Ouverture de fenetre publicitaire

pdesousa Messages postés 2 Statut Membre -  
 patricia -
Bonjour,
depuis quelques semaine je suis envahi par des fenetre publicitaire des que je me connecte
et je voudrait savoir comment fait on pour s'en debarasser de plus j'ai norton 360.2 et spyware doctor qui lui ma detecter des spyware mais j'ai toujour c'est fenetre qui s'ouvre de plus je trove que mon ordi rame j'ai windows vista familliale.
j'aimerais que quelqu'un m'aide car de plus je suis novice dans l'informatique
merci encore si quelqu'un peut m'aider
patricia
A voir également:

28 réponses

Utilisateur anonyme
 
Bonjour,
Commence par poster un rapport HijackThis stp,
>Télécharge HiJackThis : https://www.commentcamarche.net/telecharger/securite/11747-hijackthis/
- Lance le programme, puis sélectionne < do a system scan and save a logfile >
- Enregistre le rapport sur ton bureau.
Et envoie, par copier/coller, ton log Hijackthis sur le forum,

A+
0
pdesousa Messages postés 2 Statut Membre
 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:52:13, on 16/07/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\modem ADSL USB\modem ADSL USB\dslmon.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Windows\system32\svchost.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [Apanel] C:\ACERSW\config\NewSetApanel.cmd
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKCU\..\Run: [skiui] c:\users\patricia\appdata\local\skiui.exe skiui
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: DSLMON.lnk = ?
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\Broderbund\PrintMaster\PMremind.exe
O4 - Global Startup: PCM Media Sharing.lnk = C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
0
Utilisateur anonyme
 
Parfait,

> Télécharge Navilog1 de Il Mafioso : http://perso.orange.fr/il.mafioso/Navifix/Navilog1.zip
- Enregistre-le sur ton Bureau puis décompresse-le en faisant « extraire-tout ».
- Double clique sur Navilog1.exe
- Choisis pour la langue le français, puis l'option 1 et valide.
Attention : n’utilise surtout pas les options 2,3 ou 4 maintenant. (tu risquerais d’endommager ton pc)
- Patiente jusqu'au message : < Analyse Terminée le ..... > Ensuite appuie sur une touche comme demandé. Le Bloc-notes va s'ouvrir.
- Fais un copier coller du rapport généré et poste-le ici.
NB : Le rapport se trouve aussi à la racine de ton disque : fixnavi.txt

A+
0
patricia
 
Search Navipromo version 3.6.0 commencé le 16/07/2008 à 15:24:52,43

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "Patricia"

Mise à jour le 27.06.2008 à 23h00 par IL-MAFIOSO

Microsoft Windows Vista 6.0.6001
Internet Explorer : 7.0.6001.18000
Système de fichiers : NTFS

Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "C:\Windows" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "C:\ProgramData" ***


*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***

...\InternetGameBox trouvé !

*** Recherche dossiers dans "c:\users\patricia\appdata\roaming\micros~1\windows\startm~1\programs" ***


*** Recherche dossiers dans "C:\Users\Patricia\AppData\Local\virtualstore\Program Files" ***

...\InternetGameBox trouvé !

*** Recherche dossiers dans "C:\Users\Patricia\AppData\Roaming" ***

*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun Fichier trouvé


*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\Windows\system32" *

* Recherche dans "C:\Users\Patricia\AppData\Local\Microsoft" *

* Recherche dans "C:\Users\Patricia\AppData\Local\virtualstore\windows\system32" *

* Recherche dans "C:\Users\Patricia\AppData\Local" *



*** Recherche fichiers ***


C:\Windows\system32\nvs2.inf trouvé !

*** Recherche clés spécifiques dans le Registre ***

HKEY_CURRENT_USER\Software\Lanconfig trouvé !

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\Windows\system32" :


* Dans "C:\Users\Patricia\AppData\Local\Microsoft" :


* Dans "C:\Users\Patricia\AppData\Local\virtualstore\windows\system32" :


* Dans "C:\Users\Patricia\AppData\Local" :


3)Recherche Certificats :

Certificat Egroup trouvé !
Certificat Electronic-Group trouvé !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :



*** Analyse terminée le 16/07/2008 à 15:33:46,00 ***
0
Utilisateur anonyme
 
Re,
ok très bien :
> Lance navilog1 :
- Choisis l'option 2
Navilog travail... patient jusqu'à ce qui soit marqué < Nettoyage Termine le ..... >
Un rapport va être générer. Poste le dans ta prochaine réponse.
Note: le bureau disparaît.

Ensuite,
je conseille ce petit nettoyage :
> Les logiciels suivants (MalwareByte's Anti-Malware et Ccleaner) te seront utiles par la suite - ils sont à conserver...

> Télécharge MalwareByte's Anti-Malware :
- Installe le programme puis lance le stp.
NB : S'il te manque COMCTL32.OCX alors télécharge le ici
- Fais les mises à jour (clique sur "Mises à jour" puis "Recherche de mises à jour") puis ferme le programme.
NB : Si tu as besoin : Tuto

> Télécharge et installe Ccleaner :
- Fais les mises à jour puis ferme le programme.
Si besoin est tu trouveras des Tutoriaux : ici, ici et là.

> Commence par faire un copier/coller de ce poste (cette manip.): (conseillé)
Ouvre un nouveau fichier Bloc notes (clique sur "Démarrer" => "Programmes" =>"Accessoires" => "Bloc notes"),
puis fait un copier/coller de tout le contenu de la fenêtre de ce poste dans le fichier texte.
Sauvegarde le sur le bureau, tu pourras alors y avoir accès même déconnecté ou en mode sans échec.

> Démarre en mode sans échec : (image). Si problème : tuto ici

> Lance MalwareByte's Anti-Malware,
- Clique sur "Executer un examen complet" puis "Rechercher" et sélectionne tous tes disques durs => le scan débute....patiente...
- A la fin du scanne, clique sur "supprimer" (Si des éléments sont difficiles à supprimer, un message te demandera de redémarrer : clique sur "Oui" alors)
- après suppression des infections : un rapport va être généré : sauvegarde le et poste le sur forum.

> Lance Ccleaner,
- Choisi l’onglet "Options" puis clique sur "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier temp de Windows, plus vieux que 48 heures" (tout doit être supprimé).
- Dans l'onglet "Nettoyeur" clique sur "Analyse".
- Une fois l'analyse terminée, clique sur "Lancer le Nettoyage".
- Dans l'onglet "registre" => Recherches des erreurs => Réparer les erreurs sélectionnées => enregistre une sauvegarde => corriger toutes erreurs sélectionnées => ok => fermer.
N.B : Si Ccleaner te propose d'enregistrer une sauvegarde, reponds oui et enregistre sous 'Bureau'
Recommence jusqu’à ce qu’il ne trouve plus rien (cela varie en général entre 1 et 4 fois).

> Relance ton PC en mode normal

> Relance Hijackthis :
Puis sélectionne < do a system scan and save a logfile >,
Et envoie moi, par collier/coller, ton log Hijackthis,

Bon courage,

A+
0
patricia
 
J'ai lancer navilog 1 puis j'ai choisi l option 2 l'ordi a redemarer et j'ai mon bureau a l'ecran je n'est pas d'autre fenetre est ce normale car cela fait 1 heure que j'ai demarer
merci
0
Utilisateur anonyme
 
Re,
je suis revenu...

Ca arrive parfois...


PS : Si ton bureau ne réapparait pas, fais CTRL+ALT+SUPP pour ouvrir le gestionnaire de tâches.
Puis rends-toi à l'onglet "processus". Clique en haut à gauche sur fichiers et choisis "exécuter"
Tape explorer et valide. Cela te fera apparaitre ton bureau.

Puis poste les autres rapports stp.

A+
0
patricia > Utilisateur anonyme
 
je reviens car j'avais perdu ma connection internet je ne pouvait plus me connecter
pour revenir au message si j'avais bien le bureau qui etait afficher mais rien ne marchais pour navilog j'ai regarder sur ma tour pour voir si le voyant clignoter et il ne clignoter pas j'ai attendu 1heure30 et je n'avait pas le rapport de navilog
faut 'il que je recommence tout
je suis un peut perdu de plus j'ai peur de faire des betise
autre chause quand je fait navilog option 2 il a redemarer comment savoir si il fait son travail
merci
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
patricia
 
Malwarebytes' Anti-Malware 1.20
Version de la base de données: 960
Windows 6.0.6001 Service Pack 1

23:11:48 16/07/2008
mbam-log-7-16-2008 (23-11-48).txt

Type de recherche: Examen rapide
Eléments examinés: 37152
Temps écoulé: 3 minute(s), 46 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5f90c0e3-4c0a-4d54-a8ac-5afe6163a99e} (Adware.Starware) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Windows\System32\nvs2.inf (Adware.EGDAccess) -> Quarantined and deleted successfully.
je me suis tromper j'ai fait malwarebites's anti malaware en mode rapide je vais recommencer mais je ferait tous cela demain apres midi
encore merci de votre aide car je ne sais vraiment pas comment me depatouiller de tous sa
0
patricia
 
Malwarebytes' Anti-Malware 1.20
Version de la base de données: 960
Windows 6.0.6001 Service Pack 1

23:52:12 16/07/2008
mbam-log-7-16-2008 (23-52-12).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 132834
Temps écoulé: 34 minute(s), 19 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Users\Patricia\AppData\Local\Zylom Games\Magic Academy Deluxe\BASS.DLL (Trojan.Agent) -> Quarantined and deleted successfully.
voila pour malwarebyte's anti malware
0
patricia
 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:52:13, on 16/07/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\modem ADSL USB\modem ADSL USB\dslmon.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Windows\system32\svchost.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [Apanel] C:\ACERSW\config\NewSetApanel.cmd
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKCU\..\Run: [skiui] c:\users\patricia\appdata\local\skiui.exe skiui
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: DSLMON.lnk = ?
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\Broderbund\PrintMaster\PMremind.exe
O4 - Global Startup: PCM Media Sharing.lnk = C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
0
Utilisateur anonyme
 
Bonjour,
Désolé tu es sous vista c'est pour cela.

Alors,
> Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection):
- Vas dans démarrer puis panneau de configuration
- Double Clique sur l'icône "Comptes d'utilisateurs"
- Clique ensuite sur désactiver et valide.
- Un redémarrage est nécessaire.

Ensuite,
> Lance navilog1 :
- Choisis l'option 2
Navilog travail... patient jusqu'à ce qui soit marqué < Nettoyage Termine le ..... >
Un rapport va être générer. Poste le dans ta prochaine réponse.
Note: le bureau disparaît.

Poste aussi un nouveau HiJackT stp.

A+
0
patricia
 
J'ai fait comme vous m'avait dit j'ai desactiver l'u a c puis j'ai lance navilog 1 a 13heure puis j'ai choisi l'option 2 cela ma informe que l'ordi va redemarer.
l'ordi a redemarer j'ai taper mon mot de passe et mon bureau c'est afficher il est actuellement 14 heure 45 et je n'est toujours pas de rapport qui s'affiche est ce normal
0
Utilisateur anonyme
 
Non,
c'est pas normal.

Mais le rapport se trouve aussi à la racine de ton disque : fixnavi.txt

Vérifie que c'est bien celui du nettoyage puis poste le stp.
0
patricia
 
j'ai cliquer sur demarer et j'ai rechercher fixnavi.txt et je n'est pas le rapport
je commence a deseperer !!!!
y a t'il un grave probleme??
0
patricia
 
J'avait oubliez d'envoyer hijacck thisLogfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:52:13, on 16/07/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\modem ADSL USB\modem ADSL USB\dslmon.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Windows\system32\svchost.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [Apanel] C:\ACERSW\config\NewSetApanel.cmd
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKCU\..\Run: [skiui] c:\users\patricia\appdata\local\skiui.exe skiui
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: DSLMON.lnk = ?
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\Broderbund\PrintMaster\PMremind.exe
O4 - Global Startup: PCM Media Sharing.lnk = C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
0
Utilisateur anonyme
 
Re,

En fait sur le web tu dois avoir pleins de pubs, non ?

Les problèmes se trouve là :
O4 - HKCU\..\Run: [skiui] c:\users\patricia\appdata\local\skiui.exe skiui­
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: DSLMON.lnk = ?
O4 - Global Startup: Empowering Technology Launcher.lnk = ?

Info : http://www.castlecops.com/s3341-Sidebar_exe.html

Et : https://www.google.fr/search?hl=fr&q=skiui.exe&btnG=Recherche+Google&meta=&gws_rd=ssl

Alors on va faire autrement :

Après avoir désactivé l'UAC et relancé ton PC :

> Télécharge ComboFix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe (par sUBs) sur ton Bureau.
Déconnecte toi du net et désactive ton antivirus pour que Combofix puisse s'exécuter normalement.
- Double clique combofix.exe
- Tape sur la touche 1 (Yes) pour démarrer le scan.
- Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
NOTE : Le rapport se trouve également ici : C:\Combofix.txt
Attention : n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer la machine.

Aller,
bon courage.
0
patricia
 
J'ai du tout recommencer car spyware doctor c'est reactiver quand l'ordi a redemarer je l'ai donc desintaller je le reinstallerais plus tard dur dur sa mComboFix 08-07-15.4 - Patricia 2008-07-17 18:17:38.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1303 [GMT 2:00]
Endroit: C:\Users\Patricia\Desktop\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InternetGameBox
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InternetGameBox\Conditions générales.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InternetGameBox\Confidentialité.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InternetGameBox\Website.lnk

.
((((((((((((((((((((((((((((( Fichiers créés 2008-06-17 to 2008-07-17 ))))))))))))))))))))))))))))))))))))
.

2008-07-17 08:25 . 2008-07-17 08:25 <REP> d-------- C:\Program Files\CCleaner
2008-07-16 23:05 . 2008-07-16 23:05 <REP> d-------- C:\Users\Patricia\AppData\Roaming\Malwarebytes
2008-07-16 23:05 . 2008-07-16 23:05 <REP> d-------- C:\Users\All Users\Malwarebytes
2008-07-16 23:05 . 2008-07-16 23:05 <REP> d-------- C:\ProgramData\Malwarebytes
2008-07-16 23:05 . 2008-07-16 23:05 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-16 23:05 . 2008-07-07 17:35 34,296 --a------ C:\Windows\System32\drivers\mbamcatchme.sys
2008-07-16 23:05 . 2008-07-07 17:35 17,144 --a------ C:\Windows\System32\drivers\mbam.sys
2008-07-16 15:19 . 2008-07-17 12:59 <REP> d-------- C:\Program Files\Navilog1
2008-07-16 14:43 . 2008-07-16 14:43 <REP> d-------- C:\Program Files\Trend Micro
2008-07-13 17:04 . 2008-07-13 17:04 <REP> d-------- C:\Program Files\iTunes
2008-07-13 17:04 . 2008-07-13 17:04 <REP> d-------- C:\Program Files\iPod
2008-07-13 17:02 . 2008-07-13 17:02 <REP> d-------- C:\Program Files\QuickTime
2008-07-13 17:02 . 2008-07-13 17:02 <REP> d-------- C:\Program Files\Bonjour
2008-07-12 21:19 . 2008-04-29 11:33 16,952 --------- C:\Windows\System32\drivers\RkPavproc1.sys
2008-07-11 20:14 . 2008-07-11 20:14 <REP> d-------- C:\Program Files\Alwil Software
2008-07-11 20:09 . 2008-07-11 20:09 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-07-10 20:45 . 2008-06-26 03:45 12,240,896 --a------ C:\Windows\System32\NlsLexicons0007.dll
2008-07-10 20:45 . 2008-06-26 03:45 2,644,480 --a------ C:\Windows\System32\NlsLexicons0009.dll
2008-07-10 20:45 . 2008-06-26 05:29 801,280 --a------ C:\Windows\System32\NaturalLanguage6.dll
2008-07-09 17:14 . 2008-07-09 17:14 <REP> d-------- C:\Program Files\Sun
2008-07-09 17:04 . 2008-04-26 10:25 3,600,952 --a------ C:\Windows\System32\ntkrnlpa.exe
2008-07-09 17:04 . 2008-04-26 10:25 3,549,240 --a------ C:\Windows\System32\ntoskrnl.exe
2008-07-09 17:04 . 2008-04-26 10:26 891,448 --a------ C:\Windows\System32\drivers\tcpip.sys
2008-07-09 17:04 . 2008-04-12 05:32 784,896 --a------ C:\Windows\System32\rpcrt4.dll
2008-07-09 17:04 . 2008-05-10 05:35 564,736 --a------ C:\Windows\System32\emdmgmt.dll
2008-07-09 17:04 . 2008-04-05 03:21 72,192 --a------ C:\Windows\System32\drivers\pacer.sys
2008-07-09 17:04 . 2008-04-05 05:34 15,360 --a------ C:\Windows\System32\pacerprf.dll
2008-07-09 17:03 . 2008-05-08 23:59 430,080 --a------ C:\Windows\System32\vbscript.dll
2008-07-09 17:03 . 2008-05-08 23:59 180,224 --a------ C:\Windows\System32\scrobj.dll
2008-07-09 17:03 . 2008-05-08 23:59 172,032 --a------ C:\Windows\System32\scrrun.dll
2008-07-09 17:03 . 2008-05-08 23:59 155,648 --a------ C:\Windows\System32\wscript.exe
2008-07-09 17:03 . 2008-05-08 23:58 135,168 --a------ C:\Windows\System32\wshom.ocx
2008-07-09 17:03 . 2008-05-08 23:58 135,168 --a------ C:\Windows\System32\cscript.exe
2008-07-09 17:03 . 2008-05-08 23:59 90,112 --a------ C:\Windows\System32\wshext.dll
2008-07-08 21:39 . 2008-07-08 21:39 <REP> d-------- C:\Users\Patricia\AppData\Roaming\Talkback
2008-07-08 21:26 . 2008-07-17 18:14 <REP> d-a------ C:\Users\All Users\TEMP
2008-07-08 21:26 . 2008-07-17 18:14 <REP> d-a------ C:\ProgramData\TEMP
2008-07-08 21:25 . 2008-07-17 18:14 <REP> d-------- C:\Program Files\Spyware Doctor
2008-07-08 21:24 . 2008-07-08 21:24 <REP> d-------- C:\Users\All Users\Mozilla
2008-07-08 21:19 . 2008-07-16 19:22 <REP> d-------- C:\Users\All Users\Google Updater
2008-07-08 21:19 . 2008-07-16 19:22 <REP> d-------- C:\ProgramData\Google Updater
2008-07-06 16:47 . 2008-07-06 16:47 <REP> d-------- C:\Program Files\Windows Live Toolbar
2008-07-05 12:56 . 2008-07-05 12:56 <REP> d-------- C:\Users\All Users\Grisoft
2008-07-05 12:56 . 2008-07-05 12:56 <REP> d-------- C:\ProgramData\Grisoft
2008-06-30 19:06 . 2008-06-30 19:06 <REP> d-------- C:\Windows\System32\N360_BACKUP
2008-06-27 11:25 . 2008-06-27 11:57 <REP> d-------- C:\Program Files\Symantec
2008-06-27 11:25 . 2008-06-27 11:57 123,952 --a------ C:\Windows\System32\drivers\SYMEVENT.SYS
2008-06-27 11:25 . 2008-06-27 11:57 10,671 --a------ C:\Windows\System32\drivers\SYMEVENT.CAT
2008-06-27 11:25 . 2008-06-27 11:57 805 --a------ C:\Windows\System32\drivers\SYMEVENT.INF
2008-06-27 11:16 . 2008-07-11 12:20 <REP> d-------- C:\Users\All Users\Symantec
2008-06-27 11:16 . 2008-07-11 12:20 <REP> d-------- C:\ProgramData\Symantec
2008-06-19 17:33 . 2008-06-27 11:43 <REP> d-------- C:\Users\All Users\Symantec Temporary Files
2008-06-19 17:33 . 2008-06-27 11:43 <REP> d-------- C:\ProgramData\Symantec Temporary Files

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-13 20:53 --------- d-----w C:\ProgramData\Microsoft Help
2008-07-13 20:53 --------- d-----w C:\Program Files\modem ADSL USB
2008-07-13 20:53 --------- d-----w C:\Program Files\Microsoft Works
2008-07-13 20:53 --------- d-----w C:\Program Files\Google
2008-07-13 20:53 --------- d-----w C:\Program Files\Common Files\Teleca Shared
2008-07-13 20:31 248 ----a-w C:\Users\Patricia\AppData\Roaming\wklnhst.dat
2008-07-13 18:09 --------- d-----w C:\Users\Patricia\AppData\Roaming\Apple Computer
2008-07-13 15:04 --------- d-----w C:\ProgramData\Apple Computer
2008-07-09 18:37 --------- d-----w C:\Program Files\Windows Mail
2008-07-09 15:08 --------- d-----w C:\Program Files\Java
2008-07-01 05:49 --------- d-----w C:\Program Files\Norton 360
2008-06-27 09:55 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-06-27 09:31 --------- d-----w C:\Users\Patricia\AppData\Roaming\Symantec
2008-06-13 12:14 24,112 ----a-w C:\Windows\system32\drivers\SymIMV.sys
2008-06-13 12:14 13,093 ----a-w C:\Windows\system32\drivers\SymRedir.cat
2008-06-13 12:14 1,611 ----a-w C:\Windows\system32\drivers\SymRedir.inf
2008-06-13 12:13 96,432 ----a-w C:\Windows\system32\drivers\symfw.sys
2008-06-13 12:13 41,008 ----a-w C:\Windows\system32\drivers\symndisv.sys
2008-06-13 12:13 38,576 ----a-w C:\Windows\system32\drivers\symids.sys
2008-06-13 12:13 22,320 ----a-w C:\Windows\system32\drivers\symredrv.sys
2008-06-13 12:13 184,240 ----a-w C:\Windows\system32\drivers\symtdi.sys
2008-06-13 12:13 13,616 ----a-w C:\Windows\system32\drivers\symdns.sys
2008-05-22 18:50 --------- d-----w C:\Users\Patricia\AppData\Roaming\Zylom
2008-05-20 09:53 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-05-10 03:35 885,248 ----a-w C:\Windows\System32\RacEngn.dll
2008-04-26 08:08 1,314,816 ----a-w C:\Windows\System32\quartz.dll
2008-04-25 04:35 826,880 ----a-w C:\Windows\System32\wininet.dll
2008-04-23 04:42 428,544 ----a-w C:\Windows\System32\EncDec.dll
2008-04-23 04:42 293,376 ----a-w C:\Windows\System32\psisdecd.dll
2008-03-26 14:40 174 --sha-w C:\Program Files\desktop.ini
2008-02-26 16:20 559,160,704 ----a-w C:\Users\Patricia\sevensins{48773}.exe
.

((((((((((((((((((((((((((((( snapshot@2008-07-17_17.58.30.10 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-07-17 16:15:04 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-07-17 16:15:04 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-07-17 15:55:50 1,572,864 --sha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat
+ 2008-07-17 16:16:08 1,572,864 --sha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat
- 2008-07-17 15:55:50 1,572,864 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat
+ 2008-07-17 16:16:03 1,572,864 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat
+ 2008-07-17 16:09:06 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Feeds Cache\index.dat
- 2008-07-17 15:51:01 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-07-17 15:55:40 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-07-17 16:09:07 78,924 ----a-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat
- 2008-07-17 15:51:01 49,152 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-07-17 16:06:15 49,152 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-07-17 16:10:09 8,590 ----a-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\HTML Help\hh.dat
- 2008-07-17 15:51:01 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-07-17 16:06:15 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-07-17 15:44:07 104,742 ----a-w C:\Windows\System32\perfc009.dat
+ 2008-07-17 16:00:06 104,742 ----a-w C:\Windows\System32\perfc009.dat
- 2008-07-17 15:44:07 127,798 ----a-w C:\Windows\System32\perfc00C.dat
+ 2008-07-17 16:00:06 127,798 ----a-w C:\Windows\System32\perfc00C.dat
- 2008-07-17 15:44:07 595,308 ----a-w C:\Windows\System32\perfh009.dat
+ 2008-07-17 16:00:06 595,308 ----a-w C:\Windows\System32\perfh009.dat
- 2008-07-17 15:44:07 678,730 ----a-w C:\Windows\System32\perfh00C.dat
+ 2008-07-17 16:00:06 678,730 ----a-w C:\Windows\System32\perfh00C.dat
- 2008-07-17 15:41:11 16,394 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1890434015-3248361923-3785758653-1000_UserData.bin
+ 2008-07-17 16:17:37 16,656 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1890434015-3248361923-3785758653-1000_UserData.bin
- 2008-07-17 15:41:10 69,046 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-07-17 16:17:37 69,116 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-07-17 15:41:08 76,828 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-07-17 16:17:36 77,086 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayExcluded]
@="{4433A54A-1AC8-432F-90FC-85F045CF383C}"
[HKEY_CLASSES_ROOT\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C}]
2008-02-26 10:34 576352 --a------ C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayPending]
@="{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}"
[HKEY_CLASSES_ROOT\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}]
2008-02-26 10:34 576352 --a------ C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayProtected]
@="{476D0EA3-80F9-48B5-B70B-05E677C9C148}"
[HKEY_CLASSES_ROOT\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148}]
2008-02-26 10:34 576352 --a------ C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 09:33 1233920]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 09:33 125952]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-08-09 07:03 221184]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-07-08 21:19 68856]
"Acer Tour Reminder"="" [BU]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acer Empowering Technology Monitor"="C:\Acer\Empowering Technology\SysMonitor.exe" [2007-01-24 10:27 319488]
"eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-02-07 00:04 464168]
"WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 21:48 57344]
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-02-15 18:39 151552]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-18 13:37 51048]
"osCheck"="C:\Program Files\Norton 360\osCheck.exe" [2008-02-26 16:50 988512]
"Apanel"="C:\ACERSW\config\NewSetApanel.cmd" [BU]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-01 09:38 4390912 C:\Windows\RtHDVCpl.exe]
"Acer Tour"="" [BU]
"eRecoveryService"="" [BU]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
DSLMON.lnk - C:\Program Files\modem ADSL USB\modem ADSL USB\dslmon.exe [2007-08-24 20:42:13 925770]
Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2007-04-24 14:53:40 528384]
PCM Media Sharing.lnk - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe [2007-04-24 14:32:04 200812]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.mkdmp3enc"= C:\PROGRA~1\ACERAR~1\ACERVI~1\Kernel\Burner\MKDMP3Enc.ACM

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Event Reminder.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Event Reminder.lnk
backup=C:\Windows\pss\Event Reminder.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 23:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
--a------ 2008-07-10 09:47 116040 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
--a------ 2008-07-08 21:21 29744 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-07-10 10:51 289064 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-05-27 10:50 413696 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1890434015-3248361923-3785758653-1000]
"EnableNotificationsRef"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{F95798C9-BF0A-4D20-BD7C-6B38E7FF9FEE}"= C:\Program Files\Acer Arcade Live\Acer Arcade Live Main Page\Acer Arcade Live.exe:Acer Arcade Live
"{A5333138-7820-4A45-A0F8-9FD93BB4D627}"= C:\Program Files\Acer Arcade Live\Acer DV Magician\Component\ARAWP.exe:DV Magician ARA workprocess
"{D585109C-A3E9-47A0-B1F8-BEF827E9F6D7}"= C:\Program Files\Acer Arcade Live\Acer DV Magician\Component\DVAX2Process.exe:DV Magician AVAX workprocess
"{31A60708-F002-42F4-9908-B33BD16550DD}"= C:\Program Files\Acer Arcade Live\SlideShow DVD\Component\CLSLDVD.exe:SlideShow DVD workprocess
"{932D4E56-6D5F-4909-A913-8B5947834283}"= C:\Program Files\Acer Arcade Live\Acer VideoMagician\VideoMagician.exe:VideoMagician
"{B4E3A7E7-6249-4309-B05F-B68B9B030828}"= C:\Program Files\Acer Arcade Live\Acer DVDivine\DVDivine.exe:DVDivine
"{383C1570-BA3C-4015-8188-2C4B6D3284C4}"= C:\Program Files\Acer Arcade Live\Acer HomeMedia\HomeMedia.exe:HomeMedia
"{96FB5B8F-6D95-4F7A-809C-7952FC936ACB}"= C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\HomeMedia Connect.exe:HomeMedia Connect
"{4FF06BD9-4370-4B76-ACF7-40542F1CF716}"= C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.EXE:HomeMedia Connect Service
"{A3545E1B-C746-447F-9041-B38D5406AB1D}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{B27F2B2A-F1C3-4E65-8725-F857C07B7BEF}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{EE4D2278-AD7B-4803-A420-F38C28277D1C}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{194FD8EB-688B-4934-9872-216662DE2B56}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{E61F3606-05A7-4805-BF24-0DC0FBD0F937}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{62B8BC67-8872-4967-821C-78A376B0FE1E}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{08C2557A-6A5F-4E01-BC34-164411E3EB08}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"DoNotAllowExceptions"= 0 (0x0)

R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\ipsdefs\20080715.001\IDSvix86.sys [2008-06-03 16:28]
R2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [2007-04-04 18:54]
R2 LiveUpdate Notice;LiveUpdate Notice;C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-02-18 13:37]
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-05-17 16:01]
R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2008-06-13 14:13]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2007-12-06 10:51]
S3 Boonty Games;Boonty Games;C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe [2007-12-01 16:51]
S3 GoogleDesktopManager-022208-143751;Google Desktop Manager 5.7.802.22438;C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-07-08 21:21]

*Newly Created Service* - COMHOST
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-07-17 05:52:31 C:\Windows\Tasks\User_Feed_Synchronization-{EE3BDE70-B578-4D5D-BF7E-CD69151D5AA7}.job"
- C:\Windows\system32\msfeedssync.exe
"2008-07-17 15:35:02 C:\Windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{486E390A-7713-433F-A882-8B52263E595A} - (no file)
WebBrowser-{6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - (no file)

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-17 18:19:43
Windows 6.0.6001 Service Pack 1 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-07-17 18:20:36
ComboFix-quarantined-files.txt 2008-07-17 16:20:27

Pre-Run: 76,263,747,584 octets libres
Post-Run: 76,230,332,416 octets libres

263 --- E O F --- 2008-07-16 16:23:50
e stress!!!
0
Utilisateur anonyme
 
Coucou,
bien joué.

Alors,
> Télécharge ATF Cleaner par Atribune sur ton bureau.
- Démarre ATF-Cleaner et Coche les valeurs suivantes :

Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
Recycle Bin

- Clique sur <Empty Selected> et au message "Done Cleaning" sur <Ok>

NB : Si tu utilises Firefox ou Opera :
- Clique sur Firefox ou Opera au haut puis choisis <Select All>.
- Clique sur le bouton <Empty Selected> (NB : Si tu veux conserver tes mots de passe sauvegardés alors clique sur <No> à l'invite).
- Clique sur <Main> pour revenir à menu principal

- Clique sur <Exit>, du menu prinicipal, pour quitter ATFcleaner.

Puis poste un nouveau rapport HiJAckT.
Après on termine.

A+
0
patricia
 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:52:13, on 16/07/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\modem ADSL USB\modem ADSL USB\dslmon.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Windows\system32\svchost.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [Apanel] C:\ACERSW\config\NewSetApanel.cmd
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKCU\..\Run: [skiui] c:\users\patricia\appdata\local\skiui.exe skiui
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: DSLMON.lnk = ?
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\Broderbund\PrintMaster\PMremind.exe
O4 - Global Startup: PCM Media Sharing.lnk = C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
0
patricia > patricia
 
j'ai oublier de dire que j'avaisinternet explorer
0
patricia > patricia
 
j'ai encore un probleme de connection j'ai en bas a droite les deux ecran avec une croix rouge avant quand j'allumer l'ordi il se connecter automatiquement et depuis que j'ai tous c'est proble je n'arrive plus a me connecter est ce que sa vien de tous c'est probleme
0
patricia
 
de plus quand la connection se fait j'ai l'impression que internet marche tout le temps meme quand je ne vais pas sur un site y'aurait il quelqu'un qui grapille sur mon ordi???
0
Utilisateur anonyme
 
Hummmm...

Fais ceci stp :
>Ouvre ce lien http://siri.urz.free.fr/Fix/SmitfraudFix.php et télécharge SmitfraudFix (de S!RI).
- Regarde le tuto
- Exécute le programme et choisi l’option 1 (et uniquement).
Le programme va générer un rapport, copie/colle le sur le forum.


+
0
patricia > Utilisateur anonyme
 
je ne peut pas voila ce que cela me dit mais peut etre qu'il faut que je desactive l'uac et norton??
si c'est oui je ferait cela demain matin
0
patricia
 
J'ai oubliez il m'indique acces refuser erreur en entrer impossible de trouver le fichier script c:\windows\system32\G et paths.vbs
impossible de trouver c:\windows\system32\Getaths.vbs
set paths.bat n'est pas reconnu en tant que commande interne ou externe,un programme executable ou un fichier de commande.
impossible de trouver c:\windows\system32\\set paths.bat
smitfraudfix v2.329
fichier process.exe, absent!
dezipter la totaliter de l'archive dans un dossier
process.exefiles missing
unzip all the archive in a folder
appuyer sur une touche pour continuer
chose que j'ai faite mais je n'y arrive pas
0
Utilisateur anonyme
 
Hello,

Oui : désactive l'UAC toujours à chaque fois ;)

Sinon, dis moi et on fait autrement.

Bonne fin de soirée.
0
patricia
 
voila le resultat

SmitFraudFix v2.329

Scan done at 9:36:40,28, 18/07/2008
Run from C:\Users\Patricia\Desktop\SmitfraudFix
OS: Microsoft Windows [version 6.0.6001] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\Windows\system32\csrss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\modem ADSL USB\modem ADSL USB\dslmon.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\SearchFilterHost.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Patricia


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Patricia\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Patricia\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\\PROGRA~1\\Google\\GOOGLE~3\\GOEC62~1.DLL"


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\Windows\\system32\\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Marvell Yukon 88E8056 PCI-E Gigabit Ethernet Controller
DNS Server Search Order: 192.168.30.1
DNS Server Search Order: 0.0.0.0

HKLM\SYSTEM\CCS\Services\Tcpip\..\{169CEE27-4969-46D2-AB0F-0C9722446995}: DhcpNameServer=192.168.30.1 0.0.0.0
HKLM\SYSTEM\CS1\Services\Tcpip\..\{169CEE27-4969-46D2-AB0F-0C9722446995}: DhcpNameServer=192.168.30.1 0.0.0.0
HKLM\SYSTEM\CS3\Services\Tcpip\..\{169CEE27-4969-46D2-AB0F-0C9722446995}: DhcpNameServer=192.168.30.1 0.0.0.0
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.30.1 0.0.0.0
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.30.1 0.0.0.0
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.30.1 0.0.0.0


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End
0
Utilisateur anonyme
 
Bonjour,
Ok alors :

> Télécharge OTMoveIT (de Old_Timer) : http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe sur ton bureau...
- Double-clique sur OTMoveIt.exe pour le lancer.
- Assure toi que la case "Unregister Dll's and Ocx's" est bien cochée !!!
- Copie le texte qui se trouve ci-dessous et colle-le dans le cadre de gauche de OTMoveIt nommé <Paste standard List of Files/Folders to be moved>.

c:\users\patricia\appdata\local\skiui.exe
C:\Program Files\Windows Sidebar


- Clique sur < MoveIt! > pour lancer la suppression.
- Lorsqu'un résultat apparaît dans le cadre Results clique sur Exit
N.B :Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. Accepte en cliquant sur YES.
Un rapport est créé dans %SYSTEMDRIVE%\_OTMoveIt\MovedFiles\date du jour (C:\_OTMoveIt\MovedFiles\), copie-colle-le dans ta réponse suivante stp.

Puis reposte un rapport HiJackT stp.

Comment va le PC ?

A+
0
patricia
 
je suis rentre du boulot
il faut que j'ecrive aussi c:\user\patricia\appdata\local\skiui.exe et C:\Program Files\Windows Sidebar
car je l'ai fait mais sa me met erreur
0
patricia
 
je sui en train de relire le message et j'aissaie de le faire mais il faut bien que j'ecrive dan la collone de gauche mais je ne comprend pas tu me dit de copier le texte et colle comment il faut faire
0
patricia
 
Je crois que j'ai reussiFile/Folder c:\users\patricia\appdata\local\skiui.exe not found.
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images moved successfully.
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js moved successfully.
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css moved successfully.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget scheduled to be moved on reboot.
C:\Program Files\Windows Sidebar\Gadgets\Stocks.Gadget\images moved successfully.
C:\Program Files\Windows Sidebar\Gadgets\Stocks.Gadget\fr-FR\js moved successfully.
C:\Program Files\Windows Sidebar\Gadgets\Stocks.Gadget\fr-FR\css moved successfully.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Stocks.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Stocks.Gadget scheduled to be moved on reboot.
C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop moved successfully.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images scheduled to be moved on reboot.
C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js moved successfully.
C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css moved successfully.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget scheduled to be moved on reboot.
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images moved successfully.
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js moved successfully.
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css moved successfully.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget scheduled to be moved on reboot.
C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images moved successfully.
C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js moved successfully.
C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css moved successfully.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget scheduled to be moved on reboot.
C:\Program Files\Windows Sidebar\Gadgets\Notes.Gadget\images moved successfully.
C:\Program Files\Windows Sidebar\Gadgets\Notes.Gadget\fr-FR\js moved successfully.
C:\Program Files\Windows Sidebar\Gadgets\Notes.Gadget\fr-FR\css moved successfully.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Notes.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Notes.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Norton.Gadget\images\frames scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Norton.Gadget\images\buttons scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Norton.Gadget\images scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Norton.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Norton.Gadget scheduled to be moved on reboot.
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images moved successfully.
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js moved successfully.
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css moved successfully.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget scheduled to be moved on reboot.
C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images moved successfully.
C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js moved successfully.
C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css moved successfully.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget scheduled to be moved on reboot.
C:\Program Files\Windows Sidebar\Gadgets\Contacts.Gadget\images moved successfully.
C:\Program Files\Windows Sidebar\Gadgets\Contacts.Gadget\fr-FR\js moved successfully.
C:\Program Files\Windows Sidebar\Gadgets\Contacts.Gadget\fr-FR\css moved successfully.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Contacts.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Contacts.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images scheduled to be moved on reboot.
C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js moved successfully.
C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css moved successfully.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget scheduled to be moved on reboot.
C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images moved successfully.
C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js moved successfully.
C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css moved successfully.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets scheduled to be moved on reboot.
C:\Program Files\Windows Sidebar\fr-FR moved successfully.
Folder move failed. C:\Program Files\Windows Sidebar scheduled to be moved on reboot.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 07182008_164739

Files moved on Reboot...
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Stocks.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Stocks.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Stocks.Gadget scheduled to be moved on reboot.
C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar moved successfully.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Notes.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Notes.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Notes.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Norton.Gadget\images\frames scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Norton.Gadget\images\buttons scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Norton.Gadget\images\frames scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Norton.Gadget\images\buttons scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Norton.Gadget\images scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Norton.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Norton.Gadget\images\frames scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Norton.Gadget\images\buttons scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Norton.Gadget\images scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Norton.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Norton.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Contacts.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Contacts.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Contacts.Gadget scheduled to be moved on reboot.
C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images moved successfully.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Stocks.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Stocks.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Notes.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Notes.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Norton.Gadget\images\frames scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Norton.Gadget\images\buttons scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Norton.Gadget\images scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Norton.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Norton.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Contacts.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Contacts.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Stocks.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Stocks.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Notes.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Notes.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Norton.Gadget\images\frames scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Norton.Gadget\images\buttons scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Norton.Gadget\images scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Norton.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Norton.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Contacts.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Contacts.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar\Gadgets scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Windows Sidebar scheduled to be moved on reboot.
0
Utilisateur anonyme
 
Pour faire le copier/coller :

Avec ta sourie tu sélectionne le texte (fais clisser le curseur de la souris dessus en maintenant le clic gauche enfoncé) :

c:\users\patricia\appdata\local\skiui.exe
C:\Program Files\Windows Sidebar

Ensuite tu appuis sur les touches Ctrl et C (=> texte passe dans le pesse papier).

Dans OTmoveIT tu clique droit dans la colonne et tu choisis coller => le texte apparait !

Tuto ici sinon : http://planetice.free.fr/logiciel/winds/copier.htm

A+
0