pb de fenetre pub intempestives

Question

Bonjour,

En parcourant le forum à la recherche d'une solution pour arreter d'avoir en permanence des fenetre de pub et de soit disant antivirus qui apparraissent je suis tomber sur un message me donnatn un lien me permettant de creer u rapport qui apparement aide pour solutionner ce pb, est-ce que quelqu'un peut m'aider ??

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:41:21, on 16/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Antipub\antipub.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\GUILLAUME\Mes documents\Mes fichiers reçus\marie.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
O2 - BHO: (no name) - {04578D8D-6130-411B-BEE5-DFF22903F732} - C:\WINDOWS\system32
nnmjigf.dll
O2 - BHO: (no name) - {04a12f05-b47b-41cc-a3ac-77043900a361} - (no file)
O2 - BHO: (no name) - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {21526C73-065C-4DC1-A409-07C6DD87BC2F} - (no file)
O2 - BHO: (no name) - {45BD6287-51B5-495C-9856-9F2CA3976F6D} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: GamesBar - {6F282B65-56BF-4BD1-A8B2-A4449A05863D} - C:\Program Files\GamesBar\oberontb.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: {8201ce80-8bed-fd99-5014-5bc93404a068} - {860a4043-9cb5-4105-99df-deb808ec1028} - C:\WINDOWS\system32
bbzti.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {c900b400-cdfe-11d3-976a-00e02913a9e0} - (no file)
O2 - BHO: (no name) - {DF5778B0-4BDD-4922-AB5E-F733267245DD} - C:\WINDOWS\system32\geBsrSjI.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: GamesBar - {6F282B65-56BF-4BD1-A8B2-A4449A05863D} - C:\Program Files\GamesBar\oberontb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [EPSON Stylus CX3200] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX3200" /O6 "USB001" /M "Stylus CX3200"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [BM8389b7de] Rundll32.exe "C:\WINDOWS\system32\imcwqvfc.dll",s
O4 - HKLM\..\Run: [webHancer Agent] C:\Program Files\webHancer\Programs\whagent.exe
O4 - HKLM\..\Run: [{2edf7f6e-828a-e517-385a-b25ca7d71a25}] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\prjvrmtoojhurpsz.dll" DllStub
O4 - HKLM\..\Run: [80ba8442] rundll32.exe "C:\WINDOWS\system32
heyljbl.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKLM\..\Policies\Explorer\Run: [ishost.exe] ishost.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {1A93C934-025B-4c3a-B38E-9654A7003239} - C:\Program Files\GamesBar\oberontb.dll
O9 - Extra 'Tools' menuitem: GamesBar - {1A93C934-025B-4c3a-B38E-9654A7003239} - C:\Program Files\GamesBar\oberontb.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} (ITPPDiagIE Class) - http://data.jeuxclassiques.com/npwwg.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.0.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://gamenextfr.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O20 - AppInit_DLLs: nbbzti.dll
O20 - Winlogon Notify: nnnmjigf - C:\WINDOWS\SYSTEM32
nnmjigf.dll
O20 - Winlogon Notify: winwea32 - winwea32.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

Destrio5 · Answer

Salut,

Infection Vundo.

---> Fais un scan rapide avec MBAM, supprime tout ce qu'il trouve et poste le rapport :
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.htm

guigui281268 · Answer

merci j'essaye de suite

Destrio5 · Answer

Si Tea Timer te demande quelque chose, accepte.

guigui281268 · Answer

ok, j'ai effectué malwarebytes et je colle le rapport, spybot m'a demandé sur certain point d'accepter ou non les modifs, j'ai cliqué sur accépté, j'espère que j'ai bien fait !!

malwarebytes me signale qu'il y a quelques elements qu'il ne peut supprimer et que pour cela il fat redemarer l'ordi?  j'attends tes precieux conseils

Destrio5 · Answer

"spybot m'a demandé sur certain point d'accepter ou non les modifs, j'ai cliqué sur accépté, j'espère que j'ai bien fait !!"
---> Je t'avais prévenu dans le message juste au-dessus.

---> Redémarre ton PC

guigui281268 · Answer

pardon j'ai oublié de coller le rapport

Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1159
Windows 5.1.2600 Service Pack 2

16/09/2008 08:08:01
mbam-log-2008-09-16 (08-08-01).txt

Type de recherche: Examen rapide
Eléments examinés: 95147
Temps écoulé: 15 minute(s), 34 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 4
Clé(s) du Registre infectée(s): 35
Valeur(s) du Registre infectée(s): 4
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 29

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\geBsrSjI.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\imcwqvfc.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32
bbzti.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32
nnmjigf.dll (Trojan.Vundo.H) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{04578d8d-6130-411b-bee5-dff22903f732} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
nnmjigf (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{04578d8d-6130-411b-bee5-dff22903f732} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{860a4043-9cb5-4105-99df-deb808ec1028} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{860a4043-9cb5-4105-99df-deb808ec1028} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{df5778b0-4bdd-4922-ab5e-f733267245dd} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{df5778b0-4bdd-4922-ab5e-f733267245dd} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\oberontb.band (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{ad76633e-e50d-4844-9e7f-4dfbc7c18467} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{ec1a2105-5621-440f-987d-27ef428131d9} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\oberontb.band.1 (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{c89435b0-cdfe-11d3-976a-00e02913a9e0} (Adware.WebHancer) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{c8cb3870-cdfe-11d3-976a-00e02913a9e0} (Adware.WebHancer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c900b400-cdfe-11d3-976a-00e02913a9e0} (Adware.WebHancer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{1a93c934-025b-4c3a-b38e-9654a7003239} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{a394e835-c8d6-4b4b-884b-d2709059f3be} (Trojan.Network.Monitor) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0705a77a-c085-4bf2-bab2-a8551324a024} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b523c5e1-7df6-408f-ae8c-e530a6ed92cc} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winwea32 (Dialer) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\WR (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoftdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IProxyProvider (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\whiehelperobj.whiehelperobj (Adware.WebHancer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\webHancer (Adware.WebHancer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSMGR (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE (Trojan.Downloader) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bm8389b7de (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{04578d8d-6130-411b-bee5-dff22903f732} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\80ba8442 (Trojan.Vundo) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\gebsrsji -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\gebsrsji  -> Delete on reboot.

Dossier(s) infecté(s):
C:\Program Files\Network Monitor (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\Documents and Settings\LocalService\Application Data\NetMon (Trojan.NetMon) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\WINDOWS\system32
nnmjigf.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32
bbzti.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\geBsrSjI.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\IjSrsBeg.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\IjSrsBeg.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\imcwqvfc.dll (Trojan.Vundo) -> Delete on reboot.
C:\Program Files\GamesBar\oberontb.dll (Adware.Gamesbar) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mowiwmyw.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vlyhgk.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32
nnmNFwT.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ssqQhIYo.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	lkqfsrw.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	qbddavc.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\uqawof.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hvbsvjuj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\geBssQjj.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\yjveggav.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\zfujro.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Program Files\Uninstall Ask Toolbar.dll (Adware.AskSBAR) -> Quarantined and deleted successfully.
C:\Documents and Settings\LocalService\Application Data\NetMon\domains.txt (Trojan.NetMon) -> Quarantined and deleted successfully.
C:\Documents and Settings\LocalService\Application Data\NetMon\log.txt (Trojan.NetMon) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winwea32.dll (Dialer) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pac.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\pskt.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BM8389b7de.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BM8389b7de.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\uninstall_nmon.vbs (Malware.Trace) -> Quarantined and deleted successfully.

guigui281268 · Answer

ok je redemare et je reviens

Destrio5 · Answer

Ok.

guigui281268 · Answer

ok je suis revenu et spybot m'a redemandé et j'ai accepté, par contre j'ai eu deux messages d'erreur windows dll ?

Destrio5 · Answer

On va passer à ComboFix.

Important : Désactive TeaTimer, le résident de Spybot, il va gêner la désinfection en empêchant la modification des BHO.

--->  Démarre Spybot, clique sur Mode, coche Mode avancé
---> A gauche, clique sur Outils, puis sur Résident
--->  Décoche la case devant Résident "TeaTimer" :
http://apu.mabul.org/up/5/apu-5-gpdx9e06cwz2dypom2q7n6nc.jpg
--->  Quitte Spybot

Note : Je te conseille de ne pas le réactiver, il a été incapable d'empêcher l'infection de ton PC.

---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"

---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix.txt

guigui281268 · Answer

ok je fais tout ça et je reviens, en tout cas merci pour ta gentillesse

guigui281268 · Answer

ce fut long mais voila le rapport de combofix ComboFix 08-09-15.02 - GUILLAUME 2008-09-16 8:28:49.1 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.665 [GMT 2:00] Lancé depuis: C:\Documents and Settings\GUILLAUME\Bureau\ComboFix.exe * Un nouveau point de restauration a été créé [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\ELODIE\Cookies\elodie@bluestreak[2].txt C:\Documents and Settings\ELODIE\Cookies\elodie@edt02[2].txt C:\Documents and Settings\ELODIE\Cookies\elodie@ehg-citenumerique.hitbox[1].txt C:\Documents and Settings\MAXIME\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML C:\Documents and Settings\QUENTIN\Cookies\quentin@bluestreak[1].txt C:\Documents and Settings\QUENTIN\Cookies\quentin@edt02[1].txt C:\Documents and Settings\QUENTIN\Cookies\quentin@serving-sys[1].txt C:\Temp\1cb C:\Temp\1cb\syscheck.log C:\WINDOWS\Fonts\a.zip C:\WINDOWS\system32\components C:\WINDOWS\system32\i4 C:\WINDOWS\system32\i4 cX12i49.exe C:\WINDOWS\system32\lbjlyehn.ini C:\WINDOWS\system32\MSINET.oca C:\WINDOWS\system32 kjvwhdf.ini C:\WINDOWS\system32 tl60.bpl C:\WINDOWS\system32 uxnmnyi.ini . ((((((((((((((((((((((((((((( Fichiers créés du 2008-08-16 au 2008-09-16 )))))))))))))))))))))))))))))))))))) . 2008-09-16 08:14 . 2008-09-16 08:14 244 --ah----- C:\sqmnoopt05.sqm 2008-09-16 08:14 . 2008-09-16 08:14 232 --ah----- C:\sqmdata05.sqm 2008-09-16 07:50 . 2008-09-16 07:50 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-09-16 07:50 . 2008-09-16 07:50 d-------- C:\Documents and Settings\GUILLAUME\Application Data\Malwarebytes 2008-09-16 07:50 . 2008-09-16 07:50 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-09-16 07:50 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-09-16 07:50 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-09-16 06:05 . 2008-09-16 06:05 244 --ah----- C:\sqmnoopt04.sqm 2008-09-16 06:05 . 2008-09-16 06:05 232 --ah----- C:\sqmdata04.sqm 2008-09-15 19:20 . 2008-09-15 19:20 244 --ah----- C:\sqmnoopt03.sqm 2008-09-15 19:20 . 2008-09-15 19:20 232 --ah----- C:\sqmdata03.sqm 2008-09-15 18:42 . 2008-09-15 18:42 244 --ah----- C:\sqmnoopt02.sqm 2008-09-15 18:42 . 2008-09-15 18:42 232 --ah----- C:\sqmdata02.sqm 2008-09-15 18:37 . 2008-09-16 04:43 d-------- C:\Program Files\Antipub 2008-09-15 16:43 . 2008-09-15 16:47 d-------- C:\Program Files\Spybot - Search & Destroy 2008-09-15 16:43 . 2008-09-16 08:24 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-09-15 16:29 . 2008-09-15 16:29 244 --ah----- C:\sqmnoopt01.sqm 2008-09-15 16:29 . 2008-09-15 16:29 232 --ah----- C:\sqmdata01.sqm 2008-09-15 08:36 . 2008-09-15 08:36 d-------- C:\Program Files\Alwil Software 2008-09-14 18:34 . 2008-09-14 18:34 4,096 --a------ C:\WINDOWS\d3dx.dat 2008-09-14 18:33 . 2008-09-14 18:33 d-------- C:\WINDOWS\Westward II Heroes of the Frontier [h33t] [oi812heet] 2008-09-14 18:33 . 2008-09-16 06:03 d-------- C:\Program Files\Westward II Heroes of the Frontier [h33t] [oi812heet] 2008-09-14 17:48 . 2008-09-14 17:48 d-------- C:\Westward II Heroes of the Frontier [h33t] [oi812heet] 2008-09-14 17:34 . 2008-09-15 15:29 d--hs---- C:\WINDOWS\R1VJTExBVU1F 2008-09-14 17:34 . 2008-09-14 17:34 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll 2008-09-14 17:32 . 2008-09-14 17:32 d-------- C:\WINDOWS\system32\esx 2008-09-14 17:32 . 2008-09-15 15:33 d-------- C:\WINDOWS\system32\101 2008-09-14 17:31 . 2008-09-14 17:31 d-------- C:\WINDOWS\system32\mC02 2008-09-14 17:31 . 2008-09-14 17:32 d-------- C: emp\mtc2 2008-09-14 12:48 . 2008-09-15 08:28 d-------- C:\Program Files\FrostWire 2008-09-14 12:48 . 2008-09-16 06:07 d-a------ C:\Program Files\AskSBar 2008-09-14 12:48 . 2008-09-15 08:27 d-------- C:\Documents and Settings\GUILLAUME\Application Data\FrostWire 2008-09-13 16:47 . 2008-09-13 16:48 d-------- C:\Documents and Settings\QUENTIN\.gimp-2.2 2008-09-06 10:24 . 2008-09-06 10:24 d-------- C:\Program Files\Beach Soccer 2008-08-27 17:54 . 2008-08-27 17:54 d-------- C:\Program Files\ViaMichelin 2008-08-26 10:43 . 2008-08-26 11:37 d-------- C:\WINDOWS\system32\CatRoot_bak 2008-08-25 12:33 . 2008-08-25 12:33 d-------- C:\Program Files\scrabbleproB1.0.8 2008-08-25 12:33 . 2004-03-08 23:00 124,688 --a------ C:\WINDOWS\system32\MSWINSCK.OCX 2008-08-22 19:02 . 2008-08-22 19:02 d-------- C:\Program Files\bfgclient 2008-08-22 19:01 . 2008-08-22 19:11 d-------- C:\Documents and Settings\All Users\Application Data\BigFishGamesCache 2008-08-17 10:03 . 2008-08-17 10:03 d-------- C:\Documents and Settings\All Users\Application Data\SSScanAppDataDir . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-16 06:08 --------- d-----w C:\Program Files\GamesBar 2008-09-16 04:03 --------- d-----w C:\Program Files\Gamenext 2008-09-16 03:59 --------- d-----w C:\Program Files\Azureus 2008-09-15 13:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\GamesBar 2008-09-15 06:11 --------- d-----w C:\Program Files\LimeWire 2008-09-14 16:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sandlot Games 2008-09-14 09:29 --------- d-----w C:\Program Files\Google 2008-09-14 09:16 --------- d-----w C:\Program Files\Java 2008-09-13 15:57 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll 2008-09-13 15:57 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll 2008-09-13 15:57 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll 2008-09-13 13:35 --------- d-----w C:\Documents and Settings\QUENTIN\Application Data\OpenOffice.org2 2008-09-12 18:58 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-09-12 09:02 --------- d-----w C:\Program Files\InstantTouch 2008-09-10 06:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-09-10 06:26 --------- d-----w C:\Program Files\Microsoft Works 2008-09-07 11:03 --------- d-----w C:\Documents and Settings\ELODIE\Application Data\OpenOffice.org2 2008-08-27 16:04 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-26 07:29 --------- d-----w C:\Documents and Settings\GUILLAUME\Application Data\OpenOffice.org2 2008-08-24 11:30 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-08-22 17:02 0 ----a-w C:\Program Files emp01 2008-08-22 15:31 --------- d-----w C:\Program Files\Buka 2008-08-21 07:25 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-08-04 10:33 --------- d-----w C:\Program Files\Objectif Tarot 2008-08-04 10:32 131,584 ----a-w C:\WINDOWS\system32\SpoonUninstall.exe 2008-07-31 13:39 --------- d-----w C:\Program Files\Fichiers communs\Oberon Media 2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-18 20:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll 2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll 2008-07-18 18:39 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR 2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 16:28 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-20 17:37 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-02-09 20:25 38,416 ----a-w C:\Documents and Settings\GUILLAUME\Application Data\GDIPFONTCACHEV1.DAT 2007-10-17 18:34 146 ----a-w C:\Documents and Settings\QUENTIN\Application Data\wklnhst.dat 2007-09-29 07:18 224 ----a-w C:\Documents and Settings\GUILLAUME\Application Data\wklnhst.dat 2007-02-14 11:09 0 ----a-w C:\Documents and Settings\MAXIME\Application Data\wklnhst.dat 2006-08-12 13:29 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 15360] "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-09-14 171448] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "EPSON Stylus CX3200"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE" [2002-07-01 74752] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-13 98304] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 15360] "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 443968] C:\Documents and Settings\QUENTIN\Menu D‚marrer\Programmes\D‚marrage\ OpenOffice.org 2.0.lnk - C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe [2006-07-14 393216] C:\Documents and Settings\VALERIE\Menu D‚marrer\Programmes\D‚marrage\ OpenOffice.org 2.0.lnk - C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe [2006-07-14 393216] C:\Documents and Settings\ELODIE\Menu D‚marrer\Programmes\D‚marrage\ OpenOffice.org 2.0.lnk - C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe [2006-07-14 393216] C:\Documents and Settings\GUILLAUME\Menu D‚marrer\Programmes\D‚marrage\ Anti-Pub.lnk - C:\Program Files\Antipub\antipub.exe [2003-03-23 674304] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMBalloonTip"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=nbbzti.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3acm"= l3codecp.acm [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Gamma Loader.exe.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Gamma Loader.exe.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.exe.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk backup=C:\WINDOWS\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^GUILLAUME^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.0.lnk] path=C:\Documents and Settings\GUILLAUME\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.0.lnk backup=C:\WINDOWS\pss\OpenOffice.org 2.0.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC] --a------ 2005-08-12 15:43 45056 C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fsc-reminder.exe] --------- 2005-01-19 17:10 28672 C:\WINDOWS eminder\fsc-reminder.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCameraAssistant] --a------ 2005-12-07 11:26 489472 C:\Program Files\Logitech\Video\CameraAssistant.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideo[inspector]] --a------ 2005-12-07 11:33 73728 C:\Program Files\Logitech\Video\InstallHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector] --a------ 2007-10-23 23:18 443968 C:\Program Files\Picasa2\PicasaMediaDetector.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2007-02-13 19:02 98304 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-03-14 03:43 83608 C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2006-06-21 19:14 35328 C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] --a------ 2004-08-06 16:33 2502656 C:\Program Files\Yahoo!\Messenger\YPager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] --a------ 2005-12-14 19:06 577536 C:\WINDOWS\SOUNDMAN.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion un-] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un-] "LogitechCameraService(E)"=C:\WINDOWS\system32\ElkCtrl.exe /automation "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" -lang 1033 "NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe "LVCOMSX"=C:\WINDOWS\system32\LVCOMSX.EXE "NsUpdate"=C:\WINDOWS\NsUpdate.exe UPDATE "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "C:\Program Files\Yahoo!\Messenger\YPager.exe"= "C:\Program Files\Yahoo!\Messenger\YServer.exe"= "C:\Program Files\EA GAMES\Battlefield 2\BF2.exe"= "C:\Program Files\Firefly Studios\Stronghold Legends\StrongholdLegends.exe"= "C:\Program Files\Messenger\Msmsgs.exe"= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "C:\Program Files\Windows Live\Messenger\livecall.exe"= "C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"= "C:\Program Files\Microsoft ActiveSync apimgr.exe"= C:\Program Files\Microsoft ActiveSync apimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "C:\Program Files\Valve\Steam\SteamApps\guigui281268\day of defeat\hl.exe"= "C:\Program Files\Valve\Steam\SteamApps\guigui281268\condition zero deleted scenes\hl.exe"= "C:\Sierra\Empire Earth\Empire Earth.exe"= "C:\Program Files\EA GAMES\Battlefield Vietnam\bfvietnam.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "C:\Program Files\EA GAMES\MOHAA\Mohaa.exe"= "C:\Program Files\InstantTouch\bin\CmCenterV2.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] \Shell\AutoRun\command - D:\AUTORUN.EXE *Newly Created Service* - CATCHME *Newly Created Service* - PROCEXP90 [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E4066320-E4AE-11CF-B1B0-00AA00BBAD66}] rundll32.exe advpack.dll,LaunchINFSection %SystemRoot%\INF\fpxpress.inf,PerUserstub . Contenu du dossier 'Tâches planifiées' . - - - - ORPHELINS SUPPRIMES - - - - BHO-{04578D8D-6130-411B-BEE5-DFF22903F732} - (no file) BHO-{04a12f05-b47b-41cc-a3ac-77043900a361} - (no file) BHO-{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - (no file) BHO-{21526C73-065C-4DC1-A409-07C6DD87BC2F} - (no file) BHO-{45BD6287-51B5-495C-9856-9F2CA3976F6D} - (no file) BHO-{DF5778B0-4BDD-4922-AB5E-F733267245DD} - (no file) HKLM-Run-{2edf7f6e-828a-e517-385a-b25ca7d71a25} - C:\WINDOWS\system32\prjvrmtoojhurpsz.dll Notify-nnnmjigf - (no file) MSConfigStartUp-msnmsgr - C:\Program Files\MSN Messenger\msnmsgr.exe MSConfigStartUp-VVSN - C:\Program Files\VVSN\VVSN.exe . ------- Examen supplémentaire ------- . R0 -: HKCU-Main,Start Page = about:blank R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 R1 -: HKCU-Internet Connection Wizard,ShellNext = iexplore R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s O8 -: &Windows Live Search - C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O16 -: {084DAC27-6FA3-4F55-9005-033F2F102F5C} - hxxp://data.jeuxclassiques.com/npwwg.cab C:\WINDOWS\Downloaded Program Files pwwg.inf O16 -: {88764F69-3831-4EC1-B40B-FF21D8381345} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.0.cab C:\WINDOWS\Downloaded Program Files\AdSignerADP.inf C:\WINDOWS\system32\msvcp60.dll C:\WINDOWS\system32\atl.dll C:\WINDOWS\Downloaded Program Files\AdVerifierADP.dll C:\WINDOWS\Downloaded Program Files\AdSignerADP.dll O16 -: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} - hxxp://gamenextfr.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab C:\WINDOWS\Downloaded Program Files\OberonGameHost_dbg.inf C:\WINDOWS\Downloaded Program Files\OberonGameHost.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-16 09:26:44 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . Heure de fin: 2008-09-16 9:53:49 ComboFix-quarantined-files.txt 2008-09-16 07:52:53 Avant-CF: 98,554,834,944 octets libres AprŠs-CF: 99,202,543,616 octets libres 277 --- E O F --- 2008-09-10 06:29:14

Destrio5 · Answer

---> Télécharge clean.zip de Malekal :
http://www.malekal.com/download/clean.zip

---> Dézippe-le sur ton bureau (clic droit / extraire tout), tu dois obtenir un dossier clean.

---> Ouvre le dossier clean qui se trouve sur ton bureau, et double-clique sur clean.cmd

Une fenêtre noire va apparaître pendant un instant, laisse-la ouverte.

---> Choisis l'option 1 puis patiente

---> Poste le rapport obtenu (situé dans C:\rapport_clean.txt)

Ne passe pas à l'option 2 sans notre avis !

guigui281268 · Answer

ok j'y vais

guigui281268 · Answer

voici le rapport

 16/09/2008 a 10:14:23,35 
 
*** Recherche des fichiers dans C: 
C:\StubInstaller.exe FOUND 
 
*** Recherche des fichiers dans C:\WINDOWS\ 
 
*** Recherche des fichiers dans C:\WINDOWS\system32 
C:\WINDOWS\system32\SpoonUninstall.exe FOUND 
C:\WINDOWS\SYSTEM\URL.DLL FOUND 
 
*** Recherche des fichiers dans C:\Program Files 
"C:\Program Files\GamesBar\" FOUND

Destrio5 · Answer

Fais l'option 2 en mode sans échec.

guigui281268 · Answer

ok j'ai fait l'option 2 en mode sans echec

Destrio5 · Answer

Pas de rapport ?

guigui281268 · Answer

excuse moi je n'avais pas tilter sur le fait qu'il ecrasait l'ancien

Script execute en mode sans echec 
Rapport clean par Malekal_morte - http://www.malekal.com 
Script execute en mode sans echec 16/09/2008 a 10:28:50,06 

Microsoft Windows XP [version 5.1.2600]
 
*** Suppression des fichiers dans C: 
tentative de suppression de C:\StubInstaller.exe 
 
*** Suppression des fichiers dans C:\WINDOWS\ 
 
*** Suppression des fichiers dans C:\WINDOWS\system32 
tentative de suppression de C:\WINDOWS\system32\SpoonUninstall.exe 
tentative de suppression de C:\WINDOWS\SYSTEM\URL.DLL 
 
*** Suppression des fichiers dans C:\Program Files 
tentative de suppression de "C:\Program Files\GamesBar\" 
 
*** Suppression des clefs du registre effectuee..

Destrio5 · Answer

/!\ Seul guigui281268 peut suivre cette procédure /!\


1/

---> Clique sur Démarrer, Exécuter, tape notepad clique sur OK.

---> Copie le texte ci-dessous par sélection puis Ctrl+C :





KillAll::

File::
C:\WINDOWS\system32
bbzti.dll 
C:\sqmnoopt07.sqm 
C:\sqmdata07.sqm 
C:\sqmnoopt06.sqm 
C:\sqmdata06.sqm 
C:\sqmnoopt05.sqm 
C:\sqmdata05.sqm 
C:\sqmdata04.sqm
C:\sqmdata03.sqm
C:\sqmdata02.sqm
C:\sqmdata01.sqm
C:\sqmdata00.sqm
C:\sqmnoopt04.sqm 
C:\sqmnoopt03.sqm 
C:\sqmnoopt02.sqm 
C:\sqmnoopt01.sqm 
C:\sqmnoopt00.sqm 
C:\WINDOWS\NsUpdate.exe 

Folder::
C:\Program Files\GamesBar
C:\Documents and Settings\All Users\Application Data\GamesBar 
C:\Program Files\VVSN

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
"swg"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
"QuickTime Task"=-
"SunJavaUpdateSched"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] 
"AppInit_DLLs"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun-] 
"QuickTime Task"=-
"NsUpdate"=-
"LVCOMSX"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] 





---> Colle la sélection dans le bloc-notes

---> Enregistre ce fichier sur le bureau (Impératif)

---> Nom du fichier : CFScript
---> Type du fichier : tous les fichiers
---> Clique sur Enregistrer
---> Quitte le bloc-notes


2/

---> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif

[*] Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.

[*] Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.

[*] Une fois le scan achevé, un rapport va s'afficher : poste-le

[*] Si le fichier ne s'ouvre pas, il se trouve ici C:\ComboFix.txt

guigui281268 · Answer

merci j'essaye de faire tout ça et je reviens

guigui281268 · Answer

voici le gros rapport ComboFix 08-09-15.02 - GUILLAUME 2008-09-16 11:06:25.2 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.672 [GMT 2:00] Lancé depuis: C:\Documents and Settings\GUILLAUME\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\GUILLAUME\Bureau\CFScript.txt * Un nouveau point de restauration a été créé [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\GamesBar C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-06-18-15-28.xm_ C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-06-18-15-28\about.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-06-18-15-28\feedback.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-06-18-15-28\help.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-06-18-15-28\highlight.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-06-18-15-28\partner.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-06-18-15-28\popup_off.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-06-18-15-28\popup_on.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-06-18-15-28\search.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-06-18-15-28\search_goog.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-06-18-15-28\sendafriend.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-06-18-15-28\uninstall.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-06-18-15-28\update.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06.xm_ C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06\about.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06\AliceGreenfingers16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06\Azada16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06\Cake_mania_216x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06\download.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06\dream_day_first_home16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06\eye_for_design16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06\family_restaurant16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06\feedback.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06\heart_of_egypt16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06\hells_kitchen16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06\help.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06\highlight.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06\newGames.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06\partner.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06\penguins_journey16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06\peril_at_end_house16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06\pet_shop_hop16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06\popup_off.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06\popup_on.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06\ranch_rush16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06\search.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06\search_goog.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06\sendafriend.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06\uninstall.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06\update.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06\virtualvillagers16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06\vogue_tales16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-06\west16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-26.xm_ C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-26\about.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-26\feedback.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-26\heart_of_egypt16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-26\hells_kitchen16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-26\help.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-26\highlight.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-26\newGames.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-26\partner.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-26\penguins_journey16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-26\popup_off.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-26\popup_on.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-26\ranch_rush16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-26\search.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-26\search_goog.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-26\sendafriend.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-26\uninstall.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-26\update.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35.xm_ C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\about.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\action.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\AliceGreenfingers16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\arcade.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\Azada16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\Cake_mania_216x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\cards.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\download.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\dream_day_first_home16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\eye_for_design16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\family_restaurant16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\feedback.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\heart_of_egypt16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\hells_kitchen16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\help.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\highlight.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\jigsaw.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\mahjong.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\multiplayer.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\newGames.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\partner.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\penguins_journey16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\peril_at_end_house16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\pet_shop_hop16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\popup_off.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\popup_on.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\puzzle.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\ranch_rush16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\search.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\search_goog.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\sendafriend.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\sports.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\uninstall.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\update.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\virtualvillagers16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\vogue_tales16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\webgame.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-18-16-58-35\west16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-19-16-21-09.xm_ C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-19-16-21-09\about.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-19-16-21-09\feedback.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-19-16-21-09\help.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-19-16-21-09\partner.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-19-16-21-09\sendafriend.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-19-16-21-09\uninstall.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-19-16-21-09\update.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11.xm_ C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\about.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\action.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\AliceGreenfingers16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\arcade.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\Azada16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\Cake_mania_216x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\cards.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\download.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\dream_day_first_home16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\eye_for_design16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\family_restaurant16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\feedback.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\heart_of_egypt16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\hells_kitchen16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\help.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\highlight.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\newGames.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\partner.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\penguins_journey16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\peril_at_end_house16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\pet_shop_hop16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\popup_off.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\popup_on.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\puzzle.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\ranch_rush16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\search.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\search_goog.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\sendafriend.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\uninstall.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\update.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\virtualvillagers16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\vogue_tales16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-26-12-12-11\west16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13.xm_ C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\about.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\action.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\AliceGreenfingers16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\arcade.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\Azada16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\buy.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\Cake_mania_216x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\cards.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\deals.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\download.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\dream_day_first_home16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\eye_for_design16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\family_restaurant16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\feedback.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\heart_of_egypt16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\hells_kitchen16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\help.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\highlight.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\jigsaw.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\mahjong.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\multiplayer.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\mygames.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\newGames.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\partner.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\penguins_journey16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\peril_at_end_house16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\pet_shop_hop16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\popup_off.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\popup_on.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\puzzle.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\ranch_rush16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\search.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\search_goog.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\sendafriend.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\sports.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\trial.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\uninstall.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\update.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\virtualvillagers16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\vogue_tales16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\webgame.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-08-31-18-43-13\west16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45.xm_ C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\about.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\action.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\AliceGreenfingers16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\arcade.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\Azada16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\buy.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\Cake_mania_216x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\cards.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\deals.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\download.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\dream_day_first_home16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\eye_for_design16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\family_restaurant16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\feedback.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\heart_of_egypt16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\hells_kitchen16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\help.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\highlight.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\jigsaw.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\mahjong.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\multiplayer.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\mygames.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\newGames.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\partner.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\penguins_journey16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\peril_at_end_house16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\pet_shop_hop16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\popup_off.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\popup_on.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\puzzle.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\ranch_rush16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\search.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\search_goog.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\sendafriend.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\sports.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\trial.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\uninstall.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\update.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\virtualvillagers16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\vogue_tales16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\webgame.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-01-15-51-45\west16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08.xm_ C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\about.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\action.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\AliceGreenfingers16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\arcade.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\Azada16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\buy.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\Cake_mania_216x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\cards.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\deals.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\download.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\dream_day_first_home16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\eye_for_design16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\family_restaurant16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\feedback.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\heart_of_egypt16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\hells_kitchen16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\help.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\highlight.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\jigsaw.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\mahjong.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\multiplayer.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\mygames.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\newGames.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\partner.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\penguins_journey16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\peril_at_end_house16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\pet_shop_hop16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\popup_off.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\popup_on.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\puzzle.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\ranch_rush16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\search.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\search_goog.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\sendafriend.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\sports.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\trial.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\uninstall.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\update.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\virtualvillagers16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\vogue_tales16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\webgame.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-07-13-14-08\west16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07.xm_ C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\about.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\action.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\AliceGreenfingers16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\arcade.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\Azada16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\buy.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\Cake_mania_216x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\cards.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\deals.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\download.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\dream_day_first_home16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\eye_for_design16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\family_restaurant16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\feedback.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\heart_of_egypt16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\hells_kitchen16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\help.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\highlight.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\jigsaw.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\mahjong.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\multiplayer.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\mygames.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\newGames.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\partner.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\penguins_journey16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\peril_at_end_house16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\pet_shop_hop16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\popup_off.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\popup_on.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\puzzle.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\ranch_rush16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\search.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\search_goog.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\sendafriend.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\sports.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\trial.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\uninstall.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\update.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\virtualvillagers16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\vogue_tales16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\webgame.gif C:\Documents and Settings\All Users\Application Data\GamesBar\[u]0[/u]8-09-15-15-42-07\west16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\about.gif C:\Documents and Settings\All Users\Application Data\GamesBar\action.gif C:\Documents and Settings\All Users\Application Data\GamesBar\AliceGreenfingers16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\arcade.gif C:\Documents and Settings\All Users\Application Data\GamesBar\Azada16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\buy.gif C:\Documents and Settings\All Users\Application Data\GamesBar\Cake_mania_216x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\cards.gif C:\Documents and Settings\All Users\Application Data\GamesBar\deals.gif C:\Documents and Settings\All Users\Application Data\GamesBar\download.gif C:\Documents and Settings\All Users\Application Data\GamesBar\dream_day_first_home16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\eye_for_design16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\family_restaurant16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\feedback.gif C:\Documents and Settings\All Users\Application Data\GamesBar\heart_of_egypt16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\hells_kitchen16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\help.gif C:\Documents and Settings\All Users\Application Data\GamesBar\highlight.gif C:\Documents and Settings\All Users\Application Data\GamesBar\jigsaw.gif C:\Documents and Settings\All Users\Application Data\GamesBar\mahjong.gif C:\Documents and Settings\All Users\Application Data\GamesBar\multiplayer.gif C:\Documents and Settings\All Users\Application Data\GamesBar\mygames.gif C:\Documents and Settings\All Users\Application Data\GamesBar\newGames.gif C:\Documents and Settings\All Users\Application Data\GamesBar\oberonconfig.xm_ C:\Documents and Settings\All Users\Application Data\GamesBar\obSearchHistory.dat C:\Documents and Settings\All Users\Application Data\GamesBar\partner.gif C:\Documents and Settings\All Users\Application Data\GamesBar\penguins_journey16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\peril_at_end_house16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\pet_shop_hop16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\popup_off.gif C:\Documents and Settings\All Users\Application Data\GamesBar\popup_on.gif C:\Documents and Settings\All Users\Application Data\GamesBar\puzzle.gif C:\Documents and Settings\All Users\Application Data\GamesBar\ranch_rush16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\search.gif C:\Documents and Settings\All Users\Application Data\GamesBar\search_goog.gif C:\Documents and Settings\All Users\Application Data\GamesBar\sendafriend.gif C:\Documents and Settings\All Users\Application Data\GamesBar\sports.gif C:\Documents and Settings\All Users\Application Data\GamesBar\trial.gif C:\Documents and Settings\All Users\Application Data\GamesBar\uninstall.gif C:\Documents and Settings\All Users\Application Data\GamesBar\update.gif C:\Documents and Settings\All Users\Application Data\GamesBar\virtualvillagers16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\vogue_tales16x16.gif C:\Documents and Settings\All Users\Application Data\GamesBar\webgame.gif C:\Documents and Settings\All Users\Application Data\GamesBar\west16x16.gif C:\sqmdata00.sqm C:\sqmdata01.sqm C:\sqmdata02.sqm C:\sqmdata03.sqm C:\sqmdata04.sqm C:\sqmdata05.sqm C:\sqmdata06.sqm C:\sqmnoopt00.sqm C:\sqmnoopt01.sqm C:\sqmnoopt02.sqm C:\sqmnoopt03.sqm C:\sqmnoopt04.sqm C:\sqmnoopt05.sqm C:\sqmnoopt06.sqm . ((((((((((((((((((((((((((((( Fichiers cr‚‚s du 2008-08-16 au 2008-09-16 )))))))))))))))))))))))))))))))))))) . 2008-09-16 10:14 . 2008-09-16 10:14 10,921,610 --a------ C:\upload_moi_CRESSAC.tar.gz 2008-09-16 10:07 . 2008-09-16 10:07 1,374 --a------ C:\WINDOWS\imsins.BAK 2008-09-16 07:50 . 2008-09-16 07:50 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-09-16 07:50 . 2008-09-16 07:50 d-------- C:\Documents and Settings\GUILLAUME\Application Data\Malwarebytes 2008-09-16 07:50 . 2008-09-16 07:50 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-09-16 07:50 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-09-16 07:50 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-09-15 18:37 . 2008-09-16 04:43 d-------- C:\Program Files\Antipub 2008-09-15 16:43 . 2008-09-15 16:47 d-------- C:\Program Files\Spybot - Search & Destroy 2008-09-15 16:43 . 2008-09-16 08:24 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-09-15 08:36 . 2008-09-15 08:36 d-------- C:\Program Files\Alwil Software 2008-09-14 18:34 . 2008-09-14 18:34 4,096 --a------ C:\WINDOWS\d3dx.dat 2008-09-14 18:33 . 2008-09-14 18:33 d-------- C:\WINDOWS\Westward II Heroes of the Frontier [h33t] [oi812heet] 2008-09-14 18:33 . 2008-09-16 06:03 d-------- C:\Program Files\Westward II Heroes of the Frontier [h33t] [oi812heet] 2008-09-14 17:48 . 2008-09-14 17:48 d-------- C:\Westward II Heroes of the Frontier [h33t] [oi812heet] 2008-09-14 17:34 . 2008-09-15 15:29 d--hs---- C:\WINDOWS\R1VJTExBVU1F 2008-09-14 17:34 . 2008-09-14 17:34 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll 2008-09-14 17:32 . 2008-09-14 17:32 d-------- C:\WINDOWS\system32\esx 2008-09-14 17:32 . 2008-09-15 15:33 d-------- C:\WINDOWS\system32\101 2008-09-14 17:31 . 2008-09-14 17:31 d-------- C:\WINDOWS\system32\mC02 2008-09-14 17:31 . 2008-09-14 17:32 d-------- C:\temp\mtc2 2008-09-14 12:48 . 2008-09-15 08:28 d-------- C:\Program Files\FrostWire 2008-09-14 12:48 . 2008-09-16 06:07 d-a------ C:\Program Files\AskSBar 2008-09-14 12:48 . 2008-09-15 08:27 d-------- C:\Documents and Settings\GUILLAUME\Application Data\FrostWire 2008-09-13 16:47 . 2008-09-13 16:48 d-------- C:\Documents and Settings\QUENTIN\.gimp-2.2 2008-09-06 10:24 . 2008-09-06 10:24 d-------- C:\Program Files\Beach Soccer 2008-08-27 17:54 . 2008-08-27 17:54 d-------- C:\Program Files\ViaMichelin 2008-08-26 10:43 . 2008-08-26 11:37 d-------- C:\WINDOWS\system32\CatRoot_bak 2008-08-25 12:33 . 2008-08-25 12:33 d-------- C:\Program Files\scrabbleproB1.0.8 2008-08-25 12:33 . 2004-03-08 23:00 124,688 --a------ C:\WINDOWS\system32\MSWINSCK.OCX 2008-08-22 19:02 . 2008-08-22 19:02 d-------- C:\Program Files\bfgclient 2008-08-22 19:01 . 2008-08-22 19:11 d-------- C:\Documents and Settings\All Users\Application Data\BigFishGamesCache 2008-08-17 10:03 . 2008-08-17 10:03 d-------- C:\Documents and Settings\All Users\Application Data\SSScanAppDataDir . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-16 04:03 --------- d-----w C:\Program Files\Gamenext 2008-09-16 03:59 --------- d-----w C:\Program Files\Azureus 2008-09-15 06:11 --------- d-----w C:\Program Files\LimeWire 2008-09-14 16:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sandlot Games 2008-09-14 09:29 --------- d-----w C:\Program Files\Google 2008-09-14 09:16 --------- d-----w C:\Program Files\Java 2008-09-13 13:35 --------- d-----w C:\Documents and Settings\QUENTIN\Application Data\OpenOffice.org2 2008-09-12 18:58 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-09-12 09:02 --------- d-----w C:\Program Files\InstantTouch 2008-09-10 06:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-09-10 06:26 --------- d-----w C:\Program Files\Microsoft Works 2008-09-07 11:03 --------- d-----w C:\Documents and Settings\ELODIE\Application Data\OpenOffice.org2 2008-08-27 16:04 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-26 07:29 --------- d-----w C:\Documents and Settings\GUILLAUME\Application Data\OpenOffice.org2 2008-08-22 17:02 0 ----a-w C:\Program Files\temp01 2008-08-22 15:31 --------- d-----w C:\Program Files\Buka 2008-08-21 07:25 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-08-04 10:33 --------- d-----w C:\Program Files\Objectif Tarot 2008-07-31 13:39 --------- d-----w C:\Program Files\Fichiers communs\Oberon Media 2008-07-18 18:39 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR 2008-02-09 20:25 38,416 ----a-w C:\Documents and Settings\GUILLAUME\Application Data\GDIPFONTCACHEV1.DAT 2007-10-17 18:34 146 ----a-w C:\Documents and Settings\QUENTIN\Application Data\wklnhst.dat 2007-09-29 07:18 224 ----a-w C:\Documents and Settings\GUILLAUME\Application Data\wklnhst.dat 2007-02-14 11:09 0 ----a-w C:\Documents and Settings\MAXIME\Application Data\wklnhst.dat 2006-08-12 13:29 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe . ((((((((((((((((((((((((((((( snapshot@2008-09-16_ 9.41.26.25 ))))))))))))))))))))))))))))))))))))))))) . + 2008-09-16 09:11:21 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_69c.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 15360] "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "EPSON Stylus CX3200"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE" [2002-07-01 74752] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 15360] "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 443968] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMBalloonTip"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3acm"= l3codecp.acm [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Gamma Loader.exe.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Gamma Loader.exe.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.exe.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk] path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk backup=C:\WINDOWS\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^GUILLAUME^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.0.lnk] path=C:\Documents and Settings\GUILLAUME\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.0.lnk backup=C:\WINDOWS\pss\OpenOffice.org 2.0.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC] --a------ 2005-08-12 15:43 45056 C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fsc-reminder.exe] --------- 2005-01-19 17:10 28672 C:\WINDOWS\reminder\fsc-reminder.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCameraAssistant] --a------ 2005-12-07 11:26 489472 C:\Program Files\Logitech\Video\CameraAssistant.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideo[inspector]] --a------ 2005-12-07 11:33 73728 C:\Program Files\Logitech\Video\InstallHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector] --a------ 2007-10-23 23:18 443968 C:\Program Files\Picasa2\PicasaMediaDetector.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2007-02-13 19:02 98304 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-03-14 03:43 83608 C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2006-06-21 19:14 35328 C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] --a------ 2004-08-06 16:33 2502656 C:\Program Files\Yahoo!\Messenger\YPager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] --a------ 2005-12-14 19:06 577536 C:\WINDOWS\SOUNDMAN.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "LogitechCameraService(E)"=C:\WINDOWS\system32\ElkCtrl.exe /automation "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" -lang 1033 "NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "C:\Program Files\Yahoo!\Messenger\YPager.exe"= "C:\Program Files\Yahoo!\Messenger\YServer.exe"= "C:\Program Files\EA GAMES\Battlefield 2\BF2.exe"= "C:\Program Files\Firefly Studios\Stronghold Legends\StrongholdLegends.exe"= "C:\Program Files\Messenger\Msmsgs.exe"= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "C:\Program Files\Windows Live\Messenger\livecall.exe"= "C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"= "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "C:\Program Files\Valve\Steam\SteamApps\guigui281268\day of defeat\hl.exe"= "C:\Program Files\Valve\Steam\SteamApps\guigui281268\condition zero deleted scenes\hl.exe"= "C:\Sierra\Empire Earth\Empire Earth.exe"= "C:\Program Files\EA GAMES\Battlefield Vietnam\bfvietnam.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "C:\Program Files\EA GAMES\MOHAA\Mohaa.exe"= "C:\Program Files\InstantTouch\bin\CmCenterV2.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560] R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-05 14336] R3 LVPrcMon;Logitech LVPrcMon Driver;C:\WINDOWS\system32\drivers\LVPrcMon.sys [2005-12-09 16768] R3 usbstor;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-05 26496] S0 stwlfbus;stwlfbus;C:\WINDOWS\system32\DRIVERS\stwlfbus.sys [2003-04-27 8704] S3 gUSBSTOi;gUSBSTOi;C:\DOCUME~1\GUILLA~1\LOCALS~1\Temp\gUSBSTOi.sys [ ] S3 SIS163u;SiS163 USB Wireless LAN Adapter Driver;C:\WINDOWS\system32\DRIVERS\sis163u.sys [2005-11-02 215552] S3 st3wolf;st3wolf;C:\WINDOWS\system32\DRIVERS\st3wolf.sys [2003-04-27 99360] S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-04-21 307968] S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E4066320-E4AE-11CF-B1B0-00AA00BBAD66}] rundll32.exe advpack.dll,LaunchINFSection %SystemRoot%\INF\fpxpress.inf,PerUserstub . Contenu du dossier 'Tƒches planifi‚es' . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-16 11:11:53 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cach‚s ... Recherche d'‚l‚ments en d‚marrage automatique cach‚s ... Recherche de fichiers cach‚s ... Scan termin‚ avec succŠs Fichiers cach‚s: 0 ************************************************************************** . ------------------------ Autres processus actifs ------------------------ . C:\WINDOWS\system32\ati2evxx.exe C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\ati2evxx.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Fichiers communs\Logitech\LVMVFM\LVPrcSrv.exe C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSvc.exe C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\UAService7.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\ComboFix\pv.cfexe . ************************************************************************** . Heure de fin: 2008-09-16 11:17:42 - La machine a red‚marr‚ ComboFix-quarantined-files.txt 2008-09-16 09:17:37 ComboFix2.txt 2008-09-16 07:54:10 Avant-CF: 99,629,658,112 octets libres AprŠs-CF: 99,618,873,344 octets libres 586 --- E O F --- 2008-09-16 08:07:28

Destrio5 · Answer

Très bien.

---> Supprime Clean

---> Relance MBAM, va dans Quarantaine et supprime tout

---> Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

* Lance l'installation du programme en exécutant le fichier téléchargé.
* Double-clique maintenant sur le raccourci de Toolbar-S&D.
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
* Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
* Poste le rapport généré. (C:\TB.txt)

guigui281268 · Answer

faut il que je relance une recherche mbam ou est ce que la quarantaine existante suffit

Destrio5 · Answer

Pas de nouveau scan avec MBAM.

guigui281268 · Answer

Voici le rapport
   -----------\  ToolBar S&D 1.2.0   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) 4 CPU 3.00GHz )
   BIOS : Award Modular BIOS v6.00PG
   USER : GUILLAUME ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1229 [VPS 080915-0] 4.8.1229 (Activated)
   C:\ (Local Disk) - NTFS - Total : 232 Go Free : 92 Go
   D:\ (CD or DVD) - CDFS - Total : 0 Go Free : 0 Go
   E:\ (USB)
   F:\ (USB)
   G:\ (USB)
   H:\ (USB)
   I:\ (USB)
   J:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 14-09-2008|23:30 )
   Option : [1] ( 16/09/2008|11:32 )

   -----------\  Recherche de Fichiers / Dossiers ...

   C:\Program Files\AskSBar
   C:\Program Files\AskSBar\SrchAstt
   C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\GamesBar
   C:\DOCUME~1\GUILLA~1\Favoris\Torrent Search.url

   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="about:blank"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "SearchMigratedDefaultURL"="https://www.google.com/webhp?gws_rd=ssl{searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"


   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\GUILLA~1\Application Data\FrostWire\.AppSpecialShare\Bigfish Games - Westward + Crack.torrent
   C:\DOCUME~1\GUILLA~1\Application Data\FrostWire\.AppSpecialShare\Bigfish Games - Westward + Crack.torrent.bak
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MEDAL.OF.HONOR.AA.10.11.SEKONER.MOREBLOOD.ZIP
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MEDAL.OF.HONOR.AA.10.ENG.FL.BACKUPCD.ZIP
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MEDAL.OF.HONOR.AA.111.NOCD.ZIP
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MedalOfHonorv1.0NoCDFixedexeUSEng.ace
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MedalOfHonorv1.11NoCDFixedexeUSEng.ace
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA.EXE
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA_BloodPatch
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\sm.001
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\sm.002
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\winace 211
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA_BloodPatch\Install Instructions.txt
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA_BloodPatch\models
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA_BloodPatch\scripts
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA_BloodPatch	extures
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA_BloodPatch\models\fx
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA_BloodPatch\models\fx\bh_human_uniform_hard.tik
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA_BloodPatch\models\fx\bh_human_uniform_lite.tik
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA_BloodPatch\models\fx\blood_long.tik
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA_BloodPatch\scripts\effects.shader
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA_BloodPatch	extures\effects
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA_BloodPatch	extures\effects\blood_long.tga
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA_BloodPatch	extures\effects\blood_splat.tga
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA_BloodPatch	extures\effects\bodyhitpuff.tga
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\winace 211\wace211.exe



   1 - "C:\ToolBar SD\TB_1.txt" - 16/09/2008|11:33 - Option : [1]

   -----------\  Fin du rapport a 11:33:04,81

Destrio5 · Answer

Ah ok les cracks...

Relance ToolBar S&D, fais l'option 2 et poste le rapport.

guigui281268 · Answer

voila le rapport : 

   -----------\  ToolBar S&D 1.2.0   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) 4 CPU 3.00GHz )
   BIOS : Award Modular BIOS v6.00PG
   USER : GUILLAUME ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1229 [VPS 080915-0] 4.8.1229 (Activated)
   C:\ (Local Disk) - NTFS - Total : 232 Go Free : 92 Go
   D:\ (CD or DVD) - CDFS - Total : 0 Go Free : 0 Go
   E:\ (USB)
   F:\ (USB)
   G:\ (USB)
   H:\ (USB)
   I:\ (USB)
   J:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 14-09-2008|23:30 )
   Option : [2] ( 16/09/2008|11:40 )

   -----------\ SUPPRESSION

   Supprime! - C:\Program Files\AskSBar\SrchAstt
   Supprime! - C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\GamesBar
   Supprime! - C:\DOCUME~1\GUILLA~1\Favoris\Torrent Search.url
   Supprime! - C:\Program Files\AskSBar

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="about:blank"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "SearchMigratedDefaultURL"="https://www.google.com/webhp?gws_rd=ssl{searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.msn.com/fr-fr/"


   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\GUILLA~1\Application Data\FrostWire\.AppSpecialShare\Bigfish Games - Westward + Crack.torrent
   C:\DOCUME~1\GUILLA~1\Application Data\FrostWire\.AppSpecialShare\Bigfish Games - Westward + Crack.torrent.bak
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MEDAL.OF.HONOR.AA.10.11.SEKONER.MOREBLOOD.ZIP
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MEDAL.OF.HONOR.AA.10.ENG.FL.BACKUPCD.ZIP
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MEDAL.OF.HONOR.AA.111.NOCD.ZIP
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MedalOfHonorv1.0NoCDFixedexeUSEng.ace
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MedalOfHonorv1.11NoCDFixedexeUSEng.ace
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA.EXE
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA_BloodPatch
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\sm.001
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\sm.002
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\winace 211
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA_BloodPatch\Install Instructions.txt
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA_BloodPatch\models
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA_BloodPatch\scripts
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA_BloodPatch	extures
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA_BloodPatch\models\fx
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA_BloodPatch\models\fx\bh_human_uniform_hard.tik
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA_BloodPatch\models\fx\bh_human_uniform_lite.tik
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA_BloodPatch\models\fx\blood_long.tik
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA_BloodPatch\scripts\effects.shader
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA_BloodPatch	extures\effects
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA_BloodPatch	extures\effects\blood_long.tga
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA_BloodPatch	extures\effects\blood_splat.tga
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\MOHAA_BloodPatch	extures\effects\bodyhitpuff.tga
   C:\DOCUME~1\GUILLA~1\Mes documents\jeux\medal of honnor\CRACKFILE\winace 211\wace211.exe



   1 - "C:\ToolBar SD\TB_1.txt" - 16/09/2008|11:33 - Option : [1]
   2 - "C:\ToolBar SD\TB_2.txt" - 16/09/2008|11:41 - Option : [2]

   -----------\  Fin du rapport a 11:41:33,23

Destrio5 · Answer

---> Désinstalle ToolBar S&D

---> Poste un nouveau rapport HijackThis

guigui281268 · Answer

j'ai désinstalé s&D mais il reste encore des fichiers dans le repertoire,

voici le rapport

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:53:31, on 16/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Documents and Settings\GUILLAUME\Mes documents\Mes fichiers reçus\marie.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [EPSON Stylus CX3200] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX3200" /O6 "USB001" /M "Stylus CX3200"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} (ITPPDiagIE Class) - http://data.jeuxclassiques.com/npwwg.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.0.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://gamenextfr.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

Destrio5 · Answer

---> Désinstalle Norton avec ceci :
ftp://ftp.symantec.com/public/francais/removal_tools/Norton_Removal_Tool.exe

---> Désinstalle Avast et installe Antivir (français et bien plus efficace) :
http://dl1.avgate.net/down/windows/antivir_workstation_winu_fr_h.exe

guigui281268 · Answer

ok avast desinstallé et antivir installé,

Destrio5 · Answer

---> Poste un nouveau rapport HijackThis

guigui281268 · Answer

voici le rapport 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:05:07, on 16/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Antipub\antipub.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Documents and Settings\GUILLAUME\Mes documents\Mes fichiers reçus\marie.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [EPSON Stylus CX3200] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX3200" /O6 "USB001" /M "Stylus CX3200"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} (ITPPDiagIE Class) - http://data.jeuxclassiques.com/npwwg.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.0.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://gamenextfr.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

Destrio5 · Answer

---> Relance HijackThis et choisis Do a system scan only

---> Coche les cases qui sont devant les lignes suivantes :

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll     

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe     

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')     

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')     

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')     

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')     

O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)     

---> Clique en bas sur Fix checked. Mets oui si HijackThis te demande quelque chose.

---> Redémarre ton PC et poste un dernier rapport HijackThis

guigui281268 · Answer

voici le rapport

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:20:52, on 16/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Antipub\antipub.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\Documents and Settings\GUILLAUME\Mes documents\Mes fichiers reçus\marie.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
O4 - HKLM\..\Run: [EPSON Stylus CX3200] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX3200" /O6 "USB001" /M "Stylus CX3200"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} (ITPPDiagIE Class) - http://data.jeuxclassiques.com/npwwg.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.0.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://gamenextfr.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

Destrio5 · Answer

As-tu encore des problèmes ou on peut passer à la dernière étape ?

guigui281268 · Answer

J'ai été un peu sur internet et apparement je n'ais plus de problèmes.

Par contre que puis-je faire pour éviter que cela recommence?

En tous cas merci beaucoup, ton aide est particulierement précieuse.

Destrio5 · Answer

Toujours là ?

guigui281268 · Answer

toujours la mais pas toujours devant le pc

Destrio5 · Answer

Il fonctionne bien le PC désinfecté ?

guigui281268 · Answer

ecoute pour le moment il fonctionne plutot bien et grace à toi ce que je ne comprends pas c'est comment j'ai fait pour attraper toutes ces ...

Destrio5 · Answer

Faudra juste faire deux-trois choses.

guigui281268 · Answer

ecoute j'ai laissé mon pc sur le site sans rien faire le temps de voir si tu étais là ou pas et je reviens une fenetre est apparus ???

Destrio5 · Answer

Quelle sorte de fenêtre ?

guigui281268 · Answer

petite fenetre pas aussi grande qu'avant

Destrio5 · Answer

Elle disait quoi la fenêtre ?

guigui281268 · Answer

pub comme d'hab mais excuse je n'ai pas fait atention j'ai cliqué sur fermetre par habitude, c'est juste après que je me suis traité d'imbecile idiot !!!

Destrio5 · Answer

Tu me le diras à la prochaine pub.

guigui281268 · Answer

ok, je tacherais d'être moins stupide la prochaine fois

Pb de fenetre pub intempestives

50 réponses

Votre réponse

Discussions similaires

Newsletters