Rapport hijackthis , svp ! Résolu/Fermé

Question

Bonsoir, je m'adresse à vous ce soir car j'ai bien l'impression que mon ordinateur est infecté, et je voudrais vous poster mon rapport hijackthis pour que des âmes charitables puissent m'aider de leur plein gré =)

Je voudrais remercier ceux qui prendront la peine de m'aider ^^

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:29:47, on 08/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Medion Info Display\MdionLCM.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\CmUCReye.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Labtec\WebCam10\WebCam10.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Teamspeak2_RC2\TeamSpeak.exe
C:\Program Files\CCleaner\ccleaner.exe
C:\Documents and Settings\Michael Beyer\Bureau\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.jeuxvideo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: Alcohol Toolbar - {4C4E7CDB-5BFC-4D74-83E2-8AE659B7EDA2} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MedionVFD] "C:\Program Files\Medion Info Display\MdionLCM.exe"
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [CmUCRRun] C:\WINDOWS\system32\CmUCReye.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Adobe] "C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Labtec\WebCam10\WebCam10.exe" /hide
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [98892c0b] rundll32.exe "C:\WINDOWS\system32\atqjqnuh.dll",b
O4 - HKLM\..\Run: [BM9bba1f97] Rundll32.exe "C:\WINDOWS\system32\yooanqbo.dll",s
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LVSrvLauncher - Labtec Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Destrio5 · Answer

Salut,

T'es infecté par Vundo.

---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "la version ComboFix est utilisée à vos risques et avec aucune garantie..".
Accepte en cliquant sur "Oui"

---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix.txt

Hybrid · Answer

Voilà le rapport,

Deux constatations personnelles: je ne trouve plus où réactiver avast, et ComboFix a supprimé deux .dll et deux messages RUNDLL se sont affichés au redémarrage disant qu'elles étaient introuvables. Est-ce normal?

-------------------------------------------------------------

ComboFix 08-07-05.1 - Michael Beyer 2008-07-08 1:51:21.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1355 [GMT 2:00]
Endroit: C:\Documents and Settings\Michael Beyer\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Michael Beyer\Application Data\SystemDoctor 2006 Free
C:\Documents and Settings\Michael Beyer\Application Data\SystemDoctor 2006 Free\Logs\update.log
C:\Documents and Settings\Michael Beyer\Menu Démarrer\Programmes\GoRecord 2
C:\Documents and Settings\Michael Beyer\Menu Démarrer\Programmes\GoRecord 2\GoRecord 2.lnk
C:\Documents and Settings\Michael Beyer\Menu Démarrer\Programmes\GoRecord 2\Uninstall.lnk
C:\Documents and Settings\Michael Beyer\Menu Démarrer\Programmes\GoRecord 2\Website.lnk
C:\Program Files\gorecord2
C:\Program Files\gorecord2\Gfx.bin
C:\Program Files\gorecord2\GoRecord.exe
C:\Program Files\gorecord2\GoRecord.url
C:\Program Files\gorecord2\iconv.dll
C:\Program Files\gorecord2\intl.dll
C:\Program Files\gorecord2\libglib-2.0-0.dll
C:\Program Files\gorecord2\libgmodule-2.0-0.dll
C:\Program Files\gorecord2\libgobject-2.0-0.dll
C:\Program Files\gorecord2\libgstaudio-0.10.dll
C:\Program Files\gorecord2\libgstaudioconvert.dll
C:\Program Files\gorecord2\libgstbase-0.10.dll
C:\Program Files\gorecord2\libgstcontroller-0.10.dll
C:\Program Files\gorecord2\libgstcoreelements.dll
C:\Program Files\gorecord2\libgstdecodebin.dll
C:\Program Files\gorecord2\libgstdirectsound.dll
C:\Program Files\gorecord2\libgstflump3dec.dll
C:\Program Files\gorecord2\libgsticydemux.dll
C:\Program Files\gorecord2\libgstid3demux.dll
C:\Program Files\gorecord2\libgstinterfaces-0.10.dll
C:\Program Files\gorecord2\libgstlevel.dll
C:\Program Files\gorecord2\libgstneon.dll
C:\Program Files\gorecord2\libgstogg.dll
C:\Program Files\gorecord2\libgstreamer-0.10.dll
C:\Program Files\gorecord2\libgstriff-0.10.dll
C:\Program Files\gorecord2\libgsttag-0.10.dll
C:\Program Files\gorecord2\libgsttypefindfunctions.dll
C:\Program Files\gorecord2\libgstvolume.dll
C:\Program Files\gorecord2\libgstvorbis.dll
C:\Program Files\gorecord2\libgstwavparse.dll
C:\Program Files\gorecord2\libgthread-2.0-0.dll
C:\Program Files\gorecord2\libxml2.dll
C:\Program Files\gorecord2\ogg.dll
C:\Program Files\gorecord2\resources\config.bin
C:\Program Files\gorecord2\resources\musics.s3db
C:\Program Files\gorecord2\resources\radios.s3db
C:\Program Files\gorecord2\rip\1.FM - Country\Aaron Tippin - Ready To Rock.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Alabama - The Closer You Get.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Alan Jackson - Shes Got The Rythym.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Big & Rich - 8th Of November.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Big & Rich - Big Time.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Billy Currington - Must Be Doin' Somethin' Right.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Brooks & Dunn - Ain't Nothing 'Bout You.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Carolyn Dawn Johnson - Complicated.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Carrie Underwood - Don't Forget To Remember Me.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Catherine Britt - Too Far Gone - 01 - Swingin' Door.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Chely Wright - Single White Female.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Clyde Masten III - Man Enough to Cry.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Dierks Bentley - How Am I Doin'.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Dierks Bentley - What Was I Thinkin'.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Dwight Yoakam - The Back Of Your Hand.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Faith Hill - Sunshine And Summertime.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Gary Allan - Life Aint Always Beautiful.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\George Strait - Give It Away.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Gretchen Wilson - California Girls.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Heartland - I Loved Her First.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Jack Ingram - Wherever You Are.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Jason Aldean - Why.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Jo Dee Messina - That's The Way.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\John Anderson - Straight Tequila Night.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Johnny Lee - Blueberry Hill.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Keith Anderson - Every Time I Hear Your Name.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Keith Urban - But For The Grace Of God.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Kenny Chesney - She Thinks My Tractor's Sexy.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Kenny Rogers - Coward Of The County.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Lee Greenwood - God Bless The USA.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Lorrie Morgan - Except For Monday.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Mary Chapin Carpenter - I Feel Lucky.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Miranda Lambert - Me And Charlie Talking.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Montgomery Gentry - My Town.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Pat Green - Feels Just Like It Should.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Phil Vassar - The Woman In My Life.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Phil Vasser - Just Another Day In Paradise.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Randy Travis - Forever And Ever, Amen.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Rascal Flatts - What Hurts the Most.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Reba McEntire - Fancy.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Rhett Akins - Kiss My Country Ass.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Rodney Atkins - If You're Going Through Hell.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Sammy Kershaw - Love Of My Life.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Sara Evans - Cheatin.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Shannon Brown - Pearls.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\SHAVER - 02 - Oklahoma Wind.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Tanya Tucker - Two Sparrows In A Hurricane.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Taylor Swift - Tim McGraw.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Terri Clark - Girls Lie Too.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Tim McGraw - My Next Thirty Years.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Toby Keith - He Aint Worth Missing.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Trace Adkins - Arlington.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Tracy Byrd - Drinkin' Bone.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Tracy Byrd - Watermelon Crawl.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Trent Willmon - On Again Tonight.mp3
C:\Program Files\gorecord2\rip\1.FM - Country\Trisha Yearwood - Try Me.mp3
C:\Program Files\gorecord2\rip\hathormusicradio.com PRESENTS Metal\Judas Priest - Ram It Down.mp3
C:\Program Files\gorecord2\rip\hathormusicradio.com PRESENTS Metal\Metallica - Master Of Puppets.mp3
C:\Program Files\gorecord2\rip\hathormusicradio.com PRESENTS Metal\Metallica - Metal Militia.mp3
C:\Program Files\gorecord2\rip\hathormusicradio.com PRESENTS Metal\Metallica - So What.mp3
C:\Program Files\gorecord2\rip\hathormusicradio.com PRESENTS Metal\Pantara - Far Beyond Driven.mp3
C:\Program Files\gorecord2\rip\Hooligan Radio\Bootsie - If You Will.mp3
C:\Program Files\gorecord2\rip\Hooligan Radio\Planes Mistaken For Stars - Belly Full Of Hell.mp3
C:\Program Files\gorecord2\rip\Hooligan Radio\Uncle Big Time - Drowning in the Mainstream.mp3
C:\Program Files\gorecord2\rip\Rock104 - Your Alternative to the Alternative\Coal Chamber - Dark Days.mp3
C:\Program Files\gorecord2\rip\Rock104 - Your Alternative to the Alternative\Days of the New - Touch, Peel and Stand.mp3
C:\Program Files\gorecord2\rip\Rock104 - Your Alternative to the Alternative\Default - Hiding from the Sun.mp3
C:\Program Files\gorecord2\rip\Rock104 - Your Alternative to the Alternative\Godsmack - Whatever.mp3
C:\Program Files\gorecord2\rip\Rock104 - Your Alternative to the Alternative\Monster Magnet - Silver Future.mp3
C:\Program Files\gorecord2\rip\Rock104 - Your Alternative to the Alternative\Nonpoint - Alive and Kicking.mp3
C:\Program Files\gorecord2\rip\Rock104 - Your Alternative to the Alternative\Soundgarden - Black Hole Sun.mp3
C:\Program Files\gorecord2\rip\Rock104 - Your Alternative to the Alternative\Taking Back Sunday - MakeDamnSure.mp3
C:\Program Files\gorecord2\rip\The EDGE ROCKS!! - 100% ROCK (Godsmack Ozzy SlipKnot Pantera etc) Format Active Rock\30 Seconds To Mars Capricorn -.mp3
C:\Program Files\gorecord2\rip\The EDGE ROCKS!! - 100% ROCK (Godsmack Ozzy SlipKnot Pantera etc) Format Active Rock\Alice in Chains - I Stay Away.mp3
C:\Program Files\gorecord2\rip\The EDGE ROCKS!! - 100% ROCK (Godsmack Ozzy SlipKnot Pantera etc) Format Active Rock\Alice In Chains - Nutshell.mp3
C:\Program Files\gorecord2\rip\The EDGE ROCKS!! - 100% ROCK (Godsmack Ozzy SlipKnot Pantera etc) Format Active Rock\Apartment 26 Basic Breakdown -.mp3
C:\Program Files\gorecord2\rip\The EDGE ROCKS!! - 100% ROCK (Godsmack Ozzy SlipKnot Pantera etc) Format Active Rock\Damageplan Pride -.mp3
C:\Program Files\gorecord2\rip\The EDGE ROCKS!! - 100% ROCK (Godsmack Ozzy SlipKnot Pantera etc) Format Active Rock\Deftones - Minerva.mp3
C:\Program Files\gorecord2\rip\The EDGE ROCKS!! - 100% ROCK (Godsmack Ozzy SlipKnot Pantera etc) Format Active Rock\Disturbed Sons Of Plunder -.mp3
C:\Program Files\gorecord2\rip\The EDGE ROCKS!! - 100% ROCK (Godsmack Ozzy SlipKnot Pantera etc) Format Active Rock\Faktion - Take it All Away.mp3
C:\Program Files\gorecord2\rip\The EDGE ROCKS!! - 100% ROCK (Godsmack Ozzy SlipKnot Pantera etc) Format Active Rock\Godsmack - Shine Down.mp3
C:\Program Files\gorecord2\rip\The EDGE ROCKS!! - 100% ROCK (Godsmack Ozzy SlipKnot Pantera etc) Format Active Rock\Guns N Roses Mr Brownstone -.mp3
C:\Program Files\gorecord2\rip\The EDGE ROCKS!! - 100% ROCK (Godsmack Ozzy SlipKnot Pantera etc) Format Active Rock\Helmet Unsung -.mp3
C:\Program Files\gorecord2\rip\The EDGE ROCKS!! - 100% ROCK (Godsmack Ozzy SlipKnot Pantera etc) Format Active Rock\Incubus - Pardon Me.mp3
C:\Program Files\gorecord2\rip\The EDGE ROCKS!! - 100% ROCK (Godsmack Ozzy SlipKnot Pantera etc) Format Active Rock\Incubus - Wish You Were Here.mp3
C:\Program Files\gorecord2\rip\The EDGE ROCKS!! - 100% ROCK (Godsmack Ozzy SlipKnot Pantera etc) Format Active Rock\Judas Priest Breaking the Law -.mp3
C:\Program Files\gorecord2\rip\The EDGE ROCKS!! - 100% ROCK (Godsmack Ozzy SlipKnot Pantera etc) Format Active Rock\Judas Priest Living After Midnight -.mp3
C:\Program Files\gorecord2\rip\The EDGE ROCKS!! - 100% ROCK (Godsmack Ozzy SlipKnot Pantera etc) Format Active Rock\Megadeth - Angry Again.mp3
C:\Program Files\gorecord2\rip\The EDGE ROCKS!! - 100% ROCK (Godsmack Ozzy SlipKnot Pantera etc) Format Active Rock\Mudvayne World So Cold -.mp3
C:\Program Files\gorecord2\rip\The EDGE ROCKS!! - 100% ROCK (Godsmack Ozzy SlipKnot Pantera etc) Format Active Rock\Pearl Jam - Daughter.mp3
C:\Program Files\gorecord2\rip\The EDGE ROCKS!! - 100% ROCK (Godsmack Ozzy SlipKnot Pantera etc) Format Active Rock\Powerman 5000 Free -.mp3
C:\Program Files\gorecord2\rip\The EDGE ROCKS!! - 100% ROCK (Godsmack Ozzy SlipKnot Pantera etc) Format Active Rock\Puddle of Mudd Blurry -.mp3
C:\Program Files\gorecord2\rip\The EDGE ROCKS!! - 100% ROCK (Godsmack Ozzy SlipKnot Pantera etc) Format Active Rock\RA - The Only One.mp3
C:\Program Files\gorecord2\rip\The EDGE ROCKS!! - 100% ROCK (Godsmack Ozzy SlipKnot Pantera etc) Format Active Rock\Rebel Meets Rebel - Get Outta My Life.mp3
C:\Program Files\gorecord2\rip\The EDGE ROCKS!! - 100% ROCK (Godsmack Ozzy SlipKnot Pantera etc) Format Active Rock\Red Hot Chili Peppers - Dani California.mp3
C:\Program Files\gorecord2\rip\The EDGE ROCKS!! - 100% ROCK (Godsmack Ozzy SlipKnot Pantera etc) Format Active Rock\Soundgarden Outshined -.mp3
C:\Program Files\gorecord2\rip\The EDGE ROCKS!! - 100% ROCK (Godsmack Ozzy SlipKnot Pantera etc) Format Active Rock\Spineshank - New Disease.mp3
C:\Program Files\gorecord2\rip\The EDGE ROCKS!! - 100% ROCK (Godsmack Ozzy SlipKnot Pantera etc) Format Active Rock\Stabbing Westward Shame -.mp3
C:\Program Files\gorecord2\rip\The EDGE ROCKS!! - 100% ROCK (Godsmack Ozzy SlipKnot Pantera etc) Format Active Rock\Three Days Grace - Animal I Have Become.mp3
C:\Program Files\gorecord2\rip\The EDGE ROCKS!! - 100% ROCK (Godsmack Ozzy SlipKnot Pantera etc) Format Active Rock\Trapt - Disconnected (Out Of Touch).mp3
C:\Program Files\gorecord2\rip\The EDGE ROCKS!! - 100% ROCK (Godsmack Ozzy SlipKnot Pantera etc) Format Active Rock\Velvet Revolver Fall To Pieces -.mp3
C:\Program Files\gorecord2\sqlite3.dll
C:\Program Files\gorecord2\uninst.exe
C:\Program Files\gorecord2\vorbis.dll
C:\Program Files\gorecord2\zlib1.dll
C:\Program Files\winantivirus pro 2006
C:\Program Files\winantivirus pro 2006\history.db
C:\WINDOWS\pack.epk
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\atqjqnuh.dll
C:\WINDOWS\system32\hgGyvtQJ.dll
C:\WINDOWS\system32\hunqjqta.ini
C:\WINDOWS\system32\jkkICRIc.dll
c:\WINDOWS\system32\kwcqime.dat
c:\windows\system32\kwcqime.exe
C:\WINDOWS\system32\kwcqime_nav.dat
c:\WINDOWS\system32\kwcqime_navps.dat
C:\WINDOWS\system32\MSINET.oca
C:\WINDOWS\system32\nvs2.inf
C:\WINDOWS\system32\pAJkSvut.ini
C:\WINDOWS\system32\pAJkSvut.ini2
C:\WINDOWS\system32\stera.job
C:\WINDOWS\system32\tuvSkJAp.dll
C:\WINDOWS\system32\winhdn32.dll
C:\WINDOWS\system32\yooanqbo.dll
D:\Autorun.inf
E:\Autorun.inf

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-07 to 2008-07-07 ))))))))))))))))))))))))))))))))))))
.

2008-07-08 00:29 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys
2008-07-08 00:28 . 2008-07-08 00:28 <REP> d-------- C:\Program Files\Panda Security
2008-07-07 23:44 . 2003-01-26 15:48 147,456 --a------ C:\WINDOWS\system32\vbzip11.dll
2008-07-07 23:44 . 1998-12-02 09:11 143,360 --a------ C:\WINDOWS\system32\vbuzip10.dll
2008-07-07 23:44 . 2005-06-30 09:53 45,056 --a------ C:\WINDOWS\system32\wndRestrict.ocx
2008-07-07 23:44 . 1999-08-29 10:15 7,716 --a------ C:\WINDOWS\system32\URLHIST.tlb
2008-07-07 23:42 . 2008-07-07 23:42 0 --a------ C:\WINDOWS\BM9bba1f97.xml
2008-07-07 21:21 . 2008-07-07 22:36 <REP> d-------- C:\Program Files\Counter-Strike Source
2008-07-07 14:29 . 2008-07-07 14:29 <REP> d-------- C:\Documents and Settings\Antoine\Application Data\Xfire
2008-07-07 14:27 . 2008-07-07 14:31 <REP> d-------- C:\Program Files\Xfire
2008-07-07 14:27 . 2008-07-07 22:51 <REP> d-------- C:\Documents and Settings\Michael Beyer\Application Data\Xfire
2008-07-07 11:32 . 2008-07-07 11:32 <REP> d-------- C:\Documents and Settings\Antoine\Application Data\Shareaza
2008-07-06 00:14 . 2008-07-08 00:13 <REP> d-------- C:\Documents and Settings\Michael Beyer\Application Data\OpenOffice.org2
2008-07-05 23:31 . 2008-07-05 23:33 <REP> d-------- C:\Program Files\Dofus
2008-07-05 22:43 . 2008-07-07 23:47 <REP> d-------- C:\Program Files\Cheat Engine
2008-07-05 22:43 . 2007-12-26 17:30 1,970,176 --a------ C:\WINDOWS\system32\d3dx9.dll
2008-07-05 22:43 . 2007-12-26 17:30 679,936 --a------ C:\WINDOWS\system32\D3DX81ab.dll
2008-07-03 20:36 . 2008-07-05 12:47 <REP> d-------- C:\Documents and Settings\Antoine\Contacts
2008-07-03 20:35 . 2006-03-21 17:53 <REP> d--h----- C:\Documents and Settings\Antoine\Voisinage r‚seau
2008-07-03 20:35 . 2006-03-21 17:53 <REP> d--h----- C:\Documents and Settings\Antoine\Voisinage d'impression
2008-07-03 20:35 . 2006-03-22 13:27 <REP> d---s---- C:\Documents and Settings\Antoine\UserData
2008-07-03 20:35 . 2007-01-14 15:19 <REP> d--h----- C:\Documents and Settings\Antoine\ModŠles
2008-07-03 20:35 . 2008-07-07 11:32 <REP> dr------- C:\Documents and Settings\Antoine\Mes documents
2008-07-03 20:35 . 2006-03-21 17:53 <REP> dr------- C:\Documents and Settings\Antoine\Menu D‚marrer
2008-07-03 20:35 . 2008-07-03 20:35 <REP> dr------- C:\Documents and Settings\Antoine\Favoris
2008-07-03 20:35 . 2008-06-18 22:07 <REP> d-------- C:\Documents and Settings\Antoine\Bureau
2008-07-03 20:35 . 2006-03-22 13:10 <REP> d-------- C:\Documents and Settings\Antoine\Application Data\CyberLink
2008-07-03 20:35 . 2006-03-22 11:07 <REP> d-------- C:\Documents and Settings\Antoine\Application Data\ATI
2008-07-03 20:35 . 2008-07-03 20:36 <REP> d-------- C:\Documents and Settings\Antoine
2008-07-01 07:42 . 2008-07-01 07:42 <REP> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-06-30 22:35 . 2008-06-30 22:35 <REP> d-------- C:\Program Files\Fichiers communs\LogiShrd
2008-06-30 22:35 . 2008-06-30 22:35 <REP> d-------- C:\Program Files\Fichiers communs\Labtec
2008-06-30 22:35 . 2007-03-06 17:54 527,136 --a------ C:\WINDOWS\system32\LVUI2RC.dll
2008-06-30 22:35 . 2007-03-06 17:49 491,168 --a------ C:\WINDOWS\system32\drivers\LV561AV.SYS
2008-06-30 22:35 . 2003-02-21 04:42 348,160 --a------ C:\WINDOWS\system\msvcr71.dll
2008-06-30 22:35 . 2007-03-06 17:50 264,992 --a------ C:\WINDOWS\system32\lvcodec2.dll
2008-06-30 22:35 . 2007-03-06 17:54 215,840 --a------ C:\WINDOWS\system32\LVUI2.dll
2008-06-30 22:35 . 2007-03-06 17:51 129,824 --a------ C:\WINDOWS\system32\lvci1051.dll
2008-06-30 22:35 . 2007-03-06 16:02 51,370 --a------ C:\WINDOWS\system32\lvcoinst.ini
2008-06-30 22:35 . 2007-03-06 17:54 41,376 --a------ C:\WINDOWS\system32\drivers\LVUSBSta.sys
2008-06-30 22:35 . 2007-03-06 16:03 13,398 --a------ C:\WINDOWS\system32\Repository.reg
2008-06-30 22:34 . 2008-06-30 22:35 <REP> d-------- C:\Program Files\Labtec
2008-06-30 18:51 . 2008-07-02 20:29 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-30 18:45 . 2008-07-06 15:27 <REP> d-------- C:\Fraps
2008-06-28 12:24 . 2008-06-28 16:52 <REP> d-------- C:\Program Files\World of Warcraft Trial
2008-06-28 12:24 . 2008-06-28 12:24 <REP> d-------- C:\Program Files\Fichiers communs\Blizzard Entertainment
2008-06-26 22:09 . 2008-06-26 22:09 42,320 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-06-25 03:41 . 2008-06-25 03:41 <REP> d-------- C:\Documents and Settings\Maman\Application Data\Media Player Classic
2008-06-25 03:41 . 2008-06-25 03:41 <REP> d-------- C:\Documents and Settings\Maman\Application Data\DivX
2008-06-23 23:39 . 2008-07-07 14:14 <REP> d-------- C:\Documents and Settings\Maman\Application Data\OpenOffice.org2
2008-06-23 15:30 . 2008-06-23 15:42 139,264 --a------ C:\WINDOWS\War3Unin.exe
2008-06-23 15:30 . 2008-07-04 12:13 106,797 --a------ C:\WINDOWS\War3Unin.dat
2008-06-23 15:30 . 2008-06-23 15:42 2,829 --a------ C:\WINDOWS\War3Unin.pif
2008-06-22 13:06 . 2003-09-24 09:43 626,960 -ra------ C:\WINDOWS\system32\hpvaut32.dll
2008-06-22 13:06 . 2003-09-24 09:43 487,424 -ra------ C:\WINDOWS\system32\hpvcp70.dll
2008-06-22 13:06 . 2003-09-24 09:43 344,064 -ra------ C:\WINDOWS\system32\hpvcr70.dll
2008-06-22 13:06 . 2003-09-24 09:44 44,544 -ra------ C:\WINDOWS\system32\MSXML4a.dll
2008-06-22 12:59 . 2008-06-22 12:59 <REP> d-------- C:\Program Files\HP
2008-06-22 12:59 . 2008-06-22 12:59 <REP> d-------- C:\Program Files\Hewlett-Packard
2008-06-22 12:59 . 2008-06-22 13:00 219,263 --a------ C:\WINDOWS\hpdj3600.his
2008-06-22 12:59 . 2008-06-22 13:00 10,747 --a------ C:\WINDOWS\hpdj3600.ini
2008-06-22 12:49 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-06-22 12:49 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-06-22 01:13 . 2008-06-22 01:13 <REP> d-------- C:\Program Files\Shareaza
2008-06-21 10:45 . 2008-06-22 08:53 <REP> d-------- C:\Documents and Settings\C‚line
2008-06-20 12:32 . 2008-06-20 12:32 <REP> d-------- C:\Program Files\OpenOffice.org 2.4
2008-06-20 12:32 . 2007-12-14 01:59 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-06-20 12:30 . 2008-06-20 12:30 <REP> d-------- C:\Program Files\OpenOffice.org 2.4 (fr) Installation Files
2008-06-20 12:16 . 2003-07-20 20:17 5,174 --a------ C:\WINDOWS\system32\nppt9x.vxd
2008-06-20 12:16 . 2005-01-04 11:43 4,682 --a------ C:\WINDOWS\system32\npptNT2.sys
2008-06-19 18:45 . 2008-06-19 18:45 <REP> d-------- C:\Program Files\Gpotato.eu
2008-06-19 17:10 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-06-19 17:10 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-06-19 00:33 . 2008-06-19 00:33 <REP> d-------- C:\Program Files\MSXML 4.0
2008-06-18 22:28 . 2008-07-07 14:37 136,888 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-06-18 22:28 . 2008-07-07 14:37 111,928 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2008-06-18 22:28 . 2008-06-18 22:28 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2008-06-18 22:18 . 2008-07-08 00:35 <REP> d-------- C:\Documents and Settings\Michael Beyer\Application Data\teamspeak2
2008-06-18 22:18 . 2008-06-18 22:18 34,064 --a------ C:\WINDOWS\system32\lhacm.acm
2008-06-18 22:17 . 2008-06-18 22:18 <REP> d-------- C:\Program Files\Teamspeak2_RC2
2008-06-18 22:06 . 2006-03-21 17:53 <REP> d--h----- C:\Documents and Settings\Maman\Voisinage r‚seau
2008-06-18 22:06 . 2006-03-21 17:53 <REP> d--h----- C:\Documents and Settings\Maman\Voisinage d'impression
2008-06-18 22:06 . 2006-03-22 13:27 <REP> d---s---- C:\Documents and Settings\Maman\UserData
2008-06-18 22:06 . 2007-01-14 15:19 <REP> d--h----- C:\Documents and Settings\Maman\ModŠles
2008-06-18 22:06 . 2008-07-05 10:32 <REP> dr------- C:\Documents and Settings\Maman\Mes documents
2008-06-18 22:06 . 2006-03-21 17:53 <REP> dr------- C:\Documents and Settings\Maman\Menu D‚marrer
2008-06-18 22:06 . 2008-06-18 22:07 <REP> dr------- C:\Documents and Settings\Maman\Favoris
2008-06-18 22:06 . 2008-07-05 17:23 <REP> d-------- C:\Documents and Settings\Maman\Bureau
2008-06-18 22:06 . 2006-03-22 13:10 <REP> d-------- C:\Documents and Settings\Maman\Application Data\CyberLink
2008-06-18 22:06 . 2006-03-22 11:07 <REP> d-------- C:\Documents and Settings\Maman\Application Data\ATI
2008-06-18 22:06 . 2008-07-07 14:14 <REP> d-------- C:\Documents and Settings\Maman
2008-06-18 21:20 . 2008-06-18 21:20 <REP> d-------- C:\Program Files\Messenger Plus! Live
2008-06-18 21:13 . 2008-06-28 18:14 <REP> d-------- C:\Documents and Settings\Michael Beyer\Contacts
2008-06-18 21:12 . 2008-06-18 21:12 <REP> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-06-18 21:10 . 2008-06-14 19:59 272,768 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-18 21:10 . 2008-06-14 19:59 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-18 21:03 . 2008-06-18 21:12 <REP> d-------- C:\Program Files\Windows Live
2008-06-18 21:03 . 2008-06-18 21:12 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-06-18 21:03 . 2008-06-18 21:03 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-06-18 21:01 . 2008-06-18 21:01 0 --a------ C:\WINDOWS\nsreg.dat
2008-06-18 17:45 . 2008-06-18 17:45 319 --a------ C:\WINDOWS\game.ini
2008-06-18 16:56 . 2008-06-18 16:56 <REP> d-------- C:\Program Files\Activision
2008-06-12 17:29 . 2008-07-07 13:53 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-12 17:29 . 2008-06-12 17:29 1,409 --a------ C:\WINDOWS\QTFont.for

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-07 22:06 --------- d-----w C:\Program Files\Warcraft III
2008-07-07 12:31 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-06 21:12 --------- d-----w C:\Program Files\Sony
2008-06-22 15:41 --------- d-----w C:\Program Files\Diablo II
2008-06-21 23:13 --------- d-----w C:\Documents and Settings\Michael Beyer\Application Data\Shareaza
2008-06-21 15:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-06-20 10:32 --------- d-----w C:\Program Files\Java
2008-05-27 20:14 --------- d-----w C:\Documents and Settings\NetworkService\Application Data\X10 Commander
2008-05-10 10:35 2,829 ----a-w C:\WINDOWS\DIIUnin.pif
2008-05-10 10:35 102,400 ----a-w C:\WINDOWS\DIIUnin.exe
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 09:59 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 21:24 32768]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2006-01-12 17:40 155648]
"MedionVFD"="C:\Program Files\Medion Info Display\MdionLCM.exe" [2006-04-03 18:26 172032]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2004-08-10 05:04 59392]
"CmUCRRun"="C:\WINDOWS\system32\CmUCReye.exe" [2005-10-12 15:44 241664]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41 45056]
"VirtualCloneDrive"="C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2006-04-29 15:21 94208]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-01-26 18:35 282624]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-10-23 19:51 233472]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2003-06-25 11:24 49152]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-11-10 21:14 176128]
"LogitechQuickCamRibbon"="C:\Program Files\Labtec\WebCam10\WebCam10.exe" [2007-03-06 17:58 1060376]
"LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-03-06 17:48 488984]
"RTHDCPL"="RTHDCPL.EXE" [2006-01-11 18:23 15961088 C:\WINDOWS\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 14:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.yv12"= yv12vfw.dll
"vidc.mpng"= C:\Program Files\t@b\[u]0[/u].957\686\tabdec.dll
"vidc.mvjp"= C:\Program Files\t@b\[u]0[/u].957\686\tabdec.dll
"vidc.444p"= C:\Program Files\t@b\[u]0[/u].957\686\tabdec.dll
"VIDC.XFR1"= xfcodec.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\WINDOWS\\system32\\fxsclnt.exe"=
"C:\\Program Files\\NetMeeting\\Conf.exe"=
"C:\\Program Files\\Ahead\\Nero MediaHome\\NeroMediaHome.exe"=
"C:\\Program Files\\Valve\\Steam\\SteamApps\\faster205\\counter-strike\\hl.exe"=
"C:\\Program Files\\Valve\\Steam\\SteamApps\\faster205\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Valve\\Steam\\SteamApps\\faster205\\condition zero deleted scenes\\hl.exe"=
"C:\\Program Files\\Microsoft Games\\Age of Empires III\\age3.exe"=
"C:\\Program Files\\Electronic Arts\\La Bataille pour la Terre du Milieu II\\game.dat"=
"C:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\Program Files\\Ubisoft\\XIII\\system\\XIII.exe"=
"C:\\Program Files\\Electronic Arts\\La Bataille pour la Terre du Milieu II\\patchget.dat"=
"C:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"=
"C:\\Program Files\\THQ\\Dawn of War - Dark Crusade\\DarkCrusade.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\LucasArts\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe"=
"C:\\Program Files\\Free.fr\\iconf.exe"=
"C:\\Program Files\\Sony\\Media Manager for PSP 2.0\\MediaManager.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Shareaza\\Shareaza.exe"=
"C:\\Program Files\\Warcraft III\\War3.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\Counter-Strike Source\\hl2.exe"=
"C:\\WINDOWS\\system32\\winver.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"6112:TCP"= 6112:TCP:6112

R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 17:24]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2006-02-02 10:33]
R3 X10Hid;X10 Hid Device;C:\WINDOWS\system32\Drivers\x10hid.sys [2005-06-13 13:50]
S2 vcs;vcs;J:\Musique\AV VCS 3.0\vcs.sys []
S3 CMISTOR;CMIUCR.SYS CM220 Card Reader Driver;C:\WINDOWS\system32\DRIVERS\cmiucr.SYS [2005-10-04 19:37]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{44401da1-589b-11dc-a56b-00173f139b91}]
\Shell\AutoRun\command - K:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4642f46e-684d-11db-a440-0016173c2e62}]
\Shell\AutoRun\command - J:\LaunchU3.exe -a

*Newly Created Service* - PAVBOOT
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-98892c0b - C:\WINDOWS\system32\atqjqnuh.dll
HKLM-Run-BM9bba1f97 - C:\WINDOWS\system32\yooanqbo.dll
Notify-winhdn32 - winhdn32.dll

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-08 01:59:02
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\WINDOWS\ehome\ehrecvr.exe
C:\WINDOWS\ehome\ehSched.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\Tablet.exe
C:\PROGRA~1\COMMON~1\X10\Common\X10nets.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehmsas.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.bin
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-07-08 2:03:22 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-08 00:03:19

Pre-Run: 42,062,278,656 octets libres
Post-Run: 42,110,259,200 octets libres

427 --- E O F --- 2008-07-01 05:42:25

Destrio5 · Answer

C'était des .dll Vundo donc c'est normal. Je vais arranger ça.

GoRecord 2 a été détecté comme une infection. Il a été viré ainsi que tous les mp3 que tu as récupéré avec.

Destrio5 · Answer

Non, ce n'est pas fini.

Au pire, Avast, tu le réinstalles.

Poste un nouveau rapport HijackThis.

Hybrid · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:23:50, on 08/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Medion Info Display\MdionLCM.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\CmUCReye.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Labtec\WebCam10\WebCam10.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Java\jre1.6.0_04\bin\jucheck.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Michael Beyer\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.jeuxvideo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Alcohol Toolbar Helper - {52D06F97-5511-43FA-8FDA-C481864FD26E} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O3 - Toolbar: Alcohol Toolbar - {4C4E7CDB-5BFC-4D74-83E2-8AE659B7EDA2} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MedionVFD] "C:\Program Files\Medion Info Display\MdionLCM.exe"
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [CmUCRRun] C:\WINDOWS\system32\CmUCReye.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Labtec\WebCam10\WebCam10.exe" /hide
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LVSrvLauncher - Labtec Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Destrio5 · Answer

J'ai un doute.

- Télécharge Navilog1 (de IL-MAFIOSO) et enregistre-le sur le bureau : 
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe 

- Double-clique sur Navilog1.exe afin de lancer l'installation

- Si le fix ne lance pas automatiquement après son installation, double-clique sur Navilog1 présent sur le bureau

- Appuie sur F ou f  puis valide par Entrée

- Appuie sur une touche de ton clavier à chaque fois que cela est demandé, tu arriveras au menu des options

- Choisis l'option 1 et appuie sur la touche Entrée pour valider ton choix

- Patiente jusqu'au message : *** Analyse Termine le ..... ***

- Le scan fini, le bloc-notes contenant le rapport sera affiché, poste le contenu de ce rapport dans ta prochaine réponse

- Si le résultat du scan ne s'affiche pas, tu le trouveras dans C:\fixnavi.txt

N'utilise pas l'option 2, 3 et 4 sans notre accord, des fichiers légitimes peuvent être inclus dans ce scan.

Hybrid · Answer

Search Navipromo version 3.6.0 commencé le 08/07/2008 à  2:31:12,03

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1
Session actuelle : "Michael Beyer" 

Mise à jour le 27.06.2008 à 23h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 6.0.2900.2180 
Système de fichiers : NTFS

Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "C:\WINDOWS" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Michael Beyer\applic~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\applic~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\Antoine\applic~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\CLINE~1\applic~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\INVIT~1\applic~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\Maman\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\Michael Beyer\locals~1\applic~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\Antoine\locals~1\applic~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\CLINE~1\locals~1\applic~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\INVIT~1\locals~1\applic~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\Maman\locals~1\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\Michael Beyer\menudm~1\progra~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\menudm~1\progra~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\Antoine\menudm~1\progra~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\CLINE~1\menudm~1\progra~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\INVIT~1\menudm~1\progra~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\Maman\menudm~1\progra~1" *** 

*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun Fichier trouvé


*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings\Michael Beyer\locals~1\applic~1" * 

* Recherche dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" * 

* Recherche dans "C:\DOCUME~1\Antoine\locals~1\applic~1" * 

* Recherche dans "C:\DOCUME~1\CLINE~1\locals~1\applic~1" * 

* Recherche dans "C:\DOCUME~1\INVIT~1\locals~1\applic~1" * 

* Recherche dans "C:\DOCUME~1\Maman\locals~1\applic~1" * 



*** Recherche fichiers *** 



*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :


* Dans "C:\Documents and Settings\Michael Beyer\locals~1\applic~1" : 


* Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" : 


* Dans "C:\DOCUME~1\Antoine\locals~1\applic~1" : 


* Dans "C:\DOCUME~1\CLINE~1\locals~1\applic~1" : 


* Dans "C:\DOCUME~1\INVIT~1\locals~1\applic~1" : 


* Dans "C:\DOCUME~1\Maman\locals~1\applic~1" : 


3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group trouvé !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :



*** Analyse terminée le 08/07/2008 à  2:35:56,90 ***



J'espère que tu sais utiliser les logiciels que tu me fait installer car cela me semble bien sérieux et grave en cas d'erreur ^^"

Destrio5 · Answer

Je sais ce que je fais ;)

Tu peux désinstaller Navilog1.

- Télécharge et installe MalwareByte's Anti-Malware :
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.htm

- Mets-le à jour

- Redémarre en mode sans échec (Recommandé) :
https://www.malekal.com/demarrer-windows-mode-sans-echec/

- Choisis ta session habituelle

- Fais un scan complet avec MalwareByte's Anti-Malware

- Supprime tout ce que le logiciel trouve, enregistre le rapport

- Redémarre en mode normal et poste le rapport ici

Tutorial :
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

Hybrid · Answer

Malwarebytes' Anti-Malware 1.20
Version de la base de données: 930
Windows 5.1.2600 Service Pack 2

03:02:37 08/07/2008
mbam-log-7-8-2008 (03-02-37).txt

Type de recherche: Examen rapide
Eléments examinés: 50483
Temps écoulé: 9 minute(s), 0 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Destrio5 · Answer

Mets à jour Java :
https://www.java.com/fr/download/manual.jsp

Mets à jour Internet Explorer :
https://support.microsoft.com/fr-fr/allproducts

Redémarre et poste un nouveau rapport HijackThis, tu vas fixer des lignes après.

Hybrid · Answer

Je n'utilise pas IE ...

Destrio5 · Answer

Ok.

Hybrid · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:13:24, on 08/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Medion Info Display\MdionLCM.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\CmUCReye.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Labtec\WebCam10\WebCam10.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre1.6.0_04\bin\jucheck.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\Michael Beyer\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.jeuxvideo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Alcohol Toolbar Helper - {52D06F97-5511-43FA-8FDA-C481864FD26E} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O3 - Toolbar: Alcohol Toolbar - {4C4E7CDB-5BFC-4D74-83E2-8AE659B7EDA2} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MedionVFD] "C:\Program Files\Medion Info Display\MdionLCM.exe"
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [CmUCRRun] C:\WINDOWS\system32\CmUCReye.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Labtec\WebCam10\WebCam10.exe" /hide
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LVSrvLauncher - Labtec Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Destrio5 · Answer

---> Relance HijackThis et choisis Do a system scan only

---> Coche les cases qui sont devant les lignes suivantes :

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" 

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime 

---> Clique en bas sur Fix checked. Mets oui si HijackThis te demande quelque chose.

---> Poste un nouveau rapport HijackThis.

Hybrid · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:28:46, on 08/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Medion Info Display\MdionLCM.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\CmUCReye.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Labtec\WebCam10\WebCam10.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre1.6.0_04\bin\jucheck.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Documents and Settings\Michael Beyer\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.jeuxvideo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Alcohol Toolbar Helper - {52D06F97-5511-43FA-8FDA-C481864FD26E} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O3 - Toolbar: Alcohol Toolbar - {4C4E7CDB-5BFC-4D74-83E2-8AE659B7EDA2} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MedionVFD] "C:\Program Files\Medion Info Display\MdionLCM.exe"
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [CmUCRRun] C:\WINDOWS\system32\CmUCReye.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Labtec\WebCam10\WebCam10.exe" /hide
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LVSrvLauncher - Labtec Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Destrio5 · Answer

Plus de trace d'infection.

Télécharge Tools Cleaner sur ton bureau.
http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
Clique sur Recherche et laisse le scan agir.
Clique sur Suppression pour finaliser. 
Tu peux, si tu le souhaites, te servir des Options facultatives.
Clique sur Quitter pour obtenir le rapport. 
Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

Hybrid · Answer

-->- Recherche: 

C:\Qoobox: trouvé !
C:\Documents and Settings\Michael Beyer\Bureau\HijackThis.exe: trouvé !
C:\Program Files\Navilog1: trouvé !

Bizarre car j'ai complètement désinstallé navilog...

Destrio5 · Answer

Tu peux lancer la suppression.

Hybrid · Answer

Okay et après?

Destrio5 · Answer

---> Télécharge CCleaner (N'installe pas la Yahoo Toolbar) :
https://www.ccleaner.com/ccleaner/download

---> Lance-le. Va dans "Options" puis "Avancé", tu décoches la case "Effacer uniquement les fichiers etc...". Tu vas dans "Nettoyeur", tu fais "Analyse". Une fois terminé, tu lances le nettoyage. Puis tu vas dans "Registre", tu fais "Chercher des erreurs". Une fois terminé, tu répares toutes les erreurs sans sauvegarder la base de registre.

---> Il est nécessaire de désactiver puis réactiver la restauration système, fais-le :
http://www.infos-du-net.com/forum/272480-11-desactiver-activer-restauration-systeme

---> Je te conseille de créer un point de restauration que tu pourras utiliser plus tard si tu as un problème :
https://www.vulgarisation-informatique.com/creer-point-restauration.php

Et voilà ;)

Hybrid · Answer

Et bien un grand merci à toi , je te souhaite une bonne continuation sur ce forum , continue d'aider les gens c'est cool c'que tu fais, bravo ;)

Rapport hijackthis , svp !

21 réponses

Discussions similaires