D47} - (no file) 
O2 - BHO: (no name) - {8E327C20-5EEC-42FE-B19E-64A4158807A9} - (no file) 
O2 - BHO: {7bb69972-7f85-997b-33c4-c8cff9c98f0c} - {c0f89c9f-fc8c-4c33-b799-58f727996bb7} - C:\WINDOWS\system32\wnjftbet.dll (file missing)
O2 - BHO: (no name) - {d085af9c-c11f-443a-9f92-138e566ee648} - C:\WINDOWS\system32	psbexuk.dll (file missing)
O2 - BHO: (no name) - {DD4A65C7-61D7-445F-BCF1-5065F765EAF9} - (no file)
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing) 
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU) 

Ferme toutes les fenêtres (hormis Hijackthis), y compris ton navigateur web. 

&#8594; clique sur  ' fixchecked '

**********************************************


Démarrer > executer > ' services.msc ' ,

- Clic droit sur le service cité -  Creative Service for CDROM Access
- propriétés
- et dans "type de démarrage" et mets le sur « désactivé ».
- Ensuite si le "Status du service" est sur "Démarré" faire : « arrêté » 


Recommence avec : Planificateur LiveUpdate automatique


Tutorial : https://www.zebulon.fr/dossiers/windows/31-services.html

********************************************

&#8594; Télécharge CleanUp452 ( Primary download site ... )

&#8594; Lance-le et choisi l'option ' cleanup! ' 

&#8594; Poste le rapport.

Tutorial: http://pageperso.aol.fr/balltrap34/democleanup.htm ( merci à balltrap34 )

*********************************************

&#8594; Télécharge clean : http://www.malekal.com/download/clean.zip

&#8594; Dézippe-le ( clique droit , extraire tout) 

&#8594; Lance clean.cmd ( ou clean ), Choisi l'option 1 et poste moi le rapport.

(- Où est le rapport clean ? : « Poste de travail » / double clic sur disque « C / » double-clic sur « rapport_clean.txt » et « copier/coller le contenu » sur le forum. )

Note : Tu auras peut-être un message qui t'invitera a uploader un fichier , fait-le dès que tu pourras. 


Tutorial : http://bibou0007.com/outils-specifiques-f78/tuto-clean-t1007.htm

**********************************************

Rapports :

_ Cleanup
_ Clean
_ + 1 dernier Hijackthis.



+A++

rototo943 · Answer

rapport cleanup:

CleanUp! started on 05/17/08 13:26:36.
...
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\85FECN7F\Tabicon[1].png - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\85FECN7F\zzzz[1].css - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\8ZLLNBU0\11[1].gif - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\8ZLLNBU0\20F540E7D23D56A562C9CE6A464B[1].jpg - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\8ZLLNBU0\32[1].gif - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\8ZLLNBU0\6A13997D99A43235C7ECD1F16B5E3E[1].png - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\8ZLLNBU0\ADSAdClient31[2].htm - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\8ZLLNBU0\D257D215AADA5CDFCD984F3A2531A[1].png - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\8ZLLNBU0\D444C1C0EA623455B157ED637874CA[1].jpg - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\8ZLLNBU0\frfr[1].js - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\8ZLLNBU0\heart_msnfr[1].png - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\8ZLLNBU0\ie[1].css - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\8ZLLNBU0\ilm_news_mdr_awards[1].png - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\8ZLLNBU0\ix[1].e - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\8ZLLNBU0
ewpicto_tab_buddyGirl[1].png - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\8ZLLNBU0\pictonike[1].png - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\8ZLLNBU0\PictoTabIndy[1].png - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\8ZLLNBU0\picto_kdo[1].png - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\8ZLLNBU0\srchbutton[1].gif - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\S2MLUE1F\10C8DEB9C5F872C27AADBF43581385[1].png - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\S2MLUE1F\15F9D3439C531C2443464DA258E2C7[1].jpg - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\S2MLUE1F\5B23F32978DFFEAFBC5A3165DC8F[1].gif - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\S2MLUE1F\ADSAdClient31[1].htm - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\S2MLUE1F\bullet-media[1].gif - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\S2MLUE1F\CH_sport_2000[1].png - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\S2MLUE1F\DEB6DFEBECABB78484C8E03A4F5418[1].jpg - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\S2MLUE1F\delivermedia[2].asx - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\S2MLUE1F\ebay[1].png - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\S2MLUE1F\home[1].htm - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\S2MLUE1F\Image40[1].jpg - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\S2MLUE1F\loading[1].gif - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\S2MLUE1F\MsgrConfig[1].xml - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\S2MLUE1F\onglet-finances[1].png - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\S2MLUE1F\picto_18x18[1].png - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\S2MLUE1F\picto_shopping_20071112[1].png - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\S2MLUE1F\seulstwo_onglet_msn[1].png - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\S2MLUE1F\s_code[1].js - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\S2MLUE1F\views[1] - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\V2TYYL5K\DC69F6683AFE7835B8C2CE7CAFD727[1].jpg - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\V2TYYL5K\ - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.MSO\ - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.Word\ - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
http://estb.msn.com/i/39/4B5A8E6B8E867597A88582169247C7.jpg - deleted
http://estc.msn.com/br/tdy/css/12/decoration/loading.gif - deleted
http://st.msn.com/as/wea3/i/fr/saw/11.gif - deleted
https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2ffrmarkettabs.msn.fr%2f_pictos%2fshopping%2fpicto_shopping_20071112.png%3f - deleted
https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2ffrmarkettabs.msn.fr%2f_pictos%2fspaces%2fnewpicto_tab_buddyGirl.png%3f - deleted
https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2ffrmarkettabs.msn.fr%2f_pictos%2fautomobile%2fonglet-auto.png%3f - deleted
http://estb.msn.com/i/6D/CE4176A4E0B86C2227D5F2B31261.gif - deleted
https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fwww.msn.fr%2fimg%2ffr%2ffr-fr%2fmsger%2ftabs%2f_pictos%2fcoca%2fPictoCoke02.png%3f - deleted
http://estb.msn.com/i/33/6A13997D99A43235C7ECD1F16B5E3E.png - deleted
http://media.abonnez-vous.orange.fr/MSN/Image40.jpg - deleted
http://estb.msn.com/i/74/443A976443912B6F461FAE7D192783.png - deleted
http://estc.msn.com/br/tdy/css/12/zzzz.css - deleted
http://estb.msn.com/i/98/DEB6DFEBECABB78484C8E03A4F5418.jpg - deleted
http://estb.msn.com/i/44/5B23F32978DFFEAFBC5A3165DC8F.gif - deleted
https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2ffrmarkettabs.msn.fr%2f_pictos%2fcellfish%2fpicto_kdo.png%3f - deleted
http://estb.msn.com/i/8C/AB112598383CEB3C82B2C731D4FAE.png - deleted
http://estc.msn.com/br/gbl/css/5/ie.css - deleted
https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2ffrmarkettabs.msn.fr%2f_pictos%2fNRJ%2fNRJTTB_fd_trans.png%3f - deleted
http://st.msn.com/as/wea3/i/fr/saw/30.gif - deleted
http://estb.msn.com/i/73/D257D215AADA5CDFCD984F3A2531A.png - deleted
https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2ffrmarkettabs.msn.fr%2f_pictos%2fprobtp%2fpepette2.png%3f - deleted
http://estc.msn.com/br/gbl/css/5/gtl_sitegeneric.css - deleted
https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2ffrmarkettabs.msn.fr%2f_pictos%2fdivertissements%2fseulstwo%2fseulstwo_onglet_msn.png%3f - deleted
https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2ffrmarkettabs.msn.fr%2f_pictos%2fMessengerMobile%2fpicto3.png%3f - deleted
http://estb.msn.com/i/37/61B8941A35B49C2FCEB680DA1E5A22.jpg - deleted
http://estb.msn.com/i/88/22034EDE8AAE79F619080B4C9D79B.jpg - deleted
https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2ffrmarkettabs.msn.fr%2f_pictos%2ffinances%2fonglet-finances.png%3f - deleted
https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2ffrmarkettabs.msn.fr%2f_pictos%2fmessengertv%2fpicto_18x18.png%3f - deleted
https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2ffrmarkettabs.msn.fr%2f_pictos%2fdivertissements%2findianajones%2fPictoTabIndy.png%3f - deleted
https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2ffrmarkettabs.msn.fr%2f_pictos%2fWLFavorites%2fTabicon.png%3f - deleted
http://st.msn.com/as/wea3/i/fr/sab/11.gif - deleted
http://estc.msn.com/br/tdy/css/12/decoration/button_bg.png - deleted
https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2ffrmarkettabs.msn.fr%2f_pictos%2film%2film_news_mdr_awards.png%3f - deleted
http://estc.msn.com/br/tdy/css/12/decoration/srchbutton.gif - deleted
http://estb.msn.com/i/8F/795EA68F57B2DF117E175DAA333B2.jpg - deleted
http://estb.msn.com/i/8C/D444C1C0EA623455B157ED637874CA.jpg - deleted
http://media.abonnez-vous.orange.fr/MSN/Image2.jpg - deleted
http://estc.msn.com/br/gbl/css/5/decoration/pipe.gif - deleted
http://estc.msn.com/br/tdy/css/12/decoration/Home.png - deleted
http://estc.msn.com/br/gbl/css/5/decoration/bullet.gif - deleted
http://st.msn.com/as/wea3/i/fr/saw/32.gif - deleted
http://estc.msn.com/br/gbl/css/5/decoration/bullet-media.gif - deleted
http://estb.msn.com/i/CD/10C8DEB9C5F872C27AADBF43581385.png - deleted
http://pics.ebaystatic.com/aw/pics/ca/msn/ebay.png - deleted
http://estc.msn.com/br/tdy/css/12/decoration/header_bg.png - deleted
http://estb.msn.com/i/4F/8B835534F0CE944C847AE827742746.jpg - deleted
http://estb.msn.com/i/22/15F9D3439C531C2443464DA258E2C7.jpg - deleted
res://C:\WINDOWS\System32\mmcndmgr.dll/views.htm - deleted
http://media.abonnez-vous.orange.fr/MSN/Image3.jpg - deleted
http://estb.msn.com/i/A6/C93D1A9B65E949BBB26793815DC4.jpg - deleted
http://cp.intl.match.com/msn/icons/heart_msnfr.png - deleted
http://estj.msn.com/br/om/js/1/s_code.js - deleted
http://estj.msn.com/br/tdy/js/11/frfr.js - deleted
http://estb.msn.com/i/FD/20F540E7D23D56A562C9CE6A464B.jpg - deleted
https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2ffrmarkettabs.msn.fr%2f_pictos%2fnike%2fpictonike.png%3f - deleted
https://www.msn.com/en-gb - deleted
https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2ffrmarkettabs.msn.fr%2f_pictos%2fxbox%2fpictoxbox.png%3f - deleted
http://config.messenger.msn.com/Config/MsgrConfig.asmx?op=GetClientConfig&Country=FR&CLCID=040c&PLCID=040c&GeoID=84&ver=8.5.1302 - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Historique\History.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Roro la pupute!\Local Settings\Historique\History.IE5\MSHist012008051320080514\ - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Historique\History.IE5\MSHist012008051420080515\index.dat - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Historique\History.IE5\MSHist012008051420080515\ - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Historique\History.IE5\MSHist012008051520080516\index.dat - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Historique\History.IE5\MSHist012008051520080516\ - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Historique\History.IE5\MSHist012008051620080517\index.dat - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Historique\History.IE5\MSHist012008051620080517\ - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Historique\History.IE5\MSHist012008051720080518\index.dat - deleted
C:\Documents and Settings\Roro la pupute!\Local Settings\Historique\History.IE5\MSHist012008051720080518\ - deleted
'Typed URLs' (Internet Explorer) - removed from the registry.
Visited: Roro la pupute!@http://db2.t.msn.com/fr-fr/home.aspx?ver=8.5.1302&did=1&t=96jLEs4hbHB4gO2dl0YjVKwxBOqbsX6SCXxYyoILZaetnE4vGeFK505QTCD2!DV51PMs8Bg1mNr*6YcXGlYE5i68gptF1rvB!K2EyUuSXUVYt!l1OlX3NynX7dI3g3CDPd7YOickIZa!Q$&p=90L8dgwsrEZ1FTf4KotXXwZ*8n8SzzKsJzmDonRjskap!QRDp3NtICDT1F*PQrfQxqs4pw8!bkCfipsuoqMckLApN0mnyUEQvdAzH4f3i1h*bVnDg*VylampdVVd3y5ZoivbxNWAO9Xj2pQAQn31AFtBq!eQFXzN1p08W0A33!ZWuy4Y9!MzVuNs0!h3R1XIXgtB!7X3tZzaoX1V2SbRVXrw$$ - deleted
Visited: Roro la pupute!@res://c:\windows\system32\mmcndmgr.dll/views.htm - deleted
Visited: Roro la pupute!@--mmc:pagebreak.1 - deleted
Visited: Roro la pupute!@http://db2.t.msn.com/fr-fr/home.aspx?ver=8.5.1302&did=1 - deleted
C:\Documents and Settings\Roro la pupute!\Cookies\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Roro la pupute!\Cookiesoro_la_pupute!@82.98.235[1].txt - deleted
C:\Documents and Settings\Roro la pupute!\Cookiesoro_la_pupute!@85.12.43[1].txt - deleted
C:\Documents and Settings\Roro la pupute!\Cookiesoro_la_pupute!@89.188.16[2].txt - deleted
C:\Documents and Settings\Roro la pupute!\Cookiesoro_la_pupute!@bucksbill[1].txt - deleted
C:\Documents and Settings\Roro la pupute!\Cookiesoro_la_pupute!@c.msn[1].txt - deleted
C:\Documents and Settings\Roro la pupute!\Cookiesoro_la_pupute!@c.msn[2].txt - deleted
C:\Documents and Settings\Roro la pupute!\Cookiesoro_la_pupute!@cybermonitor[1].txt - deleted
C:\Documents and Settings\Roro la pupute!\Cookiesoro_la_pupute!@google[1].txt - deleted
C:\Documents and Settings\Roro la pupute!\Cookiesoro_la_pupute!@google[2].txt - deleted
C:\Documents and Settings\Roro la pupute!\Cookiesoro_la_pupute!@hotmail.msn[1].txt - deleted
C:\Documents and Settings\Roro la pupute!\Cookiesoro_la_pupute!@live[1].txt - deleted
C:\Documents and Settings\Roro la pupute!\Cookiesoro_la_pupute!@live[2].txt - deleted
C:\Documents and Settings\Roro la pupute!\Cookiesoro_la_pupute!@login.live[2].txt - deleted
C:\Documents and Settings\Roro la pupute!\Cookiesoro_la_pupute!@messenger.msn[1].txt - deleted
C:\Documents and Settings\Roro la pupute!\Cookiesoro_la_pupute!@messenger.msn[2].txt - deleted
C:\Documents and Settings\Roro la pupute!\Cookiesoro_la_pupute!@msn[1].txt - deleted
C:\Documents and Settings\Roro la pupute!\Cookiesoro_la_pupute!@msn[2].txt - deleted
C:\Documents and Settings\Roro la pupute!\Cookiesoro_la_pupute!@rad.msn[2].txt - deleted
C:\Documents and Settings\Roro la pupute!\Cookiesoro_la_pupute!@rad.msn[3].txt - deleted
C:\Documents and Settings\Roro la pupute!\Cookiesoro_la_pupute!@scache2.eorezo[1].txt - deleted
C:\Documents and Settings\Roro la pupute!\Cookiesoro_la_pupute!@statsgod[1].txt - deleted
C:\Documents and Settings\Roro la pupute!\Cookiesoro_la_pupute!@t.msn[1].txt - deleted
C:\Documents and Settings\Roro la pupute!\Cookiesoro_la_pupute!@t.msn[3].txt - deleted
C:\Documents and Settings\Roro la pupute!\Cookiesoro_la_pupute!@windowsmarketplace[2].txt - deleted
C:\Documents and Settings\Roro la pupute!\Cookiesoro_la_pupute!@yahoo[2].txt - deleted
C:\Documents and Settings\Roro la pupute!\Cookiesoro_la_pupute!@zune[2].txt - deleted
Cookie:roro la pupute!@messenger.msn.com/ - deleted
Cookie:roro la pupute!@msn.com/ - deleted
Cookie:roro la pupute!@rad.msn.com/ - deleted
Cookie:roro la pupute!@c.msn.com/ - deleted
Cookie:roro la pupute!@t.msn.com/ - deleted
Cookie:roro la pupute!@live.com/ - deleted
C:\Documents and Settings\Roro la pupute!\Application Data\Mozilla\Firefox\Profiles\01444sfo.default\history.dat - deleted
C:\Documents and Settings\Roro la pupute!\Application Data\Mozilla\Firefox\Profiles\01444sfo.default\cookies.txt.old - deleted
C:\Documents and Settings\Roro la pupute!\Recent\02 Chet Baker.wma.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\03 Make It Rain.mp3.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\04 Modern World.mp3.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\05 I Don't Wanna Hurt No More.mp3.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\05 Piste 5.wma.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\06 Good God.mp3.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\06 Piste 6.wma.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\07 Piste 7.wma.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\07 The Difference.mp3.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\08 Piste 8.wma.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\08 Whatever You Say.mp3.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\09 Ball and Chain.mp3.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\09 Piste 9.wma.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\10 Daze.mp3.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\10 La Melodie.wma.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\10 Piste 10.wma.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\11 If You Were Mine.mp3.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\11 Piste 11.wma.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\12 Good God (The Anonymous Remix).mp3.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\12 Piste 12.wma.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\343.htm.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\Amy_Winehouse-Back_To_Black_(Deluxe_Edition)-2CD-2007-UKP.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\Anouk - Together Alone(1997).lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\anouk unpluged.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\anouk.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\AYO JOYFUL.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\Azureus Downloads.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\catchme.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\Disque local (C).lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\Divinidylle.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\mbam-log-5-16-2008 (22-08-27).txt.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\putain.docx.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recentapports.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recentapport_navilog1.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recentapport_OTMoveit.log.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recenteport_navilog1.txt (2).lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recenteport_navilog1.txt.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recenteport_SDfix.txt.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\The Do - A Mouthful (2008).lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\Topless_Girls_Parade-_Girls_On_Bulls_-_Desert_[INDV00005907].mkv.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\VBG.TXT.lnk - deleted
C:\Documents and Settings\Roro la pupute!\Recent\vundofix.txt.lnk - deleted
C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\051508225201\ - deleted
C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\e4j3B.tmp_dir28700\ - deleted
C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\Google Toolbar\ - deleted
C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\hsperfdata_Roro la pupute!\ - deleted
C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\MessengerCache\icVlmq1H7gYzhFf+UAbxqy4BuWI= - deleted
C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\MessengerCache\ - deleted
C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\WPDNSE\ - deleted
C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\_avast4_\ - deleted
C:\DOCUME~1\ROROLA~1\LOCALS~1\Temp\~nsu.tmp\ - deleted
C:\WINDOWS
spC9.tmp - deleted
C:\WINDOWS	emp\Perflib_Perfdata_780.dat currently in use. Will be deleted when Windows is restarted.
C:\WINDOWS	emp\ZLT009cd.TMP currently in use. Will be deleted when Windows is restarted.
C:\WINDOWS	emp\ZLT027e9.TMP currently in use. Will be deleted when Windows is restarted.
C:\WINDOWS	emp\Cookies\ - deleted
C:\WINDOWS	emp\Fichiers Internet temporaires\Content.IE5\6YGNZTAD\ - deleted
C:\WINDOWS	emp\Fichiers Internet temporaires\Content.IE5\93V8UB6Y\ - deleted
C:\WINDOWS	emp\Fichiers Internet temporaires\Content.IE5\RGAG0WLN\ - deleted
C:\WINDOWS	emp\Fichiers Internet temporaires\Content.IE5\WLT9MZVS\ - deleted
C:\WINDOWS	emp\Fichiers Internet temporaires\Content.IE5\ - deleted
C:\WINDOWS	emp\Fichiers Internet temporaires\ - deleted
C:\WINDOWS	emp\History\History.IE5\ - deleted
C:\WINDOWS	emp\History\ - deleted
C:\WINDOWS	emp	mp00004702\ - deleted
C:\WINDOWS	emp	mp00004a6d\ - deleted
C:\WINDOWS	emp	mp000072d9\ - deleted
C:\WINDOWS	emp	mp00007a7a\ - deleted
C:\WINDOWS	emp\_avast4_\Webshlock.txt currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Roro la pupute!\Cookies\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Roro la pupute!\locals~1	empor~1\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Roro la pupute!\Cookies\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Roro la pupute!\Local Settings\Temporary Internet Files\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\NetworkService\Cookies\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\NetworkService\locals~1	empor~1\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\NetworkService\Cookies\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\LocalService\Cookies\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\LocalService\locals~1	empor~1\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\LocalService\Cookies\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat - deleted
C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\ - deleted
C:\Documents and Settings\LocalService\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\index.dat - deleted
C:\Documents and Settings\LocalService\Local Settings\Temp\Historique\History.IE5\index.dat - deleted
C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat - deleted
C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat - deleted
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Default User\Cookies\index.dat - deleted
C:\Documents and Settings\Default User\locals~1	empor~1\Content.IE5\index.dat - deleted
C:\Documents and Settings\Default User\locals~1	empor~1\Content.IE5\ - deleted
C:\WINDOWS\Prefetch\ADOBEUPDATEMANAGER.EXE-32021652.pf - deleted
C:\WINDOWS\Prefetch\ALERTMODULE.EXE-2A9DA7CC.pf - deleted
C:\WINDOWS\Prefetch\ALG.EXE-0F138680.pf - deleted
C:\WINDOWS\Prefetch\ASHDISP.EXE-0B874892.pf - deleted
C:\WINDOWS\Prefetch\ASHMAISV.EXE-12E27032.pf - deleted
C:\WINDOWS\Prefetch\ASHWEBSV.EXE-0548EF0A.pf - deleted
C:\WINDOWS\Prefetch\AU_.EXE-16452760.pf - deleted
C:\WINDOWS\Prefetch\AVAST.SETUP-032170A8.pf - deleted
C:\WINDOWS\Prefetch\AVGAS.EXE-27525987.pf - deleted
C:\WINDOWS\Prefetch\AZUREUS.EXE-008B7A30.pf - deleted
C:\WINDOWS\Prefetch\CLEANUP.EXE-3438663A.pf - deleted
C:\WINDOWS\Prefetch\CLEANUP452.EXE-01643773.pf - deleted
C:\WINDOWS\Prefetch\CLEDX.EXE-01CE559A.pf - deleted
C:\WINDOWS\Prefetch\CTCMS.EXE-147D3CBD.pf - deleted
C:\WINDOWS\Prefetch\CTCMS.EXE-3897A504.pf - deleted
C:\WINDOWS\Prefetch\CTCMSGO.EXE-232EDEF5.pf - deleted
C:\WINDOWS\Prefetch\CTDETECT.EXE-3A528B09.pf - deleted
C:\WINDOWS\Prefetch\CTFMON.EXE-0E17969B.pf - deleted
C:\WINDOWS\Prefetch\DIVXSM.EXE-25FDFA2C.pf - deleted
C:\WINDOWS\Prefetch\DRWTSN32.EXE-2B4B52AC.pf - deleted
C:\WINDOWS\Prefetch\FIREFOX.EXE-17EE503B.pf - deleted
C:\WINDOWS\Prefetch\FIREFOX.EXE-28641590.pf - deleted
C:\WINDOWS\Prefetch\GOOGLETOOLBARNOTIFIER.EXE-3629C61D.pf - deleted
C:\WINDOWS\Prefetch\GROOVEMONITOR.EXE-2606717A.pf - deleted
C:\WINDOWS\Prefetch\HIJACKTHIS.EXE-34A0FC79.pf - deleted
C:\WINDOWS\Prefetch\HIJACKTHIS_HIJACKTHIS_2.02_AN-0B6639B6.pf - deleted
C:\WINDOWS\Prefetch\HJT.EXE-00830B0E.pf - deleted
C:\WINDOWS\Prefetch\IEXPLORE.EXE-27122324.pf - deleted
C:\WINDOWS\Prefetch\LAUNCHER.EXE-13840303.pf - deleted
C:\WINDOWS\Prefetch\Layout.ini - deleted
C:\WINDOWS\Prefetch\LOGONUI.EXE-0AF22957.pf - deleted
C:\WINDOWS\Prefetch\MBAM.EXE-0BEE0439.pf - deleted
C:\WINDOWS\Prefetch\MMC.EXE-04EF131A.pf - deleted
C:\WINDOWS\Prefetch\MPLAYERC.EXE-06A9CBF3.pf - deleted
C:\WINDOWS\Prefetch\MRT.EXE-1B4A8D49.pf - deleted
C:\WINDOWS\Prefetch\MRTSTUB.EXE-0CFF2985.pf - deleted
C:\WINDOWS\Prefetch\MSCONFIG.EXE-35E4DAE9.pf - deleted
C:\WINDOWS\Prefetch\MSNMSGR.EXE-030AB647.pf - deleted
C:\WINDOWS\Prefetch\MSNTBUP.EXE-0D913FB9.pf - deleted
C:\WINDOWS\Prefetch\NOTEPAD.EXE-336351A9.pf - deleted
C:\WINDOWS\Prefetch\NTOSBOOT-B00DFAAD.pf - deleted
C:\WINDOWS\Prefetch\OTMOVEIT2.EXE-317FB98F.pf - deleted
C:\WINDOWS\Prefetch\QTTASK.EXE-342507FB.pf - deleted
C:\WINDOWS\Prefetch\RCMAN.EXE-25D6A82D.pf - deleted
C:\WINDOWS\Prefetch\REGEDIT.EXE-1B606482.pf - deleted
C:\WINDOWS\Prefetch\REGSVR32.EXE-25EEFE2F.pf - deleted
C:\WINDOWS\Prefetch\ROCKETDOCK.EXE-2D5722F9.pf - deleted
C:\WINDOWS\Prefetch\RUNDLL32.EXE-13DF4D5C.pf - deleted
C:\WINDOWS\Prefetch\RUNDLL32.EXE-147710F4.pf - deleted
C:\WINDOWS\Prefetch\RUNDLL32.EXE-1BC55A4F.pf - deleted
C:\WINDOWS\Prefetch\RUNDLL32.EXE-2D91DFC7.pf - deleted
C:\WINDOWS\Prefetch\RUNDLL32.EXE-2F7D56B7.pf - deleted
C:\WINDOWS\Prefetch\RUNDLL32.EXE-311943EE.pf - deleted
C:\WINDOWS\Prefetch\RUNDLL32.EXE-3BE970A5.pf - deleted
C:\WINDOWS\Prefetch\RUNDLL32.EXE-40831FDE.pf - deleted
C:\WINDOWS\Prefetch\RUNDLL32.EXE-44F2A2E4.pf - deleted
C:\WINDOWS\Prefetch\RUNDLL32.EXE-451FC2C0.pf - deleted
C:\WINDOWS\Prefetch\RUNDLL32.EXE-4905AB4E.pf - deleted
C:\WINDOWS\Prefetch\RUNDLL32.EXE-49139FA2.pf - deleted
C:\WINDOWS\Prefetch\RUNDLL32.EXE-4BB012E1.pf - deleted
C:\WINDOWS\Prefetch\SEARCHFILTERHOST.EXE-148579FB.pf - deleted
C:\WINDOWS\Prefetch\SEARCHPROTOCOLHOST.EXE-34E0253A.pf - deleted
C:\WINDOWS\Prefetch\SPKSET.EXE-0F68E1CE.pf - deleted
C:\WINDOWS\Prefetch\SSCHK.EXE-03401E44.pf - deleted
C:\WINDOWS\Prefetch\SVCHOST.EXE-3530F672.pf - deleted
C:\WINDOWS\Prefetch\TASKMGR.EXE-20256C55.pf - deleted
C:\WINDOWS\Prefetch\TRJSCAN.EXE-2857538B.pf - deleted
C:\WINDOWS\Prefetch\UNINSTALL.EXE-37345CBA.pf - deleted
C:\WINDOWS\Prefetch\UPDCLIENT.EXE-215FC96B.pf - deleted
C:\WINDOWS\Prefetch\USNSVC.EXE-2DF2835C.pf - deleted
C:\WINDOWS\Prefetch\VERCLSID.EXE-3667BD89.pf - deleted
C:\WINDOWS\Prefetch\VUNDOFIX.EXE-3AF04AC5.pf - deleted
C:\WINDOWS\Prefetch\WINAMPA.EXE-0536E33F.pf - deleted
C:\WINDOWS\Prefetch\WINDOWS-KB890830-V1.41-DELTA.-05BA7F44.pf - deleted
C:\WINDOWS\Prefetch\WINRAR.EXE-39C6DAD9.pf - deleted
C:\WINDOWS\Prefetch\WINWORD.EXE-07381162.pf - deleted
C:\WINDOWS\Prefetch\WLLOGINPROXY.EXE-2D4B6027.pf - deleted
C:\WINDOWS\Prefetch\WMIPRVSE.EXE-28F301A9.pf - deleted
C:\WINDOWS\Prefetch\WMPLAYER.EXE-18DDEFA4.pf - deleted
C:\WINDOWS\Prefetch\WUAUCLT.EXE-399A8E72.pf - deleted
C:\WINDOWS\Prefetch\YIZQAKXEL.EXE-14E1DC9D.pf.bd.ren - deleted
C:\WINDOWS\Prefetch\ZLCLIENT.EXE-1C550EB2.pf - deleted
Emptied Recycle Bin on drive C:
'Run MRU' list - removed from the registry.
Explorer Open/Save MRU list - removed from the registry.
Explorer Last Visited MRU list - removed from the registry.
Telnet's MRU list - removed from the registry.
CleanUp! 4.5.2 recovered 11.5 MB of disk space from 465 files.
CleanUp! finished on 05/17/08 13:26:53.

rototo943 · Answer

rapport clean:

 17/05/2008 a 13:37:44,65 
 
*** Recherche des fichiers dans C: 
 
*** Recherche des fichiers dans C:\WINDOWS\ 
 
*** Recherche des fichiers dans C:\WINDOWS\system32 
C:\WINDOWS\system32\mcrh.tmp FOUND 
C:\WINDOWS\system32\SBFC.dat FOUND 
C:\WINDOWS\system32\SBRC.dat FOUND 
"C:\WINDOWS\Downloaded Program Files\CONFLICT.1" FOUND 
 
*** Recherche des fichiers dans C:\Program Files 
*** Fin du rapport !

rototo943 · Answer

hijack again!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:42:16, on 17/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Trend Micro\HijackThis\HJT.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://lo.st
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Creative MediaSource Go] C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe /SCB
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-f82665215bfa7adf.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (MediaBar) - http://sib1.od2.com/common/musicmanager/installation/MusicManagerPlugin.CAB
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15031/CTPID.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Utilisateur anonyme · Answer

Re !

&#8594; Redémarre en MSE

Autre tutorials pour MSE:

https://www.micro-astuce.com/depannage/demarrer-mode-sans-echec.php
http://www.coupdepoucepc.com/modules/news/article.php?storyid=253

&#8594; Re-lance clean  -> Choisis l'option 2

---Clean va travailler.---

&#8594; Un rapport Va etre généré , poste le moi ;)

( Le rapport est aussi sauvegardé dans C:\Rapport_clean.txt )

***************************************************

Arrête ce service :

Planificateur LiveUpdate automatique

( déjà dit ici --> https://forums.commentcamarche.net/forum/affich-6401931-pb-trojan?page=2#24*)


***************************************************

J'attends le rapport Clean , et ensuite nous finirons.
+++

rototo943 · Answer

autant pour moi pour Planificateur LiveUpdate automatique, c fait (on peut rien te cacher! lol)

Script execute en mode sans echec 
Rapport clean par Malekal_morte - http://www.malekal.com 
Script execute en mode sans echec 17/05/2008 a 14:04:21,63 

Microsoft Windows XP [version 5.1.2600]
 
*** Suppression des fichiers dans C: 
 
*** Suppression des fichiers dans C:\WINDOWS\ 
 
*** Suppression des fichiers dans C:\WINDOWS\system32 
tentative de suppression de C:\WINDOWS\system32\mcrh.tmp 
tentative de suppression de C:\WINDOWS\system32\SBFC.dat 
tentative de suppression de C:\WINDOWS\system32\SBRC.dat 
tentative de suppression de "C:\WINDOWS\Downloaded Program Files\CONFLICT.1" 
 
*** Suppression des fichiers dans C:\Program Files 
 
*** Suppression des clefs du registre effectuee.. 
*** Fin du rapport !

Utilisateur anonyme · Answer

Re ,,

Héhéhé  =P

-> Supprime Cleanup
-> Supprime MBAM


***************************

_Maintenant , nous allons supprimer les logiciels de désinfection que je t'ai fait téléchargé.
En effet , s'en servir est dangereux pour le pc si l'on ne s'y connais pas.
De plus ils sont mis régulièrement à jours.


&#8594; Ferme toutes les applications en cours, puis télécharge ToolsCleaner2 sur ton Bureau.

&#8594; Double clique sur ToolsCleaner2.exe >
&#8594; Clique sur .Recherche
&#8594; puis sur Suppression quand la liste est trouvée.
&#8594; Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\). 


(CTRL+A Pour tout selectionner  , CTRL+C pour copier et CTRL+V pour coller )
 
Note : ton bureau RISQUE de disparaître, c'est normal. S'il n'apparaît pas à la fin du scan, fais la manip suivante :

CTRL+ALT+SUPP pour ouvrir le Gestionnaire des tâches.
Puis rends toi à l'onglet "Processus". Clique en haut à gauche sur Fichiers et choisis "Exécuter"

Tape explorer.exe et valide. Cela fera re-apparaître le Bureau

Tuto : http://www.commentcamarche.net/faq/sujet 8341 toolscleaner suppression des fix de force brute ( merci espion3004 )

******************************

Maintenant que ton PC n'est plus infecté, désactive ta "Restauration du système" puis réactive la, ce qui créer un point de restauration sain...

Désactivation :
Clique droit sur le "Poste de travail" > Propriétés > onglet "Restauration du système" > coche la case "Désactiver la Restauration du système sur tous les lecteurs"
> Applique patiente jusqu’à ce que cela soit marqué "désactivé" puis Ok.

Activation :
Suivre le même chemin ; décoche la case "Désactiver la Restauration du système sur tous les lecteurs"
> Applique attends que cela soit à nouveau sur "surveillance" puis Ok. Redémarre l'ordinateur.

*******************************

A++

rototo943 · Answer

ok, TCleaner:

-->- Recherche: 

C:\SDFIX: trouvé !
C:\Vundofix backups: trouvé !
C:\_OtMoveIt: trouvé !
C:\Documents and Settings\All Users\Bureau\Navilog1.lnk: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: trouvé !
C:\Documents and Settings\Roro la pupute!\Bureau\SdFix.exe: trouvé !
C:\Documents and Settings\Roro la pupute!\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\Roro la pupute!\Bureau\Clean.zip: trouvé !
C:\Documents and Settings\Roro la pupute!\Bureau\OtMoveIt2.exe: trouvé !
C:\Documents and Settings\Roro la pupute!\Bureau\Navilog1.exe: trouvé !
C:\Documents and Settings\Roro la pupute!\Bureau\vundoFix.exe: trouvé !
C:\Documents and Settings\Roro la pupute!\Bureau\clean\clean	ar.exe: trouvé !
C:\Documents and Settings\Roro la pupute!\Bureau\clean\cleanemove.reg: trouvé !
C:\Documents and Settings\Roro la pupute!\Bureau\clean\clean\pskill.exe: trouvé !
C:\Documents and Settings\Roro la pupute!\Bureau\clean\clean\LFiles.exe: trouvé !
C:\Documents and Settings\Roro la pupute!\Bureau\clean\clean\gzip.exe: trouvé !
C:\Documents and Settings\Roro la pupute!\Bureau\clean\clean\delsiri.cmd: trouvé !
C:\Documents and Settings\Roro la pupute!\Bureau\clean\clean\delr.cmd: trouvé !
C:\Documents and Settings\Roro la pupute!\Bureau\clean\clean\del3.cmd: trouvé !
C:\Documents and Settings\Roro la pupute!\Bureau\clean\clean\del2.cmd: trouvé !
C:\Documents and Settings\Roro la pupute!\Bureau\clean\clean\clean.cmd: trouvé !
C:\Documents and Settings\Roro la pupute!\Bureau\clean\clean\cherche.cmd: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files\Navilog1\Navilog1.bat: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !

---------------------------------
-->- Suppression: 

C:\Documents and Settings\All Users\Bureau\Navilog1.lnk: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: supprimé !
C:\Documents and Settings\Roro la pupute!\Bureau\SdFix.exe: supprimé !
C:\Documents and Settings\Roro la pupute!\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\Roro la pupute!\Bureau\Clean.zip: supprimé !
C:\Documents and Settings\Roro la pupute!\Bureau\OtMoveIt2.exe: supprimé !
C:\Documents and Settings\Roro la pupute!\Bureau\Navilog1.exe: supprimé !
C:\Documents and Settings\Roro la pupute!\Bureau\vundoFix.exe: supprimé !
C:\Documents and Settings\Roro la pupute!\Bureau\clean\clean	ar.exe: supprimé !
C:\Documents and Settings\Roro la pupute!\Bureau\clean\cleanemove.reg: supprimé !
C:\Documents and Settings\Roro la pupute!\Bureau\clean\clean\pskill.exe: supprimé !
C:\Documents and Settings\Roro la pupute!\Bureau\clean\clean\LFiles.exe: supprimé !
C:\Documents and Settings\Roro la pupute!\Bureau\clean\clean\gzip.exe: supprimé !
C:\Documents and Settings\Roro la pupute!\Bureau\clean\clean\delsiri.cmd: supprimé !
C:\Documents and Settings\Roro la pupute!\Bureau\clean\clean\delr.cmd: supprimé !
C:\Documents and Settings\Roro la pupute!\Bureau\clean\clean\del3.cmd: supprimé !
C:\Documents and Settings\Roro la pupute!\Bureau\clean\clean\del2.cmd: supprimé !
C:\Documents and Settings\Roro la pupute!\Bureau\clean\clean\clean.cmd: supprimé !
C:\Documents and Settings\Roro la pupute!\Bureau\clean\clean\cherche.cmd: supprimé !
C:\Program Files\Navilog1\Navilog1.bat: supprimé !
C:\SDFIX: supprimé !
C:\Vundofix backups: supprimé !
C:\_OtMoveIt: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: supprimé !
C:\Program Files\Navilog1: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

Sauvegarde du registre crée !

rototo943 · Answer

ok, j'ai fait la désactivation/activation de la "Restauration du système"
on  est bon là?

Utilisateur anonyme · Answer

Re ,

Supprime Toolscleaner.

Et ... mon aide s'arrête la =)

Des questions ?

++

rototo943 · Answer

non, plus de question
mais par contre, un énooooooooooorme merci! pour ton implication et tes précieux conseils (g pas tout compris keske g fait...)
g l'impression que mon pc est comme neuf, la différence depuis ton intervention est saisissante
donc merci mon cyrildu17, "mon jedi de l'informatique" :p

Utilisateur anonyme · Answer

^^
Bèh de rien =)
Bonne continuation ,
 en espérant ne plus te revoir sur le forum virus/sécurité   ;)
++

Pb trojan

34 réponses

Votre réponse

Discussions similaires

Newsletters