encore cid Résolu

Question

Bonjour,
 
apres avoir resolu le probleme des cid a cause de msn + les revoila ! pour info, hier j ai telecharge architecte 3d et alcohol 120

merci d avance

lamulata · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:51:49, on 27/05/2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
C:\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Windows\System32undll32.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Norton Ghost\Agent\VProTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Windows\system32	askeng.exe
C:\Windows\System32undll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\PETITL~1\AppData\Local\Temp\RtkBtMnt.exe
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Alcohol Soft\Alcohol 120\Alcohol.exe
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Users\PETITL~1\AppData\Local\Temp\_AIA.tmp\Setup.exe
C:\Windows\system32\conime.exe
D:	elechargements divers	elechargements rapides\FlashFXP_Modele\FlashFXP_Modele\FlashFXP.exe
C:\Windows\system32\MsiExec.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Users\petit lapin rose\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.ebay.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ALaunch] C:\Acer\ALaunch\AlaunchClient.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [eAudio] "C:\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [SetPanel] C:\Acer\APanel\APanel.cmd
O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Norton Ghost 12.0] "C:\Program Files\Norton Ghost\Agent\VProTray.exe"
O4 - HKLM\..\Run: [Deaf Thunk] "C:\ProgramData\64SoftwareSoftware.4tc8o9l"
O4 - HKLM\..\Run: [Bags Else Hole Lite] "C:\ProgramData\idle link free.jv5lk"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] c:\program files\uniblueegistrybooster 2\StartRegistryBooster.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Bags Else Hole Lite] "C:\ProgramData\scr move mp3.vquhzmq"
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Global Startup: Empowering Technology Launcher.lnk = C:\Acer\Empowering Technology\eAPLauncher.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Recherche sur eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix: 
O16 - DPF: {5DDCC37F-7C6B-48B8-9664-97C537920CA0} (aecviz Class) - http://www.maisonfamiliale.com/AECVIZ/npaecviz.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

lamulata · Answer

pourquoi telechargement douteux? je suis en train d elaborer des plans de maison car on va faire construire tu voulais que je fasse çà comment? on m avait conseillee architecte 3d...
alors evite les reflexions desagreables stp: tu crois que ça m amuse d avoir des soucis informatiques?

^^Marie^^ · Answer

Salut

&#8594; Télécharge Lopxp et enregistres-le sur ton bureau. 
http://sosvirus.changelog.fr/Green_day/Lopxpsetup.exe
http://www.commentcamarche.net/telecharger/telecharger 34055210 lopxp
	

&#9658; Referme les fenêtres de tous les programmes en cours, y compris Internet Explorer et MSN 

Double clic sur le fichier Lopxpsetup.exe
pour lancer l'installation. 

Sur le bureau, double clic ensuite sur le raccourci nommé Lopxp, pour lancer le programme. 
Dans le menu, choisis l'option 1 et valide avec la touche entrée. 
Patiente un peu, en fin d'analyse il te sera demandé d'appuyer sur une touche pour faire apparaître le rapport, fais-le. 

Copie et colle ensuite tous son contenu dans ta prochaine réponse.

Vérifie si dans ajout/supp des programmes tu n'as pas ""CIDHELP" (qq chose comme ça)

+++

^^Marie^^ · Answer

Ben !! ouéééé, j'étais en train d'éditer que tu es arrivé ;;))

lamulata · Answer

ok, d abord, merci de me filer un coup de main ;)

alors mon mari a utilise combox sas faire apparaitre les fichiers caches et ça a done çà:

ComboFix 08-05-26.2 - petit lapin rose 2008-05-27 12:55:54.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.135 [GMT 2:00]
Endroit: C:\Users\petit lapin rose\Desktop\enlever pub\ComboFix.exe
* Création d'un nouveau point de restauration
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Adssite Games Collection
C:\Program Files\Adssite Games Collection\BattlesOfHelicopters.exe
C:\Program Files\Adssite Games Collection\BobAndBill.exe
C:\Program Files\Adssite Games Collection\CrazyBlocks.exe
C:\Program Files\Adssite Games Collection\Lines.exe
C:\Program Files\Adssite Games Collection\uninstall.exe
C:\Program Files\Adssite Games Collection\VideoPool.exe
C:\Windows\system32\ACER.exe
C:\Windows\system32\adssite-remove.exe
C:\Windows\system32\rightonadz-uninst.exe

.
((((((((((((((((((((((((((((( Fichiers créés 2008-04-27 to 2008-05-27 ))))))))))))))))))))))))))))))))))))
.

2008-05-27 12:31 . 2008-05-27 12:32 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-27 12:31 . 2008-05-05 20:46 27,048 --a------ C:\Windows\System32\drivers\mbamcatchme.sys
2008-05-27 12:31 . 2008-05-05 20:46 15,864 --a------ C:\Windows\System32\drivers\mbam.sys
2008-05-27 09:29 . 2008-05-27 12:01 <REP> d-------- C:\Users\All Users\Autodesk
2008-05-27 09:29 . 2008-05-27 12:01 <REP> d-------- C:\ProgramData\Autodesk
2008-05-27 09:29 . 2008-05-27 10:01 <REP> d-------- C:\Program Files\AutoCAD Architecture 2009
2008-05-27 09:28 . 2007-07-19 18:14 3,727,720 --a------ C:\Windows\System32\d3dx9_35.dll
2008-05-27 09:24 . 2008-05-27 12:01 <REP> d-------- C:\Users\petit lapin rose\AppData\Roaming\Autodesk
2008-05-27 09:24 . 2008-05-27 10:06 <REP> d-------- C:\Program Files\Common Files\Autodesk Shared
2008-05-27 09:24 . 2008-05-27 09:24 <REP> d-------- C:\Program Files\Autodesk
2008-05-27 04:48 . 2008-05-27 04:48 <REP> d-------- C:\Users\All Users\Iso Web Bags Else
2008-05-27 04:48 . 2008-05-27 04:48 <REP> d-------- C:\ProgramData\Iso Web Bags Else
2008-05-27 04:48 . 2008-05-27 04:48 <REP> d-------- C:\Program Files\Freelist
2008-05-26 16:42 . 2008-04-13 13:37 2,402,961,408 --a------ C:\Windows\System32\185A1-11A001-P301A.iso
2008-05-26 11:04 . 2007-08-21 15:21 753,808 --a------ C:\Windows\System32\temp.003
2008-05-26 11:04 . 2007-08-21 15:21 140,224 --a------ C:\Windows\System32\temp.002
2008-05-25 14:02 . 2008-05-25 14:02 <REP> d-------- C:\Users\petit lapin rose\AppData\Roaming\Symantec
2008-05-25 11:53 . 2008-05-25 11:53 <REP> d----c--- C:\Windows\System32\DRVSTORE
2008-05-25 11:53 . 2007-03-28 20:29 131,944 --a------ C:\Windows\System32\drivers\symsnap.sys
2008-05-25 11:53 . 2007-03-28 20:49 128,104 --a------ C:\Windows\System32\drivers\WimFltr.sys
2008-05-25 11:53 . 2007-03-28 20:12 109,360 --a------ C:\Windows\System32\GEARAspi.dll
2008-05-25 11:53 . 2007-03-28 20:29 37,864 --a------ C:\Windows\System32\drivers\v2imount.sys
2008-05-25 11:53 . 2007-03-28 20:12 15,664 --a------ C:\Windows\System32\drivers\GEARAspiWDM.sys
2008-05-25 11:53 . 2007-03-28 20:23 14,072 --a------ C:\Windows\System32\drivers\vproeventmonitor.sys
2008-05-25 11:51 . 2008-05-25 11:51 <REP> d-------- C:\Program Files\Norton Ghost
2008-05-25 11:48 . 2008-05-25 11:48 <REP> d-------- C:\Program Files\Symantec
2008-05-15 23:13 . 2008-05-15 23:13 <REP> d-------- C:\Users\All Users\Forge of Games
2008-05-15 23:13 . 2008-05-15 23:13 <REP> d-------- C:\ProgramData\Forge of Games
2008-05-13 16:31 . 2008-05-13 16:31 <REP> d-------- C:\Users\petit lapin rose\AppData\Roaming\Malwarebytes
2008-05-13 16:31 . 2008-05-13 16:31 <REP> d-------- C:\Users\All Users\Malwarebytes
2008-05-13 16:31 . 2008-05-13 16:31 <REP> d-------- C:\ProgramData\Malwarebytes
2008-05-09 21:20 . 2008-05-09 21:20 <REP> d-------- C:\Users\petit lapin rose\AppData\Roaming\PeerNetworking
2008-05-06 00:10 . 2008-05-06 00:19 <REP> d-------- C:\Users\petit lapin rose\AppData\Roaming\SecondLife
2008-05-01 14:07 . 2008-05-26 09:32 <REP> d-------- C:\film

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-27 07:05 28,380 ----a-w C:\Users\petit lapin rose\AppData\Roaming\nvModes.dat
2008-05-27 02:48 --------- d-----w C:\ProgramData\Freelist
2008-05-27 02:02 --------- d-----w C:\ProgramData\Google Updater
2008-05-25 10:00 --------- d-----w C:\ProgramData\Symantec
2008-05-25 09:51 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-05-15 23:18 50,768 ----a-w C:\Windows\system32\drivers\aswMonFlt.sys
2008-05-15 01:05 --------- d-----w C:\Program Files\Windows Mail
2008-05-14 19:51 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-05-14 19:31 --------- d-----w C:\ProgramData\Lavasoft
2008-04-27 06:18 --------- d-----w C:\ProgramData\WholeSecurity
2008-04-22 17:48 --------- d-----w C:\Program Files\Alcohol Soft
2008-04-22 17:43 685,816 ----a-w C:\Windows\system32\drivers\sptd.sys
2008-04-22 16:09 --------- d-----w C:\Program Files\Alwil Software
2008-04-22 15:48 --------- d-----w C:\ProgramData\Kaspersky Lab
2008-04-22 15:16 --------- d-----w C:\Program Files\Free Audio Pack
2008-04-22 15:15 --------- d-----w C:\ProgramData\eMule
2008-04-20 23:59 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-04-20 23:59 --------- d-----w C:\Program Files\Windows Live
2008-04-20 13:04 --------- d-----w C:\Program Files\D-Tools
2008-04-20 12:26 --------- d-----w C:\Program Files\DAEMON Tools Pro
2008-04-17 16:47 --------- d-----w C:\ProgramData\WLInstaller
2008-04-13 18:56 --------- d-----w C:\Program Files\Panicware
2008-04-11 13:53 --------- d-----w C:\ProgramData\Apple Computer
2008-04-11 13:48 --------- d-----w C:\Program Files\Acer GameZone
2008-04-11 13:27 --------- d-----w C:\Users\petit lapin rose\AppData\Roaming\OpenOffice.org2
2008-04-10 23:02 --------- d-----w C:\Program Files\MSN Pictures Displayer
2008-04-10 21:24 --------- d-----w C:\Users\petit lapin rose\AppData\Roaming\Windows Live Writer
2008-04-09 08:34 --------- d-----w C:\Users\petit lapin rose\AppData\Roaming\CyberLink
2008-03-28 20:41 --------- d-----w C:\Program Files\FlashFXP
2008-01-01 21:31 207 ----a-w C:\Users\petit lapin rose\profil.dat
2007-10-06 08:07 174 --sha-w C:\Program Files\desktop.ini
.

------- Sigcheck -------

.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-09 04:09 1232896]
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-05-22 15:49 151552]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-05 12:48 68856]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
"Uniblue RegistryBooster 2"="c:\program files\uniblue\registrybooster 2\StartRegistryBooster.exe" [ ]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:35 125440]
"Bags Else Hole Lite"="C:\ProgramData\scr move mp3.vquhzmq" [ ]
"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 12:29 220544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ALaunch"="C:\Acer\ALaunch\AlaunchClient.exe" [ ]
"RtHDVCpl"="RtHDVCpl.exe" [2007-07-06 05:06 4669440 C:\Windows\RtHDVCpl.exe]
"eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-25 16:33 457216]
"eAudio"="C:\Acer\Empowering Technology\eAudio\eAudio.exe" [2007-06-11 14:54 1286144]
"Acer Tour"="" []
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-07-25 14:53 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-07-25 14:53 8433664]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-07-25 14:53 81920]
"LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2007-08-15 11:21 772616]
"PlayMovie"="C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [2007-05-24 13:38 206952]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2007-06-06 10:06 159744]
"eRecoveryService"="" []
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-05-22 15:49 151552]
"WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 21:48 57344]
"SetPanel"="C:\Acer\APanel\APanel.cmd" [ ]
"eBayToolbar"="C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe" [2008-03-23 19:43 652528]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 01:19 79224]
"Norton Ghost 12.0"="C:\Program Files\Norton Ghost\Agent\VProTray.exe" [2007-03-28 20:41 2037352]
"Deaf Thunk"="C:\ProgramData\64SoftwareSoftware.o1ro2o" [2008-05-27 12:45 163856]
"Bags Else Hole Lite"="C:\ProgramData\idle link free.jv5lk" [2008-05-27 04:48 49168]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2008-02-01 22:32 8699904]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2007-07-26 04:17:00 535336]
Outil de mise … jour Google.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-10-05 12:48:24 126136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"ValidateAdminCodeSignatures"= 1 (0x1)
"FilterAdministratorToken"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{59DE5281-D76E-4158-8705-CF329C4E4652}"= C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
"{F7BE5145-CFB9-4EF6-B59F-1DE503F9CE8D}"= C:\Program Files\Acer Arcade Deluxe\VideoMagician\VideoMagician.exe:VideoMagician
"{C86DBA55-A3E3-4F9D-96E7-A08610EB6934}"= C:\Program Files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe:HomeMedia
"{C65B0CFD-D277-4C74-BB3B-50A605A73447}"= C:\Program Files\Acer Arcade Deluxe\DV Wizard\DV Wizard.exe:DV Wizard
"{FBA08FC0-633E-4385-AC8C-9EECB469AC78}"= C:\Program Files\Acer Arcade Deluxe\DVDivine\DVDivine.exe:DVDivine
"{75CDB32E-DEC4-4243-BA05-B8BCCCFEE530}"= C:\Program Files\Acer Arcade Deluxe\Play Movie\PlayMovie.exe:Play Movie
"{AAA4F0BF-0EA7-4518-BC6B-B9B055BAFADB}"= C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe:Play Movie Resident Program
"{640A35BC-F79B-4F6A-A44D-5E05A65064DD}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{9EA4CD51-B68F-4660-9F80-E77E4924C307}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{9906F189-FC34-432F-8306-43E73885BEF4}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"TCP Query User{F5B2DA50-2856-4534-A14A-63A3361F0172}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{B7FF53F0-D8EE-46F5-8903-A3D77C95B3AD}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"TCP Query User{CA56A859-C2CC-4C13-B9E0-3C8476C82DDB}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{37CF3D0B-12E8-4B25-AF97-0152642A0A00}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"TCP Query User{A72729F6-171A-456E-9B9F-F68031814E77}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{E2301539-AED7-41FE-A8BB-5252780E10F8}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"TCP Query User{DD526920-8A95-45E1-857D-4D7B3430533A}C:\\users\\petit lapin rose\\program files\\utorrent\\utorrent.exe"= UDP:C:\users\petit lapin rose\program files\utorrent\utorrent.exe:utorrent.exe
"UDP Query User{93CCE6AA-E765-4974-B21A-1D0314021097}C:\\users\\petit lapin rose\\program files\\utorrent\\utorrent.exe"= TCP:C:\users\petit lapin rose\program files\utorrent\utorrent.exe:utorrent.exe
"TCP Query User{D096938C-53F9-4A65-BF29-8BD0E84B6889}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{9C2F7A56-6041-4EC6-A0FC-39AB04F6E759}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"{664BFE20-0D61-42C9-8010-038427305E8D}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{1B344E80-86FE-4AC7-8AEA-F66F1F433914}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"TCP Query User{C5250679-18A8-40F3-9627-312992F00514}C:\\users\\petit lapin rose\\program files\\utorrent\\utorrent.exe"= UDP:C:\users\petit lapin rose\program files\utorrent\utorrent.exe:utorrent.exe
"UDP Query User{64856FCE-105A-4449-B5CD-F651AE2966D7}C:\\users\\petit lapin rose\\program files\\utorrent\\utorrent.exe"= TCP:C:\users\petit lapin rose\program files\utorrent\utorrent.exe:utorrent.exe
"TCP Query User{5175E42E-091B-48D0-A18C-578CE55A8D5D}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{08BB62C9-3CBC-485A-A5ED-312BA0B64C3A}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"{A8A5BCF4-87DA-4CCD-B2EE-5AE42273F441}"= Disabled:UDP:C:\Program Files\MySpace\IM\MySpaceIM.exe:MySpaceIM
"{CEEF05B6-3AF2-4295-AD4A-A0EEF184C9ED}"= Disabled:TCP:C:\Program Files\MySpace\IM\MySpaceIM.exe:MySpaceIM
"TCP Query User{F0D80F0F-FF03-407C-B0BE-62A2870A6819}C:\\program files\\myspace\\im\\myspaceim.exe"= UDP:C:\program files\myspace\im\myspaceim.exe:MySpace Instant Messenger
"UDP Query User{87C85883-62C9-4563-AEC4-C7DAE007CE1C}C:\\program files\\myspace\\im\\myspaceim.exe"= TCP:C:\program files\myspace\im\myspaceim.exe:MySpace Instant Messenger
"{DA1A0DBB-9CFA-4A8B-9792-FCBC897E99E9}"= C:\Program Files\Windows Live\Messenger\wlcsdk.exe:Windows Live Messenger (Phone)
"{A4A422B7-AA23-4371-965F-56FC023B92E5}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{8F96529C-298A-44F0-9DA6-55D466380920}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-05-16 01:18]
R3 athr;Atheros Extensible Wireless LAN device driver;C:\Windows\system32\DRIVERS\athr.sys [2007-06-18 12:03]
R3 Cam5607;Acer Crystal Eye webcam;C:\Windows\system32\Drivers\BisonC07.sys [2007-05-28 07:57]
R3 enecir;ENE CIR Receiver;C:\Windows\system32\DRIVERS\enecir.sys [2007-05-16 14:47]
R3 nvsmu;nvsmu;C:\Windows\system32\DRIVERS\nvsmu.sys [2007-05-17 03:05]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{75140466-929c-11dc-8d3d-001b385397bb}]
\shell\AutoRun\command - G:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{93cd302d-2b03-11dd-b3b3-001b385397bb}]
\shell\AutoRun\command - F:\Setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bbd7ffbb-abe3-11dc-a73f-001b385397bb}]
\shell\AutoRun\command - F:\ReadMe.exe

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-27 13:01:06
Windows 6.0.6000 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-05-27 13:04:50
ComboFix-quarantined-files.txt 2008-05-27 11:04:42

Pre-Run: 20,607,639,552 octets libres
Post-Run: 20,992,081,920 octets libres

212 --- E O F --- 2008-05-23 10:54:10

ensuite j ai eu votre mail et j ai ait ce que vous m avez dit et ça donne çà:

ComboFix 08-05-26.2 - petit lapin rose 2008-05-27 14:16:10.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.178 [GMT 2:00]
Endroit: C:\Users\petit lapin rose\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((( Fichiers créés 2008-04-27 to 2008-05-27 ))))))))))))))))))))))))))))))))))))
.

2008-05-27 12:31 . 2008-05-27 12:32 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-27 12:31 . 2008-05-05 20:46 27,048 --a------ C:\Windows\System32\drivers\mbamcatchme.sys
2008-05-27 12:31 . 2008-05-05 20:46 15,864 --a------ C:\Windows\System32\drivers\mbam.sys
2008-05-27 09:29 . 2008-05-27 12:01 <REP> d-------- C:\Users\All Users\Autodesk
2008-05-27 09:29 . 2008-05-27 12:01 <REP> d-------- C:\ProgramData\Autodesk
2008-05-27 09:29 . 2008-05-27 10:01 <REP> d-------- C:\Program Files\AutoCAD Architecture 2009
2008-05-27 09:28 . 2007-07-19 18:14 3,727,720 --a------ C:\Windows\System32\d3dx9_35.dll
2008-05-27 09:24 . 2008-05-27 12:01 <REP> d-------- C:\Users\petit lapin rose\AppData\Roaming\Autodesk
2008-05-27 09:24 . 2008-05-27 10:06 <REP> d-------- C:\Program Files\Common Files\Autodesk Shared
2008-05-27 09:24 . 2008-05-27 09:24 <REP> d-------- C:\Program Files\Autodesk
2008-05-27 04:48 . 2008-05-27 04:48 <REP> d-------- C:\Users\All Users\Iso Web Bags Else
2008-05-27 04:48 . 2008-05-27 04:48 <REP> d-------- C:\ProgramData\Iso Web Bags Else
2008-05-27 04:48 . 2008-05-27 04:48 <REP> d-------- C:\Program Files\Freelist
2008-05-26 16:42 . 2008-04-13 13:37 2,402,961,408 --a------ C:\Windows\System32\185A1-11A001-P301A.iso
2008-05-26 11:04 . 2007-08-21 15:21 753,808 --a------ C:\Windows\System32\temp.003
2008-05-26 11:04 . 2007-08-21 15:21 140,224 --a------ C:\Windows\System32\temp.002
2008-05-25 14:02 . 2008-05-25 14:02 <REP> d-------- C:\Users\petit lapin rose\AppData\Roaming\Symantec
2008-05-25 11:53 . 2008-05-25 11:53 <REP> d----c--- C:\Windows\System32\DRVSTORE
2008-05-25 11:53 . 2007-03-28 20:29 131,944 --a------ C:\Windows\System32\drivers\symsnap.sys
2008-05-25 11:53 . 2007-03-28 20:49 128,104 --a------ C:\Windows\System32\drivers\WimFltr.sys
2008-05-25 11:53 . 2007-03-28 20:12 109,360 --a------ C:\Windows\System32\GEARAspi.dll
2008-05-25 11:53 . 2007-03-28 20:29 37,864 --a------ C:\Windows\System32\drivers\v2imount.sys
2008-05-25 11:53 . 2007-03-28 20:12 15,664 --a------ C:\Windows\System32\drivers\GEARAspiWDM.sys
2008-05-25 11:53 . 2007-03-28 20:23 14,072 --a------ C:\Windows\System32\drivers\vproeventmonitor.sys
2008-05-25 11:51 . 2008-05-25 11:51 <REP> d-------- C:\Program Files\Norton Ghost
2008-05-25 11:48 . 2008-05-25 11:48 <REP> d-------- C:\Program Files\Symantec
2008-05-15 23:13 . 2008-05-15 23:13 <REP> d-------- C:\Users\All Users\Forge of Games
2008-05-15 23:13 . 2008-05-15 23:13 <REP> d-------- C:\ProgramData\Forge of Games
2008-05-13 16:31 . 2008-05-13 16:31 <REP> d-------- C:\Users\petit lapin rose\AppData\Roaming\Malwarebytes
2008-05-13 16:31 . 2008-05-13 16:31 <REP> d-------- C:\Users\All Users\Malwarebytes
2008-05-13 16:31 . 2008-05-13 16:31 <REP> d-------- C:\ProgramData\Malwarebytes
2008-05-09 21:20 . 2008-05-09 21:20 <REP> d-------- C:\Users\petit lapin rose\AppData\Roaming\PeerNetworking
2008-05-06 00:10 . 2008-05-06 00:19 <REP> d-------- C:\Users\petit lapin rose\AppData\Roaming\SecondLife
2008-05-01 14:07 . 2008-05-26 09:32 <REP> d-------- C:\film

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-27 07:05 28,380 ----a-w C:\Users\petit lapin rose\AppData\Roaming\nvModes.dat
2008-05-27 02:48 --------- d-----w C:\ProgramData\Freelist
2008-05-27 02:02 --------- d-----w C:\ProgramData\Google Updater
2008-05-25 10:00 --------- d-----w C:\ProgramData\Symantec
2008-05-25 09:51 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-05-15 23:18 50,768 ----a-w C:\Windows\system32\drivers\aswMonFlt.sys
2008-05-15 01:05 --------- d-----w C:\Program Files\Windows Mail
2008-05-14 19:51 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-05-14 19:31 --------- d-----w C:\ProgramData\Lavasoft
2008-04-27 06:18 --------- d-----w C:\ProgramData\WholeSecurity
2008-04-22 17:48 --------- d-----w C:\Program Files\Alcohol Soft
2008-04-22 17:43 685,816 ----a-w C:\Windows\system32\drivers\sptd.sys
2008-04-22 16:09 --------- d-----w C:\Program Files\Alwil Software
2008-04-22 15:48 --------- d-----w C:\ProgramData\Kaspersky Lab
2008-04-22 15:16 --------- d-----w C:\Program Files\Free Audio Pack
2008-04-22 15:15 --------- d-----w C:\ProgramData\eMule
2008-04-20 23:59 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-04-20 23:59 --------- d-----w C:\Program Files\Windows Live
2008-04-20 13:04 --------- d-----w C:\Program Files\D-Tools
2008-04-20 12:26 --------- d-----w C:\Program Files\DAEMON Tools Pro
2008-04-17 16:47 --------- d-----w C:\ProgramData\WLInstaller
2008-04-13 18:56 --------- d-----w C:\Program Files\Panicware
2008-04-11 13:53 --------- d-----w C:\ProgramData\Apple Computer
2008-04-11 13:48 --------- d-----w C:\Program Files\Acer GameZone
2008-04-11 13:27 --------- d-----w C:\Users\petit lapin rose\AppData\Roaming\OpenOffice.org2
2008-04-10 23:02 --------- d-----w C:\Program Files\MSN Pictures Displayer
2008-04-10 21:24 --------- d-----w C:\Users\petit lapin rose\AppData\Roaming\Windows Live Writer
2008-04-09 08:34 --------- d-----w C:\Users\petit lapin rose\AppData\Roaming\CyberLink
2008-03-28 20:41 --------- d-----w C:\Program Files\FlashFXP
2008-03-10 11:01 6,656 ----a-w C:\Windows\System32\stdftfr.dll
2008-03-10 11:01 118,784 ----a-w C:\Windows\System32\MSSTDFMT.DLL
2008-03-10 10:59 16,200 ----a-w C:\Windows\System32\AcSignExtRes.dll
2008-03-10 10:57 43,160 ----a-w C:\Windows\System32\AcSignIcon.dll
2008-03-10 10:57 426,136 ----a-w C:\Windows\System32\AcSignOpt.exe
2008-03-10 10:57 28,312 ----a-w C:\Windows\System32\AcSignExt.dll
2008-02-29 06:51 19,000 ----a-w C:\Windows\System32\kd1394.dll
2008-02-29 06:39 40,960 ----a-w C:\Windows\System32\srclient.dll
2008-02-29 06:39 371,712 ----a-w C:\Windows\System32\srcore.dll
2008-02-29 06:38 313,856 ----a-w C:\Windows\System32\rstrui.exe
2008-02-29 06:38 16,384 ----a-w C:\Windows\System32\srdelayed.exe
2008-02-29 06:35 6,656 ----a-w C:\Windows\System32\kbd106n.dll
2008-02-29 06:34 7,168 ----a-w C:\Windows\System32\f3ahvoas.dll
2008-02-29 04:16 2,027,008 ----a-w C:\Windows\System32\win32k.sys
2008-01-01 21:31 207 ----a-w C:\Users\petit lapin rose\profil.dat
2007-10-06 08:07 174 --sha-w C:\Program Files\desktop.ini
.

------- Sigcheck -------

.
((((((((((((((((((((((((((((( snapshot@2008-05-27_13.04.19,54 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-27 07:02:10 67,584 --s-a-w C:\Windows\bootstat.dat
+ 2008-05-27 11:17:01 67,584 --s-a-w C:\Windows\bootstat.dat
- 2008-05-27 07:02:13 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-05-27 11:17:06 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2008-05-27 07:02:13 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2008-05-27 11:17:06 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-05-27 07:06:08 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat
+ 2008-05-27 11:19:46 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat
- 2008-05-27 07:06:00 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat
+ 2008-05-27 11:21:07 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat
- 2008-05-27 10:38:55 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-05-27 11:22:55 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-05-27 10:38:55 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-05-27 11:22:55 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-05-27 10:38:55 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-05-27 11:22:55 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-04-29 06:06:51 388,640 ----a-w C:\Windows\System32\FNTCACHE.DAT
+ 2008-05-27 11:17:31 461,624 ----a-w C:\Windows\System32\FNTCACHE.DAT
- 2008-05-27 07:08:13 9,708 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-464813678-2348764874-1438983479-1000_UserData.bin
+ 2008-05-27 11:21:09 9,724 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-464813678-2348764874-1438983479-1000_UserData.bin
- 2008-05-27 07:08:13 68,816 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-05-27 11:21:06 68,950 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-09 04:09 1232896]
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-05-22 15:49 151552]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-05 12:48 68856]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
"Uniblue RegistryBooster 2"="c:\program files\uniblue\registrybooster 2\StartRegistryBooster.exe" [ ]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:35 125440]
"Bags Else Hole Lite"="C:\ProgramData\scr move mp3.vquhzmq" [ ]
"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 12:29 220544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ALaunch"="C:\Acer\ALaunch\AlaunchClient.exe" [ ]
"RtHDVCpl"="RtHDVCpl.exe" [2007-07-06 05:06 4669440 C:\Windows\RtHDVCpl.exe]
"eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-25 16:33 457216]
"eAudio"="C:\Acer\Empowering Technology\eAudio\eAudio.exe" [2007-06-11 14:54 1286144]
"Acer Tour"="" []
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-07-25 14:53 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-07-25 14:53 8433664]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-07-25 14:53 81920]
"LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2007-08-15 11:21 772616]
"PlayMovie"="C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [2007-05-24 13:38 206952]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2007-06-06 10:06 159744]
"eRecoveryService"="" []
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-05-22 15:49 151552]
"WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 21:48 57344]
"SetPanel"="C:\Acer\APanel\APanel.cmd" [ ]
"eBayToolbar"="C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe" [2008-03-23 19:43 652528]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 01:19 79224]
"Norton Ghost 12.0"="C:\Program Files\Norton Ghost\Agent\VProTray.exe" [2007-03-28 20:41 2037352]
"Deaf Thunk"="C:\ProgramData\64SoftwareSoftware.eo2j5l" [2008-05-27 14:04 348176]
"Bags Else Hole Lite"="C:\ProgramData\idle link free.jv5lk" [2008-05-27 04:48 49168]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2008-02-01 22:32 8699904]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2007-07-26 04:17:00 535336]
Outil de mise … jour Google.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-10-05 12:48:24 126136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"ValidateAdminCodeSignatures"= 1 (0x1)
"FilterAdministratorToken"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{59DE5281-D76E-4158-8705-CF329C4E4652}"= C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
"{F7BE5145-CFB9-4EF6-B59F-1DE503F9CE8D}"= C:\Program Files\Acer Arcade Deluxe\VideoMagician\VideoMagician.exe:VideoMagician
"{C86DBA55-A3E3-4F9D-96E7-A08610EB6934}"= C:\Program Files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe:HomeMedia
"{C65B0CFD-D277-4C74-BB3B-50A605A73447}"= C:\Program Files\Acer Arcade Deluxe\DV Wizard\DV Wizard.exe:DV Wizard
"{FBA08FC0-633E-4385-AC8C-9EECB469AC78}"= C:\Program Files\Acer Arcade Deluxe\DVDivine\DVDivine.exe:DVDivine
"{75CDB32E-DEC4-4243-BA05-B8BCCCFEE530}"= C:\Program Files\Acer Arcade Deluxe\Play Movie\PlayMovie.exe:Play Movie
"{AAA4F0BF-0EA7-4518-BC6B-B9B055BAFADB}"= C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe:Play Movie Resident Program
"{640A35BC-F79B-4F6A-A44D-5E05A65064DD}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{9EA4CD51-B68F-4660-9F80-E77E4924C307}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{9906F189-FC34-432F-8306-43E73885BEF4}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"TCP Query User{F5B2DA50-2856-4534-A14A-63A3361F0172}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{B7FF53F0-D8EE-46F5-8903-A3D77C95B3AD}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"TCP Query User{CA56A859-C2CC-4C13-B9E0-3C8476C82DDB}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{37CF3D0B-12E8-4B25-AF97-0152642A0A00}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"TCP Query User{A72729F6-171A-456E-9B9F-F68031814E77}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{E2301539-AED7-41FE-A8BB-5252780E10F8}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"TCP Query User{DD526920-8A95-45E1-857D-4D7B3430533A}C:\\users\\petit lapin rose\\program files\\utorrent\\utorrent.exe"= UDP:C:\users\petit lapin rose\program files\utorrent\utorrent.exe:utorrent.exe
"UDP Query User{93CCE6AA-E765-4974-B21A-1D0314021097}C:\\users\\petit lapin rose\\program files\\utorrent\\utorrent.exe"= TCP:C:\users\petit lapin rose\program files\utorrent\utorrent.exe:utorrent.exe
"TCP Query User{D096938C-53F9-4A65-BF29-8BD0E84B6889}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{9C2F7A56-6041-4EC6-A0FC-39AB04F6E759}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"{664BFE20-0D61-42C9-8010-038427305E8D}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{1B344E80-86FE-4AC7-8AEA-F66F1F433914}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"TCP Query User{C5250679-18A8-40F3-9627-312992F00514}C:\\users\\petit lapin rose\\program files\\utorrent\\utorrent.exe"= UDP:C:\users\petit lapin rose\program files\utorrent\utorrent.exe:utorrent.exe
"UDP Query User{64856FCE-105A-4449-B5CD-F651AE2966D7}C:\\users\\petit lapin rose\\program files\\utorrent\\utorrent.exe"= TCP:C:\users\petit lapin rose\program files\utorrent\utorrent.exe:utorrent.exe
"TCP Query User{5175E42E-091B-48D0-A18C-578CE55A8D5D}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{08BB62C9-3CBC-485A-A5ED-312BA0B64C3A}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"{A8A5BCF4-87DA-4CCD-B2EE-5AE42273F441}"= Disabled:UDP:C:\Program Files\MySpace\IM\MySpaceIM.exe:MySpaceIM
"{CEEF05B6-3AF2-4295-AD4A-A0EEF184C9ED}"= Disabled:TCP:C:\Program Files\MySpace\IM\MySpaceIM.exe:MySpaceIM
"TCP Query User{F0D80F0F-FF03-407C-B0BE-62A2870A6819}C:\\program files\\myspace\\im\\myspaceim.exe"= UDP:C:\program files\myspace\im\myspaceim.exe:MySpace Instant Messenger
"UDP Query User{87C85883-62C9-4563-AEC4-C7DAE007CE1C}C:\\program files\\myspace\\im\\myspaceim.exe"= TCP:C:\program files\myspace\im\myspaceim.exe:MySpace Instant Messenger
"{DA1A0DBB-9CFA-4A8B-9792-FCBC897E99E9}"= C:\Program Files\Windows Live\Messenger\wlcsdk.exe:Windows Live Messenger (Phone)
"{A4A422B7-AA23-4371-965F-56FC023B92E5}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{8F96529C-298A-44F0-9DA6-55D466380920}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R0 PSDFilter;PSDFilter;C:\Windows\system32\DRIVERS\psdfilter.sys [2007-04-25 16:34]
R0 PSDNServ;PSDNSERVER;C:\Windows\system32\drivers\PSDNServ.sys [2007-04-25 16:34]
R0 psdvdisk;psdvdisk;C:\Windows\system32\drivers\psdvdisk.sys [2007-04-25 16:34]
R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};C:\Program Files\Acer Arcade Deluxe\Play Movie\[u]0/u00.fcl [2006-11-02 16:51]
R2 ALaunchService;ALaunch Service;C:\Acer\ALaunch\ALaunchSvc.exe [2007-01-26 14:24]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-05-16 01:18]
R2 eDataSecurity Service;eDSService.exe;"C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe" [2007-04-25 16:34]
R2 eNet Service;eNet Service;C:\Acer\Empowering Technology\eNet\eNet Service.exe [2007-06-13 16:54]
R2 eSettingsService;eSettings Service;C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [2007-06-28 18:50]
R2 MobilityService;MobilityService;C:\Acer\Mobility Center\MobilityService.exe [2006-11-24 12:57]
R2 WMIService;ePower Service;C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [2007-06-13 11:23]
R2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys [2007-05-17 02:46]
R3 athr;Atheros Extensible Wireless LAN device driver;C:\Windows\system32\DRIVERS\athr.sys [2007-06-18 12:03]
R3 Cam5607;Acer Crystal Eye webcam;C:\Windows\system32\Drivers\BisonC07.sys [2007-05-28 07:57]
R3 enecir;ENE CIR Receiver;C:\Windows\system32\DRIVERS\enecir.sys [2007-05-16 14:47]
R3 nvsmu;nvsmu;C:\Windows\system32\DRIVERS\nvsmu.sys [2007-05-17 03:05]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{75140466-929c-11dc-8d3d-001b385397bb}]
\shell\AutoRun\command - G:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{93cd302d-2b03-11dd-b3b3-001b385397bb}]
\shell\AutoRun\command - F:\Setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bbd7ffbb-abe3-11dc-a73f-001b385397bb}]
\shell\AutoRun\command - F:\ReadMe.exe

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-27 14:20:19
Windows 6.0.6000 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-05-27 14:24:11
ComboFix-quarantined-files.txt 2008-05-27 12:24:00
ComboFix2.txt 2008-05-27 11:04:51

Pre-Run: 25,552,338,944 octets libres
Post-Run: 25,529,499,648 octets libres

249 --- E O F --- 2008-05-23 10:54:10

et pour le apport hijack qui a suivi ça donne çà:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:40:43, on 27/05/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
C:\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Norton Ghost\Agent\VProTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Windows\System32\rundll32.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\PETITL~1\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Users\petit lapin rose\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.ebay.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O4 - HKLM\..\Run: [ALaunch] C:\Acer\ALaunch\AlaunchClient.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [eAudio] "C:\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [SetPanel] C:\Acer\APanel\APanel.cmd
O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Norton Ghost 12.0] "C:\Program Files\Norton Ghost\Agent\VProTray.exe"
O4 - HKLM\..\Run: [Deaf Thunk] "C:\ProgramData\64SoftwareSoftware.eo2j5l"
O4 - HKLM\..\Run: [Bags Else Hole Lite] "C:\ProgramData\idle link free.jv5lk"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] c:\program files\uniblue\registrybooster 2\StartRegistryBooster.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Bags Else Hole Lite] "C:\ProgramData\scr move mp3.vquhzmq"
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Global Startup: Empowering Technology Launcher.lnk = C:\Acer\Empowering Technology\eAPLauncher.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Recherche sur eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {5DDCC37F-7C6B-48B8-9664-97C537920CA0} (aecviz Class) - http://www.maisonfamiliale.com/AECVIZ/npaecviz.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

jlpjlp · Answer

pour avancer ^^Marie^^

télécharge Lop S&D.exe sur ton Bureau.https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2

* Double-clique dessus pour lancer l'installation
* Puis double-clique sur le raccourci Lop S&D présent sur ton Bureau
* Séléctionne la langue souhaitée , puis choisis l'option 1 (Recherche)
* Patiente jusqu'à la fin du scan
* Poste le rapport généré (C:\lopR.txt)

lamulata · Answer

-----------------------[  Lop S&D 4.2.0-9  XP/Vista  ]---------------------

   [ Windows 'Longhorn' (NT 6.0) Workstation Build 6000 ]
   [ USER : petit lapin rose ] [ "C:\Lop SD" ] [ Selection : 1 ]
   [ 27/05/2008 | 15:44:56,61 ] [ PC : PCPORTABLE ]
   [ MAJ : 16-05-2008 | 23:35 ]
   [ UAC => 0 ]
 
   -------------[ Listing des dossiers dans Application Data ]------------  

   [12/01/2008|23:34] C:\Users\PETITL~1\AppData\Roaming\Adobe\Flash Player
   [09/10/2007|22:42] C:\Users\PETITL~1\AppData\Roaming\Adobe\Linguistics
   [05/10/2007|12:08] C:\Users\PETITL~1\AppData\Roaming\Adobe\Acrobat

   [17/11/2007|16:44] C:\Users\PETITL~1\AppData\Roaming\Anuman Interactive\AnumanLive

   [05/12/2007|09:55] C:\Users\PETITL~1\AppData\Roaming\Apple Computer\iTunes

   [27/05/2008|12:01] C:\Users\PETITL~1\AppData\Roaming\Autodesk\ADR
   [27/05/2008|12:01] C:\Users\PETITL~1\AppData\Roaming\Autodesk\MC3
   [27/05/2008|10:45] C:\Users\PETITL~1\AppData\Roaming\Autodesk\WebServices
   [27/05/2008|09:30] C:\Users\PETITL~1\AppData\Roaming\Autodesk\ACD-A 2009
   [27/05/2008|09:24] C:\Users\PETITL~1\AppData\Roaming\Autodesk\Autodesk Design Review

   [09/04/2008|10:34] C:\Users\PETITL~1\AppData\Roaming\CyberLink\PowerDVD
   [09/04/2008|10:33] C:\Users\PETITL~1\AppData\Roaming\CyberLink\PlayMovie
   [10/12/2007|21:01] C:\Users\PETITL~1\AppData\Roaming\CyberLink\PowerCinema

   [13/03/2008|11:34] C:\Users\PETITL~1\AppData\Roaming\FlashFXP\3

   [14/05/2008|21:14] C:\Users\PETITL~1\AppData\Roaming\Google\Local Search History

   [05/10/2007|11:30] C:\Users\PETITL~1\AppData\Roaming\Identities\{59D57341-1DC9-4F50-AAD9-8BC312795EC4}

   [23/10/2007|13:46] C:\Users\PETITL~1\AppData\Roaming\Leadertech\PowerRegister

   [24/10/2007|14:01] C:\Users\PETITL~1\AppData\Roaming\LimeWire\.AppSpecialShare
   [24/10/2007|14:01] C:\Users\PETITL~1\AppData\Roaming\LimeWire\xml
   [24/10/2007|14:01] C:\Users\PETITL~1\AppData\Roaming\LimeWire	hemes

   [05/12/2007|23:03] C:\Users\PETITL~1\AppData\Roaming\ma-config.com\Logs

   [05/10/2007|12:26] C:\Users\PETITL~1\AppData\Roaming\Macromedia\Flash Player

   [13/05/2008|16:31] C:\Users\PETITL~1\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware



   [27/05/2008|15:38] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Word
   [25/05/2008|16:51] C:\Users\PETITL~1\AppData\Roaming\Microsoft\CLR Security Config
   [25/05/2008|04:01] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Office
   [23/05/2008|18:07] C:\Users\PETITL~1\AppData\Roaming\Microsoft\preuve
   [18/05/2008|09:44] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Clip Organizer
   [08/05/2008|08:16] C:\Users\PETITL~1\AppData\Roaming\Microsoft\ModŠles
   [08/03/2008|09:47] C:\Users\PETITL~1\AppData\Roaming\Microsoft\MSN Messenger
   [04/03/2008|18:53] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Outlook
   [23/02/2008|10:34] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Macros compl‚mentaires
   [13/01/2008|17:20] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Windows Photo Gallery
   [12/01/2008|15:45] C:\Users\PETITL~1\AppData\Roaming\Microsoft\eHome
   [27/11/2007|20:01] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Internet Explorer
   [25/11/2007|16:42] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Templates
   [25/11/2007|16:34] C:\Users\PETITL~1\AppData\Roaming\Microsoft\UProof
   [17/11/2007|23:14] C:\Users\PETITL~1\AppData\Roaming\Microsoft\HTML Help
   [13/11/2007|15:26] C:\Users\PETITL~1\AppData\Roaming\Microsoft\IdentityCRL
   [12/11/2007|16:12] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Proof
   [09/10/2007|14:57] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Excel
   [08/10/2007|12:15] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Crypto
   [06/10/2007|13:54] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Document Building Blocks
   [05/10/2007|20:50] C:\Users\PETITL~1\AppData\Roaming\Microsoft\AddIns
   [05/10/2007|13:28] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Speech
   [05/10/2007|13:25] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Windows
   [05/10/2007|12:40] C:\Users\PETITL~1\AppData\Roaming\Microsoft\MMC
   [05/10/2007|11:30] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Protect
   [05/10/2007|11:29] C:\Users\PETITL~1\AppData\Roaming\Microsoft\SystemCertificates
   [05/10/2007|11:29] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Credentials


   [16/03/2008|11:45] C:\Users\PETITL~1\AppData\Roaming\MySpace\IM



   [06/12/2007|15:24] C:\Users\PETITL~1\AppData\Roaming\OpenOffice.org2\user


   [13/05/2008|14:23] C:\Users\PETITL~1\AppData\Roaming\SecondLife\logs
   [13/05/2008|14:22] C:\Users\PETITL~1\AppData\Roaming\SecondLife\browser_profile
   [13/05/2008|14:22] C:\Users\PETITL~1\AppData\Roaming\SecondLife\user_settings
   [13/05/2008|14:21] C:\Users\PETITL~1\AppData\Roaming\SecondLife\cache
   [06/05/2008|00:19] C:\Users\PETITL~1\AppData\Roaming\SecondLife\franzos_lamulata
   [06/05/2008|00:17] C:\Users\PETITL~1\AppData\Roaming\SecondLife\lamulata_franzos

   [23/10/2007|13:51] C:\Users\PETITL~1\AppData\Roaming\Sonic\RecordNow!

   [25/05/2008|14:02] C:\Users\PETITL~1\AppData\Roaming\Symantec\Norton Ghost

   [09/10/2007|00:03] C:\Users\PETITL~1\AppData\Roaming\Uniblue\Registry Booster2


   [07/10/2007|00:30] C:\Users\PETITL~1\AppData\Roaming\vlc\cache

   [10/04/2008|23:24] C:\Users\PETITL~1\AppData\Roaming\Windows Live Writer\PostSupportingFiles
   [10/04/2008|23:24] C:\Users\PETITL~1\AppData\Roaming\Windows Live Writer\Dictionaries
   [10/04/2008|23:22] C:\Users\PETITL~1\AppData\Roaming\Windows Live Writer\blogtemplates
 
   ----------------[ Tâches planifiées dans C:\Windows	asks ]---------------

   [27/05/2008 14:32][--ah-----] C:\Windows	asks\SA.DAT
   [27/05/2008 14:31][--a------] C:\Windows	asks\SCHEDLGU.TXT
  
   ------[ Listing des dossiers dans C:\ProgramData ]------
   
   [27/05/2008|11:39] C:\ProgramData\64SoftwareSoftware.2eo58ij
   [27/05/2008|09:49] C:\ProgramData\64SoftwareSoftware.4tc8o9l
   [27/05/2008|05:32] C:\ProgramData\64SoftwareSoftware.6784fo
   [27/05/2008|10:33] C:\ProgramData\64SoftwareSoftware.739bmx
   [27/05/2008|15:40] C:\ProgramData\64SoftwareSoftware.7lo4yfa
   [27/05/2008|06:16] C:\ProgramData\64SoftwareSoftware.7lt5r
   [27/05/2008|04:48] C:\ProgramData\64SoftwareSoftware.86r1s
   [27/05/2008|07:43] C:\ProgramData\64SoftwareSoftware.8h7gve
   [27/05/2008|05:54] C:\ProgramData\64SoftwareSoftware.a2txklz
   [27/05/2008|11:17] C:\ProgramData\64SoftwareSoftware.bpjtc
   [27/05/2008|12:01] C:\ProgramData\64SoftwareSoftware.csbwu
   [27/05/2008|07:21] C:\ProgramData\64SoftwareSoftware.cutn9sp
   [27/05/2008|14:04] C:\ProgramData\64SoftwareSoftware.eo2j5l
   [27/05/2008|10:55] C:\ProgramData\64SoftwareSoftware.f8dwde
   [27/05/2008|08:27] C:\ProgramData\64SoftwareSoftware.fk0sx4
   [27/05/2008|05:10] C:\ProgramData\64SoftwareSoftware.gbhaoe2
   [27/05/2008|13:42] C:\ProgramData\64SoftwareSoftware.gbp6m44
   [27/05/2008|14:56] C:\ProgramData\64SoftwareSoftware.io7p8
   [27/05/2008|09:27] C:\ProgramData\64SoftwareSoftware.kjo1a
   [10/04/2008|23:30] C:\ProgramData\64SoftwareSoftware.l6vzj
   [27/05/2008|06:38] C:\ProgramData\64SoftwareSoftware.ljs935m
   [27/05/2008|12:23] C:\ProgramData\64SoftwareSoftware.nrhyc
   [27/05/2008|12:45] C:\ProgramData\64SoftwareSoftware.o1ro2o
   [27/05/2008|08:05] C:\ProgramData\64SoftwareSoftware.phlcr2
   [27/05/2008|08:49] C:\ProgramData\64SoftwareSoftware.qadvh9
   [28/04/2008|23:01] C:\ProgramData\64SoftwareSoftware.qewmtp
   [27/05/2008|15:18] C:\ProgramData\64SoftwareSoftware.rrqj49r
   [27/05/2008|04:48] C:\ProgramData\64SoftwareSoftware.t0e9y
   [27/05/2008|06:59] C:\ProgramData\64SoftwareSoftware.vmtdkim
   [27/05/2008|10:11] C:\ProgramData\64SoftwareSoftware.wc3ge
   [07/02/2008|16:17] C:\ProgramData\Adobe
   [11/10/2007|08:11] C:\ProgramData\Apple
   [11/04/2008|15:53] C:\ProgramData\Apple Computer
   [02/11/2006|15:02] C:\ProgramData\Application Data 
   [27/05/2008|12:01] C:\ProgramData\Autodesk
   [05/10/2007|11:25] C:\ProgramData\Bureau 
   [13/09/2007|16:38] C:\ProgramData\CyberLink
   [02/11/2006|15:02] C:\ProgramData\Desktop 
   [02/11/2006|15:02] C:\ProgramData\Documents 
   [05/10/2007|12:56] C:\ProgramData\eBay
   [22/04/2008|17:15] C:\ProgramData\eMule
   [05/10/2007|11:25] C:\ProgramData\Favoris 
   [02/11/2006|15:02] C:\ProgramData\Favorites 
   [15/05/2008|23:13] C:\ProgramData\Forge of Games
   [27/05/2008|04:48] C:\ProgramData\Freelist
   [05/10/2007|12:48] C:\ProgramData\Google
   [27/05/2008|04:02] C:\ProgramData\Google Updater
   [27/05/2008|04:48] C:\ProgramData\idle link free.jv5lk
   [27/05/2008|04:48] C:\ProgramData\Iso Web Bags Else
   [22/04/2008|17:48] C:\ProgramData\Kaspersky Lab
   [14/05/2008|21:31] C:\ProgramData\Lavasoft
   [13/05/2008|16:31] C:\ProgramData\Malwarebytes
   [05/10/2007|11:25] C:\ProgramData\Menu D‚marrer 
   [08/10/2007|11:02] C:\ProgramData\Messenger Plus!
   [27/05/2008|10:12] C:\ProgramData\Microsoft
   [26/11/2007|10:32] C:\ProgramData\Microsoft Help
   [05/10/2007|11:25] C:\ProgramData\ModŠles 
   [20/10/2007|12:06] C:\ProgramData\Sandlot Games
   [09/10/2007|00:28] C:\ProgramData\Skype
   [02/11/2006|15:02] C:\ProgramData\Start Menu 
   [25/05/2008|12:00] C:\ProgramData\Symantec
   [20/10/2007|12:17] C:\ProgramData\TEMP
   [02/11/2006|15:02] C:\ProgramData\Templates 
   [27/04/2008|08:18] C:\ProgramData\WholeSecurity
   [17/04/2008|18:47] C:\ProgramData\WLInstaller
 
   ---------------[ Listing des dossiers dans C:\Program Files ]--------------
 
   [13/09/2007|16:37] C:\Program Files\Acer Arcade Deluxe
   [11/04/2008|15:48] C:\Program Files\Acer GameZone
   [13/09/2007|16:54] C:\Program Files\Acer Inc
   [07/02/2008|16:17] C:\Program Files\Adobe
   [22/04/2008|19:48] C:\Program Files\Alcohol Soft
   [22/04/2008|18:09] C:\Program Files\Alwil Software
   [13/09/2007|16:52] C:\Program Files\Apoint2K
   [11/10/2007|08:11] C:\Program Files\Apple Software Update
   [27/05/2008|10:01] C:\Program Files\AutoCAD Architecture 2009
   [27/05/2008|09:24] C:\Program Files\Autodesk
   [28/02/2008|21:43] C:\Program Files\Bitmanagement Software
   [27/05/2008|09:24] C:\Program Files\Common Files
   [26/07/2007|03:29] C:\Program Files\CONEXANT
   [26/07/2007|04:13] C:\Program Files\CyberLink
   [20/04/2008|14:26] C:\Program Files\DAEMON Tools Pro
   [06/10/2007|10:07] C:\Program Files\desktop.ini
   [20/04/2008|15:04] C:\Program Files\D-Tools
   [05/10/2007|12:56] C:\Program Files\eBay
   [05/10/2007|11:25] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
   [28/03/2008|22:41] C:\Program Files\FlashFXP
   [22/04/2008|17:16] C:\Program Files\Free Audio Pack
   [27/05/2008|04:48] C:\Program Files\Freelist
   [05/10/2007|12:48] C:\Program Files\Google
   [14/11/2007|21:00] C:\Program Files\GSpot
   [05/10/2007|12:56] C:\Program Files\InstallShield Installation Information
   [10/04/2008|03:19] C:\Program Files\Internet Explorer
   [23/02/2008|14:43] C:\Program Files\IrfanView
   [09/10/2007|13:52] C:\Program Files\IZArc
   [14/03/2008|21:51] C:\Program Files\Java
   [05/10/2007|11:46] C:\Program Files\Kaspersky Lab
   [13/09/2007|16:35] C:\Program Files\Launch Manager
   [24/10/2007|14:18] C:\Program Files\LimeWire
   [17/11/2007|17:07] C:\Program Files\LiveCAD
   [05/12/2007|23:03] C:\Program Files\ma-config.com
   [27/05/2008|12:32] C:\Program Files\Malwarebytes' Anti-Malware
   [11/04/2008|01:05] C:\Program Files\Messenger
   [14/05/2008|21:51] C:\Program Files\Messenger Plus! Live
   [06/10/2007|09:56] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [02/11/2006|14:37] C:\Program Files\Microsoft Games
   [27/05/2008|09:26] C:\Program Files\Microsoft Office
   [05/10/2007|13:31] C:\Program Files\Microsoft SQL Server Compact Edition
   [23/02/2008|10:18] C:\Program Files\Microsoft Visual Studio
   [23/02/2008|10:19] C:\Program Files\Microsoft Works
   [23/02/2008|10:15] C:\Program Files\Microsoft.NET
   [02/11/2006|14:42] C:\Program Files\Movie Maker
   [02/11/2006|14:37] C:\Program Files\MSBuild
   [02/11/2006|14:37] C:\Program Files\MSN
   [11/04/2008|01:02] C:\Program Files\MSN Pictures Displayer
   [06/10/2007|09:46] C:\Program Files\MSXML 4.0
   [14/03/2008|14:58] C:\Program Files\MySpace
   [26/07/2007|04:11] C:\Program Files\NewTech Infosystems
   [25/05/2008|11:51] C:\Program Files\Norton Ghost
   [13/04/2008|20:56] C:\Program Files\Panicware
   [05/10/2007|12:31] C:\Program Files\RALINK
   [09/10/2007|00:15] C:\Program Files\Real
   [13/09/2007|16:39] C:\Program Files\Realtek
   [02/11/2006|14:37] C:\Program Files\Reference Assemblies
   [25/05/2008|11:48] C:\Program Files\Symantec
   [02/11/2006|15:01] C:\Program Files\Uninstall Information
   [07/10/2007|00:29] C:\Program Files\VideoLAN
   [06/10/2007|10:02] C:\Program Files\Windows Calendar
   [02/11/2006|14:42] C:\Program Files\Windows Collaboration
   [26/07/2007|04:19] C:\Program Files\Windows Defender
   [02/11/2006|14:42] C:\Program Files\Windows Journal
   [21/04/2008|01:59] C:\Program Files\Windows Live
   [15/05/2008|03:05] C:\Program Files\Windows Mail
   [10/10/2007|03:13] C:\Program Files\Windows Media Player
   [05/10/2007|11:25] C:\Program Files\Windows NT
   [02/11/2006|14:42] C:\Program Files\Windows Photo Gallery
   [09/01/2008|04:21] C:\Program Files\Windows Sidebar
  
   ------[ Listing des dossiers dans C:\Program Files\Common Files ]------
   
   [07/02/2008|16:18] C:\Program Files\Common Files\Adobe
   [11/10/2007|09:00] C:\Program Files\Common Files\Apple
   [27/05/2008|10:06] C:\Program Files\Common Files\Autodesk Shared
   [27/05/2008|09:26] C:\Program Files\Common Files\DESIGNER
   [26/07/2007|04:13] C:\Program Files\Common Files\InstallShield
   [24/10/2007|13:55] C:\Program Files\Common Files\Java
   [26/07/2007|04:11] C:\Program Files\Common Files\LightScribe
   [27/05/2008|09:26] C:\Program Files\Common Files\microsoft shared
   [26/07/2007|04:11] C:\Program Files\Common Files\muvee Technologies
   [26/07/2007|04:11] C:\Program Files\Common Files\NewTech Infosystems
   [14/11/2007|11:44] C:\Program Files\Common Files\Real
   [02/11/2006|13:18] C:\Program Files\Common Files\Services
   [02/11/2006|13:18] C:\Program Files\Common Files\SpeechEngines
   [25/05/2008|11:51] C:\Program Files\Common Files\Symantec Shared
   [23/02/2008|10:16] C:\Program Files\Common Files\System
   [21/04/2008|01:59] C:\Program Files\Common Files\WindowsLiveInstaller

   ---------------------------[ Process ]--------------------------

   ... 88

   iexplore.exe ~ [2848]
   iexplore.exe ~ [4200]

   ----------------------[ Recherche avec S_Lop ]---------------------

   C:\ProgramData\idle link free.jv5lk
 
   -----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------

   C:\ProgramData\Iso Web Bags Else
   C:\ProgramData\Iso Web Bags Else\ford support.exe
 
   ----------------------[ Verification du Registre ]----------------------

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
 
   ..... OK !

   --------------------[ Verification du fichier Hosts ]---------------------

   Fichier Hosts PROPRE


   ----------------[ Recherche de fichiers avec Catchme ]-----------------
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-05-27 15:45:40
   Windows 6.0.6000  NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------[ Recherche d'autres infections ]---------------------


   Aucune autre infection trouvée  !

   [F:15][D:6]-> C:\Users\PETITL~1\AppData\Local\Temp
   [F:277][D:1]-> C:\Users\PETITL~1\AppData\Roaming\MICROS~1\Windows\Cookies
   [F:863][D:4]-> C:\Users\PETITL~1\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
   [F:45][D:6]-> C:\$Recycle.Bin

   [ UAC => 1 ]

   --------------------[ Fin du rapport a 15:46:45,18  ]----------------------

jlpjlp · Answer

lop sd:

* Choisis cette fois ci l'Option 2 (Suppression)
* Ne ferme pas la fenêtre lors de la suppression !
* Poste le rapport généré (C:\lopR.txt)


(Si le Bureau ne réapparaît pas, presse Ctrl + Alt + Suppr , Onglet Fichier , Nouvelle tâche , tape explorer.exe et valide) 

______________
remets aussi un hijackhtis

lamulata · Answer

-----------------------[  Lop S&D 4.2.0-9  XP/Vista  ]---------------------

   [ Windows 'Longhorn' (NT 6.0) Workstation Build 6000 ]
   [ USER : petit lapin rose ] [ "C:\Lop SD" ] [ Selection : 2 ]
   [ 27/05/2008 | 16:00:58,97 ] [ PC : PCPORTABLE ]
   [ MAJ : 16-05-2008 | 23:35 ]
   [ UAC => 0 ]


   \\\\\\\\\\\\\\\ SUPPRESSION /////////////////////////////

   Supprimé! - C:\ProgramData\Iso Web Bags Else\ford support.exe
   Supprimé! - C:\ProgramData\idle link free.jv5lk
   Supprimé! - C:\ProgramData\Iso Web Bags Else
 
   //////////////////////////////////////-\\\\\\\\\\\\\\\\\\\\ 

 
   -------------[ Listing des dossiers dans Application Data ]------------  

   [12/01/2008|23:34] C:\Users\PETITL~1\AppData\Roaming\Adobe\Flash Player
   [09/10/2007|22:42] C:\Users\PETITL~1\AppData\Roaming\Adobe\Linguistics
   [05/10/2007|12:08] C:\Users\PETITL~1\AppData\Roaming\Adobe\Acrobat

   [17/11/2007|16:44] C:\Users\PETITL~1\AppData\Roaming\Anuman Interactive\AnumanLive

   [05/12/2007|09:55] C:\Users\PETITL~1\AppData\Roaming\Apple Computer\iTunes

   [27/05/2008|12:01] C:\Users\PETITL~1\AppData\Roaming\Autodesk\ADR
   [27/05/2008|12:01] C:\Users\PETITL~1\AppData\Roaming\Autodesk\MC3
   [27/05/2008|10:45] C:\Users\PETITL~1\AppData\Roaming\Autodesk\WebServices
   [27/05/2008|09:30] C:\Users\PETITL~1\AppData\Roaming\Autodesk\ACD-A 2009
   [27/05/2008|09:24] C:\Users\PETITL~1\AppData\Roaming\Autodesk\Autodesk Design Review

   [09/04/2008|10:34] C:\Users\PETITL~1\AppData\Roaming\CyberLink\PowerDVD
   [09/04/2008|10:33] C:\Users\PETITL~1\AppData\Roaming\CyberLink\PlayMovie
   [10/12/2007|21:01] C:\Users\PETITL~1\AppData\Roaming\CyberLink\PowerCinema

   [13/03/2008|11:34] C:\Users\PETITL~1\AppData\Roaming\FlashFXP\3

   [14/05/2008|21:14] C:\Users\PETITL~1\AppData\Roaming\Google\Local Search History

   [05/10/2007|11:30] C:\Users\PETITL~1\AppData\Roaming\Identities\{59D57341-1DC9-4F50-AAD9-8BC312795EC4}

   [23/10/2007|13:46] C:\Users\PETITL~1\AppData\Roaming\Leadertech\PowerRegister

   [24/10/2007|14:01] C:\Users\PETITL~1\AppData\Roaming\LimeWire\.AppSpecialShare
   [24/10/2007|14:01] C:\Users\PETITL~1\AppData\Roaming\LimeWire\xml
   [24/10/2007|14:01] C:\Users\PETITL~1\AppData\Roaming\LimeWire	hemes

   [05/12/2007|23:03] C:\Users\PETITL~1\AppData\Roaming\ma-config.com\Logs

   [05/10/2007|12:26] C:\Users\PETITL~1\AppData\Roaming\Macromedia\Flash Player

   [13/05/2008|16:31] C:\Users\PETITL~1\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware



   [27/05/2008|15:38] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Word
   [25/05/2008|16:51] C:\Users\PETITL~1\AppData\Roaming\Microsoft\CLR Security Config
   [25/05/2008|04:01] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Office
   [23/05/2008|18:07] C:\Users\PETITL~1\AppData\Roaming\Microsoft\preuve
   [18/05/2008|09:44] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Clip Organizer
   [08/05/2008|08:16] C:\Users\PETITL~1\AppData\Roaming\Microsoft\ModŠles
   [08/03/2008|09:47] C:\Users\PETITL~1\AppData\Roaming\Microsoft\MSN Messenger
   [04/03/2008|18:53] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Outlook
   [23/02/2008|10:34] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Macros compl‚mentaires
   [13/01/2008|17:20] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Windows Photo Gallery
   [12/01/2008|15:45] C:\Users\PETITL~1\AppData\Roaming\Microsoft\eHome
   [27/11/2007|20:01] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Internet Explorer
   [25/11/2007|16:42] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Templates
   [25/11/2007|16:34] C:\Users\PETITL~1\AppData\Roaming\Microsoft\UProof
   [17/11/2007|23:14] C:\Users\PETITL~1\AppData\Roaming\Microsoft\HTML Help
   [13/11/2007|15:26] C:\Users\PETITL~1\AppData\Roaming\Microsoft\IdentityCRL
   [12/11/2007|16:12] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Proof
   [09/10/2007|14:57] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Excel
   [08/10/2007|12:15] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Crypto
   [06/10/2007|13:54] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Document Building Blocks
   [05/10/2007|20:50] C:\Users\PETITL~1\AppData\Roaming\Microsoft\AddIns
   [05/10/2007|13:28] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Speech
   [05/10/2007|13:25] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Windows
   [05/10/2007|12:40] C:\Users\PETITL~1\AppData\Roaming\Microsoft\MMC
   [05/10/2007|11:30] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Protect
   [05/10/2007|11:29] C:\Users\PETITL~1\AppData\Roaming\Microsoft\SystemCertificates
   [05/10/2007|11:29] C:\Users\PETITL~1\AppData\Roaming\Microsoft\Credentials


   [16/03/2008|11:45] C:\Users\PETITL~1\AppData\Roaming\MySpace\IM



   [06/12/2007|15:24] C:\Users\PETITL~1\AppData\Roaming\OpenOffice.org2\user


   [13/05/2008|14:23] C:\Users\PETITL~1\AppData\Roaming\SecondLife\logs
   [13/05/2008|14:22] C:\Users\PETITL~1\AppData\Roaming\SecondLife\browser_profile
   [13/05/2008|14:22] C:\Users\PETITL~1\AppData\Roaming\SecondLife\user_settings
   [13/05/2008|14:21] C:\Users\PETITL~1\AppData\Roaming\SecondLife\cache
   [06/05/2008|00:19] C:\Users\PETITL~1\AppData\Roaming\SecondLife\franzos_lamulata
   [06/05/2008|00:17] C:\Users\PETITL~1\AppData\Roaming\SecondLife\lamulata_franzos

   [23/10/2007|13:51] C:\Users\PETITL~1\AppData\Roaming\Sonic\RecordNow!

   [25/05/2008|14:02] C:\Users\PETITL~1\AppData\Roaming\Symantec\Norton Ghost

   [09/10/2007|00:03] C:\Users\PETITL~1\AppData\Roaming\Uniblue\Registry Booster2


   [07/10/2007|00:30] C:\Users\PETITL~1\AppData\Roaming\vlc\cache

   [10/04/2008|23:24] C:\Users\PETITL~1\AppData\Roaming\Windows Live Writer\PostSupportingFiles
   [10/04/2008|23:24] C:\Users\PETITL~1\AppData\Roaming\Windows Live Writer\Dictionaries
   [10/04/2008|23:22] C:\Users\PETITL~1\AppData\Roaming\Windows Live Writer\blogtemplates
 
   ----------------[ Tâches planifiées dans C:\Windows	asks ]---------------

   [27/05/2008 15:58][--ah-----] C:\Windows	asks\SA.DAT
   [27/05/2008 15:56][--a------] C:\Windows	asks\SCHEDLGU.TXT
  
   ------[ Listing des dossiers dans C:\ProgramData ]------
   
   [27/05/2008|11:39] C:\ProgramData\64SoftwareSoftware.2eo58ij
   [27/05/2008|09:49] C:\ProgramData\64SoftwareSoftware.4tc8o9l
   [27/05/2008|05:32] C:\ProgramData\64SoftwareSoftware.6784fo
   [27/05/2008|10:33] C:\ProgramData\64SoftwareSoftware.739bmx
   [27/05/2008|15:40] C:\ProgramData\64SoftwareSoftware.7lo4yfa
   [27/05/2008|06:16] C:\ProgramData\64SoftwareSoftware.7lt5r
   [27/05/2008|04:48] C:\ProgramData\64SoftwareSoftware.86r1s
   [27/05/2008|07:43] C:\ProgramData\64SoftwareSoftware.8h7gve
   [27/05/2008|05:54] C:\ProgramData\64SoftwareSoftware.a2txklz
   [27/05/2008|11:17] C:\ProgramData\64SoftwareSoftware.bpjtc
   [27/05/2008|12:01] C:\ProgramData\64SoftwareSoftware.csbwu
   [27/05/2008|07:21] C:\ProgramData\64SoftwareSoftware.cutn9sp
   [27/05/2008|14:04] C:\ProgramData\64SoftwareSoftware.eo2j5l
   [27/05/2008|10:55] C:\ProgramData\64SoftwareSoftware.f8dwde
   [27/05/2008|08:27] C:\ProgramData\64SoftwareSoftware.fk0sx4
   [27/05/2008|05:10] C:\ProgramData\64SoftwareSoftware.gbhaoe2
   [27/05/2008|13:42] C:\ProgramData\64SoftwareSoftware.gbp6m44
   [27/05/2008|14:56] C:\ProgramData\64SoftwareSoftware.io7p8
   [27/05/2008|09:27] C:\ProgramData\64SoftwareSoftware.kjo1a
   [10/04/2008|23:30] C:\ProgramData\64SoftwareSoftware.l6vzj
   [27/05/2008|06:38] C:\ProgramData\64SoftwareSoftware.ljs935m
   [27/05/2008|12:23] C:\ProgramData\64SoftwareSoftware.nrhyc
   [27/05/2008|12:45] C:\ProgramData\64SoftwareSoftware.o1ro2o
   [27/05/2008|08:05] C:\ProgramData\64SoftwareSoftware.phlcr2
   [27/05/2008|08:49] C:\ProgramData\64SoftwareSoftware.qadvh9
   [28/04/2008|23:01] C:\ProgramData\64SoftwareSoftware.qewmtp
   [27/05/2008|15:18] C:\ProgramData\64SoftwareSoftware.rrqj49r
   [27/05/2008|04:48] C:\ProgramData\64SoftwareSoftware.t0e9y
   [27/05/2008|06:59] C:\ProgramData\64SoftwareSoftware.vmtdkim
   [27/05/2008|10:11] C:\ProgramData\64SoftwareSoftware.wc3ge
   [07/02/2008|16:17] C:\ProgramData\Adobe
   [11/10/2007|08:11] C:\ProgramData\Apple
   [11/04/2008|15:53] C:\ProgramData\Apple Computer
   [02/11/2006|15:02] C:\ProgramData\Application Data 
   [27/05/2008|12:01] C:\ProgramData\Autodesk
   [05/10/2007|11:25] C:\ProgramData\Bureau 
   [13/09/2007|16:38] C:\ProgramData\CyberLink
   [02/11/2006|15:02] C:\ProgramData\Desktop 
   [02/11/2006|15:02] C:\ProgramData\Documents 
   [05/10/2007|12:56] C:\ProgramData\eBay
   [22/04/2008|17:15] C:\ProgramData\eMule
   [05/10/2007|11:25] C:\ProgramData\Favoris 
   [02/11/2006|15:02] C:\ProgramData\Favorites 
   [15/05/2008|23:13] C:\ProgramData\Forge of Games
   [27/05/2008|04:48] C:\ProgramData\Freelist
   [05/10/2007|12:48] C:\ProgramData\Google
   [27/05/2008|04:02] C:\ProgramData\Google Updater
   [22/04/2008|17:48] C:\ProgramData\Kaspersky Lab
   [14/05/2008|21:31] C:\ProgramData\Lavasoft
   [13/05/2008|16:31] C:\ProgramData\Malwarebytes
   [05/10/2007|11:25] C:\ProgramData\Menu D‚marrer 
   [08/10/2007|11:02] C:\ProgramData\Messenger Plus!
   [27/05/2008|10:12] C:\ProgramData\Microsoft
   [26/11/2007|10:32] C:\ProgramData\Microsoft Help
   [05/10/2007|11:25] C:\ProgramData\ModŠles 
   [20/10/2007|12:06] C:\ProgramData\Sandlot Games
   [09/10/2007|00:28] C:\ProgramData\Skype
   [02/11/2006|15:02] C:\ProgramData\Start Menu 
   [25/05/2008|12:00] C:\ProgramData\Symantec
   [20/10/2007|12:17] C:\ProgramData\TEMP
   [02/11/2006|15:02] C:\ProgramData\Templates 
   [27/04/2008|08:18] C:\ProgramData\WholeSecurity
   [17/04/2008|18:47] C:\ProgramData\WLInstaller
 
   ---------------[ Listing des dossiers dans C:\Program Files ]--------------
 
   [13/09/2007|16:37] C:\Program Files\Acer Arcade Deluxe
   [11/04/2008|15:48] C:\Program Files\Acer GameZone
   [13/09/2007|16:54] C:\Program Files\Acer Inc
   [07/02/2008|16:17] C:\Program Files\Adobe
   [22/04/2008|19:48] C:\Program Files\Alcohol Soft
   [22/04/2008|18:09] C:\Program Files\Alwil Software
   [13/09/2007|16:52] C:\Program Files\Apoint2K
   [11/10/2007|08:11] C:\Program Files\Apple Software Update
   [27/05/2008|10:01] C:\Program Files\AutoCAD Architecture 2009
   [27/05/2008|09:24] C:\Program Files\Autodesk
   [28/02/2008|21:43] C:\Program Files\Bitmanagement Software
   [27/05/2008|09:24] C:\Program Files\Common Files
   [26/07/2007|03:29] C:\Program Files\CONEXANT
   [26/07/2007|04:13] C:\Program Files\CyberLink
   [20/04/2008|14:26] C:\Program Files\DAEMON Tools Pro
   [06/10/2007|10:07] C:\Program Files\desktop.ini
   [20/04/2008|15:04] C:\Program Files\D-Tools
   [05/10/2007|12:56] C:\Program Files\eBay
   [05/10/2007|11:25] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
   [28/03/2008|22:41] C:\Program Files\FlashFXP
   [22/04/2008|17:16] C:\Program Files\Free Audio Pack
   [27/05/2008|04:48] C:\Program Files\Freelist
   [05/10/2007|12:48] C:\Program Files\Google
   [14/11/2007|21:00] C:\Program Files\GSpot
   [05/10/2007|12:56] C:\Program Files\InstallShield Installation Information
   [10/04/2008|03:19] C:\Program Files\Internet Explorer
   [23/02/2008|14:43] C:\Program Files\IrfanView
   [09/10/2007|13:52] C:\Program Files\IZArc
   [14/03/2008|21:51] C:\Program Files\Java
   [05/10/2007|11:46] C:\Program Files\Kaspersky Lab
   [13/09/2007|16:35] C:\Program Files\Launch Manager
   [24/10/2007|14:18] C:\Program Files\LimeWire
   [17/11/2007|17:07] C:\Program Files\LiveCAD
   [05/12/2007|23:03] C:\Program Files\ma-config.com
   [27/05/2008|12:32] C:\Program Files\Malwarebytes' Anti-Malware
   [11/04/2008|01:05] C:\Program Files\Messenger
   [14/05/2008|21:51] C:\Program Files\Messenger Plus! Live
   [06/10/2007|09:56] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [02/11/2006|14:37] C:\Program Files\Microsoft Games
   [27/05/2008|09:26] C:\Program Files\Microsoft Office
   [05/10/2007|13:31] C:\Program Files\Microsoft SQL Server Compact Edition
   [23/02/2008|10:18] C:\Program Files\Microsoft Visual Studio
   [23/02/2008|10:19] C:\Program Files\Microsoft Works
   [23/02/2008|10:15] C:\Program Files\Microsoft.NET
   [02/11/2006|14:42] C:\Program Files\Movie Maker
   [02/11/2006|14:37] C:\Program Files\MSBuild
   [02/11/2006|14:37] C:\Program Files\MSN
   [11/04/2008|01:02] C:\Program Files\MSN Pictures Displayer
   [06/10/2007|09:46] C:\Program Files\MSXML 4.0
   [14/03/2008|14:58] C:\Program Files\MySpace
   [26/07/2007|04:11] C:\Program Files\NewTech Infosystems
   [25/05/2008|11:51] C:\Program Files\Norton Ghost
   [13/04/2008|20:56] C:\Program Files\Panicware
   [05/10/2007|12:31] C:\Program Files\RALINK
   [09/10/2007|00:15] C:\Program Files\Real
   [13/09/2007|16:39] C:\Program Files\Realtek
   [02/11/2006|14:37] C:\Program Files\Reference Assemblies
   [25/05/2008|11:48] C:\Program Files\Symantec
   [02/11/2006|15:01] C:\Program Files\Uninstall Information
   [07/10/2007|00:29] C:\Program Files\VideoLAN
   [06/10/2007|10:02] C:\Program Files\Windows Calendar
   [02/11/2006|14:42] C:\Program Files\Windows Collaboration
   [26/07/2007|04:19] C:\Program Files\Windows Defender
   [02/11/2006|14:42] C:\Program Files\Windows Journal
   [21/04/2008|01:59] C:\Program Files\Windows Live
   [15/05/2008|03:05] C:\Program Files\Windows Mail
   [10/10/2007|03:13] C:\Program Files\Windows Media Player
   [05/10/2007|11:25] C:\Program Files\Windows NT
   [02/11/2006|14:42] C:\Program Files\Windows Photo Gallery
   [09/01/2008|04:21] C:\Program Files\Windows Sidebar
  
   ------[ Listing des dossiers dans C:\Program Files\Common Files ]------
   
   [07/02/2008|16:18] C:\Program Files\Common Files\Adobe
   [11/10/2007|09:00] C:\Program Files\Common Files\Apple
   [27/05/2008|10:06] C:\Program Files\Common Files\Autodesk Shared
   [27/05/2008|09:26] C:\Program Files\Common Files\DESIGNER
   [26/07/2007|04:13] C:\Program Files\Common Files\InstallShield
   [24/10/2007|13:55] C:\Program Files\Common Files\Java
   [26/07/2007|04:11] C:\Program Files\Common Files\LightScribe
   [27/05/2008|09:26] C:\Program Files\Common Files\microsoft shared
   [26/07/2007|04:11] C:\Program Files\Common Files\muvee Technologies
   [26/07/2007|04:11] C:\Program Files\Common Files\NewTech Infosystems
   [14/11/2007|11:44] C:\Program Files\Common Files\Real
   [02/11/2006|13:18] C:\Program Files\Common Files\Services
   [02/11/2006|13:18] C:\Program Files\Common Files\SpeechEngines
   [25/05/2008|11:51] C:\Program Files\Common Files\Symantec Shared
   [23/02/2008|10:16] C:\Program Files\Common Files\System
   [21/04/2008|01:59] C:\Program Files\Common Files\WindowsLiveInstaller

   ---------------------------[ Process ]--------------------------

   ... 84

   ... OK !

   ----------------------[ Recherche avec S_Lop ]---------------------

   Aucun fichier / dossier Lop trouvé ! 
 
   -----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------

   Aucun fichier / dossier Lop trouvé ! 
 
   ----------------------[ Verification du Registre ]----------------------
 
   ..... OK !

   --------------------[ Verification du fichier Hosts ]---------------------

   Fichier Hosts PROPRE


   ----------------[ Recherche de fichiers avec Catchme ]-----------------
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-05-27 16:02:23
   Windows 6.0.6000  NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------[ Recherche d'autres infections ]---------------------


   Aucune autre infection trouvée  !

   [F:13][D:6]-> C:\Users\PETITL~1\AppData\Local\Temp
   [F:277][D:1]-> C:\Users\PETITL~1\AppData\Roaming\MICROS~1\Windows\Cookies
   [F:872][D:4]-> C:\Users\PETITL~1\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
   [F:45][D:6]-> C:\$Recycle.Bin

   [ UAC => 1 ]

   --------------------[ Fin du rapport a 16:03:44,72  ]----------------------

lamulata · Answer

et l autre:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:17:23, on 27/05/2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
C:\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Windows\System32undll32.exe
C:\Windows\System32undll32.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Norton Ghost\Agent\VProTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Windows\system32	askeng.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\conime.exe
C:\Users\PETITL~1\AppData\Local\Temp\RtkBtMnt.exe
C:\Windows\explorer.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Users\petit lapin rose\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.ebay.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O4 - HKLM\..\Run: [ALaunch] C:\Acer\ALaunch\AlaunchClient.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [eAudio] "C:\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [SetPanel] C:\Acer\APanel\APanel.cmd
O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Norton Ghost 12.0] "C:\Program Files\Norton Ghost\Agent\VProTray.exe"
O4 - HKLM\..\Run: [Deaf Thunk] "C:\ProgramData\64SoftwareSoftware.7lo4yfa"
O4 - HKLM\..\Run: [Bags Else Hole Lite] "C:\ProgramData\idle link free.jv5lk"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] c:\program files\uniblueegistrybooster 2\StartRegistryBooster.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Bags Else Hole Lite] "C:\ProgramData\scr move mp3.vquhzmq"
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Global Startup: Empowering Technology Launcher.lnk = C:\Acer\Empowering Technology\eAPLauncher.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Recherche sur eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix: 
O16 - DPF: {5DDCC37F-7C6B-48B8-9664-97C537920CA0} (aecviz Class) - http://www.maisonfamiliale.com/AECVIZ/npaecviz.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

^^Marie^^ · Answer

C'est exaspérant
http://www.commentcamarche.net/forum/affich 6375104 encore une envahie par les pub cid lol?page=2#0
http://www.commentcamarche.net/forum/affich 5919850 encore quelqu un avec des pubs cid moi lol

lamulata · Answer

merci du coup de main: les pubs sont bien parties...;)
mais pourquoi ce copié collé sur ma premiere experience "cid" ?
qu y a t il d expasperant? s il y a moyen de detecter un logiciel qui peut provoquer ce probleme, dites le moi pour que j evite de me faire avoir a nouveau svp ;)

^^Marie^^ · Answer

Salut

Tu aurais pu rester sur la discution du 13 mai ;;)

Refais un log  hijackthis-- stp

lamulata · Answer

ba je croyais que comme le probleme avait ete resolu la derniere fois, il me fallait ouvrir un nouveau sujet.. ;)

dernier hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:58:47, on 28/05/2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
C:\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Windows\System32undll32.exe
C:\Windows\system32	askeng.exe
C:\Windows\System32undll32.exe
C:\Users\PETITL~1\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Norton Ghost\Agent\VProTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\ehome\ehmsas.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\system32\conime.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\Users\petit lapin rose\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.ebay.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O4 - HKLM\..\Run: [ALaunch] C:\Acer\ALaunch\AlaunchClient.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [eAudio] "C:\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [SetPanel] C:\Acer\APanel\APanel.cmd
O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Norton Ghost 12.0] "C:\Program Files\Norton Ghost\Agent\VProTray.exe"
O4 - HKLM\..\Run: [Deaf Thunk] "C:\ProgramData\64SoftwareSoftware.7lo4yfa"
O4 - HKLM\..\Run: [Bags Else Hole Lite] "C:\ProgramData\idle link free.jv5lk"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] c:\program files\uniblueegistrybooster 2\StartRegistryBooster.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Bags Else Hole Lite] "C:\ProgramData\scr move mp3.vquhzmq"
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [Deaf Thunk] "C:\ProgramData\64SoftwareSoftware.id5nd2"
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Global Startup: Empowering Technology Launcher.lnk = C:\Acer\Empowering Technology\eAPLauncher.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Recherche sur eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix: 
O16 - DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} (Module de délivrance de certificat MINEFI) - https://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
O16 - DPF: {5DDCC37F-7C6B-48B8-9664-97C537920CA0} (aecviz Class) - http://www.maisonfamiliale.com/AECVIZ/npaecviz.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

Encore cid

14 réponses

Discussions similaires

Newsletters