rapport de recherche Navilog1 Résolu

Question

Bonjour, j'ai fais analyser mon pc avec navilog et j'ai le rapport qu'es-que je doit fair maitenant ?? voila le rapprot

Search Navipromo version 3.6.6 commencé le 11/10/2008 à 13:09:54,63

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1
Session actuelle : "gaetan" 

Mise à jour le 29.09.2008 à 17h30 par IL-MAFIOSO

Microsoft Windows Vista 6.0.6001 
Internet Explorer : 7.0.6001.18000 
Système de fichiers : NTFS

Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "C:\Windows" ***


*** Recherche dossiers dans "C:\Program Files" ***

...\InternetGameBox trouvé !

*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***

...\InternetGameBox trouvé !
...\MessengerSkinner trouvé !

*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1" ***


*** Recherche dossiers dans "C:\ProgramData" ***


*** Recherche dossiers dans "c:\users\gaetan\appdataoaming\micros~1\windows\startm~1\programs" ***


*** Recherche dossiers dans "C:\Users\gaetan\AppData\Local\virtualstore\Program Files" ***

...\InternetGameBox trouvé !

*** Recherche dossiers dans "C:\Users\gaetan\AppData\Roaming" ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Fichier(s) caché(s) :

C:\Users\gaetan\AppData\Local\umuqmoa.dat
C:\Users\gaetan\AppData\Local\umuqmoa.exe
C:\Users\gaetan\AppData\Local\umuqmoa_nav.dat
C:\Users\gaetan\AppData\Local\umuqmoa_navps.dat


*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\Windows\system32" *

* Recherche dans "C:\Users\gaetan\AppData\Local\Microsoft" *

* Recherche dans "C:\Users\gaetan\AppData\Local\virtualstore\windows\system32" *

* Recherche dans "C:\Users\gaetan\AppData\Local" *

Fichiers trouvés :

cfdafzwaxs.exe trouvé ! 
cfdafzwaxs.dat trouvé ! 
docxdymhcb.exe trouvé ! 
docxdymhcb.dat trouvé ! 
kqobxac.exe trouvé ! 
kqobxac.dat trouvé ! 
umuqmoa.exe trouvé ! 



*** Recherche fichiers *** 


c:\users\public\desktop\InternetGameBox.lnk trouvé ! 
C:\Windows\pack.epk trouvé !
C:\Windows\system32
vs2.inf trouvé !

*** Recherche clés spécifiques dans le Registre ***

HKEY_CURRENT_USER\Software\Lanconfig trouvé ! 

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\Windows\system32" :


* Dans "C:\Users\gaetan\AppData\Local\Microsoft" :


* Dans "C:\Users\gaetan\AppData\Local\virtualstore\windows\system32" :


* Dans "C:\Users\gaetan\AppData\Local" :


3)Recherche Certificats :

Certificat Egroup trouvé !
Certificat Electronic-Group trouvé !
Certificat Montorgueil absent !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :



*** Analyse terminée le 11/10/2008 à 13:27:16,27 ***

toptitbal · Answer

Bonjour

Assure-toi que l'UAC-User Account Control -contrôle des comptes utilisateurs est bien désactivé. 

Clique-droit sur le raccourci Navilog1 sur le Bureau et choisis " Exécuter en tant qu' Administrateur ". 

* Sur le menu principal, choisis 2. 
* Suis les instructions et patiente. 
* L'outil va t'informer qu'il redémarrera ton ordinateur. 
* Sauvegarde les documents ouverts, s'il y en a, puis ferme toutes les fenêtres. 
* Appuie sur une touche ainsi que demandé. 
* Si ton ordinateur ne redémarre pas automatiquement, fais le manuellement. 
* Choisis ta session habituelle si nécessaire. 
Patiente jusqu'au message *** Nettoyage terminé le ….*** (il se peut que ça prenne un certain temps). 
Un document du Bloc-notes est créé. Sauvegarde le rapport de manière à le retrouver. 
* Copie/colle le contenu de ce compte-rendu dans ta prochaine réponse. 
Referme le Bloc-notes. 
Ton Bureau va réapparaître. 

Réactive le contrôle des comptes utilisateurs (UAC-User Account Control). 

Note : Si ton Bureau ne réapparaît pas, presse Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches. 
Onglet "Processus" > Fichier (menu) > Nouvelle tâche (Exécuter...) > tape explorer et clique sur OK.

gatean · Answer

et commen je fais pour vérifier les fichier ??

gatean · Answer

voila le rapport de désinfection. Mais g toujour une fenétre internet qui souvre comme sa le nom c DORMITORY esque tu conné ???

Clean Navipromo version 3.6.6 commencé le 11/10/2008 à 14:13:27,76

Outil exécuté depuis C:\Program Files
avilog1
Session actuelle : "gaetan" 

Mise à jour le 29.09.2008 à 17h30 par IL-MAFIOSO

Microsoft Windows Vista 6.0.6001 
Internet Explorer : 7.0.6001.18000
Système de fichiers : NTFS

Mode suppression automatique 
avec prise en charge résultats Catchme et GNS


Nettoyage exécuté au redémarrage de l'ordinateur

*** Creation backups fichiers trouvés par Catchme *** 

Copie vers "C:\Program Files
avilog1\Backupnavi"

Copie C:\Users\gaetan\AppData\Local\umuqmoa.dat réalisée avec succès ! 
Copie C:\Users\gaetan\AppData\Local\umuqmoa.exe réalisée avec succès ! 
Copie C:\Users\gaetan\AppData\Local\umuqmoa_nav.dat réalisée avec succès ! 
Copie C:\Users\gaetan\AppData\Local\umuqmoa_navps.dat réalisée avec succès ! 

*** Suppression des fichiers trouvés avec Catchme ***

C:\Users\gaetan\AppData\Local\umuqmoa.dat supprimé ! 
C:\Users\gaetan\AppData\Local\umuqmoa.exe supprimé ! 
C:\Users\gaetan\AppData\Local\umuqmoa_nav.dat supprimé ! 
C:\Users\gaetan\AppData\Local\umuqmoa_navps.dat supprimé ! 
 
** 2ème passage avec résultats Catchme ** 

* Dans "C:\Windows\system32" *



* Dans "C:\Users\gaetan\AppData\Local\Microsoft" *



* Dans "C:\Users\gaetan\AppData\Local\virtualstore\windows\system32" *



* Dans "C:\Users\gaetan\AppData\Local" *



*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\Windows\System32" *



* Suppression dans "C:\Users\gaetan\AppData\Local\Microsoft" *



* Suppression dans "C:\Users\gaetan\AppData\Local\virtualstore\windows\system32" *



* Suppression dans "C:\Users\gaetan\AppData\Local" *


cfdafzwaxs.exe trouvé ! 
Copie cfdafzwaxs.exe réalisée avec succès !
cfdafzwaxs.exe supprimé !

cfdafzwaxs.dat trouvé ! 
Copie cfdafzwaxs.dat réalisée avec succès !
cfdafzwaxs.dat supprimé !

docxdymhcb.exe trouvé ! 
Copie docxdymhcb.exe réalisée avec succès !
docxdymhcb.exe supprimé !

docxdymhcb.dat trouvé ! 
Copie docxdymhcb.dat réalisée avec succès !
docxdymhcb.dat supprimé !

kqobxac.exe trouvé ! 
Copie kqobxac.exe réalisée avec succès !
kqobxac.exe supprimé !

kqobxac.dat trouvé ! 
Copie kqobxac.dat réalisée avec succès !
kqobxac.dat supprimé !



*** Suppression dossiers dans "C:\Windows" ***


*** Suppression dossiers dans "C:\Program Files" ***

...\InternetGamebox ...suppression... 
...\InternetGamebox supprimé ! 


*** Suppression dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***

...\InternetGamebox ...suppression... 
...\InternetGamebox supprimé ! 

...\MessengerSkinner ...suppression... 
...\MessengerSkinner supprimé ! 


*** Suppression dossiers dans "c:\progra~2\micros~1\windows\startm~1" ***


*** Suppression dossiers dans "C:\ProgramData" ***


*** Suppression dossiers dans c:\users\gaetan\appdataoaming\micros~1\windows\startm~1\programs ***


*** Suppression dossiers dans "C:\Users\gaetan\AppData\Local\virtualstore\Program Files" ***

...\InternetGamebox ...suppression... 
...\InternetGamebox supprimé ! 


*** Suppression dossiers dans "C:\Users\gaetan\AppData\Roaming" ***



*** Suppression fichiers ***

c:\users\public\desktop\InternetGameBox.lnk supprimé !
C:\Windows\pack.epk supprimé !
C:\Windows\system32
vs2.inf supprimé !

*** Suppression fichiers temporaires ***

Nettoyage contenu C:\Windows\Temp effectué !
Nettoyage contenu C:\Users\gaetan\AppData\Local\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\Windows\system32" *


* Dans "C:\Users\gaetan\AppData\Local\Microsoft" *


* Dans "C:\Users\gaetan\AppData\Local\virtualstore\windows\system32" *


* Dans "C:\Users\gaetan\AppData\Local" *


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup supprimé !
Certificat Electronic-Group supprimé !
Certificat Montorgueil absent !
Certificat OOO-Favorit supprimé !
Certificat Sunny-Day-Design-Ltdt absent !


*** Nettoyage terminé le 11/10/2008 à 14:21:40,79 ***

toptitbal · Answer

Télécharge le fichier d’installation d’Hijackthis en cliquant sur ce lien 

http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

* Enregistre HJTInstall.exe sur ton bureau. 

* Double-clique sur HJTInstall.exe pour lancer le programme

Tuto : https://www.malekal.com/tutoriel-hijackthis/
	http://pagesperso-orange.fr/rginformatique/section%20virus/Hijenr.gif
	http://pagesperso-orange.fr/rginformatique/section%20virus/demohijack.htm

* Accepte la license en cliquant sur le bouton "I Accept"
* Choisis l'option "Do a system scan and save a log file"
* Clique sur "Save log" pour enregistrer le rapport qui s'ouvrira avec le bloc-note
* Clique sur "Edition -> Sélectionner tout", puis sur "Edition -> Copier" pour copier tout le contenu du rapport

* Colle le rapport que tu viens de copier sur ce forum

gatean · Answer

C'est pour fair quoi se programe ???

gatean · Answer

bien voila le rapport

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:44:23, on 11/10/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\conime.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Program Files\Winamp\winampa.exe
C:\Windows\System32undll32.exe
C:\Program Files\Micro Application\Securite Internet 2007\avp.exe
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Winamp Remote\bin\OrbTray.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\VnrPack\VnrPack20.exe
C:\Program Files\VnrBlock\VnrBlock21.exe
C:\Program Files\GetModule\GetModule23.exe
C:\Program Files\GetPack\GetPack22.exe
C:\Program Files\ppcbooster\ppcbooster.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32undll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Winamp\elevator.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\program files\winamp toolbar\WinampTbServer.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: Helper Class - {3670A914-63C2-4E67-8C9B-370AE1922143} - C:\Program Files\BChanger\bchanger.dll
O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb127\Dealio.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: DrFlex IE Helper - {8EEB2711-9D21-4f9c-99A1-B7FC5A8CA56A} - C:\Program Files\QdrDrive\QdrDrive20.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: Barre d'outils MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\fr\msntb.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb127\Dealio.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Micro Application\Securite Internet 2007\avp.exe"
O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [WellPhone XT Sagem] "C:\Program Files\SmartCom\WellPhone XT Sagem\WellPhone2.exe" /background
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [Speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [VnrPack20] "C:\Program Files\VnrPack\VnrPack20.exe"
O4 - HKCU\..\Run: [VnrBlock21] "C:\Program Files\VnrBlock\VnrBlock21.exe"
O4 - HKCU\..\Run: [GetModule23] "C:\Program Files\GetModule\GetModule23.exe"
O4 - HKCU\..\Run: [GetPack22] "C:\Program Files\GetPack\GetPack22.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: ppcbooster.lnk = C:\Program Files\ppcbooster\ppcbooster.exe
O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbaresources\en-US\local\search.html
O8 - Extra context menu item: Ajouter à Anti-Banner - C:\Program Files\Micro Application\Securite Internet 2007\ie_banner_deny.htm
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Users\gaetan\AppData\LocalLow\Dealio\kb127es\DealioSearch.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Micro Application\Securite Internet 2007\scieplugin.dll
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O13 - Gopher Prefix: 
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\MICROA~1\SECURI~1\adialhk.dll,C:\PROGRA~1\MICROA~1\SECURI~13hook.dll
O23 - Service: Sécurité Internet 2007 (AVP) - Micro Application - C:\Program Files\Micro Application\Securite Internet 2007\avp.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

toptitbal · Answer

Tu as d'autres infections.

Surtout, tu fais bien tout après avoir désactivé l'UAC et en lançant les commandes par un clic droit pour choisir de le faire : "En tant qu'administrateur"

Télécharges SDFix sur ton bureau : 
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe. 

--->Double-cliques sur SDFix.exe et choisis "Install" . 

( tuto ici : https://www.malekal.com/slenfbot-still-an-other-irc-bot/ ) 

Puis une fois l'installe faite, redémarre en mode sans échec . 

Comment aller en Mode sans échec : 
1) Redémarre ton ordi 
2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip" 
3) Tu verras un écran avec options de démarrage apparaître 
4) Choisis la première option : Sans Échec, et valide avec "Entrée" 
5) Choisis ton compte habituel, et non Administrateur (si besoin ... ) 

Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script. 
--->Tapes Y pour lancer le script ... 
Le Fix supprime les services du virus et nettoie le registre, de ce fait un redémarrage est nécessaire , donc : 
presse une touche pour redémarrer quand il te le sera demandé . 

Le PC va mettre du temps avant de démarrer ( c'est normal), après le chargement du Bureau presse une touche lorsque "Finished" s'affiche . 

Le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier C:\SDFix sous le nom "Report.txt". 
Poste ce dernier dans ta prochaine réponse.

gatean · Answer

esque quelqu'un peu me répondre svp ! ! !

^^Marie^^ · Answer

Bonjour

pour avancer
Laisse tomber SdFix il ne fonctionne pas sous Vista


Télécharge Toolbar-S&D (Team IDN) sur ton Bureau. 
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2 

* Lance l'installation du programme en exécutant le fichier téléchargé. 
* Double-clique maintenant sur le raccourci de Toolbar-S&D. 
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée. 
* Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche. 
* Poste le rapport généré. (C:\TB.txt)

gatean · Answer

enfin quelqu'un qui me répond ji croier plus la merci :). je fé tou sa desuite !!

gatean · Answer

voila le rapport


   -----------\  ToolBar S&D 1.2.2   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6001 ) Service Pack 1
   X86-based PC ( Multiprocessor Free : Genuine Intel(R) CPU            2140  @ 1.60GHz )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : gaetan ( Administrator )
   BOOT : Normal boot
   Antivirus : Sécurité Internet 2007 6.0.2.614 (Activated)
   Firewall  : Sécurité Internet 2007 6.0.2.614 (Not Activated)
   C:\ (Local Disk) - NTFS - Total : 290 Go Free : 177 Go
   D:\ (CD or DVD)
   E:\ (USB)
   F:\ (USB)
   G:\ (USB)
   H:\ (CD or DVD)
   I:\ (USB)

   "C:\ToolBar SD" ( MAJ : 04-10-2008|21:00 )
   Option : [1] ( 12/10/2008|18:22 )

   [ UAC => 0 ]

   -----------\  Recherche de Fichiers / Dossiers ...

   C:\Users\gaetan\AppData\Roaming\MICROS~1\Windows\Cookies\gaetan@meacrawler[1].txt
   C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Dcads Games Collection
   C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Dealio
   C:\Program Files\Dealio
   C:\Program Files\Dealio\DealioAU.exe
   C:\Program Files\Dealio\kb127
   C:\Program Files\Dealio\SearchSettingsKit.exe
   C:\Program Files\Search Settings
   C:\Program Files\Search Settings\kb127
   C:\Program Files\Search Settings\SearchSettings.exe
   C:\Windows\system32\superiorads-uninst.exe

   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\Windows\system32\blank.htm"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Start Page"="https://www.google.fr/?gws_rd=ssl"
   "Search Bar"="https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F"
   "Url"="https://www.msn.com/fr-fr/actualite/"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="https://home.sweetim.com/"
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"


   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\Users\gaetan\AppData\Roaming\Real\RealPlayer\History	he violation of trina michael Crack, the violation .lnk


   [ UAC => 1 ]


   1 - "C:\ToolBar SD\TB_1.txt" - 12/10/2008|18:23 - Option : [1]

   -----------\  Fin du rapport a 18:23:11,64

gatean · Answer

et maitenan ??? mon frére a télécharger des truc dan la semaine depui mon pc esque sa peu étre a l'origine de mon probléme ???

^^Marie^^ · Answer

Ton frère a téléchargé des cracks (((

Relance Toolbar-S&D en double-cliquant sur le raccourci. 
Tape sur "2" puis valide en appuyant sur "Entrée". 
! Ne ferme pas la fenêtre lors de la suppression ! 
Un rapport sera généré, poste son contenu ici. 

NOTE : Si ton Bureau ne réapparait pas, appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches. 
Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter..." 
Tape explorer puis valide. 

*********************************** 
@+

gatean · Answer

voial le rapport


   -----------\  ToolBar S&D 1.2.2   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6001 ) Service Pack 1
   X86-based PC ( Multiprocessor Free : Genuine Intel(R) CPU            2140  @ 1.60GHz )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : gaetan ( Administrator )
   BOOT : Normal boot
   Antivirus : Sécurité Internet 2007 6.0.2.614 (Activated)
   Firewall  : Sécurité Internet 2007 6.0.2.614 (Not Activated)
   C:\ (Local Disk) - NTFS - Total : 290 Go Free : 177 Go
   D:\ (CD or DVD)
   E:\ (USB)
   F:\ (USB)
   G:\ (USB)
   H:\ (CD or DVD)
   I:\ (USB)

   "C:\ToolBar SD" ( MAJ : 04-10-2008|21:00 )
   Option : [2] ( 12/10/2008|18:47 )

   [ UAC => 1 ]

   -----------\ SUPPRESSION

   Supprime! - C:\Users\gaetan\AppData\Roaming\MICROS~1\Windows\Cookies\gaetan@meacrawler[1].txt
   Supprime! - C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Dcads Games Collection
   Supprime! - C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Dealio
   Supprime! - C:\Program Files\Dealio\DealioAU.exe
   Supprime! - C:\Program Files\Dealio\kb127
   Supprime! - C:\Program Files\Dealio\SearchSettingsKit.exe
   Supprime! - C:\Program Files\Search Settings\kb127
   Supprime! - C:\Program Files\Search Settings\SearchSettings.exe
   Supprime! - C:\Windows\system32\superiorads-uninst.exe
   Supprime! - C:\Program Files\Dealio
   Supprime! - C:\Program Files\Search Settings

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\Windows\system32\blank.htm"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Start Page"="https://www.google.fr/?gws_rd=ssl"
   "Search Bar"="https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F"
   "Url"="https://www.msn.com/fr-fr/actualite/"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="https://www.msn.com/fr-fr/"
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"


   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\Users\gaetan\AppData\Roaming\Real\RealPlayer\History	he violation of trina michael Crack, the violation .lnk


   [ UAC => 1 ]


   1 - "C:\ToolBar SD\TB_1.txt" - 12/10/2008|18:23 - Option : [1]
   2 - "C:\ToolBar SD\TB_2.txt" - 12/10/2008|18:49 - Option : [2]

   -----------\  Fin du rapport a 18:49:42,74

gatean · Answer

sinon en plus des pop-up g une autre page internet qui souvre toute les 10-15 min apeuprer elle s'appelle dormitory c koi ????

gatean · Answer

et voila plus personne veu me répondre . . . . . . encore -_-' lol :)

^^Marie^^ · Answer

C:\Users\gaetan\AppData\Roaming\Real\RealPlayer\History	he violation of trina michael Crack, the violation .lnk

Supprime cette merdouille de cracks

gatean · Answer

c fais. jarriver pas a le trouver mais c bon !! et maitenant ??

^^Marie^^ · Answer

et maitenant ??


Apero )))


+++

gatean · Answer

-_-'   lOol   mais sa continue avec une autre fenétre cette foi le nom c TRAFIC explorer  ??? je fé koi

gatean · Answer

HAAAAAA g toujour une fenétre qui souvre tou le temp j'en et marre quelqu'un peut venir m'aider plzzzzzzzzzzzzzzzzzzz

^^Marie^^ · Answer

Avec les cracks que tu as sur ton PC, faut pas venir pleurer maintenant ..........


Télécharges ComboFix à partir d'un de ces liens : 
En premier
http://download.bleepingcomputer.com/sUBs/ComboFix.exe 

A lire
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix


Et important, enregistre le sur le bureau. 

Avant d'utiliser ComboFix : 

&#9658; Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours. 

&#9658; Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil. 


Une fois fait, sur ton bureau double-clic sur Combofix.exe. 

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc. 

/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes. 

- En fin de scan il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection\recherche, laisses-le faire. 

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt) 

&#9658; Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet. 

&#9658; Reviens sur le forum, et 

copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

gatean · Answer

bon je pe remercier mon frére pour sa je suppose -_-' enfin bref voila le rapport ComboFix 08-10-11.04 - gaetan 2008-10-12 20:54:19.1 - NTFSx86 Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1033 [GMT 2:00] Lancé depuis: C:\Users\gaetan\ComboFix.exe * Un nouveau point de restauration a été créé . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\BChanger C:\Program Files\BChanger\bchanger.dll C:\Program Files\BChanger\data.dat C:\Program Files\BChanger\Uninstall.exe C:\Program Files\GetModule C:\Program Files\GetModule\dicik.gz C:\Program Files\GetModule\GetModule23.exe C:\Program Files\GetModule\kwdik.gz C:\Program Files\GetPack C:\Program Files\GetPack\dictame.gz C:\Program Files\GetPack\GetPack22.exe C:\Program Files\GetPack rgtame.gz C:\Program Files\iCheck C:\Program Files\iCheck\iCheck.exe C:\Program Files\iCheck\Uninstall.exe C:\Program Files\QdrDrive C:\Program Files\QdrDrive\QdrDrive20.dll C:\Program Files\QdrDrive\qdrloader.exe C:\Program Files\RichVideoCodec C:\Program Files\VnrBlock C:\Program Files\VnrBlock\VnrBlock21.exe C:\Program Files\VnrBlock\xtarga.gz C:\Program Files\VnrPack C:\Program Files\VnrPack\dicts.gz C:\Program Files\VnrPack rgts.gz C:\Program Files\VnrPack\VnrPack20.exe C:\Windows\system32\MSINET.oca C:\Windows\system32\myss_sb_uninstall.exe C:\Windows\system32\phce5jj0e58l.bmp . ((((((((((((((((((((((((((((( Fichiers créés du 2008-09-12 au 2008-10-12 )))))))))))))))))))))))))))))))))))) . 2008-10-12 20:46 . 2008-10-12 20:46 2,939,265 -ra------ C:\Users\gaetan\ComboFix.exe 2008-10-12 18:21 . 2008-10-12 18:49 d-------- C:\ToolBar SD 2008-10-12 17:58 . 2008-10-12 17:58 9,445,698 --a------ C:\upload_moi_PC-de-gaetan.tar.gz 2008-10-12 17:56 . 2008-10-12 18:34 d-a------ C:\Users\gaetan\clean 2008-10-12 17:55 . 2008-10-12 17:55 d-a------ C:\Program Files\CleanUp! 2008-10-11 16:02 . 2008-10-11 21:20 d-------- C:\SDFix 2008-10-11 14:57 . 2008-10-11 18:21 d-------- C:\SDFix-1 2008-10-11 14:43 . 2008-10-11 14:43 d-------- C:\Program Files\Trend Micro 2008-10-11 13:05 . 2008-10-12 15:23 d-------- C:\Program Files\Navilog1 2008-10-11 12:43 . 2008-10-11 12:43 56 --ah----- C:\Windows\System32\ezsidmv.dat 2008-10-08 21:36 . 2007-10-28 22:56 838,515 --a------ C:\Windows\_detmp.1 2008-10-08 21:36 . 2000-04-14 11:11 86,016 --a------ C:\Windows\_detmp.2 2008-10-08 17:37 . 2008-10-08 17:37 d-------- C:\GAMES 2008-10-08 17:29 . 2008-10-08 17:29 d-------- C:\Program Files\ppcbooster 2008-10-08 17:29 . 2008-10-08 17:29 288,734 --a------ C:\Windows\vntb9283.exe 2008-10-08 17:29 . 2008-10-08 17:29 181,766 --a------ C:\Windows\bdtb3452.exe 2008-10-08 17:29 . 2008-10-08 17:29 79,097 --a------ C:\Windows\System32\vmrnvyfhyslyykzf.exe 2008-10-08 17:29 . 2008-10-08 17:29 70,548 --a------ C:\Windows\dwtb2837.exe 2008-10-08 15:09 . 2008-10-08 18:48 d-------- C:\Users\gaetan\jeu 2008-09-22 21:42 . 2008-09-22 21:43 d-------- C:\Program Files\Free Audio Pack 2008-09-22 21:42 . 2000-11-29 04:07 307,200 --a------ C:\Windows\System32\msvcr70.dll 2008-09-22 21:42 . 2003-08-07 17:01 237,568 --a------ C:\Windows\System32\lame_enc.dll 2008-09-22 21:42 . 2004-03-09 01:00 224,016 --a------ C:\Windows\System32\TABCTL32.OCX 2008-09-22 21:42 . 1998-07-13 01:00 141,312 --a------ C:\Windows\System32\MSCMCFR.DLL 2008-09-22 21:42 . 1999-03-25 21:00 101,888 --a------ C:\Windows\System32\VB6STKIT.DLL 2008-09-22 21:42 . 1998-07-13 01:00 59,904 --a------ C:\Windows\System32\Mscc2fr.dll 2008-09-22 21:42 . 1998-07-12 21:00 32,768 --a------ C:\Windows\System32\CMDLGFR.DLL 2008-09-22 21:42 . 1998-07-13 01:00 21,504 --a------ C:\Windows\System32\TABCTFR.DLL 2008-09-22 21:42 . 1998-07-13 01:00 15,360 --a------ C:\Windows\System32\inetfr.DLL . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-12 18:56 32,741,664 --sha-w C:\Windows\system32\drivers\fidbox.dat 2008-10-12 18:07 --------- d-----w C:\Program Files\Warcraft III 2008-10-12 14:22 --------- d-----w C:\Users\gaetan\AppData\Roaming\Skype 2008-10-12 14:05 --------- d-----w C:\Users\gaetan\AppData\Roaming\skypePM 2008-10-12 11:24 --------- d-----w C:\PROGRA~2\Micro Application 2008-10-11 20:28 435,356 --sha-w C:\Windows\system32\drivers\fidbox.idx 2008-10-11 19:20 --------- d-----w C:\Program Files\Jarkanoid 3 2008-10-11 17:58 --------- d-----w C:\Users\gaetan\AppData\Roaming\LimeWire 2008-10-11 10:43 --------- d-----w C:\PROGRA~2\OrbNetworks 2008-10-08 19:36 --------- d-----w C:\Program Files\Tetris 3000 2008-10-08 19:35 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-10-04 17:10 --------- d-----w C:\Program Files\Cossacks - The Art Of War 2008-09-10 18:19 --------- d-----w C:\Program Files\Glest_3.1.2 2008-09-04 21:02 --------- d-----w C:\Users\gaetan\AppData\Roaming\GetRightToGo 2008-08-24 20:04 --------- d-----w C:\Program Files\GUILD WARS 2008-08-19 17:00 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-08-18 21:02 --------- d-----w C:\Users\gaetan\AppData\Roaming eamspeak2 2008-08-18 11:15 --------- d---a-w C:\PROGRA~2\Skype 2008-08-18 11:15 --------- d-----w C:\Program Files\Skype 2008-08-18 11:15 --------- d-----w C:\Program Files\Common Files\Skype 2008-08-15 11:58 --------- d-----w C:\Program Files\American Conquest - Fight Back 2008-08-14 14:59 --------- d-----w C:\Program Files\Metin2_France 2008-08-13 22:15 --------- d-----w C:\Program Files\Windows Mail 2008-08-13 10:14 96,976 ----a-w C:\Windows\system32\drivers\klin.dat 2008-08-13 10:14 87,855 ----a-w C:\Windows\system32\drivers\klick.dat 2008-08-13 09:57 --------- d-----w C:\Program Files\Micro Application 2008-08-13 09:51 --------- d-----w C:\PROGRA~2\Kaspersky Lab 2008-08-02 03:26 36,864 ----a-w C:\Windows\System32\cdd.dll 2008-07-31 03:32 460,288 ----a-w C:\Windows\AppPatch\AcSpecfc.dll 2008-07-31 03:32 28,160 ----a-w C:\Windows\System32\Apphlpdm.dll 2008-07-31 03:32 2,154,496 ----a-w C:\Windows\AppPatch\AcGenral.dll 2008-07-31 03:32 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll 2008-07-31 01:13 4,240,384 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll 2008-07-30 17:30 2,829 ----a-w C:\Windows\DIIUnin.pif 2008-07-30 17:30 102,400 ----a-w C:\Windows\DIIUnin.exe 2008-07-29 11:22 21,840 ----atw C:\Windows\System32\SIntfNT.dll 2008-07-29 11:22 17,212 ----atw C:\Windows\System32\SIntf32.dll 2008-07-29 11:22 12,067 ----atw C:\Windows\System32\SIntf16.dll 2008-07-25 12:00 174 --sha-w C:\Program Files\desktop.ini 2008-07-25 11:33 82,432 ----a-w C:\Windows\System32\axaltocm.dll 2008-07-25 11:33 101,888 ----a-w C:\Windows\System32\ifxcardm.dll 2008-07-19 05:10 53,448 ----a-w C:\Windows\System32\wuauclt.exe 2008-07-19 05:10 45,768 ----a-w C:\Windows\System32\wups2.dll 2008-07-19 05:10 36,552 ----a-w C:\Windows\System32\wups.dll 2008-07-19 05:09 563,912 ----a-w C:\Windows\System32\wuapi.dll 2008-07-19 05:09 1,811,656 ----a-w C:\Windows\System32\wuaueng.dll 2008-07-19 03:44 83,456 ----a-w C:\Windows\System32\wudriver.dll 2008-07-19 03:44 1,524,736 ----a-w C:\Windows\System32\wucltux.dll 2008-07-18 20:08 163,904 ----a-w C:\Windows\System32\wuwebv.dll 2008-07-18 18:44 31,232 ----a-w C:\Windows\System32\wuapp.exe 2008-07-16 01:32 2,048 ----a-w C:\Windows\System32 zres.dll 2008-07-05 20:34 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2008-07-05 20:34 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2008-07-05 20:34 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat 2008-01-03 14:29 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2008-01-03 14:29 32,768 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2008-01-03 14:29 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{EEE6C35D-6118-11DC-9C72-001320C79847}"= "C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll" [2008-03-27 173368] [HKEY_CLASSES_ROOT\clsid\{eee6c35d-6118-11dc-9c72-001320c79847}] [HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook.1] [HKEY_CLASSES_ROOT\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}] [HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}] 2008-03-27 14:12 1164600 --a------ C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{EEE6C35B-6118-11DC-9C72-001320C79847}"= "C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2008-03-27 1164600] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{EEE6C35B-6118-11DC-9C72-001320C79847}"= "C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2008-03-27 1164600] [HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}] [HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.3] [HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}] [HKEY_CLASSES_ROOT\SWEETIE.SWEETIE] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920] "SmpcSys"="C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe" [2007-05-03 1116728] "CursorXP"="C:\Program Files\CursorXP\CursorXP.exe" [2005-01-19 128000] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 125952] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184] "ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032] "Speech Recognition"="C:\Windows\Speech\Common\sapisvr.exe" [2008-01-19 49664] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-05-16 171448] "Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 507904] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-08-12 21741864] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-01-11 232184] "toolbar_eula_launcher"="C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe" [2007-02-20 28672] "NeroFilterCheck"="C:\Windows\system32\NeroCheck.exe" [2001-07-09 155648] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-10-19 286720] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784] "SweetIM"="C:\Program Files\SweetIM\Messenger\SweetIM.exe" [2008-03-27 111928] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB ealsched.exe" [2008-05-16 185896] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-07-09 36352] "NvSvc"="C:\Windows\system32 vsvc.dll" [2007-09-12 86016] "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-09-12 8497696] "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-09-12 81920] "RtHDVCpl"="RtHDVCpl.exe" [2007-05-10 C:\Windows\RtHDVCpl.exe] "Skytel"="Skytel.exe" [2007-05-07 C:\Windows\SkyTel.exe] C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ ppcbooster.lnk - C:\Program Files\ppcbooster\ppcbooster.exe [2008-10-08 20480] C:\Users\gaetan\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ ppcbooster.lnk - C:\Program Files\ppcbooster\ppcbooster.exe [2008-10-08 20480] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "FilterAdministratorToken"= 1 (0x1) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "LogonHoursAction"= 2 (0x2) "DontDisplayLogonHoursWarnings"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\MICROA~1\SECURI~1\adialhk.dll,C:\PROGRA~1\MICROA~1\SECURI~1 3hook.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.SP54"= SP5X_32.DLL [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UacDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{A5339627-E33F-4F74-A621-6094E86725B3}"= UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype "{95095CE9-163A-4BDD-B427-20949BDAB151}"= TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype "{5E45B4AF-B939-4CA2-B07A-133AB80FB86B}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{394C6BA2-C96A-4BBD-9F60-4F515EEBA77F}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{FD0C1E39-A528-493F-9760-4C4843F9E02A}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{AE8F2CC7-E273-4232-B1BD-D354146370E4}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{46085E9B-7974-4DC8-9794-D1CC8F4B7376}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{577A7DBF-45D8-4828-B37B-5FDFC66821AB}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "TCP Query User{FFB85EA8-6B9E-4F43-A81F-1DA6E69C6593}C:\program files\jowood\spellforce - diamond edition\spellforce.exe"= UDP:C:\program files\jowood\spellforce - diamond edition\spellforce.exe:SpellForce "UDP Query User{F274A370-0311-4948-9C00-87A5C244DFDC}C:\program files\jowood\spellforce - diamond edition\spellforce.exe"= TCP:C:\program files\jowood\spellforce - diamond edition\spellforce.exe:SpellForce "TCP Query User{985E93B6-BA64-4D9B-ADD7-0CD1AC6DAF25}C:\program files\emule\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule "UDP Query User{3644BD2E-7A11-4783-8710-CEFEB4116421}C:\program files\emule\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule "{90806C1F-8895-440C-B227-08E0D48F0987}"= UDP:C:\Windows\System32\WindowsAnytimeUpgrade.exe:Achat de mise à niveau en ligne "{D446BD00-BBE9-478B-9619-4D452BDB9759}"= TCP:C:\Windows\System32\WindowsAnytimeUpgrade.exe:Achat de mise à niveau en ligne "{DEE7FC4B-D651-41CC-81D7-8F6C3D7205D9}"= UDP:C:\Sierra\Arcanum\Arcanum.exe:Arcanum "{EC54DAB7-FEBA-4550-818E-5C2D411A2B29}"= TCP:C:\Sierra\Arcanum\Arcanum.exe:Arcanum "{263CADE6-F851-450D-96C1-082AB8AA19BA}"= UDP:C:\Program Files\Cossacks - The Art Of War\dmcr.exe:Cossacks - The Art of War "{4C4F4181-AB1A-499D-B561-41DE31A6B5A1}"= TCP:C:\Program Files\Cossacks - The Art Of War\dmcr.exe:Cossacks - The Art of War "{00AE8FAA-9A09-4854-A5D1-EC24CA422CC7}"= UDP:C:\Program Files\Strategy First\Disciples Gold\Exe\Disciple.exe:Disciples - Sacred Lands "{39617411-470F-48F4-A924-CFD9D565AA87}"= TCP:C:\Program Files\Strategy First\Disciples Gold\Exe\Disciple.exe:Disciples - Sacred Lands "{003BCC81-5806-46CD-876C-B72CFCA1ADEA}"= UDP:C:\Program Files\Ubisoft\Heroes of Might and Magic V\bin\H5_Game.exe:Heroes of Might and Magic V "{F239920F-2B88-472B-A5D5-76CA9035B9CE}"= TCP:C:\Program Files\Ubisoft\Heroes of Might and Magic V\bin\H5_Game.exe:Heroes of Might and Magic V "{43A9E2F3-9C50-46F9-9BB9-8F79888FA03A}"= UDP:C:\Program Files\3DO\Heroes of Might and Magic IV\heroes4f.exe:Heroes of Might and Magic IV "{3BEAD466-553E-47FE-9EFF-363A0969C7E2}"= TCP:C:\Program Files\3DO\Heroes of Might and Magic IV\heroes4f.exe:Heroes of Might and Magic IV "{9536B881-DD0F-4B9E-B48F-0F1572E0A1B6}"= UDP:C:\Program Files\Warcraft III\Warcraft III.exe:Warcraft III "{EBBA2F99-F856-45EE-A1F1-7142EBEFDDF0}"= TCP:C:\Program Files\Warcraft III\Warcraft III.exe:Warcraft III "{EE17DB73-4A90-435A-8F2B-C3E107D41848}"= UDP:C:\Program Files\Eidos Interactive\Pyro Studios\Praetorians\Praetorians.exe:Praetorians "{B1E9F990-D2E4-426B-963F-F61AAA926EFE}"= TCP:C:\Program Files\Eidos Interactive\Pyro Studios\Praetorians\Praetorians.exe:Praetorians "{315A0922-576B-4C34-912E-172ADCC367EB}"= UDP:C:\Program Files\Port Royale\PortRoyale.exe:Port Royale "{BD87D139-CC2D-42D2-83A5-9CFAFF9CF995}"= TCP:C:\Program Files\Port Royale\PortRoyale.exe:Port Royale "TCP Query User{DC42F8CF-5A2F-4BFD-92A4-2D4B22296815}C:\windows\system32\dplaysvr.exe"= UDP:C:\windows\system32\dplaysvr.exe:Application d'assistance Microsoft DirectPlay "UDP Query User{61AD9EF0-F75E-43BD-B095-D069C95428D5}C:\windows\system32\dplaysvr.exe"= TCP:C:\windows\system32\dplaysvr.exe:Application d'assistance Microsoft DirectPlay "TCP Query User{A8D9876F-D393-40B8-A956-EB5B51AE5521}C:\program files\internet explorer\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{8667E890-E0C1-4E1D-9947-56DBE1A838C1}C:\program files\internet explorer\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "TCP Query User{035A7B05-D664-4341-B6B0-675BE266701A}C:\program files\warcraft iii\war3.exe"= UDP:C:\program files\warcraft iii\war3.exe:Warcraft III "UDP Query User{C5AE43CF-0B11-4066-B4FC-89C971968756}C:\program files\warcraft iii\war3.exe"= TCP:C:\program files\warcraft iii\war3.exe:Warcraft III "TCP Query User{F2817DE4-BAFD-4FF6-B909-D0E722A92A61}C:\program files\maxis\simcity 3000 world edition\apps\updater\updater.exe"= UDP:C:\program files\maxis\simcity 3000 world edition\apps\updater\updater.exe:SC3UpdaterMFC "UDP Query User{F97870DA-D57B-40CF-88FF-CB7AD76BD659}C:\program files\maxis\simcity 3000 world edition\apps\updater\updater.exe"= TCP:C:\program files\maxis\simcity 3000 world edition\apps\updater\updater.exe:SC3UpdaterMFC "TCP Query User{E951D5EF-F6E7-467A-8B44-F83509473BA6}C:\program files\warzone 2100\warzone2100.exe"= UDP:C:\program files\warzone 2100\warzone2100.exe:Warzone 2100 "UDP Query User{50B8AE86-CC7D-4DD3-A5A8-681CAE5FA1F1}C:\program files\warzone 2100\warzone2100.exe"= TCP:C:\program files\warzone 2100\warzone2100.exe:Warzone 2100 "TCP Query User{03229C4D-E7BE-4981-8383-9142626D2EA8}C:\program files\microsoft games\age of mythology\aomx.exe"= UDP:C:\program files\microsoft games\age of mythology\aomx.exe:Age of Mythology - The Titans Expansion "UDP Query User{986D858B-4E6B-4C2F-8680-B4DA7EDAF5F5}C:\program files\microsoft games\age of mythology\aomx.exe"= TCP:C:\program files\microsoft games\age of mythology\aomx.exe:Age of Mythology - The Titans Expansion "TCP Query User{6912C221-A7D0-4505-A14A-6D759795AF3F}C:\bluebyte\the settlers iv\exe\s4_main.exe"= UDP:C:\bluebyte he settlers iv\exe\s4_main.exe:S4_Main "UDP Query User{825DA880-72D0-47AC-95C1-D7D0C1CFBF84}C:\bluebyte\the settlers iv\exe\s4_main.exe"= TCP:C:\bluebyte he settlers iv\exe\s4_main.exe:S4_Main "TCP Query User{FA1AAFE1-D686-477F-8C7B-46DFC492ECE0}C:\program files\giants\giants.exe"= UDP:C:\program files\giants\giants.exe:Giants "UDP Query User{1AC13B7B-D5AF-4AA7-ABBA-741E73EE8CB6}C:\program files\giants\giants.exe"= TCP:C:\program files\giants\giants.exe:Giants "TCP Query User{8F180B30-77F4-402C-8F7F-0E7E0A772811}C:\program files\dreamcatcher\dungeon lords\dlords.exe"= UDP:C:\program files\dreamcatcher\dungeon lords\dlords.exe:dlords "UDP Query User{1F7CA572-467C-421D-A2FD-D474704478BA}C:\program files\dreamcatcher\dungeon lords\dlords.exe"= TCP:C:\program files\dreamcatcher\dungeon lords\dlords.exe:dlords "{E6942491-2D7E-4373-BBFA-A038575FBDAE}"= UDP:C:\Program Files\Microsoft Games\Age of Empires III\age3x.exe:Age of Empires III - The WarChiefs "{10512A4C-5354-4DED-A488-3BF0D65A5986}"= TCP:C:\Program Files\Microsoft Games\Age of Empires III\age3x.exe:Age of Empires III - The WarChiefs "{20C65265-96D9-4A19-B34E-D406DCFA0F1A}"= UDP:C:\Program Files\Atari\Neverwinter Nights 2 wn2main.exe:Neverwinter Nights 2 Main "{220287E5-AA44-466B-9D32-F6F73593096C}"= TCP:C:\Program Files\Atari\Neverwinter Nights 2 wn2main.exe:Neverwinter Nights 2 Main "{47C66D78-D87D-49E1-B813-B60D6EAA0BFF}"= UDP:C:\Program Files\Atari\Neverwinter Nights 2 wn2main_amdxp.exe:Neverwinter Nights 2 AMD "{C1165618-5246-4897-B163-00E18B76447C}"= TCP:C:\Program Files\Atari\Neverwinter Nights 2 wn2main_amdxp.exe:Neverwinter Nights 2 AMD "{1435300C-09D2-4658-91E4-5C164BD15F2C}"= UDP:C:\Program Files\Atari\Neverwinter Nights 2 wupdate.exe:Neverwinter Nights 2 Updater "{0C5C33D6-DB3E-4F78-9C38-20125F092EB0}"= TCP:C:\Program Files\Atari\Neverwinter Nights 2 wupdate.exe:Neverwinter Nights 2 Updater "{41E719C3-4818-4293-84DB-9BABFF382CC4}"= UDP:C:\Program Files\Atari\Neverwinter Nights 2 wn2server.exe:Neverwinter Nights 2 Server "{E06D12E1-F75F-435E-8854-D808F4365EAA}"= TCP:C:\Program Files\Atari\Neverwinter Nights 2 wn2server.exe:Neverwinter Nights 2 Server "TCP Query User{9DDAF048-3287-46BD-9E53-FC85F7D8A4AC}C:\program files\microsoft games\dungeon siege\dungeonsiege.exe"= UDP:C:\program files\microsoft games\dungeon siege\dungeonsiege.exe:Dungeon Siege Game Executable "UDP Query User{68A9DE2C-0F8B-4689-AD2F-7F274C73E3E3}C:\program files\microsoft games\dungeon siege\dungeonsiege.exe"= TCP:C:\program files\microsoft games\dungeon siege\dungeonsiege.exe:Dungeon Siege Game Executable "TCP Query User{3B1844B2-F152-4446-B412-03398EB8967D}C:\windows\system32\dpnsvr.exe"= UDP:C:\windows\system32\dpnsvr.exe:Serveur Microsoft DirectPlay 8 "UDP Query User{59A8433A-1785-4A27-AC17-2E2412E1110A}C:\windows\system32\dpnsvr.exe"= TCP:C:\windows\system32\dpnsvr.exe:Serveur Microsoft DirectPlay 8 "TCP Query User{2395DCB8-6253-4551-AE0F-3A7006889658}C:\program files\codemasters\worms 4 mayhem\worms 4 mayhem.exe"= UDP:C:\program files\codemasters\worms 4 mayhem\worms 4 mayhem.exe:Worms 4 Mayhem "UDP Query User{5E134F99-A986-4A88-8786-3000C0ACEA78}C:\program files\codemasters\worms 4 mayhem\worms 4 mayhem.exe"= TCP:C:\program files\codemasters\worms 4 mayhem\worms 4 mayhem.exe:Worms 4 Mayhem "TCP Query User{8CB693D6-A8CE-42F8-A038-535B36683717}C:\program files\trackmania nations eswc\tmnationseswc.exe"= UDP:C:\program files rackmania nations eswc mnationseswc.exe:TmNationsESWC "UDP Query User{38D6F906-C58F-4B64-852A-B99543CF097D}C:\program files\trackmania nations eswc\tmnationseswc.exe"= TCP:C:\program files rackmania nations eswc mnationseswc.exe:TmNationsESWC "{24E3B5BF-E5AC-4430-AF66-BBA075F31D22}"= UDP:C:\Program Files\Warcraft III\Frozen Throne.exe:Warcraft III - The Frozen Throne "{3D0A14F5-1760-40D6-A1F8-7F2ACEF42530}"= TCP:C:\Program Files\Warcraft III\Frozen Throne.exe:Warcraft III - The Frozen Throne "TCP Query User{09FA9CD2-64D4-4C5A-A412-DEF58DDBBF1F}C:\program files\limewire\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire "UDP Query User{14D50DFC-4056-4E26-A43B-A2DDD65362DF}C:\program files\limewire\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire "{B4FE32BB-43C8-47AF-882A-1F7ED376DC33}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{6D7EF8BA-406B-498B-BD76-3BF3F54ACD72}"= UDP:4377:H4_4377_TCP "{661046D7-846A-41FF-BA4F-09EDF11AF06E}"= UDP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb "{257B1C6D-F537-4D7E-A96F-B67E1819594E}"= TCP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb "{147B8CF6-4754-4684-97BF-46487EEF0354}"= UDP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray "{F92AE674-A755-4E33-A8FD-29CEE08D927A}"= TCP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray "{4C3AFC98-E1C7-4DF0-BFB8-BD23B2768E5A}"= UDP:C:\Program Files\Winamp Remote\bin\OrbIR.exe:OrbIR "{75226A16-502B-4002-94A7-CE8299DD9CBF}"= TCP:C:\Program Files\Winamp Remote\bin\OrbIR.exe:OrbIR "{2406255A-46C6-4AAB-9F3F-130E58A6CD4E}"= UDP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client "{73BFB7C6-41F5-4728-8D87-35AAC0C19B00}"= TCP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client "{86F538DB-2279-43BB-902A-D118F9CBEC25}"= UDP:C:\Program Files\Diablo II\Diablo II.exe:Diablo II - Lord of Destruction "{39D35ABD-D3C7-4D5C-A042-F712804F4730}"= TCP:C:\Program Files\Diablo II\Diablo II.exe:Diablo II - Lord of Destruction "{1AA52F01-4CD9-40C2-9AD6-9488D13CBFCD}"= UDP:C:\Program Files\Metin2_France\metin2.exe:metin2 "{17C65EC1-655C-4B2E-B30A-93589BA3589D}"= TCP:C:\Program Files\Metin2_France\metin2.exe:metin2 "TCP Query User{65664738-28C3-4EAB-AB2C-B70E68588B70}C:\program files\teamspeak2_rc2\server_windows.exe"= UDP:C:\program files eamspeak2_rc2\server_windows.exe:Server "UDP Query User{E7E9A406-C4D7-41BF-8BF1-A15060AE257D}C:\program files\teamspeak2_rc2\server_windows.exe"= TCP:C:\program files eamspeak2_rc2\server_windows.exe:Server "{60C25528-AE63-48C6-A7C7-A81EF6A94630}"= UDP:C:\Program Files\Teamspeak2_RC2\TeamSpeak.exe:Teamspeak RC2 "{F91A0A54-0084-4909-AAEE-3B825188DF24}"= TCP:C:\Program Files\Teamspeak2_RC2\TeamSpeak.exe:Teamspeak RC2 "TCP Query User{4E36F86F-76F9-4502-A889-CCFAC4228CC7}C:\skype\phone\skype.exe"= UDP:C:\skype\phone\skype.exe:Skype "TCP Query User{745DA644-BAAA-402E-A58F-CEC014CB3432}C:\program files\metin2_france\metin2.bin"= UDP:C:\program files\metin2_france\metin2.bin:metin2.bin "UDP Query User{96DAEB0E-5DF9-44F7-A455-6E1848380577}C:\program files\metin2_france\metin2.bin"= TCP:C:\program files\metin2_france\metin2.bin:metin2.bin "{8E6B8276-37C6-4733-A7B2-65B6E79D65CC}"= UDP:C:\Program Files\GUILD WARS\Gw.exe:GUILD WARS "{0D9EA4F3-F864-4B74-B01D-C72FEFD2A06E}"= TCP:C:\Program Files\GUILD WARS\Gw.exe:GUILD WARS "TCP Query User{D34672FF-FBB7-4438-9088-E0EF131F68B2}C:\program files\glest_3.1.2\glest.exe"= UDP:C:\program files\glest_3.1.2\glest.exe:glest "UDP Query User{1BAB26A5-A2BF-4484-A848-409CC772EEA2}C:\program files\glest_3.1.2\glest.exe"= TCP:C:\program files\glest_3.1.2\glest.exe:glest "TCP Query User{0048870A-F567-4043-A360-21E845C6953A}C:\users\gaetan\c&c sdt\game.exe"= UDP:C:\users\gaetan\c&c sdt\game.exe:game.exe "UDP Query User{098608C5-B191-48B3-9F37-63A5F39ECAC7}C:\users\gaetan\c&c sdt\game.exe"= TCP:C:\users\gaetan\c&c sdt\game.exe:game.exe "{8A5F95CE-0D1A-4C9A-A4E6-CFA204948D49}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\system32\DRIVERS\klim6.sys [2007-01-25 20760] R1 SSHDRV52;SSHDRV52;C:\Windows\system32\drivers\SSHDRV52.sys [2007-10-02 29184] R1 SSHDRV85;SSHDRV85;C:\Windows\system32\drivers\SSHDRV85.sys [2007-12-05 78848] S3 ARCSOFTVIRTUALCAPTURE;Magic-i Virtual Driver;C:\Windows\system32\DRIVERS\ArcSoftVirtualCapture.sys [2006-12-07 17024] S3 PAC207;Webcam 1200;C:\Windows\system32\DRIVERS\PFC027.SYS [2007-06-29 611584] *Newly Created Service* - CATCHME *Newly Created Service* - PROCEXP90 . - - - - ORPHELINS SUPPRIMES - - - - HKCU-Run-WellPhone XT Sagem - C:\Program Files\SmartCom\WellPhone XT Sagem\WellPhone2.exe HKCU-Run-VnrPack20 - C:\Program Files\VnrPack\VnrPack20.exe HKCU-Run-VnrBlock21 - C:\Program Files\VnrBlock\VnrBlock21.exe HKCU-Run-GetModule23 - C:\Program Files\GetModule\GetModule23.exe HKCU-Run-GetPack22 - C:\Program Files\GetPack\GetPack22.exe . ------- Examen supplémentaire ------- . FireFox -: Profile - C:\Users\gaetan\AppData\Roaming\Mozilla\Firefox\Profiles go1i7xo.default\ . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-12 20:58:06 Windows 6.0.6001 Service Pack 1 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . Heure de fin: 2008-10-12 20:59:44 ComboFix-quarantined-files.txt 2008-10-12 18:59:36 Avant-CF: 192 618 807 296 octets libres Après-CF: 192,636,555,264 octets libres 333 --- E O F --- 2008-10-11 12:11:08

gatean · Answer

et b merci sa marche nikel maitenan !!! je v fair de la pub pour le site lool :) !!!

Utilisateur anonyme · Answer

Salut

^^Marie¨¨ M a demandé de prendre la suite car elle est occupé ... ah les meres de familles 

fais ceci :

Copie le texte ci-dessous : 

File:: 
C:\Windows\System32\ezsidmv.dat 
C:\upload_moi_PC-de-gaetan.tar.gz 
C:\Windows\vntb9283.exe 
C:\Windows\bdtb3452.exe 
C:\Windows\System32\vmrnvyfhyslyykzf.exe 
C:\Windows\dwtb2837.exe 

Folder:: 
C:\ToolBar SD 
C:\Users\gaetan\clean 
C:\Program Files\CleanUp!
C:\SDFix 
C:\SDFix-1 
C:\Program Files\Navilog1 
C:\Program Files\SweetIM

Registry:: 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] 
"{EEE6C35D-6118-11DC-9C72-001320C79847}"=-
[-HKEY_CLASSES_ROOT\clsid\{eee6c35d-6118-11dc-9c72-001320c79847}] 
[-HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook.1] 
[-HKEY_CLASSES_ROOT\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}] 
[-HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook] 
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}] 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] 
"{EEE6C35B-6118-11DC-9C72-001320C79847}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] 
"{EEE6C35B-6118-11DC-9C72-001320C79847}"=-
[-HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}] 
[-HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.3] 
[-HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}] 
[-HKEY_CLASSES_ROOT\SWEETIE.SWEETIE] 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
"SweetIM"=-

DirLook:: 
C:\Windows\_detmp.1 
C:\Windows\_detmp.2 


Ouvre le Bloc-Notes puis colle le texte copié. 
(Démarrer\Tous les programmes\Accessoires\Bloc notes.) 
Sauvegarde ce fichier sous le nom de CFScript.txt

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ceci : 

Cela va relancer Combofix, 

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide. 

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal! 

Ne touche à rien tant que le scan n'est pas terminé. 

Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis. 

S'il n'y a pas de rédémarrage, poste quand même les rapports.

gatean · Answer

bonjour , je fé sa desuite ! mais enféte sa va servir a quoi ????

Utilisateur anonyme · Answer

a nettoyer le registe supprimer des fichires nefaste ..

^^Marie^^ · Answer

;;))

gatean · Answer

voila le rapport de combofix en 2 parti sinon sa bug et le message et pa envoier je vien de le fair, et sa a pas marcher et a suivre le rapport Hijackthis

ComboFix 08-10-11.04 - gaetan 2008-10-13 15:52:05.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium   6.0.6001.1.1252.1.1036.18.1244 [GMT 2:00]
Lancé depuis: C:\Users\gaetan\ComboFix.exe
Commutateurs utilisés :: C:\Users\gaetan\CFScript.txt
 * Un nouveau point de restauration a été créé

FILE ::
C:\upload_moi_PC-de-gaetan.tar.gz
C:\Windows\bdtb3452.exe
C:\Windows\dwtb2837.exe
C:\Windows\System32\ezsidmv.dat
C:\Windows\System32\vmrnvyfhyslyykzf.exe
C:\Windows\vntb9283.exe
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\CleanUp!
C:\Program Files\CleanUp!\CleanUp! Web Site.url
C:\Program Files\CleanUp!\CleanUp.cnt
C:\Program Files\CleanUp!\Cleanup.exe
C:\Program Files\CleanUp!\CleanUp.hlp
C:\Program Files\CleanUp!\license.txt
C:\Program Files\CleanUp!eadme.txt
C:\Program Files\CleanUp!\uninstall.exe
C:\Program Files\CleanUp!\uninstall.ini
C:\Program Files\Navilog1
C:\Program Files\Navilog1\Backupnavi\cfdafzwaxs.dat
C:\Program Files\Navilog1\Backupnavi\cfdafzwaxs.exe
C:\Program Files\Navilog1\Backupnavi\docxdymhcb.dat
C:\Program Files\Navilog1\Backupnavi\docxdymhcb.exe
C:\Program Files\Navilog1\Backupnavi\kqobxac.dat
C:\Program Files\Navilog1\Backupnavi\kqobxac.exe
C:\Program Files\Navilog1\Backupnavi\umuqmoa.dat
C:\Program Files\Navilog1\Backupnavi\umuqmoa.exe
C:\Program Files\Navilog1\Backupnavi\umuqmoa_nav.dat
C:\Program Files\Navilog1\Backupnavi\umuqmoa_navps.dat
C:\Program Files\Navilog1\catchme.exe
C:\Program Files\Navilog1\Contents\Filess.bat
C:\Program Files\Navilog1\Contents\Folders.bat
C:\Program Files\Navilog1\Contents\Folderss.bat
C:\Program Files\Navilog1\Contents\Gnc2.bat
C:\Program Files\Navilog1\Contents\Gnc2su.bat
C:\Program Files\Navilog1\Contents\Gncs.bat
C:\Program Files\Navilog1\Contents\Gncssfil.bat
C:\Program Files\Navilog1\Contents\Heurs.bat
C:\Program Files\Navilog1\Contents\Heurss.bat
C:\Program Files\Navilog1\Contents\Orphus.bat
C:\Program Files\Navilog1\Contents\Wlist.bat
C:\Program Files\Navilog1\GetPaths.exe
C:\Program Files\Navilog1\gnc.exe
C:\Program Files\Navilog1
avilog1.bat
C:\Program Files\Navilog1\Navreb.bat
C:\Program Files\Navilog1\oem2ansi.exe
C:\Program Files\Navilog1\Process.exe
C:\Program Files\Navilog1echerok.txt
C:\Program Files\Navilog1eg.exe
C:\Program Files\Navilog1egnavi.reg
C:\Program Files\Navilog1\Report\catchme.log
C:\Program Files\Navilog1\Safebackup\backup_registry.dat
C:\Program Files\Navilog1\Safebackup\HKCU_Run.reg
C:\Program Files\Navilog1\Safebackup\HKLM_Run.reg
C:\Program Files\Navilog1\Safebackup\HKLM_Startupreg.reg
C:\Program Files\Navilog1\Safebackup\HKLM_Uninstall.reg
C:\Program Files\Navilog1	raite.bat
C:\Program Files\Navilog1	raite2.bat
C:\Program Files\Navilog1	raite3.bat
C:\Program Files\Navilog1\unins000.dat
C:\Program Files\Navilog1\unins000.exe
C:\Program Files\SweetIM
C:\Program Files\SweetIM\Messenger\default.xml
C:\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll
C:\Program Files\SweetIM\Messenger\mgAIMAuto.dll
C:\Program Files\SweetIM\Messenger\mgAIMMessengerAdapter.dll
C:\Program Files\SweetIM\Messenger\mgArchive.dll
C:\Program Files\SweetIM\Messenger\mgcommon.dll
C:\Program Files\SweetIM\Messenger\mgcommunication.dll
C:\Program Files\SweetIM\Messenger\mgconfig.dll
C:\Program Files\SweetIM\Messenger\mgFlashPlayer.dll
C:\Program Files\SweetIM\Messenger\mghooking.dll
C:\Program Files\SweetIM\Messenger\mgIEPlayer.dll
C:\Program Files\SweetIM\Messenger\mglogger.dll
C:\Program Files\SweetIM\Messenger\mgMediaPlayer.dll
C:\Program Files\SweetIM\Messenger\mgMsnAuto.dll
C:\Program Files\SweetIM\Messenger\mgMsnMessengerAdapter.dll
C:\Program Files\SweetIM\Messenger\mgsimcommon.dll
C:\Program Files\SweetIM\Messenger\mgSweetIM.dll
C:\Program Files\SweetIM\Messenger\mgUpdateSupport.dll
C:\Program Files\SweetIM\Messenger\mgxml_wrapper.dll
C:\Program Files\SweetIM\Messenger\mgYahooAuto.dll
C:\Program Files\SweetIM\Messenger\mgYahooMessengerAdapter.dll
C:\Program Files\SweetIM\Messenger\msvcp71.dll
C:\Program Files\SweetIM\Messenger\msvcr71.dll
C:\Program Files\SweetIM\Messengeresources\images\AudibleButton.png
C:\Program Files\SweetIM\Messengeresources\images\DisplayPicturesButton.png
C:\Program Files\SweetIM\Messengeresources\images\EmoticonButton.png
C:\Program Files\SweetIM\Messengeresources\images\NudgeButton.png
C:\Program Files\SweetIM\Messengeresources\images\SoundFxButton.png
C:\Program Files\SweetIM\Messengeresources\images\WinksButton.png
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\SweetIM\Toolbars\Internet Explorer\ClearHist.exe
C:\Program Files\SweetIM\Toolbars\Internet Explorer\conf\logger.xml
C:\Program Files\SweetIM\Toolbars\Internet Explorer\default.xml
C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgcommon.dll
C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgconfig.dll
C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
C:\Program Files\SweetIM\Toolbars\Internet Explorer\mglogger.dll
C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgsimcommon.dll
C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgxml_wrapper.dll
C:\Program Files\SweetIM\Toolbars\Internet Explorer\msvcp71.dll
C:\Program Files\SweetIM\Toolbars\Internet Explorer\msvcr71.dll
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\affid.dat
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\basis.xml
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\Bookmarks_23x18.bmp
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\Email_23x18.bmp
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\Games_23x18.bmp
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\Greetingcards_23x18.bmp
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\Logo.bmp
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\Mobile_23x18.bmp
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\Music_23x18.bmp
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\News_23x18.bmp
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\Shoping_23x18.bmp
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\SmileySmile.bmp
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\SmileyWink.bmp
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\sweetimicons.bmp
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources	oolbar.xml
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources\version.txt
C:\SDFix-1
C:\SDFix-1\Add_DBFix_RunOnce_key.inf
C:\SDFix-1\apps\assosfix.reg
C:\SDFix-1\apps\Cghtme.exe
C:\SDFix-1\apps\clb1.txt
C:\SDFix-1\apps\cliptext.exe
C:\SDFix-1\apps\CSweg.exe
C:\SDFix-1\apps\DBFix.inf
C:\SDFix-1\apps\download.exe
C:\SDFix-1\apps\dummy.sys
C:\SDFix-1\apps\Enable_Command_Prompt.inf
C:\SDFix-1\apps\Enable_Command_Prompt.reg
C:\SDFix-1\apps\ERDNT.E_E
C:\SDFix-1\apps\ERDNTDOS.LOC
C:\SDFix-1\apps\ERDNTWIN.LOC
C:\SDFix-1\apps\ERUNT.EXE
C:\SDFix-1\apps\ERUNT.LOC
C:\SDFix-1\apps\fix.reg
C:\SDFix-1\apps\FixBeep.reg
C:\SDFix-1\apps\FixBH.reg
C:\SDFix-1\apps\FixComponents.reg
C:\SDFix-1\apps\FIXCU.reg
C:\SDFix-1\apps\FIXLM.reg
C:\SDFix-1\apps\FixPath.exe
C:\SDFix-1\apps\FixRedir.reg
C:\SDFix-1\apps\FixSchedule.reg
C:\SDFix-1\apps\FixWebCheck.reg
C:\SDFix-1\apps\fixXP.reg
C:\SDFix-1\apps\FixXPsp2.reg
C:\SDFix-1\apps\grep.exe
C:\SDFix-1\apps\HaxdFix.reg
C:\SDFix-1\apps\HPFix.reg
C:\SDFix-1\apps\HPFix2.reg
C:\SDFix-1\apps\HPFix3.reg
C:\SDFix-1\apps\HPFix4.reg
C:\SDFix-1\apps\HPFix5.reg
C:\SDFix-1\apps\HPFix6.reg
C:\SDFix-1\apps\HPFix7.reg
C:\SDFix-1\apps\HPFix8.reg
C:\SDFix-1\apps\HPFix9.reg
C:\SDFix-1\apps\Installed.txt
C:\SDFix-1\apps\isadmin.exe
C:\SDFix-1\apps\leg2.txt
C:\SDFix-1\apps\legacy.txt
C:\SDFix-1\apps\legacybk.txt
C:\SDFix-1\apps\locate.com
C:\SDFix-1\apps\LS.exe
C:\SDFix-1\apps\MD5File.exe
C:\SDFix-1\apps\moveex.exe
C:\SDFix-1\apps\MyGcpvFix.reg
C:\SDFix-1\apps\MyGkFix2.reg
C:\SDFix-1\apps\Process.exe
C:\SDFix-1\apps\procs.exe
C:\SDFix-1\apps\psservice.exe
C:\SDFix-1\apps\Rem.txt
C:\SDFix-1\apps\Rem2.txt
C:\SDFix-1\apps\Replaceegedit.exe
C:\SDFix-1\apps\Replace\w2k\AUTOEXEC.NT
C:\SDFix-1\apps\Replace\w2k\beep.sys
C:\SDFix-1\apps\Replace\w2k\command.com
C:\SDFix-1\apps\Replace\w2k\command.PIF
C:\SDFix-1\apps\Replace\w2k\CONFIG.NT
C:\SDFix-1\apps\Replace\w2k
ull.sys
C:\SDFix-1\apps\Replace\xp\AUTOEXEC.NT
C:\SDFix-1\apps\Replace\xp\beep.sys
C:\SDFix-1\apps\Replace\xp\command.com
C:\SDFix-1\apps\Replace\xp\command.PIF
C:\SDFix-1\apps\Replace\xp\CONFIG.NT
C:\SDFix-1\apps\Replace\xp
ull.sys
C:\SDFix-1\apps\Reset_AppInit_DLLs.reg
C:\SDFix-1\apps\RestartIt!.exe
C:\SDFix-1\apps\Restore_SafeBoot_Windows2000.reg
C:\SDFix-1\apps\Restore_SafeBoot_WindowsXP.reg
C:\SDFix-1\apps\Restore_SafeBoot_WindowsXP_SP2.reg
C:\SDFix-1\apps\Restore_SafeBoot_WindowsXP_SP3.reg
C:\SDFix-1\apps\Restore_SecurityCenter.reg
C:\SDFix-1\apps\Restore_SharedAccess.reg
C:\SDFix-1\apps\sc.exe
C:\SDFix-1\apps\sed.exe
C:\SDFix-1\apps\SF.exe
C:\SDFix-1\apps\shutdown.exe
C:\SDFix-1\apps\srv2.txt
C:\SDFix-1\apps\srv2bk.txt
C:\SDFix-1\apps\svc.txt
C:\SDFix-1\apps\svcbk.txt
C:\SDFix-1\apps\Swreg.exe
C:\SDFix-1\apps\swsc.exe
C:\SDFix-1\apps\unzip.exe
C:\SDFix-1\apps\vfind.exe
C:\SDFix-1\apps\WINMSG.EXE
C:\SDFix-1\apps\winsec.reg
C:\SDFix-1\apps\zip.exe
C:\SDFix-1\catchme.exe
C:\SDFix-1\DBFix.bat
C:\SDFix-1\dummy.sys
C:\SDFix-1\RunThis.bat
C:\SDFix-1\SDFIX_ReadMe_Online.url
C:\SDFix-1\W2K_VirusAlert_Repair.inf
C:\SDFix-1\XP_VirusAlert_Repair.inf
C:\SDFix
C:\SDFix\Add_DBFix_RunOnce_key.inf
C:\SDFix\apps\assosfix.reg
C:\SDFix\apps\Cghtme.exe
C:\SDFix\apps\clb1.txt
C:\SDFix\apps\cliptext.exe
C:\SDFix\apps\CSweg.exe
C:\SDFix\apps\DBFix.inf
C:\SDFix\apps\download.exe
C:\SDFix\apps\dummy.sys
C:\SDFix\apps\Enable_Command_Prompt.inf
C:\SDFix\apps\Enable_Command_Prompt.reg
C:\SDFix\apps\ERDNT.E_E
C:\SDFix\apps\ERDNTDOS.LOC
C:\SDFix\apps\ERDNTWIN.LOC
C:\SDFix\apps\ERUNT.EXE
C:\SDFix\apps\ERUNT.LOC
C:\SDFix\apps\fix.reg
C:\SDFix\apps\FixBeep.reg
C:\SDFix\apps\FixBH.reg
C:\SDFix\apps\FixComponents.reg
C:\SDFix\apps\FIXCU.reg
C:\SDFix\apps\FIXLM.reg
C:\SDFix\apps\FixPath.exe
C:\SDFix\apps\FixRedir.reg
C:\SDFix\apps\FixSchedule.reg
C:\SDFix\apps\FixWebCheck.reg
C:\SDFix\apps\fixXP.reg
C:\SDFix\apps\FixXPsp2.reg
C:\SDFix\apps\grep.exe
C:\SDFix\apps\HaxdFix.reg
C:\SDFix\apps\HPFix.reg
C:\SDFix\apps\HPFix2.reg
C:\SDFix\apps\HPFix3.reg
C:\SDFix\apps\HPFix4.reg
C:\SDFix\apps\HPFix5.reg
C:\SDFix\apps\HPFix6.reg
C:\SDFix\apps\HPFix7.reg
C:\SDFix\apps\HPFix8.reg
C:\SDFix\apps\HPFix9.reg
C:\SDFix\apps\Installed.txt
C:\SDFix\apps\isadmin.exe
C:\SDFix\apps\leg2.txt
C:\SDFix\apps\legacy.txt
C:\SDFix\apps\legacybk.txt
C:\SDFix\apps\locate.com
C:\SDFix\apps\LS.exe
C:\SDFix\apps\MD5File.exe
C:\SDFix\apps\moveex.exe
C:\SDFix\apps\MyGcpvFix.reg
C:\SDFix\apps\MyGkFix2.reg
C:\SDFix\apps\Process.exe
C:\SDFix\apps\procs.exe
C:\SDFix\apps\psservice.exe
C:\SDFix\apps\Rem.txt
C:\SDFix\apps\Rem2.txt
C:\SDFix\apps\Replaceegedit.exe
C:\SDFix\apps\Replace\w2k\AUTOEXEC.NT
C:\SDFix\apps\Replace\w2k\beep.sys
C:\SDFix\apps\Replace\w2k\command.com
C:\SDFix\apps\Replace\w2k\command.PIF
C:\SDFix\apps\Replace\w2k\CONFIG.NT
C:\SDFix\apps\Replace\w2k
ull.sys
C:\SDFix\apps\Replace\xp\AUTOEXEC.NT
C:\SDFix\apps\Replace\xp\beep.sys
C:\SDFix\apps\Replace\xp\command.com
C:\SDFix\apps\Replace\xp\command.PIF
C:\SDFix\apps\Replace\xp\CONFIG.NT
C:\SDFix\apps\Replace\xp
ull.sys
C:\SDFix\apps\Reset_AppInit_DLLs.reg
C:\SDFix\apps\RestartIt!.exe
C:\SDFix\apps\Restore_SafeBoot_Windows2000.reg
C:\SDFix\apps\Restore_SafeBoot_WindowsXP.reg
C:\SDFix\apps\Restore_SafeBoot_WindowsXP_SP2.reg
C:\SDFix\apps\Restore_SafeBoot_WindowsXP_SP3.reg
C:\SDFix\apps\Restore_SecurityCenter.reg
C:\SDFix\apps\Restore_SharedAccess.reg
C:\SDFix\apps\sc.exe
C:\SDFix\apps\sed.exe
C:\SDFix\apps\SF.exe
C:\SDFix\apps\shutdown.exe
C:\SDFix\apps\srv2.txt
C:\SDFix\apps\srv2bk.txt
C:\SDFix\apps\svc.txt
C:\SDFix\apps\svcbk.txt
C:\SDFix\apps\Swreg.exe
C:\SDFix\apps\swsc.exe
C:\SDFix\apps\unzip.exe
C:\SDFix\apps\vfind.exe
C:\SDFix\apps\WINMSG.EXE
C:\SDFix\apps\winsec.reg
C:\SDFix\apps\zip.exe
C:\SDFix\catchme.exe
C:\SDFix\DBFix.bat
C:\SDFix\dummy.sys
C:\SDFix\SDFIX_ReadMe_Online.url
C:\SDFix\W2K_VirusAlert_Repair.inf
C:\SDFix\XP_VirusAlert_Repair.inf
C:\ToolBar SD
C:\ToolBar SD\Autrinf.cmd
C:\ToolBar SD\Back.cmd
C:\ToolBar SD\Backup-TB\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Bob and Bill adventures - Wild Hunting.lnk
C:\ToolBar SD\Backup-TB\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Crazy Blocks.lnk
C:\ToolBar SD\Backup-TB\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Dealio Deskbar.lnk
C:\ToolBar SD\Backup-TB\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Help.url
C:\ToolBar SD\Backup-TB\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Lines.lnk
C:\ToolBar SD\Backup-TB\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\The Battles Of Helicopters.lnk
C:\ToolBar SD\Backup-TB\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Uninstall.lnk
C:\ToolBar SD\Backup-TB\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Video Pool.lnk
C:\ToolBar SD\Backup-TB\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\What is Dealio.url
C:\ToolBar SD\Backup-TB\Program Files\Dealio\Dealio Deskbar.exe
C:\ToolBar SD\Backup-TB\Program Files\Dealio\Dealio.dll
C:\ToolBar SD\Backup-TB\Program Files\Dealio\DealioAU.exe
C:\ToolBar SD\Backup-TB\Program Files\Dealio\DealioRes409.dll
C:\ToolBar SD\Backup-TB\Program Files\Dealio\SearchSettingsKit.exe
C:\ToolBar SD\Backup-TB\Program Files\Search Settings\SearchSettings.dll
C:\ToolBar SD\Backup-TB\Program Files\Search Settings\SearchSettings.exe
C:\ToolBar SD\Backup-TB\Program Files\Search Settings\SearchSettingsRes409.dll
C:\ToolBar SD\Backup-TB\Reg\HKCU_Run.reg
C:\ToolBar SD\Backup-TB\Reg\HKLM_BHO.reg
C:\ToolBar SD\Backup-TB\Reg\HKLM_Classes.reg
C:\ToolBar SD\Backup-TB\Reg\HKLM_Run.reg
C:\ToolBar SD\Backup-TB\Reg\HKLM_ToolBar.reg
C:\ToolBar SD\Backup-TB\Reg\HKLM_Uninstall.reg
C:\ToolBar SD\Backup-TB\Users\gaetan\AppData\Roaming\MICROS~1\Windows\Cookies\gaetan@meacrawler[1].txt
C:\ToolBar SD\Backup-TB\Windows\System32\superiorads-uninst.exe
C:\ToolBar SD\Changelog ToolBar.txt
C:\ToolBar SD\Crack.txt
C:\ToolBar SD\DemP.cmd
C:\ToolBar SD\DirectFix.cmd
C:\ToolBar SD\Discl_en.vbs
C:\ToolBar SD\Discl_fr.vbs
C:\ToolBar SD\Discl_sp.vbs
C:\ToolBar SD\Doss.tbsd
C:\ToolBar SD\Fich.cmd
C:\ToolBar SD\FixExt.cmd
C:\ToolBar SD\Kill.cmd
C:\ToolBar SD\Langues.cmd
C:\ToolBar SD\Orph.egd
C:\ToolBar SD\OsV.exe
C:\ToolBar SD\paths.bat
C:\ToolBar SD\pv.exe
C:\ToolBar SD\Rech.cmd
C:\ToolBar SD\RegP2.txt
C:\ToolBar SD\RegP3.txt
C:\ToolBar SD\RegP4.txt
C:\ToolBar SD\RegP5.txt
C:\ToolBar SD\RegPCU.txt
C:\ToolBar SD\RegPLM.txt
C:\ToolBar SD\RegTBSD.reg
C:\ToolBar SD\RKit.lsd
C:\ToolBar SD\RoGUeS.lsd
C:\ToolBar SD\RunTool.txt
C:\ToolBar SD\sed.exe
C:\ToolBar SD\setpath.exe
C:\ToolBar SD\TB_1.txt
C:\ToolBar SD\TB_2.txt
C:\ToolBar SD\ToolBarSD.cmd
C:\ToolBar SD\ToolBarSD.ico
C:\ToolBar SD\Uninstal.exe
C:\upload_moi_PC-de-gaetan.tar.gz
C:\Users\gaetan\clean
C:\Users\gaetan\clean\cherche.cmd
C:\Users\gaetan\clean\clean.cmd
C:\Users\gaetan\clean\clean.zip
C:\Users\gaetan\clean\CleanUp40.exe
C:\Users\gaetan\clean\del2.cmd
C:\Users\gaetan\clean\del3.cmd
C:\Users\gaetan\clean\delr.cmd
C:\Users\gaetan\clean\delsiri.cmd
C:\Users\gaetan\clean\gzip.exe
C:\Users\gaetan\clean\LFiles.exe
C:\Users\gaetan\clean\pskill.exe
C:\Users\gaetan\cleanemove.reg
C:\Users\gaetan\clean\SDFix.exe
C:\Users\gaetan\clean	ar.exe
C:\Users\gaetan\clean\ToolBarSD.exe
C:\Users\gaetan\clean\upload.txt
C:\Users\gaetan\clean\upload2.txt
C:\Windows\bdtb3452.exe
C:\Windows\dwtb2837.exe
C:\Windows\System32\ezsidmv.dat
C:\Windows\System32\vmrnvyfhyslyykzf.exe
C:\Windows\vntb9283.exe

gatean · Answer

. ((((((((((((((((((((((((((((( Fichiers créés du 2008-09-13 au 2008-10-13 )))))))))))))))))))))))))))))))))))) . 2008-10-12 20:46 . 2008-10-12 20:46 2,939,265 -ra------ C:\Users\gaetan\ComboFix.exe 2008-10-11 14:43 . 2008-10-11 14:43 d-------- C:\Program Files\Trend Micro 2008-10-08 21:36 . 2007-10-28 22:56 838,515 --a------ C:\Windows\_detmp.1 2008-10-08 21:36 . 2000-04-14 11:11 86,016 --a------ C:\Windows\_detmp.2 2008-10-08 17:37 . 2008-10-08 17:37 d-------- C:\GAMES 2008-10-08 17:29 . 2008-10-08 17:29 d-------- C:\Program Files\ppcbooster 2008-10-08 15:09 . 2008-10-08 18:48 d-------- C:\Users\gaetan\jeu 2008-09-22 21:42 . 2008-09-22 21:43 d-------- C:\Program Files\Free Audio Pack 2008-09-22 21:42 . 2000-11-29 04:07 307,200 --a------ C:\Windows\System32\msvcr70.dll 2008-09-22 21:42 . 2003-08-07 17:01 237,568 --a------ C:\Windows\System32\lame_enc.dll 2008-09-22 21:42 . 2004-03-09 01:00 224,016 --a------ C:\Windows\System32\TABCTL32.OCX 2008-09-22 21:42 . 1998-07-13 01:00 141,312 --a------ C:\Windows\System32\MSCMCFR.DLL 2008-09-22 21:42 . 1999-03-25 21:00 101,888 --a------ C:\Windows\System32\VB6STKIT.DLL 2008-09-22 21:42 . 1998-07-13 01:00 59,904 --a------ C:\Windows\System32\Mscc2fr.dll 2008-09-22 21:42 . 1998-07-12 21:00 32,768 --a------ C:\Windows\System32\CMDLGFR.DLL 2008-09-22 21:42 . 1998-07-13 01:00 21,504 --a------ C:\Windows\System32\TABCTFR.DLL 2008-09-22 21:42 . 1998-07-13 01:00 15,360 --a------ C:\Windows\System32\inetfr.DLL . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-13 13:54 32,856,352 --sha-w C:\Windows\system32\drivers\fidbox.dat 2008-10-13 13:37 --------- d-----w C:\Users\gaetan\AppData\Roaming\Skype 2008-10-13 13:35 --------- d-----w C:\Users\gaetan\AppData\Roaming\skypePM 2008-10-13 13:34 --------- d-----w C:\PROGRA~2\Micro Application 2008-10-12 20:33 440,492 --sha-w C:\Windows\system32\drivers\fidbox.idx 2008-10-12 20:15 --------- d-----w C:\Program Files\Warcraft III 2008-10-11 19:20 --------- d-----w C:\Program Files\Jarkanoid 3 2008-10-11 17:58 --------- d-----w C:\Users\gaetan\AppData\Roaming\LimeWire 2008-10-11 10:43 --------- d-----w C:\PROGRA~2\OrbNetworks 2008-10-08 19:36 --------- d-----w C:\Program Files\Tetris 3000 2008-10-08 19:35 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-10-04 17:10 --------- d-----w C:\Program Files\Cossacks - The Art Of War 2008-09-10 18:19 --------- d-----w C:\Program Files\Glest_3.1.2 2008-09-04 21:02 --------- d-----w C:\Users\gaetan\AppData\Roaming\GetRightToGo 2008-08-24 20:04 --------- d-----w C:\Program Files\GUILD WARS 2008-08-19 17:00 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-08-18 21:02 --------- d-----w C:\Users\gaetan\AppData\Roaming eamspeak2 2008-08-18 11:15 --------- d---a-w C:\PROGRA~2\Skype 2008-08-18 11:15 --------- d-----w C:\Program Files\Skype 2008-08-18 11:15 --------- d-----w C:\Program Files\Common Files\Skype 2008-08-15 11:58 --------- d-----w C:\Program Files\American Conquest - Fight Back 2008-08-14 14:59 --------- d-----w C:\Program Files\Metin2_France 2008-08-13 22:15 --------- d-----w C:\Program Files\Windows Mail 2008-08-13 10:14 96,976 ----a-w C:\Windows\system32\drivers\klin.dat 2008-08-13 10:14 87,855 ----a-w C:\Windows\system32\drivers\klick.dat 2008-08-13 09:57 --------- d-----w C:\Program Files\Micro Application 2008-08-13 09:51 --------- d-----w C:\PROGRA~2\Kaspersky Lab 2008-08-02 03:26 36,864 ----a-w C:\Windows\System32\cdd.dll 2008-07-31 03:32 460,288 ----a-w C:\Windows\AppPatch\AcSpecfc.dll 2008-07-31 03:32 28,160 ----a-w C:\Windows\System32\Apphlpdm.dll 2008-07-31 03:32 2,154,496 ----a-w C:\Windows\AppPatch\AcGenral.dll 2008-07-31 03:32 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll 2008-07-31 01:13 4,240,384 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll 2008-07-30 17:30 2,829 ----a-w C:\Windows\DIIUnin.pif 2008-07-30 17:30 102,400 ----a-w C:\Windows\DIIUnin.exe 2008-07-29 11:22 21,840 ----atw C:\Windows\System32\SIntfNT.dll 2008-07-29 11:22 17,212 ----atw C:\Windows\System32\SIntf32.dll 2008-07-29 11:22 12,067 ----atw C:\Windows\System32\SIntf16.dll 2008-07-25 12:00 174 --sha-w C:\Program Files\desktop.ini 2008-07-25 11:33 82,432 ----a-w C:\Windows\System32\axaltocm.dll 2008-07-25 11:33 101,888 ----a-w C:\Windows\System32\ifxcardm.dll 2008-07-19 05:10 53,448 ----a-w C:\Windows\System32\wuauclt.exe 2008-07-19 05:10 45,768 ----a-w C:\Windows\System32\wups2.dll 2008-07-19 05:10 36,552 ----a-w C:\Windows\System32\wups.dll 2008-07-19 05:09 563,912 ----a-w C:\Windows\System32\wuapi.dll 2008-07-19 05:09 1,811,656 ----a-w C:\Windows\System32\wuaueng.dll 2008-07-19 03:44 83,456 ----a-w C:\Windows\System32\wudriver.dll 2008-07-19 03:44 1,524,736 ----a-w C:\Windows\System32\wucltux.dll 2008-07-18 20:08 163,904 ----a-w C:\Windows\System32\wuwebv.dll 2008-07-18 18:44 31,232 ----a-w C:\Windows\System32\wuapp.exe 2008-07-16 01:32 2,048 ----a-w C:\Windows\System32 zres.dll 2008-07-05 20:34 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2008-07-05 20:34 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2008-07-05 20:34 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat 2008-01-03 14:29 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2008-01-03 14:29 32,768 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2008-01-03 14:29 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ---- Directory of C:\Windows\_detmp.1 ---- C:\Windows\_detmp.1\ ---- Directory of C:\Windows\_detmp.2 ---- C:\Windows\_detmp.2\ ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920] "SmpcSys"="C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe" [2007-05-03 1116728] "CursorXP"="C:\Program Files\CursorXP\CursorXP.exe" [2005-01-19 128000] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 125952] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184] "ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032] "Speech Recognition"="C:\Windows\Speech\Common\sapisvr.exe" [2008-01-19 49664] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-05-16 171448] "Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 507904] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-08-12 21741864] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-01-11 232184] "toolbar_eula_launcher"="C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe" [2007-02-20 28672] "NeroFilterCheck"="C:\Windows\system32\NeroCheck.exe" [2001-07-09 155648] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-10-19 286720] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB ealsched.exe" [2008-05-16 185896] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-07-09 36352] "NvSvc"="C:\Windows\system32 vsvc.dll" [2007-09-12 86016] "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-09-12 8497696] "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-09-12 81920] "RtHDVCpl"="RtHDVCpl.exe" [2007-05-10 C:\Windows\RtHDVCpl.exe] "Skytel"="Skytel.exe" [2007-05-07 C:\Windows\SkyTel.exe] C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ ppcbooster.lnk - C:\Program Files\ppcbooster\ppcbooster.exe [2008-10-08 20480] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "FilterAdministratorToken"= 1 (0x1) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "LogonHoursAction"= 2 (0x2) "DontDisplayLogonHoursWarnings"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\MICROA~1\SECURI~1\adialhk.dll,C:\PROGRA~1\MICROA~1\SECURI~1 3hook.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.SP54"= SP5X_32.DLL [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UacDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{A5339627-E33F-4F74-A621-6094E86725B3}"= UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype "{95095CE9-163A-4BDD-B427-20949BDAB151}"= TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype "{5E45B4AF-B939-4CA2-B07A-133AB80FB86B}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{394C6BA2-C96A-4BBD-9F60-4F515EEBA77F}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{FD0C1E39-A528-493F-9760-4C4843F9E02A}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{AE8F2CC7-E273-4232-B1BD-D354146370E4}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{46085E9B-7974-4DC8-9794-D1CC8F4B7376}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{577A7DBF-45D8-4828-B37B-5FDFC66821AB}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "TCP Query User{FFB85EA8-6B9E-4F43-A81F-1DA6E69C6593}C:\program files\jowood\spellforce - diamond edition\spellforce.exe"= UDP:C:\program files\jowood\spellforce - diamond edition\spellforce.exe:SpellForce "UDP Query User{F274A370-0311-4948-9C00-87A5C244DFDC}C:\program files\jowood\spellforce - diamond edition\spellforce.exe"= TCP:C:\program files\jowood\spellforce - diamond edition\spellforce.exe:SpellForce "TCP Query User{985E93B6-BA64-4D9B-ADD7-0CD1AC6DAF25}C:\program files\emule\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule "UDP Query User{3644BD2E-7A11-4783-8710-CEFEB4116421}C:\program files\emule\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule "{90806C1F-8895-440C-B227-08E0D48F0987}"= UDP:C:\Windows\System32\WindowsAnytimeUpgrade.exe:Achat de mise à niveau en ligne "{D446BD00-BBE9-478B-9619-4D452BDB9759}"= TCP:C:\Windows\System32\WindowsAnytimeUpgrade.exe:Achat de mise à niveau en ligne "{DEE7FC4B-D651-41CC-81D7-8F6C3D7205D9}"= UDP:C:\Sierra\Arcanum\Arcanum.exe:Arcanum "{EC54DAB7-FEBA-4550-818E-5C2D411A2B29}"= TCP:C:\Sierra\Arcanum\Arcanum.exe:Arcanum "{263CADE6-F851-450D-96C1-082AB8AA19BA}"= UDP:C:\Program Files\Cossacks - The Art Of War\dmcr.exe:Cossacks - The Art of War "{4C4F4181-AB1A-499D-B561-41DE31A6B5A1}"= TCP:C:\Program Files\Cossacks - The Art Of War\dmcr.exe:Cossacks - The Art of War "{00AE8FAA-9A09-4854-A5D1-EC24CA422CC7}"= UDP:C:\Program Files\Strategy First\Disciples Gold\Exe\Disciple.exe:Disciples - Sacred Lands "{39617411-470F-48F4-A924-CFD9D565AA87}"= TCP:C:\Program Files\Strategy First\Disciples Gold\Exe\Disciple.exe:Disciples - Sacred Lands "{003BCC81-5806-46CD-876C-B72CFCA1ADEA}"= UDP:C:\Program Files\Ubisoft\Heroes of Might and Magic V\bin\H5_Game.exe:Heroes of Might and Magic V "{F239920F-2B88-472B-A5D5-76CA9035B9CE}"= TCP:C:\Program Files\Ubisoft\Heroes of Might and Magic V\bin\H5_Game.exe:Heroes of Might and Magic V "{43A9E2F3-9C50-46F9-9BB9-8F79888FA03A}"= UDP:C:\Program Files\3DO\Heroes of Might and Magic IV\heroes4f.exe:Heroes of Might and Magic IV "{3BEAD466-553E-47FE-9EFF-363A0969C7E2}"= TCP:C:\Program Files\3DO\Heroes of Might and Magic IV\heroes4f.exe:Heroes of Might and Magic IV "{9536B881-DD0F-4B9E-B48F-0F1572E0A1B6}"= UDP:C:\Program Files\Warcraft III\Warcraft III.exe:Warcraft III "{EBBA2F99-F856-45EE-A1F1-7142EBEFDDF0}"= TCP:C:\Program Files\Warcraft III\Warcraft III.exe:Warcraft III "{EE17DB73-4A90-435A-8F2B-C3E107D41848}"= UDP:C:\Program Files\Eidos Interactive\Pyro Studios\Praetorians\Praetorians.exe:Praetorians "{B1E9F990-D2E4-426B-963F-F61AAA926EFE}"= TCP:C:\Program Files\Eidos Interactive\Pyro Studios\Praetorians\Praetorians.exe:Praetorians "{315A0922-576B-4C34-912E-172ADCC367EB}"= UDP:C:\Program Files\Port Royale\PortRoyale.exe:Port Royale "{BD87D139-CC2D-42D2-83A5-9CFAFF9CF995}"= TCP:C:\Program Files\Port Royale\PortRoyale.exe:Port Royale "TCP Query User{DC42F8CF-5A2F-4BFD-92A4-2D4B22296815}C:\windows\system32\dplaysvr.exe"= UDP:C:\windows\system32\dplaysvr.exe:Application d'assistance Microsoft DirectPlay "UDP Query User{61AD9EF0-F75E-43BD-B095-D069C95428D5}C:\windows\system32\dplaysvr.exe"= TCP:C:\windows\system32\dplaysvr.exe:Application d'assistance Microsoft DirectPlay "TCP Query User{A8D9876F-D393-40B8-A956-EB5B51AE5521}C:\program files\internet explorer\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{8667E890-E0C1-4E1D-9947-56DBE1A838C1}C:\program files\internet explorer\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "TCP Query User{035A7B05-D664-4341-B6B0-675BE266701A}C:\program files\warcraft iii\war3.exe"= UDP:C:\program files\warcraft iii\war3.exe:Warcraft III "UDP Query User{C5AE43CF-0B11-4066-B4FC-89C971968756}C:\program files\warcraft iii\war3.exe"= TCP:C:\program files\warcraft iii\war3.exe:Warcraft III "TCP Query User{F2817DE4-BAFD-4FF6-B909-D0E722A92A61}C:\program files\maxis\simcity 3000 world edition\apps\updater\updater.exe"= UDP:C:\program files\maxis\simcity 3000 world edition\apps\updater\updater.exe:SC3UpdaterMFC "UDP Query User{F97870DA-D57B-40CF-88FF-CB7AD76BD659}C:\program files\maxis\simcity 3000 world edition\apps\updater\updater.exe"= TCP:C:\program files\maxis\simcity 3000 world edition\apps\updater\updater.exe:SC3UpdaterMFC "TCP Query User{E951D5EF-F6E7-467A-8B44-F83509473BA6}C:\program files\warzone 2100\warzone2100.exe"= UDP:C:\program files\warzone 2100\warzone2100.exe:Warzone 2100 "UDP Query User{50B8AE86-CC7D-4DD3-A5A8-681CAE5FA1F1}C:\program files\warzone 2100\warzone2100.exe"= TCP:C:\program files\warzone 2100\warzone2100.exe:Warzone 2100 "TCP Query User{03229C4D-E7BE-4981-8383-9142626D2EA8}C:\program files\microsoft games\age of mythology\aomx.exe"= UDP:C:\program files\microsoft games\age of mythology\aomx.exe:Age of Mythology - The Titans Expansion "UDP Query User{986D858B-4E6B-4C2F-8680-B4DA7EDAF5F5}C:\program files\microsoft games\age of mythology\aomx.exe"= TCP:C:\program files\microsoft games\age of mythology\aomx.exe:Age of Mythology - The Titans Expansion "TCP Query User{6912C221-A7D0-4505-A14A-6D759795AF3F}C:\bluebyte\the settlers iv\exe\s4_main.exe"= UDP:C:\bluebyte he settlers iv\exe\s4_main.exe:S4_Main "UDP Query User{825DA880-72D0-47AC-95C1-D7D0C1CFBF84}C:\bluebyte\the settlers iv\exe\s4_main.exe"= TCP:C:\bluebyte he settlers iv\exe\s4_main.exe:S4_Main "TCP Query User{FA1AAFE1-D686-477F-8C7B-46DFC492ECE0}C:\program files\giants\giants.exe"= UDP:C:\program files\giants\giants.exe:Giants "UDP Query User{1AC13B7B-D5AF-4AA7-ABBA-741E73EE8CB6}C:\program files\giants\giants.exe"= TCP:C:\program files\giants\giants.exe:Giants "TCP Query User{8F180B30-77F4-402C-8F7F-0E7E0A772811}C:\program files\dreamcatcher\dungeon lords\dlords.exe"= UDP:C:\program files\dreamcatcher\dungeon lords\dlords.exe:dlords "UDP Query User{1F7CA572-467C-421D-A2FD-D474704478BA}C:\program files\dreamcatcher\dungeon lords\dlords.exe"= TCP:C:\program files\dreamcatcher\dungeon lords\dlords.exe:dlords "{E6942491-2D7E-4373-BBFA-A038575FBDAE}"= UDP:C:\Program Files\Microsoft Games\Age of Empires III\age3x.exe:Age of Empires III - The WarChiefs "{10512A4C-5354-4DED-A488-3BF0D65A5986}"= TCP:C:\Program Files\Microsoft Games\Age of Empires III\age3x.exe:Age of Empires III - The WarChiefs "{20C65265-96D9-4A19-B34E-D406DCFA0F1A}"= UDP:C:\Program Files\Atari\Neverwinter Nights 2 wn2main.exe:Neverwinter Nights 2 Main "{220287E5-AA44-466B-9D32-F6F73593096C}"= TCP:C:\Program Files\Atari\Neverwinter Nights 2 wn2main.exe:Neverwinter Nights 2 Main "{47C66D78-D87D-49E1-B813-B60D6EAA0BFF}"= UDP:C:\Program Files\Atari\Neverwinter Nights 2 wn2main_amdxp.exe:Neverwinter Nights 2 AMD "{C1165618-5246-4897-B163-00E18B76447C}"= TCP:C:\Program Files\Atari\Neverwinter Nights 2 wn2main_amdxp.exe:Neverwinter Nights 2 AMD "{1435300C-09D2-4658-91E4-5C164BD15F2C}"= UDP:C:\Program Files\Atari\Neverwinter Nights 2 wupdate.exe:Neverwinter Nights 2 Updater "{0C5C33D6-DB3E-4F78-9C38-20125F092EB0}"= TCP:C:\Program Files\Atari\Neverwinter Nights 2 wupdate.exe:Neverwinter Nights 2 Updater "{41E719C3-4818-4293-84DB-9BABFF382CC4}"= UDP:C:\Program Files\Atari\Neverwinter Nights 2 wn2server.exe:Neverwinter Nights 2 Server "{E06D12E1-F75F-435E-8854-D808F4365EAA}"= TCP:C:\Program Files\Atari\Neverwinter Nights 2 wn2server.exe:Neverwinter Nights 2 Server "TCP Query User{9DDAF048-3287-46BD-9E53-FC85F7D8A4AC}C:\program files\microsoft games\dungeon siege\dungeonsiege.exe"= UDP:C:\program files\microsoft games\dungeon siege\dungeonsiege.exe:Dungeon Siege Game Executable "UDP Query User{68A9DE2C-0F8B-4689-AD2F-7F274C73E3E3}C:\program files\microsoft games\dungeon siege\dungeonsiege.exe"= TCP:C:\program files\microsoft games\dungeon siege\dungeonsiege.exe:Dungeon Siege Game Executable "TCP Query User{3B1844B2-F152-4446-B412-03398EB8967D}C:\windows\system32\dpnsvr.exe"= UDP:C:\windows\system32\dpnsvr.exe:Serveur Microsoft DirectPlay 8 "UDP Query User{59A8433A-1785-4A27-AC17-2E2412E1110A}C:\windows\system32\dpnsvr.exe"= TCP:C:\windows\system32\dpnsvr.exe:Serveur Microsoft DirectPlay 8 "TCP Query User{2395DCB8-6253-4551-AE0F-3A7006889658}C:\program files\codemasters\worms 4 mayhem\worms 4 mayhem.exe"= UDP:C:\program files\codemasters\worms 4 mayhem\worms 4 mayhem.exe:Worms 4 Mayhem "UDP Query User{5E134F99-A986-4A88-8786-3000C0ACEA78}C:\program files\codemasters\worms 4 mayhem\worms 4 mayhem.exe"= TCP:C:\program files\codemasters\worms 4 mayhem\worms 4 mayhem.exe:Worms 4 Mayhem "TCP Query User{8CB693D6-A8CE-42F8-A038-535B36683717}C:\program files\trackmania nations eswc\tmnationseswc.exe"= UDP:C:\program files rackmania nations eswc mnationseswc.exe:TmNationsESWC "UDP Query User{38D6F906-C58F-4B64-852A-B99543CF097D}C:\program files\trackmania nations eswc\tmnationseswc.exe"= TCP:C:\program files rackmania nations eswc mnationseswc.exe:TmNationsESWC "{24E3B5BF-E5AC-4430-AF66-BBA075F31D22}"= UDP:C:\Program Files\Warcraft III\Frozen Throne.exe:Warcraft III - The Frozen Throne "{3D0A14F5-1760-40D6-A1F8-7F2ACEF42530}"= TCP:C:\Program Files\Warcraft III\Frozen Throne.exe:Warcraft III - The Frozen Throne "TCP Query User{09FA9CD2-64D4-4C5A-A412-DEF58DDBBF1F}C:\program files\limewire\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire "UDP Query User{14D50DFC-4056-4E26-A43B-A2DDD65362DF}C:\program files\limewire\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire "{B4FE32BB-43C8-47AF-882A-1F7ED376DC33}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{6D7EF8BA-406B-498B-BD76-3BF3F54ACD72}"= UDP:4377:H4_4377_TCP "{661046D7-846A-41FF-BA4F-09EDF11AF06E}"= UDP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb "{257B1C6D-F537-4D7E-A96F-B67E1819594E}"= TCP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb "{147B8CF6-4754-4684-97BF-46487EEF0354}"= UDP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray "{F92AE674-A755-4E33-A8FD-29CEE08D927A}"= TCP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray "{4C3AFC98-E1C7-4DF0-BFB8-BD23B2768E5A}"= UDP:C:\Program Files\Winamp Remote\bin\OrbIR.exe:OrbIR "{75226A16-502B-4002-94A7-CE8299DD9CBF}"= TCP:C:\Program Files\Winamp Remote\bin\OrbIR.exe:OrbIR "{2406255A-46C6-4AAB-9F3F-130E58A6CD4E}"= UDP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client "{73BFB7C6-41F5-4728-8D87-35AAC0C19B00}"= TCP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client "{86F538DB-2279-43BB-902A-D118F9CBEC25}"= UDP:C:\Program Files\Diablo II\Diablo II.exe:Diablo II - Lord of Destruction "{39D35ABD-D3C7-4D5C-A042-F712804F4730}"= TCP:C:\Program Files\Diablo II\Diablo II.exe:Diablo II - Lord of Destruction "{1AA52F01-4CD9-40C2-9AD6-9488D13CBFCD}"= UDP:C:\Program Files\Metin2_France\metin2.exe:metin2 "{17C65EC1-655C-4B2E-B30A-93589BA3589D}"= TCP:C:\Program Files\Metin2_France\metin2.exe:metin2 "TCP Query User{65664738-28C3-4EAB-AB2C-B70E68588B70}C:\program files\teamspeak2_rc2\server_windows.exe"= UDP:C:\program files eamspeak2_rc2\server_windows.exe:Server "UDP Query User{E7E9A406-C4D7-41BF-8BF1-A15060AE257D}C:\program files\teamspeak2_rc2\server_windows.exe"= TCP:C:\program files eamspeak2_rc2\server_windows.exe:Server "{60C25528-AE63-48C6-A7C7-A81EF6A94630}"= UDP:C:\Program Files\Teamspeak2_RC2\TeamSpeak.exe:Teamspeak RC2 "{F91A0A54-0084-4909-AAEE-3B825188DF24}"= TCP:C:\Program Files\Teamspeak2_RC2\TeamSpeak.exe:Teamspeak RC2 "TCP Query User{4E36F86F-76F9-4502-A889-CCFAC4228CC7}C:\skype\phone\skype.exe"= UDP:C:\skype\phone\skype.exe:Skype "TCP Query User{745DA644-BAAA-402E-A58F-CEC014CB3432}C:\program files\metin2_france\metin2.bin"= UDP:C:\program files\metin2_france\metin2.bin:metin2.bin "UDP Query User{96DAEB0E-5DF9-44F7-A455-6E1848380577}C:\program files\metin2_france\metin2.bin"= TCP:C:\program files\metin2_france\metin2.bin:metin2.bin "{8E6B8276-37C6-4733-A7B2-65B6E79D65CC}"= UDP:C:\Program Files\GUILD WARS\Gw.exe:GUILD WARS "{0D9EA4F3-F864-4B74-B01D-C72FEFD2A06E}"= TCP:C:\Program Files\GUILD WARS\Gw.exe:GUILD WARS "TCP Query User{D34672FF-FBB7-4438-9088-E0EF131F68B2}C:\program files\glest_3.1.2\glest.exe"= UDP:C:\program files\glest_3.1.2\glest.exe:glest "UDP Query User{1BAB26A5-A2BF-4484-A848-409CC772EEA2}C:\program files\glest_3.1.2\glest.exe"= TCP:C:\program files\glest_3.1.2\glest.exe:glest "TCP Query User{0048870A-F567-4043-A360-21E845C6953A}C:\users\gaetan\c&c sdt\game.exe"= UDP:C:\users\gaetan\c&c sdt\game.exe:game.exe "UDP Query User{098608C5-B191-48B3-9F37-63A5F39ECAC7}C:\users\gaetan\c&c sdt\game.exe"= TCP:C:\users\gaetan\c&c sdt\game.exe:game.exe "{8A5F95CE-0D1A-4C9A-A4E6-CFA204948D49}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\system32\DRIVERS\klim6.sys [2007-01-25 20760] R1 SSHDRV52;SSHDRV52;C:\Windows\system32\drivers\SSHDRV52.sys [2007-10-02 29184] R1 SSHDRV85;SSHDRV85;C:\Windows\system32\drivers\SSHDRV85.sys [2007-12-05 78848] S3 ARCSOFTVIRTUALCAPTURE;Magic-i Virtual Driver;C:\Windows\system32\DRIVERS\ArcSoftVirtualCapture.sys [2006-12-07 17024] S3 PAC207;Webcam 1200;C:\Windows\system32\DRIVERS\PFC027.SYS [2007-06-29 611584] . - - - - ORPHELINS SUPPRIMES - - - - Toolbar-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file) ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-13 15:56:36 Windows 6.0.6001 Service Pack 1 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . Heure de fin: 2008-10-13 15:57:55 ComboFix-quarantined-files.txt 2008-10-13 13:57:50 ComboFix2.txt 2008-10-12 18:59:46 Avant-CF: 190 389 485 568 octets libres Après-CF: 190,369,665,024 octets libres 671 --- E O F --- 2008-10-11 12:11:08

gatean · Answer

et maitenan le rapport de Hijackthis, je croi que c lui parcque les 2 rapport que g on la méme date mé lui a le mon que g donné au dernier fé taleur donc je pense que c lui . . . . enfin bref :) !!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:44:23, on 11/10/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\conime.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Program Files\Winamp\winampa.exe
C:\Windows\System32undll32.exe
C:\Program Files\Micro Application\Securite Internet 2007\avp.exe
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Winamp Remote\bin\OrbTray.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\VnrPack\VnrPack20.exe
C:\Program Files\VnrBlock\VnrBlock21.exe
C:\Program Files\GetModule\GetModule23.exe
C:\Program Files\GetPack\GetPack22.exe
C:\Program Files\ppcbooster\ppcbooster.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32undll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Winamp\elevator.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\program files\winamp toolbar\WinampTbServer.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: Helper Class - {3670A914-63C2-4E67-8C9B-370AE1922143} - C:\Program Files\BChanger\bchanger.dll
O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb127\Dealio.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: DrFlex IE Helper - {8EEB2711-9D21-4f9c-99A1-B7FC5A8CA56A} - C:\Program Files\QdrDrive\QdrDrive20.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: Barre d'outils MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\fr\msntb.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb127\Dealio.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Micro Application\Securite Internet 2007\avp.exe"
O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [WellPhone XT Sagem] "C:\Program Files\SmartCom\WellPhone XT Sagem\WellPhone2.exe" /background
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [Speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [VnrPack20] "C:\Program Files\VnrPack\VnrPack20.exe"
O4 - HKCU\..\Run: [VnrBlock21] "C:\Program Files\VnrBlock\VnrBlock21.exe"
O4 - HKCU\..\Run: [GetModule23] "C:\Program Files\GetModule\GetModule23.exe"
O4 - HKCU\..\Run: [GetPack22] "C:\Program Files\GetPack\GetPack22.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: ppcbooster.lnk = C:\Program Files\ppcbooster\ppcbooster.exe
O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbaresources\en-US\local\search.html
O8 - Extra context menu item: Ajouter à Anti-Banner - C:\Program Files\Micro Application\Securite Internet 2007\ie_banner_deny.htm
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Users\gaetan\AppData\LocalLow\Dealio\kb127es\DealioSearch.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Micro Application\Securite Internet 2007\scieplugin.dll
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O13 - Gopher Prefix: 
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\MICROA~1\SECURI~1\adialhk.dll,C:\PROGRA~1\MICROA~1\SECURI~13hook.dll
O23 - Service: Sécurité Internet 2007 (AVP) - Micro Application - C:\Program Files\Micro Application\Securite Internet 2007\avp.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

Utilisateur anonyme · Answer

télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau. 
double-clique sur OTMoveIt.exe pour le lancer. 
Assure toi que la case Unregister Dll's and Ocx's soit bien cochée 
copie la liste qui se trouve en gras ci-dessous, 
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved. 

C:\Windows\_detmp.1 
C:\Windows\_detmp.2 

clique sur MoveIt! pour lancer la suppression. 
le résultat apparaitra dans le cadre "Results". 
clique sur Exit pour fermer. 
poste le rapport situé dans C:\_OTMoveIt\MovedFiles. 

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

gatean · Answer

voila le rapport 

File move failed. C:\Windows\_detmp.1 scheduled to be moved on reboot.
File move failed. C:\Windows\_detmp.2 scheduled to be moved on reboot.
 
OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 10132008_162518

gatean · Answer

Et maitenant c'est fini ????

Utilisateur anonyme · Answer

fais un clic droit sur hijackthis
choisi executer en tant qu administrateur

fais le scan et post le rapport , je reviens dans 1H

gatean · Answer

voila le rapport

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:51:37, on 13/10/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Program Files\Winamp\winampa.exe
C:\Windows\System32undll32.exe
C:\Program Files\Micro Application\Securite Internet 2007\avp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Windows\System32undll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\ppcbooster\ppcbooster.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
O3 - Toolbar: Barre d'outils MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\fr\msntb.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Micro Application\Securite Internet 2007\avp.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [Speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: ppcbooster.lnk = C:\Program Files\ppcbooster\ppcbooster.exe
O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbaresources\en-US\local\search.html
O8 - Extra context menu item: Ajouter à Anti-Banner - C:\Program Files\Micro Application\Securite Internet 2007\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Micro Application\Securite Internet 2007\scieplugin.dll
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O13 - Gopher Prefix: 
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\MICROA~1\SECURI~1\adialhk.dll,C:\PROGRA~1\MICROA~1\SECURI~13hook.dll
O23 - Service: Sécurité Internet 2007 (AVP) - Micro Application - C:\Program Files\Micro Application\Securite Internet 2007\avp.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

Utilisateur anonyme · Answer

Démarrer > accesoire > executer > tape : services.msc 

- Clic droit sur le service cité - Symantec Lic NetConnect service 
- propriétés 
- et dans "type de démarrage" et mets le sur « désactivé ». 
- Ensuite si le "Status du service" est sur "Démarré" faire : « arrêté » 

Tutorial : https://www.zebulon.fr/dossiers/windows/31-services.html 


désinstal java car pas a jours et telecharge et instal cette version


* pour supprimer les outils/fix utilisés : 

Télécharge ToolsCleaner sur ton bureau. 
--> 
http://pc-system.fr/ 
http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner

# Fais un clic droit sur toolcleaner
# Choisi executer en tant qu administrateur
# Clique sur Recherche et laisse le scan agir ... 
# Clique sur Suppression pour finaliser. 
# Tu peux, si tu le souhaites, te servir des Options facultatives. 
# Clique sur Quitter pour obtenir le rapport. 
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\). 



tuto vista : Désactive et reactive ta restauration

gatean · Answer

je doi désactivé ma restauration ??????

Utilisateur anonyme · Answer

oui desactiver et reactiver ça va la nettoyer aides toi du tuto

gatean · Answer

voila le rapport

[ Rapport ToolsCleaner version 2.2.3 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

C:\Combofix.txt: trouvé !
C:\fixnavi.txt: trouvé !
C:\cleannavi.txt: trouvé !
C:\rapport_clean.txt: trouvé !
C:\TB.txt: trouvé !
C:\Combofix: trouvé !
C:\Qoobox: trouvé !
C:\_OtMoveIt: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\HijackThis: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\Navilog1: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Navilog1: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Navilog1\Navilog1.lnk: trouvé !
C:\Qoobox\Quarantine\C\SDFIX: trouvé !
C:\Qoobox\Quarantine\C\Toolbar SD: trouvé !
C:\Qoobox\Quarantine\C\Program Files\Navilog1: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programmes\HijackThis: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programmes\Navilog1: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HijackThis: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Navilog1: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Navilog1\Navilog1.lnk: trouvé !
C:\Users\gaetan\OtMoveIt2.exe: trouvé !
C:\Users\gaetan\ComboFix.exe: trouvé !
C:\Users\gaetan\hijackthis.log: trouvé !
C:\Users\gaetan\AppData\Local\VirtualStore\Program Files\Trend Micro\HijackThis: trouvé !
C:\Users\gaetan\AppData\Local\VirtualStore\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !
C:\Users\gaetan\Desktop\HijackThis.lnk: trouvé !
C:\Users\gaetan\Documents\hijackthis.log: trouvé !
C:\Users\gaetan\Documents\fixnavi.txt: trouvé !
C:\Users\gaetan\Documents\rapport_clean.txt: trouvé !
C:\Users\gaetan\Documents\TB.txt: trouvé !
C:\Users\gaetan\Documents\Age of mythology - The titans\AOM\HISTORY2\UNITS\avenger.txt: trouvé !
C:\Users\Public\Desktop\Navilog1.lnk: trouvé !

---------------------------------
-->- Suppression: 

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Navilog1\Navilog1.lnk: supprimé !
C:\Users\gaetan\OtMoveIt2.exe: supprimé !
C:\Users\gaetan\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Users\gaetan\Desktop\HijackThis.lnk: supprimé !
C:\Users\Public\Desktop\Navilog1.lnk: supprimé !
C:\Combofix.txt: supprimé !
C:\fixnavi.txt: supprimé !
C:\cleannavi.txt: supprimé !
C:\rapport_clean.txt: supprimé !
C:\TB.txt: supprimé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\Users\gaetan\hijackthis.log: supprimé !
C:\Users\gaetan\AppData\Local\VirtualStore\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\Users\gaetan\Documents\hijackthis.log: supprimé !
C:\Users\gaetan\Documents\fixnavi.txt: supprimé !
C:\Users\gaetan\Documents\rapport_clean.txt: supprimé !
C:\Users\gaetan\Documents\TB.txt: supprimé !
C:\Users\gaetan\Documents\Age of mythology - The titans\AOM\HISTORY2\UNITS\avenger.txt: supprimé !
C:\Combofix: supprimé !
C:\Qoobox: supprimé !
C:\_OtMoveIt: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\HijackThis: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\Navilog1: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Navilog1: supprimé !
C:\Users\gaetan\AppData\Local\VirtualStore\Program Files\Trend Micro\HijackThis: supprimé !

Utilisateur anonyme · Answer

si tu n as pas d autres soucis change le statut du sujet en resolu stp

http://www.commentcamarche.net/faq/sujet 11365 marquer un fil de discussion comme etant resolu

gatean · Answer

okok merci pour tous !!!

Utilisateur anonyme · Answer

de rien gaetan

bonne semaine 

@+

Rapport de recherche Navilog1 - Page 3

Discussions similaires

Newsletters