Windows has detected spyware infectionRésolu/Fermé

Question

Bonjour,
j'ai un pc portable, HP Intel centrino XP V2
depuis hier, j'ai un message dans la barre d'etat qui me met que j'ai un spy, ca m'ouvre des fenetres me disant d'acheter spynomore quand je clic dessus, et je ne peux  anti virus ni aucun anti spy, je n'ai aps de soucis a les installer, mais apres impossiible de les faire demarrer...
J'ai testé plein d'anti spy et aucun ne demarre...
Help me please

mouick · Answer

j'ai trouvé dans le forum le moyen d'ouvrir hyjackthis
voici le txt:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:36:39, on 13/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Inventel\Gateway\wlancfg.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\System32\drivers\ieudinit.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\SpyNoMore\SNM.exe
C:\Documents and Settings\All Users\Application Data
wbgpuly	ipmtufk.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\yvidwhkt.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\DOCUME~1\CELINE~1\LOCALS~1\Temp\~tmp\hmunmlcl98\hmunmlcl98.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Documents and Settings\celine billard\Bureau\HiJ.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F3 - REG:win.ini: load=C:\WINDOWS\System32\drivers\ieudinit.exe
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [SNM] C:\Program Files\SpyNoMore\SNM.exe /startup
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SVCHOST.EXE] C:\WINDOWS\system32\drivers\svchost.exe
O4 - HKCU\..\Run: [strcfgadm] C:\WINDOWS\system32\yvidwhkt.exe
O4 - HKCU\..\Run: [brastk] C:\WINDOWS\system32\brastk.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKLM\..\Policies\Explorer\Run: [MqtgSVC] C:\DOCUME~1\CELINE~1\LOCALS~1\Temp\mqtgsvc.exe /waitservice
O4 - HKLM\..\Policies\Explorer\Run: [PJVKPn003N] C:\Documents and Settings\All Users\Application Data
wbgpuly	ipmtufk.exe
O4 - HKCU\..\Policies\Explorer\Run: [MstInit] C:\DOCUME~1\CELINE~1\LOCALS~1\APPLIC~1\MICROS~1\mstinit.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [PJVKPn003N] C:\Documents and Settings\All Users\Application Data
wbgpuly	ipmtufk.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [DllHst] C:\WINDOWS\dllhst3g.exe /waitservice (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [DllHst] C:\WINDOWS\dllhst3g.exe /waitservice (User 'Default user')
O4 - Startup: .security
O4 - Global Startup: .security
O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {2EF3FB47-7B1E-4536-BA4D-51427BD45DFA} - https://www.pixaco.fr/static/download/pixacodndupload.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{674C9B90-1461-46F6-86E7-F398B0D6087E}: NameServer = 80.10.246.1,80.10.246.132
O20 - AppInit_DLLs: karna.dat
O21 - SSODL: SysMsg - {621483C7-EF15-1660-0E71-00BE5E159BBC} - C:\Program Files\lxgaheb\SysMsg.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SsBeSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\Program Files\Inventel\Gateway\wlancfg.exe

mouick · Answer

est ce que c'est bien ce rapport qu'il vous faut pour m'aider? :)
merci par avance du temps que vous m'accorderez :)

mouick · Answer

help me j'ai du travail, je peux plus taffer, je vais me faire detruire par mon boss :(

chimay8 · Answer

Salut...
si je comprend bien,selon ton message,tu as cliquer sur tout ce qui bouge!!!

quand je clic dessus, et je ne peux anti virus ni aucun anti spy, je n'ai aps de soucis a les installer, mais apres impossiible de les faire demarrer... 
J'ai testé plein d'anti spy et aucun ne demarre...

une petite lecture s'impose
https://forum.malekal.com/viewtopic.php?f=56&t=589

mouick · Answer

oui j'ai cliqué la ou ca me disait de cliquer, en meme temps, je suis blonde :D
non serieusement, je m'en debarrasse comment maintenant? 
parce que mine de rien ca me bloque mes antispy, j'avais spybot? c'est pas bien? 
je fais quoi desinstalle tout les jolis joujoux que j'ai pris sur le net comme antispy et je tente de relancer spybot? je seche un peu a vrai dire :(

chimay8 · Answer

tu as deux infections distinctes
je suppose que tu as des pub aussi?

commence par ici stp

 Télécharge SmitFraudfix de S!Ri, balltrap34 et moe31 
 http://siri.urz.free.fr/Fix/SmitfraudFix.zip  -
en cas de problème avec le premier lien, 
 mirroir: http://72.232.135.12/siri/SmitfraudFix.php 
 
 voila à quoi cela ressemble : http://siri.urz.free.fr/Fix/SmitfraudFix.php
 une aide en vidéo (merci à balltrap34)
 http://pagesperso-orange.fr/rginformatique/section%20virus/smitfraudfix.htm
 
 Désactive les logiciels de protections(antivirus et antispyware)
-- Fais un clic droit puis Extraire tout sur le fichier SmitfraudFix.zip, cela va tout décompresser dans un nouveau dossier SmitFraudfix
-- Ouvre le dossier SmitfraudFix double-clique sur SmitfraudFix.cmd (le .cmd peut ne pas être présent)
-- Choisis l'option 1 et appuie sur Entrée
-- Réponds o (Oui) aux deux questions suivantes si elles sont posées
-- Un rapport sera généré; sauvegarde le dans un dossier.
-- Copie/colle le contenu du rapport ici

mouick · Answer

SmitFraudFix v2.359

Rapport fait à 13:45:04,51, 13/10/2008
Executé à partir de C:\Documents and Settings\celine billard\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Inventel\Gateway\wlancfg.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\System32\drivers\ieudinit.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Documents and Settings\All Users\Application Data
wbgpuly	ipmtufk.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\yvidwhkt.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32	emp1.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

Fichier hosts corrompu !

127.0.0.1	www.legal-at-spybot.info
127.0.0.1	legal-at-spybot.info

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

C:\WINDOWS\karna.dat PRESENT !
C:\WINDOWS\svchost.exe PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\brastk.exe PRESENT !
C:\WINDOWS\system32\karna.dat PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\celine billard


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\celine billard\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\CELINE~1\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 

C:\Program Files\akl\ PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="karna.dat"


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK

C:\WINDOWS\system32\drivers\beep.sys infecté !


»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel(R) PRO/Wireless 3945ABG Network Connection - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{674C9B90-1461-46F6-86E7-F398B0D6087E}: NameServer=80.10.246.1,80.10.246.132
HKLM\SYSTEM\CCS\Services\Tcpip\..\{CEAA0727-4A5D-44AD-AFE6-85DF98DE2E3F}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{674C9B90-1461-46F6-86E7-F398B0D6087E}: NameServer=80.10.246.1,80.10.246.132
HKLM\SYSTEM\CS1\Services\Tcpip\..\{CEAA0727-4A5D-44AD-AFE6-85DF98DE2E3F}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{674C9B90-1461-46F6-86E7-F398B0D6087E}: NameServer=80.10.246.1,80.10.246.132
HKLM\SYSTEM\CS3\Services\Tcpip\..\{674C9B90-1461-46F6-86E7-F398B0D6087E}: NameServer=80.10.246.1,80.10.246.132
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin



J'espere que tu vas trouver, en tout cas dors et deja merci de ton aide

chimay8 · Answer

t'inquiète pas...

Redémarre l'ordinateur en mode sans échec . 
Comment aller en Mode sans échec 
1) Redémarre ton ordi 
2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip" 
3) Tu verras un écran avec options de démarrage apparaître 
4) Choisis la première option : Sans Échec, et valide avec "Entrée" 
5) Choisis ton compte habituel, et non Administrateur (si besoin ... ) 
( ps : n'oublies pas , en mode sans échec , pas de connexion ! Donc copie ou imprime bien les infos ci-dessous ...) 

*Double click sur SmitfraudFix.exe 

* Sélectionnes 2 et presses "Entrée" dans le menu pour supprimer les fichiers responsables de l'infection. 

* A la question: Voulez-vous nettoyer le registre ? répondre O (oui) et presse Entrée afin de débloquer le fond d'écran et supprimer les clés de registre de l'infection. 

( Le correctif déterminera si le fichier wininet.dll est infecté.) 

* A la question: "Corriger le fichier infecté ?" répondre O (oui) et presser Entrée 
pour remplacer le fichier corrompu. 

* Un redémarrage sera peut être nécessaire pour terminer la procédure de nettoyage ( sinon fais le manuellement ) 

Le rapport se trouve à la racine de C\: 
(dans le fichier "rapport.txt") 

ensuite

Télécharge  LOP S&D de Eric71.
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2

Double-clique dessus pour lancer l'installation.
Double-clique sur le raccourci Lop S&D présent sur ton bureau.
Séléctionne la langue souhaitée, puis choisis l'Option 1 ( Recherche )
Patiente jusqu'à la fin du scan.
Poste le rapport généré ( Il se trouve ici: C:\lopR.txt )

Si le Bureau ne réapparaît pas, presse Ctrl + Alt + Suppr , choisis l' onglet Fichier , puis clique sur Nouvelle tâche; tape alors explorer.exe et valide.

mouick · Answer

Merci :)

Voici mon rapport


   --------------------\  Lop S&D 4.2.4-5   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free : Genuine Intel(R) CPU           T2050  @ 1.60GHz )
   BIOS : Ver 1.00PARTTBL
   USER : celine billard ( Administrator )
   BOOT : Normal boot
   C:\ (Local Disk) - NTFS - Total : 66 Go Free : 4 Go
   D:\ (Local Disk) - FAT32 - Total : 7 Go Free : 1 Go
   E:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 02-10-2008|23:42 )
   Option : [1] ( 13/10/2008|14:13 )
 
   --------------------\  Listing des dossiers dans APPLIC~1  

   [10/09/2008|21:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
   [21/09/2008|15:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [12/08/2007|14:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe Systems
   [27/08/2007|21:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [10/10/2006|22:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [15/09/2008|22:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BVRP Software
   [08/02/2008|21:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CanonBJ
   [02/04/2008|16:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CopyPod
   [30/04/2008|19:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
   [13/10/2008|07:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\dqtcdwfo
   [08/12/2006|18:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
   [22/12/2006|22:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Elaborate Bytes
   [12/10/2008|22:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Fighters
   [27/01/2007|17:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [23/09/2008|21:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP
   [11/05/2006|10:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
   [02/04/2008|18:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Intel
   [13/10/2008|07:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\jsnunsfm
   [12/10/2008|20:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab Setup Files
   [19/08/2008|17:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [10/09/2008|16:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
   [22/09/2008|07:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NOS
   [11/05/2006|02:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1
View_Profiles
   [13/10/2008|14:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1
wbgpuly
   [03/01/2008|13:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\River Past G5
   [18/04/2007|18:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Samsung
   [11/05/2006|10:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
   [11/05/2006|10:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sonic
   [04/06/2007|21:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony Corporation
   [13/10/2008|14:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [01/02/2007|23:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
   [12/10/2008|17:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\wfgvilmf
   [29/08/2006|00:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [22/03/2008|22:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

   [10/02/2008|11:03] C:\DOCUME~1\CELINE~1\APPLIC~1\Adobe
   [07/10/2008|07:22] C:\DOCUME~1\CELINE~1\APPLIC~1\AdobeUM
   [27/12/2006|22:21] C:\DOCUME~1\CELINE~1\APPLIC~1\Ahead
   [10/09/2008|22:20] C:\DOCUME~1\CELINE~1\APPLIC~1\Apple Computer
   [10/02/2008|11:02] C:\DOCUME~1\CELINE~1\APPLIC~1\BitTorrent
   [08/10/2008|12:46] C:\DOCUME~1\CELINE~1\APPLIC~1\CopyToDvd
   [06/02/2007|18:21] C:\DOCUME~1\CELINE~1\APPLIC~1\CyberLink
   [08/11/2006|07:44] C:\DOCUME~1\CELINE~1\APPLIC~1\DivX
   [06/02/2007|18:02] C:\DOCUME~1\CELINE~1\APPLIC~1\dvdcss
   [02/12/2006|17:15] C:\DOCUME~1\CELINE~1\APPLIC~1\Elaborate Bytes
   [28/08/2006|19:20] C:\DOCUME~1\CELINE~1\APPLIC~1\Google
   [12/08/2008|11:40] C:\DOCUME~1\CELINE~1\APPLIC~1\GrabIt
   [23/04/2008|13:36] C:\DOCUME~1\CELINE~1\APPLIC~1\Help
   [24/09/2008|08:33] C:\DOCUME~1\CELINE~1\APPLIC~1\HP
   [11/05/2006|10:35] C:\DOCUME~1\CELINE~1\APPLIC~1\Identities
   [23/09/2008|21:11] C:\DOCUME~1\CELINE~1\APPLIC~1\Image Zone Express
   [02/04/2008|18:03] C:\DOCUME~1\CELINE~1\APPLIC~1\Intel
   [03/01/2008|13:08] C:\DOCUME~1\CELINE~1\APPLIC~1\Lavasoft
   [01/09/2006|13:48] C:\DOCUME~1\CELINE~1\APPLIC~1\Leadertech
   [14/05/2008|09:29] C:\DOCUME~1\CELINE~1\APPLIC~1\LimeWire
   [28/08/2006|19:09] C:\DOCUME~1\CELINE~1\APPLIC~1\Macromedia
   [08/09/2006|14:54] C:\DOCUME~1\CELINE~1\APPLIC~1\Media Player Classic
   [10/07/2008|22:58] C:\DOCUME~1\CELINE~1\APPLIC~1\Microsoft
   [12/06/2008|21:39] C:\DOCUME~1\CELINE~1\APPLIC~1\Mozilla
   [22/03/2007|23:28] C:\DOCUME~1\CELINE~1\APPLIC~1\Real
   [18/04/2007|22:19] C:\DOCUME~1\CELINE~1\APPLIC~1\River Past G5
   [18/04/2007|19:32] C:\DOCUME~1\CELINE~1\APPLIC~1\Samsung
   [16/03/2007|22:31] C:\DOCUME~1\CELINE~1\APPLIC~1\SecondLife
   [05/12/2006|19:13] C:\DOCUME~1\CELINE~1\APPLIC~1\Skype
   [02/12/2006|17:01] C:\DOCUME~1\CELINE~1\APPLIC~1\SlySoft
   [01/09/2006|13:48] C:\DOCUME~1\CELINE~1\APPLIC~1\Sonic
   [04/06/2007|22:06] C:\DOCUME~1\CELINE~1\APPLIC~1\Sony Corporation
   [29/08/2006|19:05] C:\DOCUME~1\CELINE~1\APPLIC~1\Sun
   [28/01/2007|11:33] C:\DOCUME~1\CELINE~1\APPLIC~1\Talkback
   [12/06/2008|21:15] C:\DOCUME~1\CELINE~1\APPLIC~1\TaoUSign
   [12/06/2008|21:39] C:\DOCUME~1\CELINE~1\APPLIC~1\Thunderbird
   [06/10/2006|21:46] C:\DOCUME~1\CELINE~1\APPLIC~1\UseNeXT
   [08/10/2008|08:41] C:\DOCUME~1\CELINE~1\APPLIC~1\uTorrent
   [09/11/2006|07:50] C:\DOCUME~1\CELINE~1\APPLIC~1\vlc
   [08/10/2008|12:46] C:\DOCUME~1\CELINE~1\APPLIC~1\Vso
   [19/08/2008|17:41] C:\DOCUME~1\CELINE~1\APPLIC~1\Windows Desktop Search
   [19/08/2008|20:59] C:\DOCUME~1\CELINE~1\APPLIC~1\Windows Search

   [11/05/2006|10:35] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [02/04/2008|18:03] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Intel
   [11/05/2006|02:54] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [02/04/2008|18:03] C:\DOCUME~1\LOCALS~1\APPLIC~1\Intel
   [26/08/2006|00:32] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [02/04/2008|18:03] C:\DOCUME~1\NETWOR~1\APPLIC~1\Intel
   [11/05/2006|02:40] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [08/10/2008 22:32][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [26/03/2007 22:08][--a------] C:\WINDOWS	asks\Critical Battery Alarm Program.job
   [13/10/2008 14:10][--ah-----] C:\WINDOWS	asks\SA.DAT
   [05/08/2004 23:00][-rah-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [21/09/2008|15:30] C:\Program Files\Adobe
   [10/09/2008|21:15] C:\Program Files\Apple Software Update
   [22/07/2008|23:34] C:\Program Files\BitTorrent
   [29/08/2006|00:30] C:\Program Files\CONEXANT
   [24/06/2008|06:46] C:\Program Files\CopyPod
   [27/12/2006|08:27] C:\Program Files\DAEMON Tools
   [10/02/2007|23:25] C:\Program Files\directx
   [07/09/2008|22:46] C:\Program Files\DivX
   [22/12/2006|23:32] C:\Program Files\Elaborate Bytes
   [15/08/2008|16:02] C:\Program Files\Electronic Arts
   [13/10/2008|07:12] C:\Program Files\eMule
   [13/10/2008|11:23] C:\Program Files\Enigma Software Group
   [12/10/2008|17:35] C:\Program Files\Fichiers communs
   [13/10/2008|02:55] C:\Program Files\Fighters
   [07/01/2008|10:03] C:\Program Files\Google
   [29/03/2008|21:45] C:\Program Files\GrabIt
   [18/11/2006|10:28] C:\Program Files\Hewlett-Packard
   [23/09/2008|21:08] C:\Program Files\Hp
   [17/08/2006|22:37] C:\Program Files\HPQ
   [12/10/2008|17:33] C:\Program Files\Inet Delivery
   [15/09/2008|22:36] C:\Program Files\InstallShield Installation Information
   [30/08/2006|21:06] C:\Program Files\Intel
   [19/08/2008|17:06] C:\Program Files\Internet Explorer
   [18/08/2006|01:06] C:\Program Files\Inventel
   [04/05/2008|09:21] C:\Program Files\Iomega
   [10/09/2008|21:14] C:\Program Files\iPod
   [10/09/2008|21:14] C:\Program Files\iTunes
   [20/07/2008|21:50] C:\Program Files\Java
   [01/09/2006|17:10] C:\Program Files\K-Lite Codec Pack
   [12/10/2008|17:19] C:\Program Files\lxgaheb
   [03/01/2008|13:08] C:\Program Files\Macrogaming
   [01/10/2007|21:04] C:\Program Files\MEMO
   [19/08/2008|15:27] C:\Program Files\Messenger
   [27/01/2007|23:31] C:\Program Files\Microsoft ActiveSync
   [10/05/2007|03:01] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [28/08/2006|23:38] C:\Program Files\microsoft frontpage
   [12/06/2008|22:12] C:\Program Files\Microsoft Office
   [19/08/2008|15:29] C:\Program Files\Microsoft Silverlight
   [12/06/2008|22:12] C:\Program Files\Microsoft Works
   [12/06/2008|22:12] C:\Program Files\Microsoft.NET
   [01/01/2008|22:19] C:\Program Files\Mindscape
   [19/08/2008|14:14] C:\Program Files\Movie Maker
   [13/10/2008|14:11] C:\Program Files\Mozilla Firefox
   [13/10/2008|12:12] C:\Program Files\Mozilla Thunderbird
   [18/04/2007|23:21] C:\Program Files\mp3DirectCut
   [05/08/2007|20:42] C:\Program Files\MSBuild
   [11/05/2006|10:35] C:\Program Files\MSN
   [11/05/2006|10:35] C:\Program Files\MSN Gaming Zone
   [26/03/2008|09:01] C:\Program Files\MSN Messenger
   [15/10/2006|00:06] C:\Program Files\MSXML 4.0
   [05/08/2007|20:47] C:\Program Files\MSXML 6.0
   [01/09/2006|18:22] C:\Program Files\Nero
   [19/08/2008|14:12] C:\Program Files\NetMeeting
   [01/09/2006|18:57] C:\Program Files\NetWaiting
   [22/09/2008|07:03] C:\Program Files\NOS
   [29/08/2006|20:59] C:\Program Files\OfficeUpdate11
   [19/08/2008|14:12] C:\Program Files\Outlook Express
   [12/10/2008|17:55] C:\Program Files\PC-Antispy
   [07/01/2008|10:04] C:\Program Files\Picasa2
   [29/03/2008|21:52] C:\Program Files\QuickPar
   [10/09/2008|21:13] C:\Program Files\QuickTime
   [20/01/2007|23:02] C:\Program Files\Real
   [05/08/2007|20:38] C:\Program Files\Reference Assemblies
   [30/03/2008|10:33] C:\Program Files\Roxio
   [10/09/2008|21:28] C:\Program Files\Safari
   [20/07/2008|21:57] C:\Program Files\Samsung
   [22/12/2006|23:32] C:\Program Files\SlySoft
   [04/06/2007|21:33] C:\Program Files\Sony
   [13/10/2008|14:12] C:\Program Files\Spybot - Search & Destroy
   [11/05/2006|02:56] C:\Program Files\Synaptics
   [28/12/2006|22:53] C:\Program Files\THQ
   [11/05/2006|10:35] C:\Program Files\Uninstall Information
   [06/10/2006|19:59] C:\Program Files\UseNeXT
   [22/07/2008|23:41] C:\Program Files\uTorrent
   [09/11/2006|07:45] C:\Program Files\VideoLAN
   [08/10/2008|12:28] C:\Program Files\VSO
   [28/08/2006|23:04] C:\Program Files\Wanadoo
   [19/08/2008|17:41] C:\Program Files\Windows Desktop Search
   [22/03/2008|22:24] C:\Program Files\Windows Live
   [07/11/2006|08:10] C:\Program Files\Windows Media Connect 2
   [19/08/2008|14:12] C:\Program Files\Windows Media Player
   [19/08/2008|14:12] C:\Program Files\Windows NT
   [11/05/2006|10:35] C:\Program Files\WindowsUpdate
   [23/04/2008|13:36] C:\Program Files\WinRAR
   [11/05/2006|10:35] C:\Program Files\xerox

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [23/09/2008|21:37] C:\Program Files\Fichiers communs\Adobe
   [12/08/2007|14:44] C:\Program Files\Fichiers communs\Adobe Systems Shared
   [01/10/2007|23:25] C:\Program Files\Fichiers communs\Ahead
   [10/09/2008|21:13] C:\Program Files\Fichiers communs\Apple
   [12/06/2008|22:12] C:\Program Files\Fichiers communs\DESIGNER
   [03/09/2008|12:03] C:\Program Files\Fichiers communs\Hewlett-Packard
   [11/05/2006|10:35] C:\Program Files\Fichiers communs\HP
   [18/11/2006|15:34] C:\Program Files\Fichiers communs\InstallShield
   [11/05/2006|10:35] C:\Program Files\Fichiers communs\Java
   [27/01/2007|23:31] C:\Program Files\Fichiers communs\LightScribe
   [15/09/2008|22:36] C:\Program Files\Fichiers communs\Microsoft Shared
   [24/10/2007|12:58] C:\Program Files\Fichiers communs\Motorola Shared
   [11/05/2006|10:35] C:\Program Files\Fichiers communs\MSSoap
   [11/05/2006|10:35] C:\Program Files\Fichiers communs\ODBC
   [09/09/2007|08:42] C:\Program Files\Fichiers communs\Real
   [11/05/2006|10:35] C:\Program Files\Fichiers communs\Services
   [30/03/2008|10:33] C:\Program Files\Fichiers communs\Sonic Shared
   [04/06/2007|21:32] C:\Program Files\Fichiers communs\Sony Shared
   [11/05/2006|10:35] C:\Program Files\Fichiers communs\SpeechEngines
   [30/03/2008|10:33] C:\Program Files\Fichiers communs\SureThing Shared
   [01/02/2007|23:01] C:\Program Files\Fichiers communs\Symantec Shared
   [19/08/2008|14:12] C:\Program Files\Fichiers communs\System
   [22/03/2008|22:23] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [09/09/2007|08:42] C:\Program Files\Fichiers communs\xing shared

   --------------------\  Process

   ( 60 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-10-13 14:14:16
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 745
 
   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [F:1446][D:99]-> C:\DOCUME~1\CELINE~1\LOCALS~1\Temp
   [F:15][D:0]-> C:\DOCUME~1\CELINE~1\Cookies
   [F:10266][D:20]-> C:\DOCUME~1\CELINE~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 13/10/2008|14:16 - Option : [1]

   --------------------\  Fin du rapport a 14:16:40

mouick · Answer

pour info la fenetre de windows est toujours la :(

chimay8 · Answer

tu ne m'as pas donner le rapport de smitfraudfix!

tu as fait ceci?

1) Redémarre ton ordi 
2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip" 
3) Tu verras un écran avec options de démarrage apparaître 
4) Choisis la première option : Sans Échec, et valide avec "Entrée" 
5) Choisis ton compte habituel, et non Administrateur (si besoin ... ) 
( ps : n'oublies pas , en mode sans échec , pas de connexion ! Donc copie ou imprime bien les infos ci-dessous ...) 

*Double click sur SmitfraudFix.exe 

* Sélectionnes 2 et presses "Entrée" dans le menu pour supprimer les fichiers responsables de l'infection. 

* A la question: Voulez-vous nettoyer le registre ? répondre O (oui) et presse Entrée afin de débloquer le fond d'écran et supprimer les clés de registre de l'infection. 

( Le correctif déterminera si le fichier wininet.dll est infecté.) 

* A la question: "Corriger le fichier infecté ?" répondre O (oui) et presser Entrée 
pour remplacer le fichier corrompu. 

* Un redémarrage sera peut être nécessaire pour terminer la procédure de nettoyage ( sinon fais le manuellement ) 

Le rapport se trouve à la racine de C\: 
(dans le fichier "rapport.txt")

mouick · Answer

Alors je l'ai refais parce qu'en voulant te mettre le rapport je me suis apercue que ca me demandais de le refaire :)
maintenant ca donne ca:

j'ai aussi une fenetre au demarrage qui me dit que temp2 est introuvable...

J'ai du mal a poster ce truc, en plus il y a des truc ecrit hot ... je suis seule, je n'ai personne qui touche a mon pc :( c'est strange quand meme

SmitFraudFix v2.359

Rapport fait à 15:09:50,07, 13/10/2008
Executé à partir de C:\Documents and Settings\celine billard\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1       localhost
127.0.0.1    www.007guard.com
127.0.0.1    007guard.com
127.0.0.1    008i.com
127.0.0.1    www.008k.com
127.0.0.1    008k.com
127.0.0.1    www.00hq.com
127.0.0.1    00hq.com
127.0.0.1    010402.com
127.0.0.1    www.032439.com
127.0.0.1    032439.com
127.0.0.1    www.100888290cs.com
127.0.0.1    100888290cs.com
127.0.0.1    www.100sexlinks.com
127.0.0.1    100sexlinks.com
127.0.0.1    www.10sek.com
127.0.0.1    10sek.com
127.0.0.1    www.123topsearch.com
127.0.0.1    123topsearch.com
127.0.0.1    www.132.com
127.0.0.1    132.com
127.0.0.1    www.136136.net
127.0.0.1    136136.net
127.0.0.1    www.163ns.com
127.0.0.1    163ns.com
127.0.0.1    171203.com
127.0.0.1    17-plus.com
127.0.0.1    www.1800searchonline.com
127.0.0.1    1800searchonline.com
127.0.0.1    www.180searchassistant.com
127.0.0.1    180searchassistant.com
127.0.0.1    www.180solutions.com
127.0.0.1    180solutions.com
127.0.0.1    www.181.365soft.info
127.0.0.1    181.365soft.info
127.0.0.1    www.1987324.com
127.0.0.1    1987324.com
127.0.0.1    www.1-domains-registrations.com
127.0.0.1    1-domains-registrations.com
127.0.0.1    www.1sexparty.com
127.0.0.1    1sexparty.com
127.0.0.1    www.1stantivirus.com
127.0.0.1    1stantivirus.com
127.0.0.1    www.1stpagehere.com
127.0.0.1    1stpagehere.com
127.0.0.1    www.1stsearchportal.com
127.0.0.1    1stsearchportal.com
127.0.0.1    2.82211.net
127.0.0.1    www.2006ooo.com
127.0.0.1    www.2007-download.com
127.0.0.1    2007-download.com
127.0.0.1    www.2020search.com
127.0.0.1    2020search.com
127.0.0.1    20x2p.com
127.0.0.1    www.24.365soft.info
127.0.0.1    24.365soft.info

mouick · Answer

127.0.0.1    www.24-7pharmacy.info
127.0.0.1    24-7pharmacy.info
127.0.0.1    www.24-7searching-and-more.com
127.0.0.1    24-7searching-and-more.com
127.0.0.1    www.24teen.com
127.0.0.1    24teen.com
127.0.0.1    2ndpower.com
127.0.0.1    www.2search.com
127.0.0.1    2search.com
127.0.0.1    www.2search.org
127.0.0.1    2search.org
127.0.0.1    www.2squared.com
127.0.0.1    2squared.com
127.0.0.1    www.3322.org
127.0.0.1    3322.org
127.0.0.1    365soft.info
127.0.0.1    www.36site.com
127.0.0.1    36site.com
127.0.0.1    3721.com
127.0.0.1    39-93.com
127.0.0.1    www.3bay.it
127.0.0.1    3bay.it
127.0.0.1    www.3xclipsonline.com
127.0.0.1    3xclipsonline.com
127.0.0.1    www.3xcurves.com
127.0.0.1    3xcurves.com
127.0.0.1    www.3xfestival.com
127.0.0.1    3xfestival.com
127.0.0.1    www.3x-festival.com
127.0.0.1    3x-festival.com
127.0.0.1    www.3x-galls.com
127.0.0.1    3x-galls.com
127.0.0.1    www.3xmiracle.com
127.0.0.1    3xmiracle.com
127.0.0.1    www.3xmoviesblog.com
127.0.0.1    3xmoviesblog.com
127.0.0.1    www.404dns.com
127.0.0.1    404dns.com
127.0.0.1    www.4199.com
127.0.0.1    4199.com
127.0.0.1    www.4corn.net
127.0.0.1    4corn.net
127.0.0.1    www.4ebay.it
127.0.0.1    4ebay.it
127.0.0.1    4klm.com
127.0.0.1    www.4mpg.com
127.0.0.1    4mpg.com
127.0.0.1    www.5zgmu7o20kt5d8yq.com
127.0.0.1    5zgmu7o20kt5d8yq.com
127.0.0.1    www.680180.net
127.0.0.1    680180.net
127.0.0.1    www.6sek.com
127.0.0.1    6sek.com
127.0.0.1    www.70-music.com
127.0.0.1    70-music.com
127.0.0.1    www.7322.com
127.0.0.1    7322.com
127.0.0.1    75tz.com
127.0.0.1    www.777search.com
127.0.0.1    777search.com
127.0.0.1    www.777top.com
127.0.0.1    777top.com
127.0.0.1    www.7939.com
127.0.0.1    7939.com
127.0.0.1    www.7search.com
127.0.0.1    7search.com
127.0.0.1    80gw6ry3i3x3qbrkwhxhw.032439.com
127.0.0.1    www.80-music.com
127.0.0.1    80-music.com
127.0.0.1    82211.net
127.0.0.1    8866.org
127.0.0.1    www.8ad.com
127.0.0.1    8ad.com
127.0.0.1    www.90-music.com
127.0.0.1    90-music.com
127.0.0.1    www.9505.com
127.0.0.1    9505.com
127.0.0.1    www.971searchbox.com
127.0.0.1    971searchbox.com
127.0.0.1    a.bestmanage.org
127.0.0.1    www.aaabesthomepage.com
127.0.0.1    aaabesthomepage.com
127.0.0.1    aaasexypics.com
127.0.0.1    www.aaawebfinder.com
127.0.0.1    aaawebfinder.com

mouick · Answer

127.0.0.1    www.aaqadarsztriv.com
127.0.0.1    aaqadarsztriv.com
127.0.0.1    www.aaqada-rsztriv.com
127.0.0.1    aaqada-rsztriv.com
127.0.0.1    www.aaqadaueorn.com
127.0.0.1    aaqadaueorn.com
127.0.0.1    www.aaqada-ueorn.com
127.0.0.1    aaqada-ueorn.com
127.0.0.1    www.aaqada-ygco.com
127.0.0.1    aaqada-ygco.com
127.0.0.1    www.aaqada-ymct.com
127.0.0.1    aaqada-ymct.com
127.0.0.1    aavc.com
127.0.0.1    www.abcdperformance.com
127.0.0.1    abcdperformance.com
127.0.0.1    www.abc-find.info
127.0.0.1    abc-find.info
127.0.0.1    www.abcsearch.com
127.0.0.1    abcsearch.com
127.0.0.1    www.abetterinternet.com
127.0.0.1    abetterinternet.com
127.0.0.1    www.abnetsoft.info
127.0.0.1    abnetsoft.info
127.0.0.1    www.aboutclicker.com
127.0.0.1    aboutclicker.com
127.0.0.1    www.abrp.net
127.0.0.1    abrp.net
127.0.0.1    www.absolutee.com
127.0.0.1    absolutee.com
127.0.0.1    www.ac66.cn
127.0.0.1    ac66.cn
127.0.0.1    access.Navinetwork.com
127.0.0.1    access.rapid-pass.net
127.0.0.1    www.accessactivexvideo.com
127.0.0.1    accessactivexvideo.com
127.0.0.1    www.accessclips.com
127.0.0.1    accessclips.com
127.0.0.1    www.access-dvd.com
127.0.0.1    access-dvd.com
127.0.0.1    www.accesskeygenerator.com
127.0.0.1    accesskeygenerator.com
127.0.0.1    www.accessthefuture.net
127.0.0.1    accessthefuture.net
127.0.0.1    www.accessvid.net
127.0.0.1    accessvid.net
127.0.0.1    www.acemedic.com
127.0.0.1    acemedic.com
127.0.0.1    www.ace-webmaster.com
127.0.0.1    ace-webmaster.com
127.0.0.1    acjp.com
127.0.0.1    www.acrobat-2007.com
127.0.0.1    acrobat-2007.com
127.0.0.1    www.acrobat-8.com
127.0.0.1    acrobat-8.com
127.0.0.1    www.acrobat-center.com
127.0.0.1    acrobat-center.com
127.0.0.1    www.acrobat-hq.com
127.0.0.1    acrobat-hq.com
127.0.0.1    www.acrobatreader-8.com
127.0.0.1    acrobatreader-8.com
127.0.0.1    www.acrobat-reader-8.de
127.0.0.1    acrobat-reader-8.de
127.0.0.1    www.acrobat-stop.com
127.0.0.1    acrobat-stop.com
127.0.0.1    www.actionbreastcancer.org
127.0.0.1    actionbreastcancer.org
127.0.0.1    www.activesearcher.info
127.0.0.1    activesearcher.info
127.0.0.1    www.activexaccessobject.com
127.0.0.1    activexaccessobject.com
127.0.0.1    www.activexaccessvideo.com
127.0.0.1    activexaccessvideo.com
127.0.0.1    www.activexemedia.com
127.0.0.1    activexemedia.com
127.0.0.1    www.activexmediaobject.com
127.0.0.1    activexmediaobject.com
127.0.0.1    www.activexmediapro.com
127.0.0.1    activexmediapro.com
127.0.0.1    www.activexmediasite.com
127.0.0.1    activexmediasite.com
127.0.0.1    www.activexmediasoftware.com
127.0.0.1    activexmediasoftware.com
127.0.0.1    www.activexmediasource.com
127.0.0.1    activexmediasource.com
127.0.0.1    www.activexmediatool.com
127.0.0.1    activexmediatool.com
127.0.0.1    www.activexmediatour.com
127.0.0.1    activexmediatour.com
127.0.0.1    www.activexsoftwares.com
127.0.0.1    activexsoftwares.com
127.0.0.1    www.activexsource.com
127.0.0.1    activexsource.com
127.0.0.1    www.activexupdate.com
127.0.0.1    activexupdate.com
127.0.0.1    www.activexvideo.com
127.0.0.1    activexvideo.com
127.0.0.1    www.activexvideotool.com
127.0.0.1    activexvideotool.com
127.0.0.1    www.ad.marketingsector.com
127.0.0.1    ad.marketingsector.com
127.0.0.1    www.ad.mokead.com
127.0.0.1    ad.mokead.com
127.0.0.1    ad.oinadserver.com
127.0.0.1    ad.outerinfoads.com
127.0.0.1    www.ad25.com
127.0.0.1    ad25.com
127.0.0.1    www.ad45.com
127.0.0.1    ad45.com
127.0.0.1    www.ad77.com
127.0.0.1    ad77.com
127.0.0.1    www.ad86.com
127.0.0.1    ad86.com
127.0.0.1    www.adamsupportgroup.org
127.0.0.1    adamsupportgroup.org
127.0.0.1    www.adarmor.com
127.0.0.1    adarmor.com
127.0.0.1    www.adasearch.com
127.0.0.1    adasearch.com
127.0.0.1    adaware.cc
127.0.0.1    www.adawarenow.com
127.0.0.1    adawarenow.com
127.0.0.1    adchannel.contextplus.net
127.0.0.1    www.addetect.com
127.0.0.1    addetect.com
127.0.0.1    www.add-hhh.info
127.0.0.1    add-hhh.info
127.0.0.1    www.addictivetechnologies.com
127.0.0.1    addictivetechnologies.com
127.0.0.1    www.addictivetechnologies.net
127.0.0.1    addictivetechnologies.net
127.0.0.1    www.addioerrori.com
127.0.0.1    addioerrori.com
127.0.0.1    www.add-manager.com
127.0.0.1    add-manager.com
127.0.0.1    www.adgate.info
127.0.0.1    adgate.info
127.0.0.1    www.adintelligence.net
127.0.0.1    adintelligence.net
127.0.0.1    www.adioserrores.com
127.0.0.1    adioserrores.com
127.0.0.1    www.adipics.com
127.0.0.1    adipics.com
127.0.0.1    www.adlogix.com
127.0.0.1    adlogix.com
127.0.0.1    www.admin2cash.biz
127.0.0.1    admin2cash.biz
127.0.0.1    adnet-plus.com
127.0.0.1    www.adnetserver.com
127.0.0.1    adnetserver.com
127.0.0.1    adobe-download-now.com
127.0.0.1    www.adobe-downloads.com
127.0.0.1    adobe-downloads.com
127.0.0.1    www.adobe-reader-8.fr
127.0.0.1    adobe-reader-8.fr
127.0.0.1    www.adprotect.com
127.0.0.1    adprotect.com
127.0.0.1    ads.centralmedia.ws
127.0.0.1    ads.k8l.info
127.0.0.1    ads.kmpads.com
127.0.0.1    ads.kw.revenue.net
127.0.0.1    ads.marketingsector.com
127.0.0.1    ads.searchingbooth.com
127.0.0.1    ads.z-quest.com
127.0.0.1    ads1.revenue.net
127.0.0.1    www.ads183.com
127.0.0.1    ads183.com
127.0.0.1    www.adscontex.com
127.0.0.1    adscontex.com
127.0.0.1    www.adservices1.enhance.com
127.0.0.1    adservices1.enhance.com
127.0.0.1    adservs.com
127.0.0.1    www.adsextend.net
127.0.0.1    adsextend.net
127.0.0.1    www.adshttp.com
127.0.0.1    adshttp.com
127.0.0.1    www.adsniffer.com
127.0.0.1    adsniffer.com
127.0.0.1    www.adsonwww.com
127.0.0.1    adsonwww.com
127.0.0.1    www.adspics.com
127.0.0.1    adspics.com
127.0.0.1    www.adsrevenue.net
127.0.0.1    adsrevenue.net
127.0.0.1    www.adtrak.net
127.0.0.1    adtrak.net
127.0.0.1    adtrgt.com
127.0.0.1    www.adult777search.info
127.0.0.1    adult777search.info
127.0.0.1    www.adultan.com
127.0.0.1    adultan.com
127.0.0.1    www.adult-engine-search.com
127.0.0.1    adult-engine-search.com
127.0.0.1    www.adult-erotic-guide.net
127.0.0.1    adult-erotic-guide.net
127.0.0.1    www.adultfilmsite.com
127.0.0.1    adultfilmsite.com
127.0.0.1    www.adult-friends-finder.net
127.0.0.1    adult-friends-finder.net
127.0.0.1    adultgambling.org
127.0.0.1    adult-host.org
127.0.0.1    www.adulthyperlinks.com
127.0.0.1    adulthyperlinks.com
127.0.0.1    www.adultmovieplus.com
127.0.0.1    adultmovieplus.com
127.0.0.1    www.adult-mpg.net
127.0.0.1    adult-mpg.net
127.0.0.1    adult-personal.us
127.0.0.1    adultsgames.net
127.0.0.1    www.adultsonlyvids.com
127.0.0.1    adultsonlyvids.com
127.0.0.1    www.adultsper.com
127.0.0.1    adultsper.com
127.0.0.1    www.adulttds.com
127.0.0.1    adulttds.com
127.0.0.1    www.adultzoneworld.com
127.0.0.1    adultzoneworld.com
127.0.0.1    www.advancedcleaner.com
127.0.0.1    advancedcleaner.com

mouick · Answer

127.0.0.1    advcash.biz
127.0.0.1    www.advcash.biz
127.0.0.1    advert.exaccess.ru
127.0.0.1    advertisemoney.info
127.0.0.1    www.advertisemoney.info
127.0.0.1    advertising.paltalk.com
127.0.0.1    www.advertising-money.info
127.0.0.1    advertising-money.info
127.0.0.1    ad-ware.cc
127.0.0.1    ad-w-a-r-e.com
127.0.0.1    www.ad-w-a-r-e.com
127.0.0.1    a-d-w-a-r-e.com
127.0.0.1    www.a-d-w-a-r-e.com
127.0.0.1    adware.pro
127.0.0.1    www.adware.pro
127.0.0.1    www.adwarealert.com
127.0.0.1    adwarealert.com
127.0.0.1    ad-warealert.com
127.0.0.1    www.ad-warealert.com
127.0.0.1    www.adwarearrest.com
127.0.0.1    adwarearrest.com
127.0.0.1    adwarebazooka.com
127.0.0.1    www.adwarebazooka.com
127.0.0.1    www.adwarecommander.com
127.0.0.1    adwarecommander.com
127.0.0.1    adwarefinder.com
127.0.0.1    www.adwarefinder.com
127.0.0.1    adwaregold.com
127.0.0.1    www.adwaregold.com
127.0.0.1    adwarepatrol.com
127.0.0.1    www.adwarepatrol.com
127.0.0.1    www.adwareplatinum.com
127.0.0.1    adwareplatinum.com
127.0.0.1    adwareprotectionsite.com
127.0.0.1    www.adwareprotectionsite.com
127.0.0.1    www.adwarepunisher.com
127.0.0.1    adwarepunisher.com
127.0.0.1    adwareremover.ws
127.0.0.1    www.adwareremover.ws
127.0.0.1    www.adwaresafety.com
127.0.0.1    adwaresafety.com
127.0.0.1    adwarexp.com
127.0.0.1    www.adwarexp.com
127.0.0.1    affiliate.idownload.com
127.0.0.1    aflgate.com
127.0.0.1    www.aflgate.com
127.0.0.1    africaspromise.org
127.0.0.1    agava.com
127.0.0.1    agava.ru
127.0.0.1    agentstudio.com
127.0.0.1    aginegialle.it
127.0.0.1    www.aginegialle.it
127.0.0.1    www.Ahnenforschung.de
127.0.0.1    Ahnenforschung.de
127.0.0.1    Ahnenforschung.de
127.0.0.1    www.aifind.info
127.0.0.1    aifind.info
127.0.0.1    airtleworld.com
127.0.0.1    www.airtleworld.com
127.0.0.1    aitalia.it
127.0.0.1    www.aitalia.it
127.0.0.1    akamai.downloadv3.com
127.0.0.1    aklitalia.it
127.0.0.1    www.aklitalia.it
127.0.0.1    akril.com
127.0.0.1    alcatel.ws
127.0.0.1    www.alertspy.com
127.0.0.1    alertspy.com
127.0.0.1    alfacleaner.com
127.0.0.1    www.alfacleaner.com
127.0.0.1    alfa-search.com
127.0.0.1    www.alialia.it
127.0.0.1    alialia.it
127.0.0.1    www.aliotalia.it
127.0.0.1    aliotalia.it
127.0.0.1    alirtalia.it
127.0.0.1    www.alirtalia.it
127.0.0.1    www.alitaia.it
127.0.0.1    alitaia.it
127.0.0.1    www.alitaklia.it
127.0.0.1    alitaklia.it
127.0.0.1    alitala.it
127.0.0.1    www.alitala.it
127.0.0.1    alitali.it
127.0.0.1    www.alitali.it
127.0.0.1    www.alitaliaq.it
127.0.0.1    alitaliaq.it
127.0.0.1    www.alitalias.it
127.0.0.1    alitalias.it
127.0.0.1    www.alitaliaz.it
127.0.0.1    alitaliaz.it
127.0.0.1    alitalioa.it
127.0.0.1    www.alitalioa.it
127.0.0.1    www.alitalisa.it
127.0.0.1    alitalisa.it
127.0.0.1    alitaliua.it
127.0.0.1    www.alitaliua.it
127.0.0.1    www.alitalkia.it
127.0.0.1    alitalkia.it
127.0.0.1    www.alitaloia.it
127.0.0.1    alitaloia.it
127.0.0.1    alitaluia.it
127.0.0.1    www.alitaluia.it
127.0.0.1    alitaslia.it
127.0.0.1    www.alitaslia.it
127.0.0.1    www.alitlia.it
127.0.0.1    alitlia.it
127.0.0.1    www.alitralia.it
127.0.0.1    alitralia.it
127.0.0.1    alitsalia.it
127.0.0.1    www.alitsalia.it
127.0.0.1    www.aliutalia.it
127.0.0.1    aliutalia.it
127.0.0.1    www.ALL1COUNT.NET
127.0.0.1    ALL1COUNT.NET
127.0.0.1    www.all4internet.com
127.0.0.1    all4internet.com
127.0.0.1    allabtcars.com
127.0.0.1    allabtjeeps.com
127.0.0.1    www.all-bittorrent.com
127.0.0.1    all-bittorrent.com
127.0.0.1    www.allcollisions.com
127.0.0.1    allcollisions.com
127.0.0.1    allcybersearch.com
127.0.0.1    www.allcybersearch.com
127.0.0.1    www.alldnserrors.com
127.0.0.1    alldnserrors.com
127.0.0.1    www.all-downloads-now.com
127.0.0.1    all-downloads-now.com
127.0.0.1    all-edonkey.com
127.0.0.1    www.all-edonkey.com
127.0.0.1    www.allertaminacce.com
127.0.0.1    allertaminacce.com
127.0.0.1    allforadult.com
127.0.0.1    allhyperlinks.com
127.0.0.1    www.alliesecurity.com
127.0.0.1    alliesecurity.com
127.0.0.1    all-inet.com

mouick · Answer

127.0.0.1    allinternetbusiness.com
127.0.0.1    all-limewire.com
127.0.0.1    www.all-limewire.com
127.0.0.1    allmegabucks.com
127.0.0.1    www.allmegabucks.com
127.0.0.1    www.allprotections.com
127.0.0.1    allprotections.com
127.0.0.1    www.allresultz.net
127.0.0.1    allresultz.net
127.0.0.1    allsearch.us
127.0.0.1    www.allsearch.us
127.0.0.1    www.allsecuritynotes.com
127.0.0.1    allsecuritynotes.com
127.0.0.1    www.allsecuritysite.com
127.0.0.1    allsecuritysite.com
127.0.0.1    allstarsvideos.net
127.0.0.1    www.allstarsvideos.net
127.0.0.1    alltiettantivirus.com
127.0.0.1    www.alltiettantivirus.com
127.0.0.1    www.alltruesoftware.com
127.0.0.1    alltruesoftware.com
127.0.0.1    www.allvideoactivex.com
127.0.0.1    allvideoactivex.com
127.0.0.1    www.almanah.biz
127.0.0.1    almanah.biz
127.0.0.1    almarvideos.com
127.0.0.1    www.aloitalia.it
127.0.0.1    aloitalia.it
127.0.0.1    aluitalia.it
127.0.0.1    www.aluitalia.it
127.0.0.1    www.amaena.com
127.0.0.1    amaena.com
127.0.0.1    amandamountains.com
127.0.0.1    amateurliveshow.com
127.0.0.1    www.amateurliveshow.com
127.0.0.1    amediasoftware.com
127.0.0.1    www.amediasoftware.com
127.0.0.1    amediasource.com
127.0.0.1    www.amediasource.com
127.0.0.1    www.americanautobargains.com
127.0.0.1    americanautobargains.com
127.0.0.1    americancarbargains.com
127.0.0.1    www.americancarbargains.com
127.0.0.1    american-teens.net
127.0.0.1    amigeek.com
127.0.0.1    amigobore.com
127.0.0.1    www.amigobore.com
127.0.0.1    amisbusiness.com
127.0.0.1    ampmsearch.com
127.0.0.1    www.ampmsearch.com
127.0.0.1    analcord.com
127.0.0.1    www.analcord.com
127.0.0.1    analmovi.com
127.0.0.1    anarchylolita.com
127.0.0.1    www.anarchylolita.com
127.0.0.1    anarchyporn.com
127.0.0.1    www.andromedical.com
127.0.0.1    andromedical.com
127.0.0.1    www.animepornmag.com
127.0.0.1    animepornmag.com
127.0.0.1    anin.org
127.0.0.1    www.anjpn-avxiz.biz
127.0.0.1    anjpn-avxiz.biz
127.0.0.1    www.anjpnzqav.biz
127.0.0.1    anjpnzqav.biz
127.0.0.1    www.anjpn-zqav.biz
127.0.0.1    anjpn-zqav.biz
127.0.0.1    annaromeo.com
127.0.0.1    www.antiddos.us
127.0.0.1    antiddos.us
127.0.0.1    Antiespiadorado.com
127.0.0.1    www.Antiespiadorado.com
127.0.0.1    www.Antiespionspack.com
127.0.0.1    Antiespionspack.com
127.0.0.1    Antigusanos2008.com
127.0.0.1    www.Antigusanos2008.com
127.0.0.1    antispamassistant.com
127.0.0.1    www.antispamassistant.com
127.0.0.1    www.antispamdeluxe.com
127.0.0.1    antispamdeluxe.com
127.0.0.1    www.Antispionage.com
127.0.0.1    Antispionage.com
127.0.0.1    Antispionagepro.com
127.0.0.1    www.Antispionagepro.com
127.0.0.1    www.antispyadvanced.com
127.0.0.1    antispyadvanced.com
127.0.0.1    www.antispydns.biz
127.0.0.1    antispydns.biz
127.0.0.1    antispykit.com
127.0.0.1    www.antispykit.com
127.0.0.1    antispylab.com
127.0.0.1    www.antispylab.com
127.0.0.1    www.antispyshield.com
127.0.0.1    antispyshield.com
127.0.0.1    www.antispysolutions.com
127.0.0.1    antispysolutions.com
127.0.0.1    www.antispyware.com
127.0.0.1    antispyware.com
127.0.0.1    www.antispywareboot.com
127.0.0.1    antispywareboot.com
127.0.0.1    www.antispywarebot.com
127.0.0.1    antispywarebot.com
127.0.0.1    antispywarebox.com
127.0.0.1    www.antispywarebox.com
127.0.0.1    antispywaredownloads.com
127.0.0.1    www.antispywaredownloads.com
127.0.0.1    www.Antispywaresuite.com
127.0.0.1    antispywaresuite.com
127.0.0.1    www.antispywareupdates.net
127.0.0.1    antispywareupdates.net
127.0.0.1    antispywarexp.com
127.0.0.1    www.antispywarexp.com
127.0.0.1    Antispyweb.net
127.0.0.1    www.Antispyweb.net
127.0.0.1    www.Antiver2008.com
127.0.0.1    Antiver2008.com
127.0.0.1    www.antivermins.com
127.0.0.1    antivermins.com
127.0.0.1    anti-vermins.com
127.0.0.1    www.anti-vermins.com
127.0.0.1    www.antivir2007.com
127.0.0.1    antivir2007.com
127.0.0.1    www.antivirgear.com
127.0.0.1    antivirgear.com
127.0.0.1    www.antivirus.fastfreedownload.com
127.0.0.1    antivirus.fastfreedownload.com
127.0.0.1    antivirusadvance.com
127.0.0.1    www.antivirusadvance.com
127.0.0.1    antivirusaskeladd.com
127.0.0.1    www.antivirusaskeladd.com
127.0.0.1    www.antivirusgereedschap.com
127.0.0.1    antivirusgereedschap.com
127.0.0.1    www.antivirusgolden.com
127.0.0.1    antivirusgolden.com
127.0.0.1    www.antivirus-hq.net
127.0.0.1    antivirus-hq.net
127.0.0.1    www.antiviruspcsuite.com
127.0.0.1    antiviruspcsuite.com
127.0.0.1    www.antiviruspremium.com
127.0.0.1    antiviruspremium.com
127.0.0.1    anti-virus-pro.com
127.0.0.1    www.anti-virus-pro.com
127.0.0.1    www.antivirusprotector.com
127.0.0.1    antivirusprotector.com
127.0.0.1    www.antivirusscherm.com
127.0.0.1    antivirusscherm.com
127.0.0.1    antivirussecuritypro.com
127.0.0.1    www.antivirussecuritypro.com

mouick · Answer

127.0.0.1    www.antivirus-stop.com
127.0.0.1    antivirus-stop.com
127.0.0.1    antiworm2008.com
127.0.0.1    www.antiworm2008.com
127.0.0.1    Antiwurm2008.com
127.0.0.1    www.Antiwurm2008.com
127.0.0.1    antrocity.com
127.0.0.1    anyofus.com
127.0.0.1    www.anyofus.com
127.0.0.1    anysn.seproger.com
127.0.0.1    www.anysn.seproger.com
127.0.0.1    anything4health.com
127.0.0.1    apicpreview.com
127.0.0.1    www.apicpreview.com
127.0.0.1    www.appealcircuit.com
127.0.0.1    appealcircuit.com
127.0.0.1    www.approvedlinks.com
127.0.0.1    approvedlinks.com
127.0.0.1    apps.deskwizz.com
127.0.0.1    apps.webservicehost.com
127.0.0.1    aprotectedpage.com
127.0.0.1    www.aprotectedpage.com
127.0.0.1    apsua.com
127.0.0.1    www.archivioadulti.com
127.0.0.1    archivioadulti.com
127.0.0.1    archiviosex.net
127.0.0.1    www.archiviosex.net
127.0.0.1    aregay.com
127.0.0.1    ares.click-new-download.com
127.0.0.1    www.ares.click-new-download.com
127.0.0.1    www.ares-freebie.com
127.0.0.1    ares-freebie.com
127.0.0.1    www.arespro2007.com
127.0.0.1    arespro2007.com
127.0.0.1    www.aresultra.com
127.0.0.1    aresultra.com
127.0.0.1    ares-usa.com
127.0.0.1    www.ares-usa.com
127.0.0.1    arheo.com
127.0.0.1    arizonaweb.org
127.0.0.1    armitageinn.com
127.0.0.1    www.arquivojpgs.smtp.ru
127.0.0.1    arquivojpgs.smtp.ru
127.0.0.1    artachnid.com
127.0.0.1    art-func.com
127.0.0.1    art-xxx.com
127.0.0.1    www.asafebrowser.com
127.0.0.1    asafebrowser.com
127.0.0.1    asafetyalways.com
127.0.0.1    www.asafetyalways.com
127.0.0.1    asafetynotice.com
127.0.0.1    www.asafetynotice.com
127.0.0.1    www.asafetypage.com
127.0.0.1    asafetypage.com
127.0.0.1    www.asdbiz.biz
127.0.0.1    asdbiz.biz
127.0.0.1    www.asdeykuddq.com
127.0.0.1    asdeykuddq.com
127.0.0.1    www.asecurebar.com
127.0.0.1    asecurebar.com
127.0.0.1    www.asecureboard.com
127.0.0.1    asecureboard.com
127.0.0.1    asecurevalue.com
127.0.0.1    www.asecurevalue.com
127.0.0.1    www.asecurityissue.com
127.0.0.1    asecurityissue.com
127.0.0.1    asecuritynotice.com
127.0.0.1    www.asecuritynotice.com
127.0.0.1    asecuritypaper.com
127.0.0.1    www.asecuritypaper.com
127.0.0.1    asecuritystuff.com
127.0.0.1    www.asecuritystuff.com
127.0.0.1    asiankingkong.com
127.0.0.1    asianpornmag.com
127.0.0.1    www.asianpornmag.com
127.0.0.1    asiantoolbar.com
127.0.0.1    www.asiantoolbar.com
127.0.0.1    www.asidseiupc.com
127.0.0.1    asidseiupc.com
127.0.0.1    aslitalia.it
127.0.0.1    www.aslitalia.it
127.0.0.1    ass-gals.com
127.0.0.1    www.assureprotection.com
127.0.0.1    assureprotection.com
127.0.0.1    asta-killer.com
127.0.0.1    astrologie-server.com
127.0.0.1    www.astrologie-server.com
127.0.0.1    astrologie-server.com
127.0.0.1    asupereva.it
127.0.0.1    www.asupereva.it
127.0.0.1    ataprogram.com
127.0.0.1    www.ataprogram.com
127.0.0.1    athenrye.com
127.0.0.1    www.atotalsafety.com
127.0.0.1    atotalsafety.com
127.0.0.1    www.atrueprotection.com
127.0.0.1    atrueprotection.com
127.0.0.1    atruesecurity.com
127.0.0.1    www.atruesecurity.com
127.0.0.1    attackware.com
127.0.0.1    www.attackware.com
127.0.0.1    www.attrezzi.biz
127.0.0.1    attrezzi.biz
127.0.0.1    www.aucunsvirus.com
127.0.0.1    aucunsvirus.com
127.0.0.1    www.aulde.net
127.0.0.1    aulde.net
127.0.0.1    www.aupereva.it
127.0.0.1    aupereva.it
127.0.0.1    autobargains.org
127.0.0.1    www.autobargains.org
127.0.0.1    www.autobargainsnetwork.com
127.0.0.1    autobargainsnetwork.com
127.0.0.1    www.autocontext.begun.ru
127.0.0.1    autocontext.begun.ru
127.0.0.1    autoescrowpay.com
127.0.0.1    www.avadvance.com
127.0.0.1    avadvance.com
127.0.0.1    avast.free-software-center.com
127.0.0.1    www.avast.free-software-center.com
127.0.0.1    avast-2007.com
127.0.0.1    www.avast-2007.com
127.0.0.1    avast-downloads.com
127.0.0.1    www.avast-downloads.com
127.0.0.1    avast-hq.com
127.0.0.1    www.avast-hq.com
127.0.0.1    www.avforce.com
127.0.0.1    avforce.com
127.0.0.1    www.avg.grab-it-today.net
127.0.0.1    avg.grab-it-today.net
127.0.0.1    avg.softwarecenterz.com
127.0.0.1    www.avg.softwarecenterz.com
127.0.0.1    avg-secure.com
127.0.0.1    www.avg-secure.com
127.0.0.1    aviadaptation.com
127.0.0.1    www.aviadaptation.com
127.0.0.1    avian-ads.com
127.0.0.1    www.avicoupler.com
127.0.0.1    avicoupler.com
127.0.0.1    avideoaxaccess.com
127.0.0.1    www.avideoaxaccess.com
127.0.0.1    www.avideosurfer.com
127.0.0.1    avideosurfer.com
127.0.0.1    www.avidirection.com
127.0.0.1    avidirection.com
127.0.0.1    www.aviewersoft.com
127.0.0.1    aviewersoft.com
127.0.0.1    www.avpcheckupdate.com
127.0.0.1    avpcheckupdate.com
127.0.0.1    www.avsmanufacture.com
127.0.0.1    avsmanufacture.com
127.0.0.1    www.avsystemcare.com
127.0.0.1    avsystemcare.com
127.0.0.1    www.avxizaaqada.biz
127.0.0.1    avxizaaqada.biz
127.0.0.1    avxiz-anjpn.biz
127.0.0.1    www.avxiz-anjpn.biz
127.0.0.1    www.avxizueorn.biz
127.0.0.1    avxizueorn.biz
127.0.0.1    avxiz-ueorn.biz
127.0.0.1    www.avxiz-ueorn.biz
127.0.0.1    avxiz-vtvcp.biz
127.0.0.1    www.avxiz-vtvcp.biz
127.0.0.1    www.avxiz-ygco.biz
127.0.0.1    avxiz-ygco.biz
127.0.0.1    www.avxiz-zqav.biz
127.0.0.1    avxiz-zqav.biz
127.0.0.1    www.awarenesstech.com
127.0.0.1    awarenesstech.com
127.0.0.1    awarninglist.com
127.0.0.1    www.awarninglist.com
127.0.0.1    awbeta.net-nucleus.com
127.0.0.1    awesomehomepage.com
127.0.0.1    www.awesomehomepage.com
127.0.0.1    awmcash.biz
127.0.0.1    awmdabest.com
127.0.0.1    axemediasoftware.com
127.0.0.1    www.axemediasoftware.com
127.0.0.1    www.aximageobject.com
127.0.0.1    aximageobject.com
127.0.0.1    www.axmediaproject.com
127.0.0.1    axmediaproject.com
127.0.0.1    www.axmediasoftware.com
127.0.0.1    axmediasoftware.com
127.0.0.1    axmediasolutions.com
127.0.0.1    www.axmediasolutions.com
127.0.0.1    www.axobjectpage.com
127.0.0.1    axobjectpage.com
127.0.0.1    www.axobjectsource.com
127.0.0.1    axobjectsource.com
127.0.0.1    www.axsoftwaretool.com
127.0.0.1    axsoftwaretool.com
127.0.0.1    www.axvideoproject.com
127.0.0.1    axvideoproject.com
127.0.0.1    axvideosetup.com
127.0.0.1    www.axvideosetup.com
127.0.0.1    ayakawamura.com
127.0.0.1    ayb.dns-look-up.com
127.0.0.1    ayb.netbios-wait.com
127.0.0.1    ayumitaniguchi.com
127.0.0.1    azebar.com
127.0.0.1    azureusclub.com
127.0.0.1    www.azureusclub.com
127.0.0.1    www.azureus-freebie.com
127.0.0.1    azureus-freebie.com
127.0.0.1    www.azzetta.it
127.0.0.1    azzetta.it
127.0.0.1    b.casalemedia.com
127.0.0.1    b122.mcboo.com
127.0.0.1    www.babe.k-lined.com
127.0.0.1    babe.k-lined.com
127.0.0.1    www.babe.the-killer.bz
127.0.0.1    babe.the-killer.bz
127.0.0.1    www.babenet.com
127.0.0.1    babenet.com
127.0.0.1    www.babespornmag.com
127.0.0.1    babespornmag.com
127.0.0.1    babeweb.de
127.0.0.1    www.babeweb.de
127.0.0.1    baccarat-other.info
127.0.0.1    www.baccarat-other.info
127.0.0.1    www.Backstripgirls.com
127.0.0.1    Backstripgirls.com
127.0.0.1    backup.mabou.org
127.0.0.1    www.balotierra.com
127.0.0.1    balotierra.com
127.0.0.1    bannedhost.net
127.0.0.1    barbudafarms.com
127.0.0.1    www.bardownload.com
127.0.0.1    bardownload.com
127.0.0.1    barnandfence.com
127.0.0.1    batsearch.com
127.0.0.1    baygraphicsllc.com
127.0.0.1    bbbsearch.com
127.0.0.1    bb-search.com
127.0.0.1    bcnproduction.com
127.0.0.1    www.bcnproduction.com
127.0.0.1    bdsmlibrary.net
127.0.0.1    bdsmpornmag.com
127.0.0.1    www.bdsmpornmag.com
127.0.0.1    bearshare.click-new-download.com
127.0.0.1    www.bearshare.click-new-download.com
127.0.0.1    bearshare.download-me.info
127.0.0.1    www.bearshare.download-me.info
127.0.0.1    www.bearshare.mp3-muzic.com
127.0.0.1    bearshare.mp3-muzic.com
127.0.0.1    www.bearshare-download.org
127.0.0.1    bearshare-download.org
127.0.0.1    bearshare-downloads.net
127.0.0.1    www.bearshare-downloads.net
127.0.0.1    www.bearsharelive.co.uk
127.0.0.1    bearsharelive.co.uk
127.0.0.1    www.bearshare-music-downloads.com
127.0.0.1    bearshare-music-downloads.com
127.0.0.1    www.bearsharepro2007.com
127.0.0.1    bearsharepro2007.com
127.0.0.1    bearshare-usa.com
127.0.0.1    www.bearshare-usa.com
127.0.0.1    bedhome.com
127.0.0.1    bediadance.com
127.0.0.1    beebappyy.biz
127.0.0.1    www.beebappyy.biz
127.0.0.1    begin2search.com
127.0.0.1    www.begin2search.com
127.0.0.1    bellabasketsfl.com
127.0.0.1    bernaolatwin.com
127.0.0.1    berufe-jobs.de
127.0.0.1    www.berufe-jobs.de
127.0.0.1    berufe-jobs.de
127.0.0.1    berufe-server.de
127.0.0.1    www.berufe-server.de
127.0.0.1    berufe-server.de
127.0.0.1    www.berufe-welt.de
127.0.0.1    berufe-welt.de
127.0.0.1    berufe-welt.de
127.0.0.1    www.berufs-wahl.de
127.0.0.1    berufs-wahl.de
127.0.0.1    berufs-wahl.de
127.0.0.1    www.beruijindegunhadesun.com
127.0.0.1    beruijindegunhadesun.com
127.0.0.1    best3xclips.com
127.0.0.1    www.best3xclips.com
127.0.0.1    www.bestadults.com
127.0.0.1    bestadults.com
127.0.0.1    best-counter.com
127.0.0.1    bestcrawler.com
127.0.0.1    bestdailyvids.com
127.0.0.1    www.bestdailyvids.com
127.0.0.1    bestfor.ru
127.0.0.1    bestfuckvids.com
127.0.0.1    www.bestfuckvids.com
127.0.0.1    best-hardpics.com
127.0.0.1    www.bestmanage.org
127.0.0.1    bestmanage.org
127.0.0.1    www.bestmanage0.org
127.0.0.1    bestmanage0.org
127.0.0.1    www.bestmanage1.org
127.0.0.1    bestmanage1.org
127.0.0.1    www.bestmanage2.org
127.0.0.1    bestmanage2.org
127.0.0.1    www.bestmanage3.org
127.0.0.1    bestmanage3.org

mouick · Answer

127.0.0.1    www.bestmanage4.org
127.0.0.1    bestmanage4.org
127.0.0.1    www.bestmanage5.org
127.0.0.1    bestmanage5.org
127.0.0.1    bestmanage6.org
127.0.0.1    www.bestmanage6.org
127.0.0.1    www.bestmanage7.org
127.0.0.1    bestmanage7.org
127.0.0.1    www.bestmanage8.org
127.0.0.1    bestmanage8.org
127.0.0.1    www.bestmanage9.org
127.0.0.1    bestmanage9.org
127.0.0.1    www.bestmovszone.com
127.0.0.1    bestmovszone.com
127.0.0.1    www.bestoffersnetworks.com
127.0.0.1    bestoffersnetworks.com
127.0.0.1    bestporngate.com
127.0.0.1    www.bestsafetyguide.net
127.0.0.1    bestsafetyguide.net
127.0.0.1    www.bestsearch.cc
127.0.0.1    bestsearch.cc
127.0.0.1    best-spyware.info
127.0.0.1    www.best-spyware.info
127.0.0.1    www.best-targeted-traffic.com
127.0.0.1    best-targeted-traffic.com
127.0.0.1    www.best-voyeur.info
127.0.0.1    best-voyeur.info
127.0.0.1    bestweblinks.com
127.0.0.1    best-winning-casino.com
127.0.0.1    bestworldgirls-for-u.net
127.0.0.1    www.bestworldgirls-for-u.net
127.0.0.1    www.bestxclips.com
127.0.0.1    bestxclips.com
127.0.0.1    bestxporno.com
127.0.0.1    bestxxxmpegs.com
127.0.0.1    www.bestxxxmpegs.com
127.0.0.1    www.bettersearch.biz
127.0.0.1    bettersearch.biz
127.0.0.1    www.bgazzetta.it
127.0.0.1    bgazzetta.it
127.0.0.1    www.bgoogle.it
127.0.0.1    bgoogle.it
127.0.0.1    www.bigtrafficnetwork.com
127.0.0.1    bigtrafficnetwork.com
127.0.0.1    bigwww.com
127.0.0.1    www.bigwww.com
127.0.0.1    bill.de
127.0.0.1    bill.de
127.0.0.1    www.bill.de
127.0.0.1    bin.errorprotector.com
127.0.0.1    bins.media-motor.net
127.0.0.1    bins2.media-motor.net
127.0.0.1    bis.180solutions.com
127.0.0.1    bitchesonline.net
127.0.0.1    www.bitcomet-freebie.com
127.0.0.1    bitcomet-freebie.com
127.0.0.1    www.bittorrent.click-new-download.com
127.0.0.1    bittorrent.click-new-download.com
127.0.0.1    biz.biz
127.0.0.1    bkvcompany.com
127.0.0.1    www.bkvcompany.com
127.0.0.1    www.blackblues00.com
127.0.0.1    blackblues00.com
127.0.0.1    www.blackcodec.com
127.0.0.1    blackcodec.com
127.0.0.1    www.blackcodec.net
127.0.0.1    blackcodec.net
127.0.0.1    blackhats.tc
127.0.0.1    www.blackhats.tc
127.0.0.1    www.blackhawksoftware.com
127.0.0.1    blackhawksoftware.com
127.0.0.1    blackjack-free.net
127.0.0.1    www.blacklegion.info
127.0.0.1    blacklegion.info
127.0.0.1    blazefind.com
127.0.0.1    blender.xu.pl
127.0.0.1    www.blockcheckercontrol.com
127.0.0.1    blockcheckercontrol.com
127.0.0.1    blondetgp.com
127.0.0.1    www.blue-elefant.com
127.0.0.1    blue-elefant.com
127.0.0.1    bm.theaimonline.com
127.0.0.1    www.bm.theaimonline.com
127.0.0.1    www.bnmgate.com
127.0.0.1    bnmgate.com
127.0.0.1    bodaciousbabette.com
127.0.0.1    bonzi.com
127.0.0.1    www.bonzi.com
127.0.0.1    boobdoll.com
127.0.0.1    boobsandtits.com
127.0.0.1    boobsclub.com
127.0.0.1    www.bookedspace.com
127.0.0.1    bookedspace.com
127.0.0.1    www.boom.com.vn
127.0.0.1    boom.com.vn
127.0.0.1    boredlife.com
127.0.0.1    bowlofogumbo.com
127.0.0.1    www.bpfq02.com
127.0.0.1    bpfq02.com
127.0.0.1    www.bqgate.com
127.0.0.1    bqgate.com
127.0.0.1    br.errorsafe.com
127.0.0.1    br.winantivirus.com
127.0.0.1    br.winfixer.com
127.0.0.1    bradcoem.org
127.0.0.1    www.braincodec.com
127.0.0.1    braincodec.com
127.0.0.1    brandiyoung.com
127.0.0.1    bravesentry.com
127.0.0.1    www.bravesentry.com
127.0.0.1    www.breenten.biz
127.0.0.1    breenten.biz
127.0.0.1    www.brodbfm.net
127.0.0.1    brodbfm.net
127.0.0.1    brookeburn.com
127.0.0.1    www.browserwise.com
127.0.0.1    browserwise.com
127.0.0.1    bsa.safetydownload.com
127.0.0.1    www.bsplaycodec.com
127.0.0.1    bsplaycodec.com
127.0.0.1    bucps.com
127.0.0.1    buhartes.info
127.0.0.1    buldog-stats.com
127.0.0.1    www.bullseye-network.com
127.0.0.1    bullseye-network.com
127.0.0.1    burgerkingbigscreen.com
127.0.0.1    www.burningsite.com
127.0.0.1    burningsite.com
127.0.0.1    www.burnsrecyclinginc.com
127.0.0.1    burnsrecyclinginc.com
127.0.0.1    buscards.net
127.0.0.1    bustyrussell.com
127.0.0.1    busysearch.net
127.0.0.1    www.busysearch.net
127.0.0.1    buttejazz.org
127.0.0.1    www.buy-find.info
127.0.0.1    buy-find.info
127.0.0.1    buyselldomain.net
127.0.0.1    www.buytraff.biz
127.0.0.1    buytraff.biz
127.0.0.1    buz.ru
127.0.0.1    www.bvdtechinque.com
127.0.0.1    bvdtechinque.com
127.0.0.1    www.bvirgilio.it
127.0.0.1    bvirgilio.it
127.0.0.1    c.centralmedia.ws
127.0.0.1    www.c.enhance.com
127.0.0.1    c.enhance.com
127.0.0.1    c.goclick.com
127.0.0.1    c4tdownload.com
127.0.0.1    www.c4tdownload.com
127.0.0.1    www.c5.www4free.info
127.0.0.1    c5.www4free.info
127.0.0.1    www.cache.surfaccuracy.com
127.0.0.1    cache.surfaccuracy.com
127.0.0.1    cache.ysbweb.com
127.0.0.1    www.cadesfinjeriokas.com
127.0.0.1    cadesfinjeriokas.com
127.0.0.1    calcioturris.com
127.0.0.1    calendaralerts.net
127.0.0.1    www.calendaralerts.net
127.0.0.1    www.callinghome.biz
127.0.0.1    callinghome.biz
127.0.0.1    www.cameouk.co.uk
127.0.0.1    cameouk.co.uk
127.0.0.1    cameup.com
127.0.0.1    www.camouflageclothingonline.net
127.0.0.1    camouflageclothingonline.net
127.0.0.1    campaigns.outerinfo.net
127.0.0.1    camup.net
127.0.0.1    canberracricketcoaching.com
127.0.0.1    candycantaloupes.com
127.0.0.1    www.canidetect.org
127.0.0.1    canidetect.org
127.0.0.1    www.cantfind.com
127.0.0.1    cantfind.com
127.0.0.1    careers.dulcineasystems.net
127.0.0.1    carsands.com
127.0.0.1    carsrentals.net
127.0.0.1    cartoes.uol.com.br
127.0.0.1    www.casalemedia.com
127.0.0.1    casalemedia.com
127.0.0.1    cashdeluxe.net
127.0.0.1    www.cashdeluxe.net
127.0.0.1    www.cashengines.com
127.0.0.1    cashengines.com
127.0.0.1    cashsearch.biz
127.0.0.1    www.cashsurfers.com
127.0.0.1    cashsurfers.com
127.0.0.1    www.CashUnlim.com
127.0.0.1    CashUnlim.com
127.0.0.1    casino.com.free.game.pogo.gratisdownloads.nl
127.0.0.1    casino2win.net
127.0.0.1    casino-gambling-1.net
127.0.0.1    casino-gambling-2.net
127.0.0.1    casinomidas.net
127.0.0.1    casinonline.net
127.0.0.1    casino-onlines.net
127.0.0.1    www.castingsamateur.com
127.0.0.1    castingsamateur.com
127.0.0.1    catallogue.com
127.0.0.1    catch-dc.info
127.0.0.1    www.catch-dc.info
127.0.0.1    categories.mygeek.com
127.0.0.1    catsss.da.ru
127.0.0.1    caxa.ru
127.0.0.1    cc.panet.org
127.0.0.1    www.ccecaedbebfcaf.com
127.0.0.1    ccecaedbebfcaf.com
127.0.0.1    cclebali.org
127.0.0.1    ccorriere.it
127.0.0.1    www.ccorriere.it
127.0.0.1    www.cdcopysite.com
127.0.0.1    cdcopysite.com
127.0.0.1    www.cdegate.com
127.0.0.1    cdegate.com
127.0.0.1    cdn.drivecleaner.com
127.0.0.1    cdn.errorsafe.com
127.0.0.1    cdn.movies-etc.com
127.0.0.1    cdn.winsoftware.com
127.0.0.1    cdn2.movies-etc.com
127.0.0.1    www.cdorriere.it
127.0.0.1    cdorriere.it
127.0.0.1    ceewawires.org
127.0.0.1    centralmedia.ws
127.0.0.1    certumgroup.com
127.0.0.1    www.cforriere.it
127.0.0.1    cforriere.it
127.0.0.1    www.check.jupitersatellites.biz
127.0.0.1    check.jupitersatellites.biz
127.0.0.1    www.checkin100.com
127.0.0.1    checkin100.com
127.0.0.1    www.checkssecurity.com
127.0.0.1    checkssecurity.com
127.0.0.1    chelancatering.com
127.0.0.1    www.chenshijituan.com
127.0.0.1    chenshijituan.com
127.0.0.1    childrenvilla.com
127.0.0.1    www.chilly3xvids.com
127.0.0.1    chilly3xvids.com
127.0.0.1    www.chillymovs.com
127.0.0.1    chillymovs.com
127.0.0.1    chips-4-free.com
127.0.0.1    chrisswasey.com
127.0.0.1    chriswallace.net
127.0.0.1    www.cia-trjn.myvnc.com
127.0.0.1    cia-trjn.myvnc.com
127.0.0.1    www.cinemadownload.com
127.0.0.1    cinemadownload.com
127.0.0.1    www.ciorriere.it
127.0.0.1    ciorriere.it
127.0.0.1    www.cirriere.it
127.0.0.1    cirriere.it
127.0.0.1    www.citycodec.com
127.0.0.1    citycodec.com
127.0.0.1    ckick4thumbs.com
127.0.0.1    cl55.biz
127.0.0.1    clackamasliteraryreview.com
127.0.0.1    www.clckm.com
127.0.0.1    clckm.com
127.0.0.1    www.cleancodec.com
127.0.0.1    cleancodec.com
127.0.0.1    www.cleansoftwares.com
127.0.0.1    cleansoftwares.com
127.0.0.1    clearsearch.cc
127.0.0.1    clearsearch.net
127.0.0.1    clickaire.com
127.0.0.1    www.click-codec.com
127.0.0.1    click-codec.com
127.0.0.1    www.clickhere4search.com
127.0.0.1    clickhere4search.com
127.0.0.1    www.click-new-download.com
127.0.0.1    click-new-download.com
127.0.0.1    click-now.net
127.0.0.1    clickspring.net
127.0.0.1    www.clickspring.net
127.0.0.1    www.click-to-download.com
127.0.0.1    click-to-download.com
127.0.0.1    www.clicktomakeasearch.com
127.0.0.1    clicktomakeasearch.com
127.0.0.1    clickyestoenter.net
127.0.0.1    client.exeupdate.com
127.0.0.1    client.myadultexplorer.com
127.0.0.1    www.cliks.org
127.0.0.1    cliks.org
127.0.0.1    www.clipsfestival.com
127.0.0.1    clipsfestival.com
127.0.0.1    www.clipsreality.com
127.0.0.1    clipsreality.com
127.0.0.1    www.clorriere.it
127.0.0.1    clorriere.it
127.0.0.1    clrsch.com
127.0.0.1    www.clubxxxvideo.com
127.0.0.1    clubxxxvideo.com
127.0.0.1    clusif.free.fr
127.0.0.1    cmtapestry.com
127.0.0.1    www.cnetadd.com
127.0.0.1    cnetadd.com
127.0.0.1    www.cnomy.com
127.0.0.1    cnomy.com
127.0.0.1    www.cnzz.com
127.0.0.1    cnzz.com
127.0.0.1    www.cocktails-ideen.de
127.0.0.1    cocktails-ideen.de
127.0.0.1    cocktails-ideen.de
127.0.0.1    code.ignphrases.com
127.0.0.1    codec.ninoa.com
127.0.0.1    www.codecbsplay.com
127.0.0.1    codecbsplay.com
127.0.0.1    www.codecdvd.net
127.0.0.1    codecdvd.net
127.0.0.1    www.codecdvi.com
127.0.0.1    codecdvi.com
127.0.0.1    www.codec-fun.com
127.0.0.1    codec-fun.com
127.0.0.1    www.codechard.com
127.0.0.1    codechard.com
127.0.0.1    www.codechot.net
127.0.0.1    codechot.net
127.0.0.1    www.codechq.net
127.0.0.1    codechq.net
127.0.0.1    www.codecmeg.net
127.0.0.1    codecmeg.net
127.0.0.1    codecmega.net
127.0.0.1    www.codecmega.net
127.0.0.1    codecmoon.com
127.0.0.1    www.codecmoon.com
127.0.0.1    www.codecmpg.com
127.0.0.1    codecmpg.com
127.0.0.1    codecnice.net
127.0.0.1    www.codecnice.net
127.0.0.1    www.codecops.net
127.0.0.1    codecops.net
127.0.0.1    www.codecplay.com
127.0.0.1    codecplay.com
127.0.0.1    codecpretty.net
127.0.0.1    www.codecpretty.net
127.0.0.1    codecpro.net
127.0.0.1    www.codecpro.net
127.0.0.1    www.codecsoft.net
127.0.0.1    codecsoft.net
127.0.0.1    codectime.com
127.0.0.1    www.codectime.com
127.0.0.1    www.codecultra.net
127.0.0.1    codecultra.net
127.0.0.1    www.codecvids.com
127.0.0.1    codecvids.com
127.0.0.1    codecvip.com
127.0.0.1    www.codecvip.com
127.0.0.1    www.codecviva.com
127.0.0.1    codecviva.com
127.0.0.1    codeczang.net
127.0.0.1    www.codeczang.net
127.0.0.1    www.codrriere.it
127.0.0.1    codrriere.it
127.0.0.1    www.coeriere.it
127.0.0.1    coeriere.it
127.0.0.1    www.coerriere.it
127.0.0.1    coerriere.it
127.0.0.1    www.cofrriere.it
127.0.0.1    cofrriere.it
127.0.0.1    www.cogrriere.it
127.0.0.1    cogrriere.it
127.0.0.1    www.coirriere.it
127.0.0.1    coirriere.it
127.0.0.1    command.adservs.com
127.0.0.1    www.commonname.com
127.0.0.1    www.computerpcgames.net
127.0.0.1    computerpcgames.net
127.0.0.1    www.computerrecover.com
127.0.0.1    computerrecover.com
127.0.0.1    config.180solutions.com
127.0.0.1    www.content.dollarrevenue.com
127.0.0.1    content.dollarrevenue.com
127.0.0.1    www.content.ireit.com
127.0.0.1    content.ireit.com
127.0.0.1    content.onerateld.com
127.0.0.1    www.contentmatch.net
127.0.0.1    contentmatch.net
127.0.0.1    www.contextplus.net
127.0.0.1    contextplus.net
127.0.0.1    www.contra-virus.com
127.0.0.1    contra-virus.com
127.0.0.1    controlmeh.com
127.0.0.1    www.controlmeh.com
127.0.0.1    www.convenient-search.com
127.0.0.1    convenient-search.com
127.0.0.1    www.cookingluck.com
127.0.0.1    cookingluck.com
127.0.0.1    cooldeskalert.com
127.0.0.1    www.cooldeskalert.com
127.0.0.1    coolfetishsite.com
127.0.0.1    coolfreehost.com
127.0.0.1    coolfreepage.com
127.0.0.1    coolfreepages.com
127.0.0.1    cool-homepage.co
127.0.0.1    cool-homepage.com
127.0.0.1    coolmoneysearch.com
127.0.0.1    coolpornsearch.com
127.0.0.1    cool-search.net
127.0.0.1    cool-search.netfartpost.com
127.0.0.1    coolsearcher.info
127.0.0.1    coolservecorp.net
127.0.0.1    www.coolservecorp.net
127.0.0.1    www.coolwebsearch.com

chimay8 · Answer

je n'ai pas la fin du rapport...

si tu vois qu'il y a beaucoup de lignes de ce type

127.0.0.1 www.1stpagehere.com 
127.0.0.1 1stpagehere.com 
127.0.0.1 www.1stsearchportal.com 
127.0.0.1 1stsearchportal.com 
127.0.0.1 2.82211.net 

tu passes outre mais il me faut la fin du rapport juste en dessous de ces lignes

mouick · Answer

127.0.0.1    coolwebsearch.com
127.0.0.1    cool-web-search.com
127.0.0.1    coolwebsearsh.com
127.0.0.1    www.coolwwwsearch.com
127.0.0.1    coolwwwsearch.com
127.0.0.1    cool-xxx.net
127.0.0.1    www.coorriere.it
127.0.0.1    coorriere.it
127.0.0.1    copmtraine.com
127.0.0.1    www.coprriere.it
127.0.0.1    coprriere.it
127.0.0.1    core.psyche-evolution.com
127.0.0.1    www.core.psyche-evolution.com
127.0.0.1    www.coreiere.it
127.0.0.1    coreiere.it
127.0.0.1    www.coreriere.it
127.0.0.1    coreriere.it
127.0.0.1    www.corrdiere.it
127.0.0.1    corrdiere.it
127.0.0.1    www.correiere.it
127.0.0.1    correiere.it
127.0.0.1    www.corrfiere.it
127.0.0.1    corrfiere.it
127.0.0.1    www.corrgiere.it
127.0.0.1    corrgiere.it
127.0.0.1    www.corridere.it
127.0.0.1    corridere.it
127.0.0.1    www.corriedre.it
127.0.0.1    corriedre.it
127.0.0.1    www.corriee.it
127.0.0.1    corriee.it
127.0.0.1    www.corrieere.it
127.0.0.1    corrieere.it
127.0.0.1    www.corriefre.it
127.0.0.1    corriefre.it
127.0.0.1    www.corriegre.it
127.0.0.1    corriegre.it
127.0.0.1    www.corrierde.it
127.0.0.1    corrierde.it
127.0.0.1    www.corriered.it
127.0.0.1    corriered.it
127.0.0.1    www.corrieree.it
127.0.0.1    corrieree.it
127.0.0.1    www.corrieref.it
127.0.0.1    corrieref.it
127.0.0.1    www.corrierer.it
127.0.0.1    corrierer.it
127.0.0.1    www.corrieres.it
127.0.0.1    corrieres.it
127.0.0.1    www.corrierew.it
127.0.0.1    corrierew.it
127.0.0.1    www.corrierfe.it
127.0.0.1    corrierfe.it
127.0.0.1    corrierge.it
127.0.0.1    www.corrierge.it
127.0.0.1    www.corrierr.it
127.0.0.1    corrierr.it
127.0.0.1    www.corrierre.it
127.0.0.1    corrierre.it
127.0.0.1    www.corrierse.it
127.0.0.1    corrierse.it
127.0.0.1    www.corrierte.it
127.0.0.1    corrierte.it
127.0.0.1    www.corrierw.it
127.0.0.1    corrierw.it
127.0.0.1    www.corrierwe.it
127.0.0.1    corrierwe.it
127.0.0.1    corriesre.it
127.0.0.1    www.corriesre.it
127.0.0.1    corriete.it
127.0.0.1    www.corriete.it
127.0.0.1    www.corrietre.it
127.0.0.1    corrietre.it
127.0.0.1    corriewre.it
127.0.0.1    www.corriewre.it
127.0.0.1    corrifere.it
127.0.0.1    www.corrifere.it
127.0.0.1    corriiere.it
127.0.0.1    www.corriiere.it
127.0.0.1    www.corrilere.it
127.0.0.1    corrilere.it
127.0.0.1    corrioere.it
127.0.0.1    www.corrioere.it
127.0.0.1    www.corrire.it
127.0.0.1    corrire.it
127.0.0.1    corrirere.it
127.0.0.1    www.corrirere.it
127.0.0.1    www.corrirre.it
127.0.0.1    corrirre.it
127.0.0.1    www.corrisere.it
127.0.0.1    corrisere.it
127.0.0.1    corriuere.it
127.0.0.1    www.corriuere.it
127.0.0.1    www.corriwere.it
127.0.0.1    corriwere.it
127.0.0.1    www.corriwre.it
127.0.0.1    corriwre.it
127.0.0.1    www.corrliere.it
127.0.0.1    corrliere.it
127.0.0.1    www.corroere.it
127.0.0.1    corroere.it
127.0.0.1    www.corroiere.it
127.0.0.1    corroiere.it
127.0.0.1    www.corrriere.it
127.0.0.1    corrriere.it
127.0.0.1    www.corrtiere.it
127.0.0.1    corrtiere.it
127.0.0.1    www.corruere.it
127.0.0.1    corruere.it
127.0.0.1    www.corruiere.it
127.0.0.1    corruiere.it
127.0.0.1    www.cortiere.it
127.0.0.1    cortiere.it
127.0.0.1    cortriere.it
127.0.0.1    www.cortriere.it
127.0.0.1    www.costrike.com
127.0.0.1    costrike.com
127.0.0.1    www.cotriere.it
127.0.0.1    cotriere.it
127.0.0.1    www.cotrriere.it
127.0.0.1    cotrriere.it
127.0.0.1    couldnotfind.com
127.0.0.1    count.cc
127.0.0.1    count.hitscount.net
127.0.0.1    count-all.com
127.0.0.1    www.countdutycall.info
127.0.0.1    countdutycall.info
127.0.0.1    counter.sexmaniack.com
127.0.0.1    www.courtrecordslookup.com
127.0.0.1    courtrecordslookup.com
127.0.0.1    cporriere.it
127.0.0.1    www.cporriere.it
127.0.0.1    www.cprriere.it
127.0.0.1    cprriere.it
127.0.0.1    cpvfeed.com
127.0.0.1    cracks.me.uk
127.0.0.1    www.cracks4all.com
127.0.0.1    cracks4all.com
127.0.0.1    www.crapsgold.info
127.0.0.1    crapsgold.info
127.0.0.1    Crazygirls-world.com
127.0.0.1    www.crazywinnings.com
127.0.0.1    crazywinnings.com
127.0.0.1    creamedcutties.com
127.0.0.1    www.createaccesskey.com
127.0.0.1    createaccesskey.com
127.0.0.1    www.creatonsoft.com
127.0.0.1    creatonsoft.com
127.0.0.1    creditsearchonline.com
127.0.0.1    crestring.com
127.0.0.1    crooder.com
127.0.0.1    www.crriere.it
127.0.0.1    crriere.it
127.0.0.1    www.cryptdrive.com
127.0.0.1    cryptdrive.com
127.0.0.1    www.crystalysmedia.com
127.0.0.1    crystalysmedia.com
127.0.0.1    www.csx.adservs.com
127.0.0.1    csx.adservs.com
127.0.0.1    cts.180solutions.com
127.0.0.1    www.cuisinartoven.com
127.0.0.1    cuisinartoven.com
127.0.0.1    www.curedc.info
127.0.0.1    curedc.info
127.0.0.1    www.curepcsolutions.com
127.0.0.1    curepcsolutions.com
127.0.0.1    curvedspaces.com
127.0.0.1    www.cutadult.com
127.0.0.1    cutadult.com
127.0.0.1    www.cvirgilio.it
127.0.0.1    cvirgilio.it
127.0.0.1    www.cvorriere.it
127.0.0.1    cvorriere.it
127.0.0.1    cvs.jps.ru
127.0.0.1    cvsymphony.com
127.0.0.1    www.cxorriere.it
127.0.0.1    cxorriere.it
127.0.0.1    www.cyberrape.com
127.0.0.1    cyberrape.com
127.0.0.1    cydom.com
127.0.0.1    www.cydoor.com
127.0.0.1    cydoor.com
127.0.0.1    www.daily3xlinks.com
127.0.0.1    daily3xlinks.com
127.0.0.1    www.dailybestclips.com
127.0.0.1    dailybestclips.com
127.0.0.1    daily-gals.com
127.0.0.1    dailyhugemovs.com
127.0.0.1    www.dailyhugemovs.com
127.0.0.1    www.dailykeys.com
127.0.0.1    dailykeys.com
127.0.0.1    www.dailypornmag.com
127.0.0.1    dailypornmag.com
127.0.0.1    dailyteenspic.com
127.0.0.1    www.dailytoolbar.com
127.0.0.1    dailytoolbar.com
127.0.0.1    www.dailyxvids.com
127.0.0.1    dailyxvids.com
127.0.0.1    dancingbabycd.com
127.0.0.1    www.dapsol.com
127.0.0.1    dapsol.com
127.0.0.1    dapsolution.com
127.0.0.1    www.dapsolution.com
127.0.0.1    www.data-hoster.com
127.0.0.1    data-hoster.com
127.0.0.1    datanotary.com
127.0.0.1    datareco.com
127.0.0.1    www.dateanybabe.com
127.0.0.1    dateanybabe.com
127.0.0.1    www.dateanychick.com
127.0.0.1    dateanychick.com
127.0.0.1    www.datingdoctorsite.com
127.0.0.1    datingdoctorsite.com
127.0.0.1    www.dating-galaxy.info
127.0.0.1    dating-galaxy.info
127.0.0.1    dating-search.net
127.0.0.1    davemarshall.org
127.0.0.1    db105.com
127.0.0.1    www.dbdecicated.com
127.0.0.1    dbdecicated.com
127.0.0.1    www.dbxcompany.com
127.0.0.1    dbxcompany.com
127.0.0.1    dcdl.dmcast.com
127.0.0.1    dcfitusa.com
127.0.0.1    www.dcorriere.it
127.0.0.1    dcorriere.it
127.0.0.1    www.dcurtis.com
127.0.0.1    dcurtis.com
127.0.0.1    dcww.dmcast.com
127.0.0.1    de.ag
127.0.0.1    de.drivecleaner.com
127.0.0.1    de.errorsafe.com
127.0.0.1    de.winantivirus.com
127.0.0.1    de98.remsys.org
127.0.0.1    www.debay.it
127.0.0.1    debay.it
127.0.0.1    decknews.com
127.0.0.1    www.decknews.com
127.0.0.1    dedmazay.3322.org
127.0.0.1    dedsearch.com
127.0.0.1    www.dedsearch.com
127.0.0.1    defaultsearch.net
127.0.0.1    www.Defensaantimalware.com
127.0.0.1    Defensaantimalware.com
127.0.0.1    deja-rue.com
127.0.0.1    www.deja-rue.com
127.0.0.1    delficodec.com
127.0.0.1    www.delficodec.com
127.0.0.1    democodec.com
127.0.0.1    www.democodec.com
127.0.0.1    www.derklaif.biz
127.0.0.1    derklaif.biz
127.0.0.1    derrari.it
127.0.0.1    www.derrari.it
127.0.0.1    desarrollocreativo.com
127.0.0.1    www.deskbar.worldtostart.com
127.0.0.1    deskbar.worldtostart.com
127.0.0.1    www.deskwizz.com
127.0.0.1    deskwizz.com
127.0.0.1    www.destruktor.to.pl
127.0.0.1    destruktor.to.pl
127.0.0.1    www.detectivehound.com
127.0.0.1    detectivehound.com
127.0.0.1    detectivesearches.com
127.0.0.1    www.detectivesearches.com
127.0.0.1    dev.ntcor.com
127.0.0.1    develip.com
127.0.0.1    dewis.spb.ru
127.0.0.1    dewis.us
127.0.0.1    df809jow4wj2304lfd0sf9fsd0a2t4ldf809jow4wj2304lfd0sf9fsd0a2t4ld.biz
127.0.0.1    dgbusiness.com
127.0.0.1    www.dgbusiness.com
127.0.0.1    dialer2004.com
127.0.0.1    www.dialerclub.com
127.0.0.1    dialerclub.com
127.0.0.1    dialer-shop.com
127.0.0.1    www.dialer-shop.com
127.0.0.1    www.dialoff.com
127.0.0.1    dialoff.com
127.0.0.1    www.did.i-used.cc
127.0.0.1    did.i-used.cc
127.0.0.1    dietpills4free.com
127.0.0.1    dietpussy.com
127.0.0.1    www.digikeygen.com
127.0.0.1    digikeygen.com
127.0.0.1    digistreamsa.com
127.0.0.1    www.digitalcoders.net
127.0.0.1    digitalcoders.net
127.0.0.1    www.digitalfan.com
127.0.0.1    digital-pornography.com
127.0.0.1    dionforvalleycouncil.org
127.0.0.1    www.directdvdpro.com
127.0.0.1    directdvdpro.com
127.0.0.1    www.directnameservice.com
127.0.0.1    directnameservice.com
127.0.0.1    www.directporta.info
127.0.0.1    directporta.info
127.0.0.1    www.directsearchzone.com
127.0.0.1    directsearchzone.com
127.0.0.1    www.diskretter.com
127.0.0.1    diskretter.com
127.0.0.1    dist.checkin100.com
127.0.0.1    dl.ad-ware.cc
127.0.0.1    dl.malwarewipe.com
127.0.0.1    dl.mcboo.com
127.0.0.1    www.dl.targetsaver.com
127.0.0.1    dl.targetsaver.com
127.0.0.1    dl.web-nexus.net
127.0.0.1    dl1.antivermins.com
127.0.0.1    dl1.antivirgear.com
127.0.0.1    dl1.spydawn.com
127.0.0.1    dl1.virusprotectpro.com

mouick · Answer

127.0.0.1    dl10.spyfalcon.com
127.0.0.1    dl16.spyfalcon.com
127.0.0.1    dl2.spyfalcon.com
127.0.0.1    dl2.spyheal.com
127.0.0.1    dl2.spywarestrike.com
127.0.0.1    dl3.spyfalcon.com
127.0.0.1    dl3.spyheal.com
127.0.0.1    dl3.spywarestrike.com
127.0.0.1    dl4.spyfalcon.com
127.0.0.1    dl4.spywarestrike.com
127.0.0.1    dl5.spyfalcon.com
127.0.0.1    dl5.spywarestrike.com
127.0.0.1    dl6.spywarestrike.com
127.0.0.1    dl7.spywarestrike.com
127.0.0.1    dl8.spyheal.com
127.0.0.1    dl8.spywarestrike.com
127.0.0.1    dl9.spyfalcon.com
127.0.0.1    dload.contextplus.net
127.0.0.1    dltsolution.com
127.0.0.1    www.dltsolution.com
127.0.0.1    www.dmcast.com
127.0.0.1    dmcast.com
127.0.0.1    www.dmqfirm.com
127.0.0.1    dmqfirm.com
127.0.0.1    dnaads.com
127.0.0.1    www.dnaads.com
127.0.0.1    dnl.mabou.org
127.0.0.1    www.dns-look-up.com
127.0.0.1    dns-look-up.com
127.0.0.1    doctorwaldron.com
127.0.0.1    document-not-found.pornpic.org
127.0.0.1    doggyaction.com
127.0.0.1    www.dogproblemswebsite.com
127.0.0.1    dogproblemswebsite.com
127.0.0.1    doktorxxx.com
127.0.0.1    dollarrevenue.com
127.0.0.1    www.domaincar.com
127.0.0.1    domaincar.com
127.0.0.1    domains2003.net
127.0.0.1    domains-for-you-online.com
127.0.0.1    domain-your-registration.com
127.0.0.1    domkrat.com
127.0.0.1    doofo.com
127.0.0.1    www.doofo.com
127.0.0.1    www.dotcomtoolbar.com
127.0.0.1    dotcomtoolbar.com
127.0.0.1    down.136136.net
127.0.0.1    download.abetterinternet.com
127.0.0.1    download.adintelligence.net
127.0.0.1    www.download.antispywarebot.com
127.0.0.1    download.antispywarebot.com
127.0.0.1    www.download.bardownload.com
127.0.0.1    download.bardownload.com
127.0.0.1    www.download.bravesentry.com
127.0.0.1    download.bravesentry.com
127.0.0.1    download.cdn.drivecleaner.com
127.0.0.1    download.cdn.errorsafe.com
127.0.0.1    download.cdn.winsoftware.com
127.0.0.1    download.contextplus.net
127.0.0.1    download.errorsafe.com
127.0.0.1    www.download.jupitersatellites.biz
127.0.0.1    download.jupitersatellites.biz
127.0.0.1    download.MalwareAlarm.com
127.0.0.1    download.searchtabs.net
127.0.0.1    www.download.secureyournet.biz
127.0.0.1    download.secureyournet.biz
127.0.0.1    download.spyonthis.net
127.0.0.1    download.spy-shredder.com
127.0.0.1    download.systemdoctor.com
127.0.0.1    download.winantispyware.com
127.0.0.1    download.winantivirus.com
127.0.0.1    download.windrivecleaner.com
127.0.0.1    download.winfixer.com
127.0.0.1    download10.spywarequake.com
127.0.0.1    download11.spywarequake.com
127.0.0.1    download12.spywarequake.com
127.0.0.1    download13.spywarequake.com
127.0.0.1    download15.spywarequake.com
127.0.0.1    download2.spywarequake.com
127.0.0.1    www.download-2007.com
127.0.0.1    download-2007.com
127.0.0.1    download3.spyaxe.com
127.0.0.1    download3.spywarequake.com
127.0.0.1    www.download3xpics.com
127.0.0.1    download3xpics.com
127.0.0.1    download4.spyaxe.com
127.0.0.1    download4.spywarequake.com
127.0.0.1    download5.spyaxe.com
127.0.0.1    download5.spywarequake.com
127.0.0.1    download6.spyaxe.com
127.0.0.1    download7.spywarequake.com
127.0.0.1    download8.spywarequake.com
127.0.0.1    download9.spywarequake.com
127.0.0.1    www.downloadacceleratorsite.com
127.0.0.1    downloadacceleratorsite.com
127.0.0.1    www.download-ad-aware.com
127.0.0.1    download-ad-aware.com
127.0.0.1    www.download-all-4-free.com
127.0.0.1    download-all-4-free.com
127.0.0.1    download-all-area.com
127.0.0.1    www.download-all-area.com
127.0.0.1    www.download-antivir.com
127.0.0.1    download-antivir.com
127.0.0.1    www.downloadanysong.com
127.0.0.1    downloadanysong.com
127.0.0.1    www.downloadaresnow.com
127.0.0.1    downloadaresnow.com
127.0.0.1    www.download-avast.com
127.0.0.1    download-avast.com
127.0.0.1    www.downloadcorporation.com
127.0.0.1    downloadcorporation.com
127.0.0.1    www.download-dvdshrink.com
127.0.0.1    download-dvdshrink.com
127.0.0.1    www.download-for-free.net
127.0.0.1    download-for-free.net
127.0.0.1    www.downloadfreesoft.com
127.0.0.1    downloadfreesoft.com
127.0.0.1    www.downloadfreeway.com
127.0.0.1    downloadfreeway.com
127.0.0.1    www.downloadimesh.com
127.0.0.1    downloadimesh.com
127.0.0.1    www.download-itunes-now.com
127.0.0.1    download-itunes-now.com
127.0.0.1    www.download-limewire.org
127.0.0.1    download-limewire.org
127.0.0.1    www.downloadlost.tv
127.0.0.1    downloadlost.tv
127.0.0.1    www.downloadmax.net
127.0.0.1    downloadmax.net
127.0.0.1    www.download-mcafee.com
127.0.0.1    download-mcafee.com
127.0.0.1    download-me.info
127.0.0.1    www.downloadmediaax.com
127.0.0.1    downloadmediaax.com
127.0.0.1    www.downloadpics.net
127.0.0.1    downloadpics.net
127.0.0.1    www.downloadprovider.net
127.0.0.1    downloadprovider.net
127.0.0.1    www.download-real-player.com
127.0.0.1    download-real-player.com
127.0.0.1    downloads.180solutions.com
127.0.0.1    downloads.adaware.cc
127.0.0.1    downloadservicearea.com
127.0.0.1    www.downloadservicearea.com
127.0.0.1    www.downloads-free.org
127.0.0.1    downloads-free.org
127.0.0.1    www.downloadsglobe.com
127.0.0.1    downloadsglobe.com
127.0.0.1    www.download-this.us
127.0.0.1    download-this.us
127.0.0.1    www.download-trillian.com
127.0.0.1    download-trillian.com
127.0.0.1    www.downloadv3.com
127.0.0.1    downloadv3.com
127.0.0.1    www.downloadvax.com
127.0.0.1    downloadvax.com
127.0.0.1    www.download-windvd.com
127.0.0.1    download-windvd.com
127.0.0.1    www.download-winrar.com
127.0.0.1    download-winrar.com
127.0.0.1    downloadwizard.com
127.0.0.1    www.downloadxmoveis.com
127.0.0.1    downloadxmoveis.com
127.0.0.1    www.downloadxvids.com
127.0.0.1    downloadxvids.com
127.0.0.1    downloadzcenter.com
127.0.0.1    downloadzcentral.com
127.0.0.1    www.downloadzfree.com
127.0.0.1    downloadzfree.com
127.0.0.1    downloadznow.net
127.0.0.1    www.download-zone-free.com
127.0.0.1    download-zone-free.com
127.0.0.1    www.download-zone-free.net
127.0.0.1    download-zone-free.net
127.0.0.1    dp-host.com
127.0.0.1    dr.mcboo.com
127.0.0.1    www.dr.webhancer.com
127.0.0.1    dr.webhancer.com
127.0.0.1    dr2.webhancer.com
127.0.0.1    www.dr2.webhancer.com
127.0.0.1    dr38.mcboo.com
127.0.0.1    dr47.mcboo.com
127.0.0.1    dragqueen.gay-clan.com
127.0.0.1    www.drepubblica.it
127.0.0.1    drepubblica.it
127.0.0.1    drivecleaner.com
127.0.0.1    www.drivecleaner.com
127.0.0.1    www.drivecleanr.com
127.0.0.1    drivecleanr.com
127.0.0.1    drocherway.com
127.0.0.1    www.dropspam.com
127.0.0.1    dropspam.com
127.0.0.1    drug-sources-exposed.com
127.0.0.1    drvvv.com
127.0.0.1    www.dsupereva.it
127.0.0.1    dsupereva.it
127.0.0.1    www.dtlproduct.com
127.0.0.1    dtlproduct.com
127.0.0.1    dudu.com
127.0.0.1    www.dudu.com
127.0.0.1    dulcineasystems.net
127.0.0.1    dumpserv.com
127.0.0.1    duolaimi.net
127.0.0.1    dutch-sex.com
127.0.0.1    dvdaccess.net
127.0.0.1    www.dvdaccess.net
127.0.0.1    dvdbank.org
127.0.0.1    www.dvd-codec.com
127.0.0.1    dvd-codec.com
127.0.0.1    www.dvdcodec.net
127.0.0.1    dvdcodec.net
127.0.0.1    www.dvden.de
127.0.0.1    dvden.de
127.0.0.1    dvden.de
127.0.0.1    www.dvdsmovies.net
127.0.0.1    dvdsmovies.net
127.0.0.1    dvdsvideos.net
127.0.0.1    www.dvdsvideos.net
127.0.0.1    www.dvdtocdsite.com
127.0.0.1    dvdtocdsite.com
127.0.0.1    dvdxgold.com
127.0.0.1    www.dvdxgold.com
127.0.0.1    www.dvdxpremium.com
127.0.0.1    dvdxpremium.com
127.0.0.1    dvicodec.com
127.0.0.1    www.dvicodec.com
127.0.0.1    dynamique.drivecleaner.com
127.0.0.1    www.e3bay.it
127.0.0.1    e3bay.it
127.0.0.1    www.e4bay.it
127.0.0.1    e4bay.it
127.0.0.1    eager-sex.com
127.0.0.1    www.earthllnk.net
127.0.0.1    earthllnk.net
127.0.0.1    eases.net
127.0.0.1    easyantispy.com
127.0.0.1    easybestdeals.com
127.0.0.1    www.easybestdeals.com
127.0.0.1    easycategories.com
127.0.0.1    easycdrip.com
127.0.0.1    www.easycdrip.com
127.0.0.1    www.easymovieplayer.com
127.0.0.1    easymovieplayer.com
127.0.0.1    easymp3musicnow.com
127.0.0.1    www.easymp3musicnow.com
127.0.0.1    www.easymus.cn
127.0.0.1    easymus.cn
127.0.0.1    www.easy-pharmacy.info
127.0.0.1    easy-pharmacy.info
127.0.0.1    www.easypspdownloads.com
127.0.0.1    easypspdownloads.com
127.0.0.1    easy-search.net
127.0.0.1    www.easysearch4you.com
127.0.0.1    easysearch4you.com
127.0.0.1    easysearchingtips.com
127.0.0.1    www.easyspyware.com
127.0.0.1    easyspyware.com
127.0.0.1    www.easywww.info
127.0.0.1    easywww.info
127.0.0.1    www.eazel.com
127.0.0.1    eazel.com
127.0.0.1    www.eba6y.it
127.0.0.1    eba6y.it
127.0.0.1    www.eba7y.it
127.0.0.1    eba7y.it
127.0.0.1    www.ebaay.it
127.0.0.1    ebaay.it
127.0.0.1    www.ebagy.it
127.0.0.1    ebagy.it
127.0.0.1    www.ebahy.it
127.0.0.1    ebahy.it
127.0.0.1    www.ebajy.it
127.0.0.1    ebajy.it
127.0.0.1    www.ebaqy.it
127.0.0.1    ebaqy.it
127.0.0.1    www.ebasy.it
127.0.0.1    ebasy.it
127.0.0.1    www.ebaty.it
127.0.0.1    ebaty.it
127.0.0.1    www.ebauy.it
127.0.0.1    ebauy.it
127.0.0.1    ebav.com
127.0.0.1    ebaw.com
127.0.0.1    www.ebawy.it
127.0.0.1    ebawy.it
127.0.0.1    www.ebaxy.it
127.0.0.1    ebaxy.it
127.0.0.1    www.ebay6.it
127.0.0.1    ebay6.it
127.0.0.1    www.ebay7.it
127.0.0.1    ebay7.it
127.0.0.1    www.ebayg.it
127.0.0.1    ebayg.it
127.0.0.1    ebayh.it
127.0.0.1    www.ebayh.it
127.0.0.1    www.ebayj.it
127.0.0.1    ebayj.it
127.0.0.1    www.ebayt.it
127.0.0.1    ebayt.it
127.0.0.1    www.ebayu.it
127.0.0.1    ebayu.it
127.0.0.1    ebazy.it
127.0.0.1    www.ebazy.it
127.0.0.1    ebch.com
127.0.0.1    ebdv.com
127.0.0.1    ebdw.com
127.0.0.1    ebestfind.org
127.0.0.1    www.ebestfind.org
127.0.0.1    ebgay.it
127.0.0.1    www.ebgay.it
127.0.0.1    ebgo.com
127.0.0.1    www.ebhay.it
127.0.0.1    ebhay.it
127.0.0.1    ebjp.com
127.0.0.1    ebkb.com
127.0.0.1    ebkn.com
127.0.0.1    ebky.com
127.0.0.1    eblv.com
127.0.0.1    ebmu.com
127.0.0.1    ebnay.it
127.0.0.1    www.ebnay.it
127.0.0.1    ebonypornmag.com
127.0.0.1    www.ebonypornmag.com
127.0.0.1    ebony-pornmag.com
127.0.0.1    www.ebony-pornmag.com
127.0.0.1    www.ebqay.it
127.0.0.1    ebqay.it
127.0.0.1    www.ebsay.it
127.0.0.1    ebsay.it
127.0.0.1    ebsy.it
127.0.0.1    www.ebsy.it
127.0.0.1    www.ebvay.it
127.0.0.1    ebvay.it
127.0.0.1    ebvr.com
127.0.0.1    ebway.it
127.0.0.1    www.ebway.it
127.0.0.1    www.ebwmanufacture.com
127.0.0.1    ebwmanufacture.com
127.0.0.1    ebxay.it
127.0.0.1    www.ebxay.it
127.0.0.1    ebzay.it
127.0.0.1    www.ebzay.it
127.0.0.1    www.echterschutz.com
127.0.0.1    echterschutz.com
127.0.0.1    ecmh.com
127.0.0.1    ecmp.com
127.0.0.1    ecosrioplatenses.org
127.0.0.1    ecpm.com
127.0.0.1    ecstasyporn.net
127.0.0.1    ecwz.com
127.0.0.1    ecyb.com
127.0.0.1    edbay.it
127.0.0.1    www.edbay.it
127.0.0.1    edhq.com
127.0.0.1    edietprogram.com
127.0.0.1    www.edietprogram.com
127.0.0.1    edty.com
127.0.0.1    eduy.com
127.0.0.1    eebay.it
127.0.0.1    www.eebay.it
127.0.0.1    eeev.com
127.0.0.1    www.eepubblica.it
127.0.0.1    eepubblica.it
127.0.0.1    www.efbay.it
127.0.0.1    efbay.it
127.0.0.1    efcsoftware.com
127.0.0.1    www.efcsoftware.com
127.0.0.1    www.egbay.it
127.0.0.1    egbay.it
127.0.0.1    www.ehbay.it
127.0.0.1    ehbay.it
127.0.0.1    eikokoike.com
127.0.0.1    www.elitecodec.com
127.0.0.1    elitecodec.com
127.0.0.1    www.elitemediagroup.net
127.0.0.1    elitemediagroup.net
127.0.0.1    e-localad.com
127.0.0.1    www.elseif.biz
127.0.0.1    elseif.biz
127.0.0.1    www.emailicon.org
127.0.0.1    emailicon.org
127.0.0.1    emch.com
127.0.0.1    www.emcodec.com
127.0.0.1    emcodec.com
127.0.0.1    www.emediacodec.com
127.0.0.1    emediacodec.com
127.0.0.1    www.e-mp3now.com
127.0.0.1    e-mp3now.com
127.0.0.1    www.emule.click-new-download.com
127.0.0.1    emule.click-new-download.com
127.0.0.1    www.emule.mp3-muzic.com
127.0.0.1    emule.mp3-muzic.com
127.0.0.1    www.emuledownloadhome.com
127.0.0.1    emuledownloadhome.com
127.0.0.1    www.emule-freebie.com
127.0.0.1    emule-freebie.com
127.0.0.1    www.enay.it
127.0.0.1    enay.it
127.0.0.1    www.enbay.it
127.0.0.1    enbay.it
127.0.0.1    www.encodeinstrument.com
127.0.0.1    encodeinstrument.com
127.0.0.1    www.endcodec.com
127.0.0.1    endcodec.com
127.0.0.1    www.energy-factor.com
127.0.0.1    energy-factor.com
127.0.0.1    www.engineplay.com
127.0.0.1    engineplay.com
127.0.0.1    www.engine-ticket.com
127.0.0.1    engine-ticket.com
127.0.0.1    www.enhance.com
127.0.0.1    enhance.com
127.0.0.1    enhancevideos.com
127.0.0.1    www.enhancevideos.com
127.0.0.1    enitinvest.net
127.0.0.1    enjoywebsurf.com
127.0.0.1    www.entertainsite.net
127.0.0.1    entertainsite.net
127.0.0.1    www.enterthesearch.com
127.0.0.1    enterthesearch.com
127.0.0.1    www.entirexxx.com
127.0.0.1    entirexxx.com
127.0.0.1    envolo.peopleonpage.com
127.0.0.1    e-plus.cc
127.0.0.1    epornsex.com
127.0.0.1    www.eprotectionline.com
127.0.0.1    eprotectionline.com
127.0.0.1    www.eprotectpage.com
127.0.0.1    eprotectpage.com
127.0.0.1    www.erbay.it
127.0.0.1    erbay.it
127.0.0.1    www.erepubblica.it
127.0.0.1    erepubblica.it
127.0.0.1    ergosites.com
127.0.0.1    erossoalice.it
127.0.0.1    www.erossoalice.it
127.0.0.1    errari.it
127.0.0.1    www.errari.it
127.0.0.1    errclean.com
127.0.0.1    www.errclean.com
127.0.0.1    error404site.com
127.0.0.1    www.error404site.com
127.0.0.1    error404site.net
127.0.0.1    www.error404site.net
127.0.0.1    www.errordoctor.com
127.0.0.1    errordoctor.com
127.0.0.1    www.errorfri.com
127.0.0.1    errorfri.com
127.0.0.1    www.errorkiller.com
127.0.0.1    errorkiller.com

mouick · Answer

127.0.0.1    www.errorout.com
127.0.0.1    errorout.com
127.0.0.1    www.errorprotector.com
127.0.0.1    errorprotector.com
127.0.0.1    www.errorsafe.com
127.0.0.1    errorsafe.com
127.0.0.1    www.errorsdns.com
127.0.0.1    errorsdns.com
127.0.0.1    www.errorskydd.com
127.0.0.1    errorskydd.com
127.0.0.1    www.errorsmart.com
127.0.0.1    errorsmart.com
127.0.0.1    www.errorsoshi.com
127.0.0.1    errorsoshi.com
127.0.0.1    www.errorsweeper.com
127.0.0.1    errorsweeper.com
127.0.0.1    ert0003.e76.163ns.com
127.0.0.1    ert47.a1.wrs.mcboo.com
127.0.0.1    www.ertikadeswiokinganfujas.com
127.0.0.1    ertikadeswiokinganfujas.com
127.0.0.1    es.winantivirus.com
127.0.0.1    es0-www.5zgmu7o20kt5d8yq.com
127.0.0.1    es1-www.5zgmu7o20kt5d8yq.com
127.0.0.1    es2-www.5zgmu7o20kt5d8yq.com
127.0.0.1    es3-www.5zgmu7o20kt5d8yq.com
127.0.0.1    es4-www.5zgmu7o20kt5d8yq.com
127.0.0.1    es5-www.5zgmu7o20kt5d8yq.com
127.0.0.1    es6-www.5zgmu7o20kt5d8yq.com
127.0.0.1    es7-www.5zgmu7o20kt5d8yq.com
127.0.0.1    es8-www.5zgmu7o20kt5d8yq.com
127.0.0.1    es9-www.5zgmu7o20kt5d8yq.com
127.0.0.1    www.esafetylist.com
127.0.0.1    esafetylist.com
127.0.0.1    www.esafetypage.com
127.0.0.1    esafetypage.com
127.0.0.1    www.esbay.it
127.0.0.1    esbay.it
127.0.0.1    www.esearch2005.com
127.0.0.1    esearch2005.com
127.0.0.1    www.esecuritynote.com
127.0.0.1    esecuritynote.com
127.0.0.1    www.esecuritypage.com
127.0.0.1    esecuritypage.com
127.0.0.1    esims.ch
127.0.0.1    www.esims.ch
127.0.0.1    esims.ch
127.0.0.1    esupereva.it
127.0.0.1    www.esupereva.it
127.0.0.1    etdscanner.com
127.0.0.1    www.etdscanner.com
127.0.0.1    www.etomi.all-downloads-now.com
127.0.0.1    etomi.all-downloads-now.com
127.0.0.1    eupdatepage.com
127.0.0.1    www.eupdatepage.com
127.0.0.1    euuu.com
127.0.0.1    www.evbay.it
127.0.0.1    evbay.it
127.0.0.1    www.every-game.com
127.0.0.1    every-game.com
127.0.0.1    every-game.com
127.0.0.1    evidence-detector.biz
127.0.0.1    evidenceeraser.com
127.0.0.1    www.evidenceeraser.com
127.0.0.1    evilspidercomics.com
127.0.0.1    evko.biz
127.0.0.1    www.evko.biz
127.0.0.1    www.ewbay.it
127.0.0.1    ewbay.it
127.0.0.1    ewebsearch.net
127.0.0.1    e-websitesolutions.com
127.0.0.1    ewizard.cc
127.0.0.1    www.exaccess.ru
127.0.0.1    exaccess.ru
127.0.0.1    excellentsckin.com
127.0.0.1    www.exclusivexxxclips.com
127.0.0.1    exclusivexxxclips.com
127.0.0.1    www.exeupdate.com
127.0.0.1    exeupdate.com
127.0.0.1    www.exflow.org
127.0.0.1    exflow.org
127.0.0.1    exit.megago.com
127.0.0.1    www.expandvideo.com
127.0.0.1    expandvideo.com
127.0.0.1    explorertool.net
127.0.0.1    www.explorertool.net
127.0.0.1    www.exportplay.com
127.0.0.1    exportplay.com
127.0.0.1    www.extremepaidsurveys.com
127.0.0.1    extremepaidsurveys.com
127.0.0.1    extremeseek.net
127.0.0.1    eza1netsearch.com
127.0.0.1    www.eza1netsearch.com
127.0.0.1    www.ezcybersearch.com
127.0.0.1    ezcybersearch.com
127.0.0.1    www.ezdvdx.com
127.0.0.1    ezdvdx.com
127.0.0.1    ez-searching.com
127.0.0.1    www.ezwebsearching.com
127.0.0.1    ezwebsearching.com
127.0.0.1    www.ezycontract.com
127.0.0.1    ezycontract.com
127.0.0.1    f0.thezirius.com
127.0.0.1    f1.bestmanage.org
127.0.0.1    f1.cookingluck.com
127.0.0.1    f1.thezirius.com
127.0.0.1    f1.truth-is-out-there.org
127.0.0.1    www.f1organizer.com
127.0.0.1    f1organizer.com
127.0.0.1    f2.bestmanage.org
127.0.0.1    f2.cookingluck.com
127.0.0.1    f2.thezirius.com
127.0.0.1    f2.truth-is-out-there.org
127.0.0.1    f3.bestmanage.org
127.0.0.1    f3.cookingluck.com
127.0.0.1    f3.thezirius.com
127.0.0.1    f3.truth-is-out-there.org
127.0.0.1    f4.bestmanage.org
127.0.0.1    f4.cookingluck.com
127.0.0.1    f4.thezirius.com
127.0.0.1    f4.truth-is-out-there.org
127.0.0.1    f5.bestmanage.org
127.0.0.1    f5.cookingluck.com
127.0.0.1    f5.thezirius.com
127.0.0.1    f5.truth-is-out-there.org
127.0.0.1    f6.bestmanage.org
127.0.0.1    f6.cookingluck.com
127.0.0.1    f6.thezirius.com
127.0.0.1    f7.bestmanage.org
127.0.0.1    f7.cookingluck.com
127.0.0.1    f7.thezirius.com
127.0.0.1    f7.truth-is-out-there.org
127.0.0.1    f8.bestmanage.org
127.0.0.1    f8.cookingluck.com
127.0.0.1    f8.thezirius.com
127.0.0.1    f8.truth-is-out-there.org
127.0.0.1    f9.bestmanage.org
127.0.0.1    f9.cookingluck.com
127.0.0.1    f9.thezirius.com
127.0.0.1    f9.truth-is-out-there.org
127.0.0.1    fabrikverkauf.com
127.0.0.1    www.fabrikverkauf.com
127.0.0.1    fabrikverkauf.com
127.0.0.1    www.fabrik-verkauf.de
127.0.0.1    fabrik-verkauf.de
127.0.0.1    fabrik-verkauf.de
127.0.0.1    Fahrschulquiz.com
127.0.0.1    www.Fahrschulquiz.com
127.0.0.1    Fahrschulquiz.com
127.0.0.1    www.fairsearcher.com
127.0.0.1    fairsearcher.com
127.0.0.1    faithstevens.com
127.0.0.1    fantasiewelten.com
127.0.0.1    www.fapparatus.com
127.0.0.1    fapparatus.com
127.0.0.1    farmacept32.phpnet.us
127.0.0.1    farmsteadbandb.com
127.0.0.1    farse.com
127.0.0.1    fartpost.com
127.0.0.1    fastfreedownload.com
127.0.0.1    fastmediaservice.com
127.0.0.1    www.fastmediaservice.com
127.0.0.1    www.fastmetasearch.com
127.0.0.1    fastmetasearch.com
127.0.0.1    www.fastmp.net
127.0.0.1    fastmp.net
127.0.0.1    www.fastpspdownloads.com
127.0.0.1    fastpspdownloads.com
127.0.0.1    www.fastssearch.com
127.0.0.1    fastssearch.com
127.0.0.1    fasttvdownloads.com
127.0.0.1    www.fasttvdownloads.com
127.0.0.1    fastwebfinder.com
127.0.0.1    faxporn.com
127.0.0.1    www.fazzetta.it
127.0.0.1    fazzetta.it
127.0.0.1    www.fcorriere.it
127.0.0.1    fcorriere.it
127.0.0.1    featured-results.com
127.0.0.1    www.febay.it
127.0.0.1    febay.it
127.0.0.1    feed.dedsearch.com
127.0.0.1    www.feeds.2search.com
127.0.0.1    feeds.2search.com
127.0.0.1    feeds2.2search.org
127.0.0.1    www.feeds2.2search.org
127.0.0.1    www.ferraeri.it
127.0.0.1    ferraeri.it
127.0.0.1    www.ferrai.it
127.0.0.1    ferrai.it
127.0.0.1    www.ferrarei.it
127.0.0.1    ferrarei.it
127.0.0.1    www.ferrarti.it
127.0.0.1    ferrarti.it
127.0.0.1    www.ferrasri.it
127.0.0.1    ferrasri.it
127.0.0.1    www.ferratri.it
127.0.0.1    ferratri.it
127.0.0.1    www.ferreari.it
127.0.0.1    ferreari.it
127.0.0.1    www.ferrri.it
127.0.0.1    ferrri.it
127.0.0.1    www.ferrsari.it
127.0.0.1    ferrsari.it
127.0.0.1    www.ferrtari.it
127.0.0.1    ferrtari.it
127.0.0.1    www.fetrrari.it
127.0.0.1    fetrrari.it
127.0.0.1    www.fgazzetta.it
127.0.0.1    fgazzetta.it
127.0.0.1    www.fgoogle.it
127.0.0.1    fgoogle.it
127.0.0.1    fhg.panet.org
127.0.0.1    www.fhgate.com
127.0.0.1    fhgate.com
127.0.0.1    fickenisgeil.de
127.0.0.1    www.fidoproblems.com
127.0.0.1    fidoproblems.com
127.0.0.1    www.fiksfeil.com
127.0.0.1    fiksfeil.com
127.0.0.1    file.qqhelper.com
127.0.0.1    file.unionsms.net
127.0.0.1    file0.qqhelper.com
127.0.0.1    file1.qqhelper.com
127.0.0.1    file2.qqhelper.com
127.0.0.1    file3.qqhelper.com
127.0.0.1    file4.qqhelper.com
127.0.0.1    file5.qqhelper.com
127.0.0.1    file6.qqhelper.com
127.0.0.1    file7.qqhelper.com
127.0.0.1    file8.qqhelper.com
127.0.0.1    file9.qqhelper.com
127.0.0.1    www.fileprotector.com
127.0.0.1    fileprotector.com
127.0.0.1    www.filesharing-downloads.com
127.0.0.1    filesharing-downloads.com
127.0.0.1    www.filetretporn.com
127.0.0.1    filetretporn.com
127.0.0.1    www.filevoom.com
127.0.0.1    filevoom.com
127.0.0.1    www.Filtrodetrojan.com
127.0.0.1    Filtrodetrojan.com
127.0.0.1    www.finalfantasyactionfigures.com
127.0.0.1    finalfantasyactionfigures.com
127.0.0.1    finance-loans.com
127.0.0.1    find4u.net
127.0.0.1    www.find-52.com
127.0.0.1    find-52.com
127.0.0.1    www.findanyshow.org
127.0.0.1    findanyshow.org
127.0.0.1    www.find-find-777.net
127.0.0.1    find-find-777.net
127.0.0.1    find-itnow.com
127.0.0.1    findit-now.com
127.0.0.1    www.finditquick.com
127.0.0.1    finditquick.com
127.0.0.1    findloss.com
127.0.0.1    findthesite.com
127.0.0.1    www.findthewebsiteyouneed.com
127.0.0.1    findthewebsiteyouneed.com
127.0.0.1    find-uk-health.co.uk
127.0.0.1    www.findwapsite.org
127.0.0.1    findwapsite.org
127.0.0.1    www.findwhatevernow.com
127.0.0.1    findwhatevernow.com
127.0.0.1    fined.biz
127.0.0.1    fine-search.net
127.0.0.1    fionasteel.com
127.0.0.1    firecodec.com
127.0.0.1    www.firecodec.com
127.0.0.1    www.firefoxdownload-now.com
127.0.0.1    firefoxdownload-now.com
127.0.0.1    www.firehunt.com
127.0.0.1    firehunt.com
127.0.0.1    www.firewallgold.com
127.0.0.1    firewallgold.com
127.0.0.1    www.firewallprotectionpro.com
127.0.0.1    firewallprotectionpro.com
127.0.0.1    www.firewallprotectionsite.com
127.0.0.1    firewallprotectionsite.com
127.0.0.1    www.firewallprotector.com
127.0.0.1    firewallprotector.com
127.0.0.1    www.firgilio.it
127.0.0.1    firgilio.it
127.0.0.1    firstbookmark.net
127.0.0.1    www.firstgoodsearch.com
127.0.0.1    firstgoodsearch.com
127.0.0.1    fitness-free.com
127.0.0.1    www.fixerantispy.com
127.0.0.1    fixerantispy.com
127.0.0.1    www.fjsynebcod.com
127.0.0.1    fjsynebcod.com
127.0.0.1    flashdollars.com
127.0.0.1    www.flashdollars.com
127.0.0.1    flashflashmx.3322.org
127.0.0.1    www.floorsovertexas.com
127.0.0.1    floorsovertexas.com
127.0.0.1    www.floproject.com
127.0.0.1    floproject.com
127.0.0.1    flrxtools.greatnuke.com
127.0.0.1    www.flrx-tools.net
127.0.0.1    flrx-tools.net
127.0.0.1    www.flycodecs.com
127.0.0.1    flycodecs.com
127.0.0.1    www.fn777.greatbahamas.com
127.0.0.1    fn777.greatbahamas.com
127.0.0.1    foodvacations.net
127.0.0.1    forex.jps.ru
127.0.0.1    forexcredit.com
127.0.0.1    forexcredit.ru
127.0.0.1    formingfusions.com
127.0.0.1    www.forseo.com
127.0.0.1    forseo.com
127.0.0.1    forsythfire.net
127.0.0.1    forthline.com
127.0.0.1    www.foxmin.com
127.0.0.1    foxmin.com
127.0.0.1    fp.gad-network.com
127.0.0.1    fp.outerinfo.net
127.0.0.1    www.fr.drivecleaner.com
127.0.0.1    fr.drivecleaner.com
127.0.0.1    fr.winantivirus.com
127.0.0.1    fr.winfixer.com
127.0.0.1    frame.crazywinnings.com
127.0.0.1    www.free3xclips.com
127.0.0.1    free3xclips.com
127.0.0.1    free4porno.net
127.0.0.1    free64all.com
127.0.0.1    free-adobe-download-support.com
127.0.0.1    www.free-adobe-download-support.com
127.0.0.1    www.free-avg.org
127.0.0.1    free-avg.org
127.0.0.1    www.free-avg-download.com
127.0.0.1    free-avg-download.com
127.0.0.1    www.free-bearshares.com
127.0.0.1    free-bearshares.com
127.0.0.1    freebookmark.net
127.0.0.1    freebookmarks.net
127.0.0.1    www.freecat.biz
127.0.0.1    freecat.biz
127.0.0.1    freecategories.com
127.0.0.1    free-chipes.com
127.0.0.1    freecj.com
127.0.0.1    www.freeclipoftheday.com
127.0.0.1    freeclipoftheday.com
127.0.0.1    freecoolhost.com
127.0.0.1    www.freedownloadhq.com
127.0.0.1    freedownloadhq.com
127.0.0.1    freedownloadpage.com
127.0.0.1    www.freedownloadpage.com
127.0.0.1    free-download-place.com
127.0.0.1    www.free-download-place.com
127.0.0.1    free-download-support.com
127.0.0.1    www.free-download-support.com
127.0.0.1    freedownloadzone.com
127.0.0.1    www.freedownloadzone.com
127.0.0.1    freefuckmovs.com
127.0.0.1    www.freefuckmovs.com
127.0.0.1    free-hit.com
127.0.0.1    freehqmovies.com
127.0.0.1    www.freeimageheaven.com
127.0.0.1    freeimageheaven.com
127.0.0.1    freemp3access.com
127.0.0.1    www.freemp3access.com
127.0.0.1    free-music-network.com
127.0.0.1    www.free-music-network.com
127.0.0.1    www.free-pc-repair.com
127.0.0.1    free-pc-repair.com
127.0.0.1    www.freepcsecure.com
127.0.0.1    freepcsecure.com
127.0.0.1    free-pics-and-movies.com
127.0.0.1    www.free-popup-killer.com
127.0.0.1    free-popup-killer.com
127.0.0.1    www.free-porn-movies.info
127.0.0.1    free-porn-movies.info
127.0.0.1    www.free-program-download.com
127.0.0.1    free-program-download.com
127.0.0.1    freerbhost.com
127.0.0.1    www.freerealityvidz.com
127.0.0.1    freerealityvidz.com
127.0.0.1    www.free-registrysmart.com
127.0.0.1    free-registrysmart.com
127.0.0.1    freescratchandwin.com
127.0.0.1    free-sex-movie-clips.net
127.0.0.1    freeshemalepics.net
127.0.0.1    www.free-software-center.com
127.0.0.1    free-software-center.com
127.0.0.1    www.free-spybot.com
127.0.0.1    free-spybot.com
127.0.0.1    www.freeunlimitedskype.com
127.0.0.1    freeunlimitedskype.com
127.0.0.1    www.freexxxmpegz.com
127.0.0.1    freexxxmpegz.com
127.0.0.1    freeyaho.com
127.0.0.1    fregat.drocherway.com
127.0.0.1    frepubblica.it
127.0.0.1    www.frepubblica.it
127.0.0.1    freshseek.com
127.0.0.1    freshteensite.com
127.0.0.1    fric.cn
127.0.0.1    frostwire.click-new-download.com
127.0.0.1    www.frostwire.click-new-download.com
127.0.0.1    frrari.it
127.0.0.1    www.frrari.it
127.0.0.1    www.frrrari.it
127.0.0.1    frrrari.it
127.0.0.1    www.ftiscali.it
127.0.0.1    ftiscali.it
127.0.0.1    ftrenitalia.it
127.0.0.1    www.ftrenitalia.it
127.0.0.1    www.ftuttogratis.it
127.0.0.1    ftuttogratis.it
127.0.0.1    fuehrerscheincheck.com
127.0.0.1    fuehrerscheincheck.com
127.0.0.1    www.fuehrerscheincheck.com
127.0.0.1    www.fullmusicdownload.com
127.0.0.1    fullmusicdownload.com
127.0.0.1    www.fullpaidsurveys.com
127.0.0.1    fullpaidsurveys.com
127.0.0.1    full-search.net
127.0.0.1    www.fullsoftwarecenter.com
127.0.0.1    fullsoftwarecenter.com
127.0.0.1    www.fullsoftwaredownloadz.com
127.0.0.1    fullsoftwaredownloadz.com
127.0.0.1    full-tgp.net
127.0.0.1    www.fulltimevideos.com
127.0.0.1    fulltimevideos.com
127.0.0.1    www.fulltvdownloading.com
127.0.0.1    fulltvdownloading.com
127.0.0.1    www.funcodec.com
127.0.0.1    funcodec.com
127.0.0.1    funny-girls.com
127.0.0.1    www.funnysuperxxx.com
127.0.0.1    funnysuperxxx.com
127.0.0.1    www.fun-photo.com
127.0.0.1    fun-photo.com
127.0.0.1    www.fvirgilio.it
127.0.0.1    fvirgilio.it
127.0.0.1    www.fwrrari.it
127.0.0.1    fwrrari.it
127.0.0.1    www.g0oogle.it
127.0.0.1    g0oogle.it
127.0.0.1    g9oogle.it
127.0.0.1    www.g9oogle.it
127.0.0.1    ga31.com
127.0.0.1    www.gaazzetta.it
127.0.0.1    gaazzetta.it
127.0.0.1    gabrielscott.com
127.0.0.1    www.gad-network.com
127.0.0.1    gad-network.com
127.0.0.1    www.galleriesforporn.com
127.0.0.1    galleriesforporn.com
127.0.0.1    www.galleryclick.net
127.0.0.1    galleryclick.net
127.0.0.1    www.gallerypictures.net
127.0.0.1    gallerypictures.net
127.0.0.1    www.gallsforporn.com
127.0.0.1    gallsforporn.com
127.0.0.1    galpostgirls.com
127.0.0.1    gals-for-free.com
127.0.0.1    gambling-online4you.com
127.0.0.1    www.game4all.biz
127.0.0.1    game4all.biz
127.0.0.1    www.games.de.ag
127.0.0.1    games.de.ag
127.0.0.1    games.uzoogle.com
127.0.0.1    www.games-desktop.com
127.0.0.1    games-desktop.com
127.0.0.1    www.games-u-spiele.de
127.0.0.1    games-u-spiele.de
127.0.0.1    games-u-spiele.de
127.0.0.1    gameterror.net
127.0.0.1    gaqzzetta.it
127.0.0.1    www.gaqzzetta.it
127.0.0.1    garfirm.com
127.0.0.1    www.garfirm.com
127.0.0.1    www.gasan.ru
127.0.0.1    gasan.ru
127.0.0.1    gaszzetta.it
127.0.0.1    www.gaszzetta.it
127.0.0.1    gateqy.com
127.0.0.1    www.gateqy.com
127.0.0.1    gaxzetta.it
127.0.0.1    www.gaxzetta.it
127.0.0.1    www.gaxzzetta.it
127.0.0.1    gaxzzetta.it
127.0.0.1    gay50.com
127.0.0.1    gay-clan.com
127.0.0.1    www.gayspornmag.com
127.0.0.1    gayspornmag.com
127.0.0.1    www.gaystogay.com
127.0.0.1    gaystogay.com
127.0.0.1    gazxetta.it
127.0.0.1    www.gazxetta.it
127.0.0.1    gazxzetta.it
127.0.0.1    www.gazxzetta.it
127.0.0.1    www.gazzaetta.it
127.0.0.1    gazzaetta.it
127.0.0.1    www.gazzdetta.it
127.0.0.1    gazzdetta.it
127.0.0.1    www.gazzedtta.it
127.0.0.1    gazzedtta.it
127.0.0.1    www.gazzeetta.it
127.0.0.1    gazzeetta.it
127.0.0.1    www.gazzeftta.it
127.0.0.1    gazzeftta.it
127.0.0.1    www.gazzegtta.it
127.0.0.1    gazzegtta.it
127.0.0.1    www.gazzehtta.it
127.0.0.1    gazzehtta.it
127.0.0.1    www.gazzerta.it
127.0.0.1    gazzerta.it
127.0.0.1    www.gazzertta.it
127.0.0.1    gazzertta.it
127.0.0.1    gazzestta.it
127.0.0.1    www.gazzestta.it
127.0.0.1    gazzetra.it
127.0.0.1    www.gazzetra.it
127.0.0.1    www.gazzett.it
127.0.0.1    gazzett.it
127.0.0.1    www.gazzettaa.it
127.0.0.1    gazzettaa.it
127.0.0.1    gazzettaq.it
127.0.0.1    www.gazzettaq.it

chimay8 · Answer

passe outre ces lignes poste juste la fin

mouick · Answer

j'en ai encore je ne sais pas combien de pages et apres c'est ca...


»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

C:\WINDOWS\system32\Delete_Me_Dummy_karna.dat supprimé

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» RK

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{674C9B90-1461-46F6-86E7-F398B0D6087E}: NameServer=80.10.246.1,80.10.246.132
HKLM\SYSTEM\CS1\Services\Tcpip\..\{674C9B90-1461-46F6-86E7-F398B0D6087E}: NameServer=80.10.246.1,80.10.246.132
HKLM\SYSTEM\CS2\Services\Tcpip\..\{674C9B90-1461-46F6-86E7-F398B0D6087E}: NameServer=80.10.246.1,80.10.246.132
HKLM\SYSTEM\CS3\Services\Tcpip\..\{674C9B90-1461-46F6-86E7-F398B0D6087E}: NameServer=80.10.246.1,80.10.246.132

»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
 
Nettoyage terminé.
 
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin


tu as besoin des autres pages de WW???W

mouick · Answer

:) la blonde qui pose 10 pages et qui pose la question a la fin :)

chimay8 · Answer

nooooonnn,lol
j'en ai pas besoin hi hi

c'est ok,
Relance LOP S&D 

Choisis cette fois ci l'Option 2 ( Suppression ) 

Ne ferme pas la fenêtre lors de la suppression ! 

Poste le rapport généré ( C:\lopR.txt ) 

( Si le Bureau ne réapparaît pas presse Ctrl + Alt + Suppr, Onglet Fichier, 

Nouvelle tâche, tape explorer.exe et valide )

mouick · Answer

--------------------\  Lop S&D 4.2.4-5   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free : Genuine Intel(R) CPU           T2050  @ 1.60GHz )
   BIOS : Ver 1.00PARTTBL
   USER : celine billard ( Administrator )
   BOOT : Normal boot
   C:\ (Local Disk) - NTFS - Total : 66 Go Free : 4 Go
   D:\ (Local Disk) - FAT32 - Total : 7 Go Free : 1 Go
   E:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 02-10-2008|23:42 )
   Option : [2] ( 13/10/2008|15:45 )


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\DOCUME~1\CELINE~1\LOCALS~1\Temp
scopy.tmp
   Supprime! - C:\DOCUME~1\CELINE~1\LOCALS~1\Temp
smail.eml
   -
   [ Fichier Hosts ] .. Restaure!
 
   \\\\\\\\\\\\\\\ 

 
   --------------------\  Listing des dossiers dans APPLIC~1  

   [10/09/2008|21:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
   [21/09/2008|15:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [12/08/2007|14:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe Systems
   [27/08/2007|21:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [10/10/2006|22:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [15/09/2008|22:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BVRP Software
   [08/02/2008|21:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CanonBJ
   [02/04/2008|16:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CopyPod
   [30/04/2008|19:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
   [13/10/2008|07:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\dqtcdwfo
   [08/12/2006|18:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
   [22/12/2006|22:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Elaborate Bytes
   [12/10/2008|22:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Fighters
   [27/01/2007|17:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [23/09/2008|21:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP
   [11/05/2006|10:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
   [02/04/2008|18:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Intel
   [13/10/2008|07:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\jsnunsfm
   [12/10/2008|20:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab Setup Files
   [19/08/2008|17:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [10/09/2008|16:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
   [22/09/2008|07:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NOS
   [11/05/2006|02:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1
View_Profiles
   [13/10/2008|14:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1
wbgpuly
   [03/01/2008|13:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\River Past G5
   [18/04/2007|18:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Samsung
   [11/05/2006|10:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
   [11/05/2006|10:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sonic
   [04/06/2007|21:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony Corporation
   [13/10/2008|14:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [01/02/2007|23:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
   [12/10/2008|17:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\wfgvilmf
   [29/08/2006|00:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [22/03/2008|22:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

   [10/02/2008|11:03] C:\DOCUME~1\CELINE~1\APPLIC~1\Adobe
   [07/10/2008|07:22] C:\DOCUME~1\CELINE~1\APPLIC~1\AdobeUM
   [27/12/2006|22:21] C:\DOCUME~1\CELINE~1\APPLIC~1\Ahead
   [10/09/2008|22:20] C:\DOCUME~1\CELINE~1\APPLIC~1\Apple Computer
   [10/02/2008|11:02] C:\DOCUME~1\CELINE~1\APPLIC~1\BitTorrent
   [08/10/2008|12:46] C:\DOCUME~1\CELINE~1\APPLIC~1\CopyToDvd
   [06/02/2007|18:21] C:\DOCUME~1\CELINE~1\APPLIC~1\CyberLink
   [08/11/2006|07:44] C:\DOCUME~1\CELINE~1\APPLIC~1\DivX
   [06/02/2007|18:02] C:\DOCUME~1\CELINE~1\APPLIC~1\dvdcss
   [02/12/2006|17:15] C:\DOCUME~1\CELINE~1\APPLIC~1\Elaborate Bytes
   [28/08/2006|19:20] C:\DOCUME~1\CELINE~1\APPLIC~1\Google
   [12/08/2008|11:40] C:\DOCUME~1\CELINE~1\APPLIC~1\GrabIt
   [23/04/2008|13:36] C:\DOCUME~1\CELINE~1\APPLIC~1\Help
   [24/09/2008|08:33] C:\DOCUME~1\CELINE~1\APPLIC~1\HP
   [11/05/2006|10:35] C:\DOCUME~1\CELINE~1\APPLIC~1\Identities
   [23/09/2008|21:11] C:\DOCUME~1\CELINE~1\APPLIC~1\Image Zone Express
   [02/04/2008|18:03] C:\DOCUME~1\CELINE~1\APPLIC~1\Intel
   [03/01/2008|13:08] C:\DOCUME~1\CELINE~1\APPLIC~1\Lavasoft
   [01/09/2006|13:48] C:\DOCUME~1\CELINE~1\APPLIC~1\Leadertech
   [14/05/2008|09:29] C:\DOCUME~1\CELINE~1\APPLIC~1\LimeWire
   [28/08/2006|19:09] C:\DOCUME~1\CELINE~1\APPLIC~1\Macromedia
   [08/09/2006|14:54] C:\DOCUME~1\CELINE~1\APPLIC~1\Media Player Classic
   [10/07/2008|22:58] C:\DOCUME~1\CELINE~1\APPLIC~1\Microsoft
   [12/06/2008|21:39] C:\DOCUME~1\CELINE~1\APPLIC~1\Mozilla
   [22/03/2007|23:28] C:\DOCUME~1\CELINE~1\APPLIC~1\Real
   [18/04/2007|22:19] C:\DOCUME~1\CELINE~1\APPLIC~1\River Past G5
   [18/04/2007|19:32] C:\DOCUME~1\CELINE~1\APPLIC~1\Samsung
   [16/03/2007|22:31] C:\DOCUME~1\CELINE~1\APPLIC~1\SecondLife
   [05/12/2006|19:13] C:\DOCUME~1\CELINE~1\APPLIC~1\Skype
   [02/12/2006|17:01] C:\DOCUME~1\CELINE~1\APPLIC~1\SlySoft
   [01/09/2006|13:48] C:\DOCUME~1\CELINE~1\APPLIC~1\Sonic
   [04/06/2007|22:06] C:\DOCUME~1\CELINE~1\APPLIC~1\Sony Corporation
   [29/08/2006|19:05] C:\DOCUME~1\CELINE~1\APPLIC~1\Sun
   [28/01/2007|11:33] C:\DOCUME~1\CELINE~1\APPLIC~1\Talkback
   [12/06/2008|21:15] C:\DOCUME~1\CELINE~1\APPLIC~1\TaoUSign
   [12/06/2008|21:39] C:\DOCUME~1\CELINE~1\APPLIC~1\Thunderbird
   [06/10/2006|21:46] C:\DOCUME~1\CELINE~1\APPLIC~1\UseNeXT
   [08/10/2008|08:41] C:\DOCUME~1\CELINE~1\APPLIC~1\uTorrent
   [09/11/2006|07:50] C:\DOCUME~1\CELINE~1\APPLIC~1\vlc
   [08/10/2008|12:46] C:\DOCUME~1\CELINE~1\APPLIC~1\Vso
   [19/08/2008|17:41] C:\DOCUME~1\CELINE~1\APPLIC~1\Windows Desktop Search
   [19/08/2008|20:59] C:\DOCUME~1\CELINE~1\APPLIC~1\Windows Search

   [11/05/2006|10:35] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [02/04/2008|18:03] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Intel
   [11/05/2006|02:54] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [02/04/2008|18:03] C:\DOCUME~1\LOCALS~1\APPLIC~1\Intel
   [26/08/2006|00:32] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [02/04/2008|18:03] C:\DOCUME~1\NETWOR~1\APPLIC~1\Intel
   [11/05/2006|02:40] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [08/10/2008 22:32][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [26/03/2007 22:08][--a------] C:\WINDOWS	asks\Critical Battery Alarm Program.job
   [13/10/2008 15:14][--ah-----] C:\WINDOWS	asks\SA.DAT
   [05/08/2004 23:00][-rah-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [21/09/2008|15:30] C:\Program Files\Adobe
   [10/09/2008|21:15] C:\Program Files\Apple Software Update
   [22/07/2008|23:34] C:\Program Files\BitTorrent
   [29/08/2006|00:30] C:\Program Files\CONEXANT
   [24/06/2008|06:46] C:\Program Files\CopyPod
   [27/12/2006|08:27] C:\Program Files\DAEMON Tools
   [10/02/2007|23:25] C:\Program Files\directx
   [07/09/2008|22:46] C:\Program Files\DivX
   [22/12/2006|23:32] C:\Program Files\Elaborate Bytes
   [15/08/2008|16:02] C:\Program Files\Electronic Arts
   [13/10/2008|07:12] C:\Program Files\eMule
   [13/10/2008|15:29] C:\Program Files\Enigma Software Group
   [12/10/2008|17:35] C:\Program Files\Fichiers communs
   [13/10/2008|02:55] C:\Program Files\Fighters
   [07/01/2008|10:03] C:\Program Files\Google
   [29/03/2008|21:45] C:\Program Files\GrabIt
   [18/11/2006|10:28] C:\Program Files\Hewlett-Packard
   [23/09/2008|21:08] C:\Program Files\Hp
   [17/08/2006|22:37] C:\Program Files\HPQ
   [12/10/2008|17:33] C:\Program Files\Inet Delivery
   [15/09/2008|22:36] C:\Program Files\InstallShield Installation Information
   [30/08/2006|21:06] C:\Program Files\Intel
   [19/08/2008|17:06] C:\Program Files\Internet Explorer
   [18/08/2006|01:06] C:\Program Files\Inventel
   [04/05/2008|09:21] C:\Program Files\Iomega
   [10/09/2008|21:14] C:\Program Files\iPod
   [10/09/2008|21:14] C:\Program Files\iTunes
   [20/07/2008|21:50] C:\Program Files\Java
   [01/09/2006|17:10] C:\Program Files\K-Lite Codec Pack
   [12/10/2008|17:19] C:\Program Files\lxgaheb
   [03/01/2008|13:08] C:\Program Files\Macrogaming
   [01/10/2007|21:04] C:\Program Files\MEMO
   [19/08/2008|15:27] C:\Program Files\Messenger
   [27/01/2007|23:31] C:\Program Files\Microsoft ActiveSync
   [10/05/2007|03:01] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [28/08/2006|23:38] C:\Program Files\microsoft frontpage
   [12/06/2008|22:12] C:\Program Files\Microsoft Office
   [19/08/2008|15:29] C:\Program Files\Microsoft Silverlight
   [12/06/2008|22:12] C:\Program Files\Microsoft Works
   [12/06/2008|22:12] C:\Program Files\Microsoft.NET
   [01/01/2008|22:19] C:\Program Files\Mindscape
   [19/08/2008|14:14] C:\Program Files\Movie Maker
   [13/10/2008|15:20] C:\Program Files\Mozilla Firefox
   [13/10/2008|15:29] C:\Program Files\Mozilla Thunderbird
   [18/04/2007|23:21] C:\Program Files\mp3DirectCut
   [05/08/2007|20:42] C:\Program Files\MSBuild
   [11/05/2006|10:35] C:\Program Files\MSN
   [11/05/2006|10:35] C:\Program Files\MSN Gaming Zone
   [26/03/2008|09:01] C:\Program Files\MSN Messenger
   [15/10/2006|00:06] C:\Program Files\MSXML 4.0
   [05/08/2007|20:47] C:\Program Files\MSXML 6.0
   [01/09/2006|18:22] C:\Program Files\Nero
   [19/08/2008|14:12] C:\Program Files\NetMeeting
   [01/09/2006|18:57] C:\Program Files\NetWaiting
   [22/09/2008|07:03] C:\Program Files\NOS
   [29/08/2006|20:59] C:\Program Files\OfficeUpdate11
   [19/08/2008|14:12] C:\Program Files\Outlook Express
   [12/10/2008|17:55] C:\Program Files\PC-Antispy
   [07/01/2008|10:04] C:\Program Files\Picasa2
   [29/03/2008|21:52] C:\Program Files\QuickPar
   [10/09/2008|21:13] C:\Program Files\QuickTime
   [20/01/2007|23:02] C:\Program Files\Real
   [05/08/2007|20:38] C:\Program Files\Reference Assemblies
   [30/03/2008|10:33] C:\Program Files\Roxio
   [10/09/2008|21:28] C:\Program Files\Safari
   [20/07/2008|21:57] C:\Program Files\Samsung
   [22/12/2006|23:32] C:\Program Files\SlySoft
   [04/06/2007|21:33] C:\Program Files\Sony
   [13/10/2008|14:12] C:\Program Files\Spybot - Search & Destroy
   [11/05/2006|02:56] C:\Program Files\Synaptics
   [28/12/2006|22:53] C:\Program Files\THQ
   [11/05/2006|10:35] C:\Program Files\Uninstall Information
   [06/10/2006|19:59] C:\Program Files\UseNeXT
   [22/07/2008|23:41] C:\Program Files\uTorrent
   [09/11/2006|07:45] C:\Program Files\VideoLAN
   [08/10/2008|12:28] C:\Program Files\VSO
   [28/08/2006|23:04] C:\Program Files\Wanadoo
   [19/08/2008|17:41] C:\Program Files\Windows Desktop Search
   [22/03/2008|22:24] C:\Program Files\Windows Live
   [07/11/2006|08:10] C:\Program Files\Windows Media Connect 2
   [19/08/2008|14:12] C:\Program Files\Windows Media Player
   [19/08/2008|14:12] C:\Program Files\Windows NT
   [11/05/2006|10:35] C:\Program Files\WindowsUpdate
   [23/04/2008|13:36] C:\Program Files\WinRAR
   [11/05/2006|10:35] C:\Program Files\xerox

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [23/09/2008|21:37] C:\Program Files\Fichiers communs\Adobe
   [12/08/2007|14:44] C:\Program Files\Fichiers communs\Adobe Systems Shared
   [01/10/2007|23:25] C:\Program Files\Fichiers communs\Ahead
   [10/09/2008|21:13] C:\Program Files\Fichiers communs\Apple
   [12/06/2008|22:12] C:\Program Files\Fichiers communs\DESIGNER
   [03/09/2008|12:03] C:\Program Files\Fichiers communs\Hewlett-Packard
   [11/05/2006|10:35] C:\Program Files\Fichiers communs\HP
   [18/11/2006|15:34] C:\Program Files\Fichiers communs\InstallShield
   [11/05/2006|10:35] C:\Program Files\Fichiers communs\Java
   [27/01/2007|23:31] C:\Program Files\Fichiers communs\LightScribe
   [15/09/2008|22:36] C:\Program Files\Fichiers communs\Microsoft Shared
   [24/10/2007|12:58] C:\Program Files\Fichiers communs\Motorola Shared
   [11/05/2006|10:35] C:\Program Files\Fichiers communs\MSSoap
   [11/05/2006|10:35] C:\Program Files\Fichiers communs\ODBC
   [09/09/2007|08:42] C:\Program Files\Fichiers communs\Real
   [11/05/2006|10:35] C:\Program Files\Fichiers communs\Services
   [30/03/2008|10:33] C:\Program Files\Fichiers communs\Sonic Shared
   [04/06/2007|21:32] C:\Program Files\Fichiers communs\Sony Shared
   [11/05/2006|10:35] C:\Program Files\Fichiers communs\SpeechEngines
   [30/03/2008|10:33] C:\Program Files\Fichiers communs\SureThing Shared
   [01/02/2007|23:01] C:\Program Files\Fichiers communs\Symantec Shared
   [19/08/2008|14:12] C:\Program Files\Fichiers communs\System
   [22/03/2008|22:23] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [09/09/2007|08:42] C:\Program Files\Fichiers communs\xing shared

   --------------------\  Process

   ( 60 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-10-13 15:46:25
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 745
 
   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [F:1449][D:99]-> C:\DOCUME~1\CELINE~1\LOCALS~1\Temp
   [F:15][D:0]-> C:\DOCUME~1\CELINE~1\Cookies
   [F:10270][D:20]-> C:\DOCUME~1\CELINE~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 13/10/2008|14:16 - Option : [1]
   2 - "C:\Lop SD\LopR_2.txt" - 13/10/2008|14:38 - Option : [1]
   3 - "C:\Lop SD\LopR_3.txt" - 13/10/2008|15:48 - Option : [2]

   --------------------\  Fin du rapport a 15:48:28

chimay8 · Answer

ok,
tu peux me reposter un nouveau rapport HijackThis stp

mouick · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:54:46, on 13/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Inventel\Gateway\wlancfg.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\DOCUME~1\CELINE~1\LOCALS~1\Temp\mqtgsvc.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\yvidwhkt.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Documents and Settings\celine billard\Bureau\HiJ.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F3 - REG:win.ini: load=C:\DOCUME~1\CELINE~1\APPLIC~1\mstinit.exe
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [SNM] C:\Program Files\SpyNoMore\SNM.exe /startup
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SVCHOST.EXE] C:\WINDOWS\system32\drivers\svchost.exe
O4 - HKCU\..\Run: [strcfgadm] C:\WINDOWS\system32\yvidwhkt.exe
O4 - HKLM\..\Policies\Explorer\Run: [MqtgSVC] C:\DOCUME~1\CELINE~1\LOCALS~1\Temp\mqtgsvc.exe /waitservice
O4 - HKLM\..\Policies\Explorer\Run: [PJVKPn003N] C:\Documents and Settings\All Users\Application Data
wbgpuly	ipmtufk.exe
O4 - HKCU\..\Policies\Explorer\Run: [MstInit] C:\DOCUME~1\CELINE~1\LOCALS~1\APPLIC~1\MICROS~1\mstinit.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [PJVKPn003N] C:\Documents and Settings\All Users\Application Data
wbgpuly	ipmtufk.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [DllHst] C:\WINDOWS\dllhst3g.exe /waitservice (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [DllHst] C:\WINDOWS\dllhst3g.exe /waitservice (User 'Default user')
O4 - Startup: .security
O4 - Global Startup: .security
O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {2EF3FB47-7B1E-4536-BA4D-51427BD45DFA} - https://www.pixaco.fr/static/download/pixacodndupload.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{674C9B90-1461-46F6-86E7-F398B0D6087E}: NameServer = 80.10.246.1,80.10.246.132
O21 - SSODL: SysMsg - {621483C7-EF15-1660-0E71-00BE5E159BBC} - C:\Program Files\lxgaheb\SysMsg.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SsBeSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\Program Files\Inventel\Gateway\wlancfg.exe

chimay8 · Answer

heu je pourrais abuser et quand tu auras terminé te demander un conseil pour mieux me proteger?
bien sur

fais ceci stp
relance HIjackThis(scan only) et coche ces lignes

O4 - HKLM\..\Run: [SNM] C:\Program Files\SpyNoMore\SNM.exe /startup 
O4 - HKCU\..\Run: [SVCHOST.EXE] C:\WINDOWS\system32\drivers\svchost.exe 
O4 - HKLM\..\Policies\Explorer\Run: [PJVKPn003N] C:\Documents and Settings\All Users\Application Data
wbgpuly	ipmtufk.exe 
O4 - HKCU\..\Policies\Explorer\Run: [MstInit] C:\DOCUME~1\CELINE~1\LOCALS~1\APPLIC~1\MICROS~1\mstinit.exe /waitservice 
O4 - HKCU\..\Policies\Explorer\Run: [PJVKPn003N] C:\Documents and Settings\All Users\Application Data
wbgpuly	ipmtufk.exe 
O4 - Startup: .security 
O4 - Global Startup: .security 

clic sur fix checked

ensuite

Télécharge SDfix (créé par AndyManchesta) et sauvegarde le sur ton Bureau. Tu peux suivre le tutorial SDFix de Malekal pour t'aider : 

Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici : 
Redémarre ton ordinateur 
Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde). 
A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître. 
Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée". 
Choisis ton compte. 
Déroule la liste des instructions ci-dessous : 
Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script. 
Appuie sur Y pour commencer le processus de nettoyage. 
Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer. 
Appuie sur une touche pour redémarrer le PC. 
Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers. 
Après le chargement du Bureau, l'outil terminera son travail et affichera Finished. 
Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau. 
Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt. 
Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis ! 

Si SDFix ne se lance pas 
Clique sur Démarrer > Exécuter 
Copie/colle ceci : 
%systemroot%\system32\cmd.exe /K %systemdrive%\SDFix\apps\FixPath.exe 

Clique sur Ok. 
Redémarre et essaie de relance SDFix.

mouick · Answer

ok, je vais chercher ma fille a l'ecole et je reviens faire ca :D tu es la jusque quelle heure?

chimay8 · Answer

ouf...je sais pas!!
mais je suis là ce soir

chimay8 · Answer

des que ces fait,
clic sur démarrer-->panneau de config
double clique sur parefeu et active le

ensuite on va installer un Antivirus...

mouick · Answer

SmitFraudFix v2.359

Rapport fait à 13:45:04,51, 13/10/2008
Executé à partir de C:\Documents and Settings\celine billard\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Inventel\Gateway\wlancfg.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\System32\drivers\ieudinit.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Documents and Settings\All Users\Application Data
wbgpuly	ipmtufk.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\yvidwhkt.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32	emp1.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

Fichier hosts corrompu !

127.0.0.1	www.legal-at-spybot.info
127.0.0.1	legal-at-spybot.info

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

C:\WINDOWS\karna.dat PRESENT !
C:\WINDOWS\svchost.exe PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\brastk.exe PRESENT !
C:\WINDOWS\system32\karna.dat PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\celine billard


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\celine billard\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\CELINE~1\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 

C:\Program Files\akl\ PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="karna.dat"


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK

C:\WINDOWS\system32\drivers\beep.sys infecté !


»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel(R) PRO/Wireless 3945ABG Network Connection - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{674C9B90-1461-46F6-86E7-F398B0D6087E}: NameServer=80.10.246.1,80.10.246.132
HKLM\SYSTEM\CCS\Services\Tcpip\..\{CEAA0727-4A5D-44AD-AFE6-85DF98DE2E3F}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{674C9B90-1461-46F6-86E7-F398B0D6087E}: NameServer=80.10.246.1,80.10.246.132
HKLM\SYSTEM\CS1\Services\Tcpip\..\{CEAA0727-4A5D-44AD-AFE6-85DF98DE2E3F}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{674C9B90-1461-46F6-86E7-F398B0D6087E}: NameServer=80.10.246.1,80.10.246.132
HKLM\SYSTEM\CS3\Services\Tcpip\..\{674C9B90-1461-46F6-86E7-F398B0D6087E}: NameServer=80.10.246.1,80.10.246.132
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin



hijack

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:59:34, on 13/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Inventel\Gateway\wlancfg.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\yvidwhkt.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Documents and Settings\celine billard\Bureau\HiJ.exe
C:\WINDOWS\system32\yvidwhkt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [strcfgadm] C:\WINDOWS\system32\yvidwhkt.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {2EF3FB47-7B1E-4536-BA4D-51427BD45DFA} - https://www.pixaco.fr/static/download/pixacodndupload.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{674C9B90-1461-46F6-86E7-F398B0D6087E}: NameServer = 80.10.246.1,80.10.246.132
O21 - SSODL: SysMsg - {621483C7-EF15-1660-0E71-00BE5E159BBC} - C:\Program Files\lxgaheb\SysMsg.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SsBeSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\Program Files\Inventel\Gateway\wlancfg.exe

chimay8 · Answer

yep...
tu m'as collé le rapport de SmitFraudFix v2.359
je préfère celui de Sdfix
hi hi

Sacabouffe · Answer

Salut
Voilà le message qu'était resté coincé.

voila pour le SDFIX


[b]SDFix: Version 1.235 /b
Run by celine billard on 13/10/2008 at 17:34

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services /b:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Infected beep.sys Found!/b

beep.sys File Locations:

"C:\WINDOWS\system32\dllcache\beep.sys" 28160 12/10/2008 17:19
"C:\WINDOWS\system32\drivers\beep.sys" 4224 28/08/2001 14:00

Infected File Listed Below:

C:\WINDOWS\system32\dllcache\beep.sys

File copied to Backups Folder
Attempting to replace beep.sys with original version


Original beep.sys Restored

"C:\WINDOWS\system32\dllcache\beep.sys" 4224 07/08/2008 16:27
"C:\WINDOWS\system32\drivers\beep.sys" 4224 07/08/2008 16:27



[b]Checking Files /b:

Trojan Files Found:

C:\autorun.inf - Deleted
C:\.security - Deleted
C:\WINDOWS\.security - Deleted
C:\WINDOWS\system32\drivers\etc\.security - Deleted
C:\Program Files\PC-Antispy\ASpyStBlk.dll - Deleted
C:\WINDOWS\a.bat - Deleted
C:\WINDOWS\system32\wini104552663.exe - Deleted
C:\WINDOWS\zip1.tmp - Deleted
C:\WINDOWS\zip2.tmp - Deleted
C:\WINDOWS\zip3.tmp - Deleted
C:\WINDOWS\zipped.tmp - Deleted
C:\WINDOWS\a.bat - Deleted
C:\WINDOWS\autorun.inf - Deleted
C:\WINDOWS\base64.tmp - Deleted
C:\WINDOWS\bdn.com - Deleted
C:\WINDOWS\brastk.exe - Deleted
C:\WINDOWS\FVProtect.exe - Deleted
C:\WINDOWS\iTunesMusic.exe - Deleted
C:\WINDOWS\mssecu.exe - Deleted
C:\WINDOWS\svchost.exe - Deleted
C:\WINDOWS\system32\akttzn.exe - Deleted
C:\WINDOWS\system32\anticipator.dll - Deleted
C:\WINDOWS\system32\awtoolb.dll - Deleted
C:\WINDOWS\system32\bdn.com - Deleted
C:\WINDOWS\system32\dpcproxy.exe - Deleted
C:\WINDOWS\system32\hoproxy.dll - Deleted
C:\WINDOWS\system32\hxiwlgpm.dat - Deleted
C:\WINDOWS\system32\hxiwlgpm.exe - Deleted
C:\WINDOWS\system32\medup012.dll - Deleted
C:\WINDOWS\system32\medup020.dll - Deleted
C:\WINDOWS\system32\msgp.exe - Deleted
C:\WINDOWS\system32\msnbho.dll - Deleted
C:\WINDOWS\system32\mssecu.exe - Deleted
C:\WINDOWS\system32\msvchost.exe - Deleted
C:\WINDOWS\system32\mtr2.exe - Deleted
C:\WINDOWS\system32\mwin32.exe - Deleted
C:\WINDOWS\system32
etode.exe - Deleted
C:\WINDOWS\system32
ewsd32.exe - Deleted
C:\WINDOWS\system32\ps1.exe - Deleted
C:\WINDOWS\system32\psof1.exe - Deleted
C:\WINDOWS\system32\psoft1.exe - Deleted
C:\WINDOWS\system32egc64.dll - Deleted
C:\WINDOWS\system32egm64.dll - Deleted
C:\WINDOWS\system32\Rundl1.exe - Deleted
C:\WINDOWS\system32\smp\msrc.exe - Deleted
C:\WINDOWS\system32\sncntr.exe - Deleted
C:\WINDOWS\system32\ssvchost.com - Deleted
C:\WINDOWS\system32\ssvchost.exe - Deleted
C:\WINDOWS\system32\sysreq.exe - Deleted
C:\WINDOWS\system32	aack.dat - Deleted
C:\WINDOWS\system32	aack.exe - Deleted
C:\WINDOWS\system32	emp#01.exe - Deleted
C:\WINDOWS\system32	hun.dll - Deleted
C:\WINDOWS\system32	hun32.dll - Deleted
C:\WINDOWS\system32\VBIEWER.OCX - Deleted
C:\WINDOWS\system32\vbsys2.dll - Deleted
C:\WINDOWS\system32\vcatchpi.dll - Deleted
C:\WINDOWS\system32\winlogonpc.exe - Deleted
C:\WINDOWS\system32\winsystem.exe - Deleted
C:\WINDOWS\system32\WINWGPX.EXE - Deleted
C:\WINDOWS\userconfig9x.dll - Deleted
C:\WINDOWS\winsystem.exe - Deleted



Folder C:\Program Files\Inet Delivery - Removed
Folder C:\Program Files\PC-Antispy - Removed
Folder C:\WINDOWS\mslagent - Removed
Folder C:\WINDOWS\system32\smp - Removed


Removing Temp Files

[b]ADS Check /b:



[b]Final Check /b:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-13 17:52:37
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:8cba427d
"s2"=dword:a7eff81e
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:c1,ae,26,ad,f5,07,1b,d5,74,a5,85,e8,00,01,7e,e9,16,89,15,59,b5,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:e4,48,0f,89,15,12,f2,23,1e,7a,e9,77,74,a5,8c,f9,27,05,ce,79,94,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:c1,ae,26,ad,f5,07,1b,d5,74,a5,85,e8,00,01,7e,e9,16,89,15,59,b5,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:e4,48,0f,89,15,12,f2,23,1e,7a,e9,77,74,a5,8c,f9,27,05,ce,79,94,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:c1,ae,26,ad,f5,07,1b,d5,74,a5,85,e8,00,01,7e,e9,16,89,15,59,b5,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:e4,48,0f,89,15,12,f2,23,1e,7a,e9,77,74,a5,8c,f9,27,05,ce,79,94,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services /b:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"C:\Program Files\eMule\eMule.exe"="C:\Program Files\eMule\eMule.exe:*:Enabled:eMule"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:æTorrent"
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Hp\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\Hp\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\Program Files\Hp\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\Hp\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\Program Files\Hp\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\Hp\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\Program Files\Hp\Digital Imaging\bin\hposid01.exe"="C:\Program Files\Hp\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"C:\Program Files\Hp\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\Hp\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\Program Files\Hp\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\Hp\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\Program Files\Hp\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\Hp\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\Program Files\Hp\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\Hp\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\Program Files\Hp\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\Hp\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\Program Files\Hp\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\Hp\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\Program Files\Hp\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\Hp\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files /b:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes /b:

Fri 12 May 2006 1,211 A.SHR --- "C:\copy.exe"
Sat 20 May 2006 70,207 A.SHR --- "C:\host.exe"
Fri 12 May 2006 1,211 A.SHR --- "C:\WINDOWS\xcopy.exe"
Mon 14 Apr 2008 60,416 A.SH. --- "C:\Program Files\Outlook Express\msimn.exe"
Mon 7 Jan 2008 6,219,320 A..H. --- "C:\Program Files\Picasa2\setup.exe"
Mon 15 Sep 2008 1,562,960 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll"
Mon 7 Jul 2008 4,891,472 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\Sp.exe"
Fri 25 Aug 2006 22 A.SH. --- "C:\WINDOWS\SMINST\HPCD.sys"
Tue 7 Nov 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue 7 Nov 2006 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Thu 24 Jan 2008 0 A..H. --- "C:\WINDOWS\SDold\Download\585dc2612ebcefc90e7dee4c276ee95e\BIT1.tmp"
Thu 24 Jan 2008 0 A..H. --- "C:\WINDOWS\SDold\Download\bc066f3f60df1b38218903dd0d40ce98\BIT2.tmp"

[b]Finished!/b


et hijack:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:59:34, on 13/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Inventel\Gateway\wlancfg.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\yvidwhkt.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Documents and Settings\celine billard\Bureau\HiJ.exe
C:\WINDOWS\system32\yvidwhkt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [strcfgadm] C:\WINDOWS\system32\yvidwhkt.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {2EF3FB47-7B1E-4536-BA4D-51427BD45DFA} - https://www.pixaco.fr/static/download/pixacodndupload.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{674C9B90-1461-46F6-86E7-F398B0D6087E}: NameServer = 80.10.246.1,80.10.246.132
O21 - SSODL: SysMsg - {621483C7-EF15-1660-0E71-00BE5E159BBC} - C:\Program Files\lxgaheb\SysMsg.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SsBeSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\Program Files\Inventel\Gateway\wlancfg.exe

-- 
End of file - 11561 bytes

Bonne continuation ;-)

chimay8 · Answer

ok,
merci Sacabouffe

chimay8 · Answer

mouick
clic sur démarrer-->panneau de config 
double clique sur parefeu et active le

tu l'as fait?

mouick · Answer

j'ai une alert Windows security qui me demande si je veux enable the protection pour un trojan nommé trojan downloader.win32.agent.bq!!!

mouick · Answer

heu oui j'ai activé le par feu :)
je fais tout ce que tu me dis en fait :D
confiance totale :)

chimay8 · Answer

tu as fait le poste 38?

tracasse pas on va tout avoir

chimay8 · Answer

ah ok,
fais ceci

installe Antivir

Pour t'aider tu peux suivre ce lien : http://forum.malekal.com/ftopic4192.php 

- Après l'installation, mets le à jour - si ton firewall fait une alerte.. accepte la connexion.
- Assure toi qu'Antivir est bien à jour, vérifie la date d'update.

-- Redémarre en mode sans échec, pour cela, redémarre l'ordinateur, avant le logo Windows, tapote sur la touche F8, un menu va apparaître, choisis Mode sans échec et appuye sur la touche entrée du clavier.

- Ouvre Antivir par le menu Démarrer / Programmes
- Clique sur l'onglet Scanner.
- Sélectionne "Manual Selection"
- Sélectionne ton/tes disque(s) 
- Lance le scan - Mets en quarantaine tous les éléments détectés.
- Une fois le scan terminé enregistre le rapport.

Redémarre en mode normal.

Poste le rapport ici.

mouick · Answer

ouah que c'est long, en plus ca sonne super fort :lol: voici le rapport Avira AntiVir Personal Report file date: lundi 13 octobre 2008 21:13 Scanning for 1681179 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 3) [5.1.2600] Boot mode: Save mode Username: celine billard Computer name: ANGELE Version information: BUILD.DAT : 8.1.0.331 16934 Bytes 12/08/2008 11:46:00 AVSCAN.EXE : 8.1.4.7 315649 Bytes 26/06/2008 08:57:53 AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40 LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19 LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34 ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 13:54:15 ANTIVIR2.VDF : 7.0.7.12 4066816 Bytes 08/10/2008 19:08:06 ANTIVIR3.VDF : 7.0.7.35 175104 Bytes 13/10/2008 19:08:08 Engineversion : 8.1.1.35 AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21 AESCRIPT.DLL : 8.1.0.76 319867 Bytes 13/10/2008 19:08:23 AESCN.DLL : 8.1.0.23 119156 Bytes 10/07/2008 12:44:49 AERDL.DLL : 8.1.1.2 438644 Bytes 13/10/2008 19:08:22 AEPACK.DLL : 8.1.2.3 364918 Bytes 13/10/2008 19:08:21 AEOFFICE.DLL : 8.1.0.25 196986 Bytes 13/10/2008 19:08:18 AEHEUR.DLL : 8.1.0.59 1438071 Bytes 13/10/2008 19:08:15 AEHELP.DLL : 8.1.0.15 115063 Bytes 10/07/2008 12:44:48 AEGEN.DLL : 8.1.0.36 315764 Bytes 13/10/2008 19:08:11 AEEMU.DLL : 8.1.0.7 430452 Bytes 31/07/2008 08:33:21 AECORE.DLL : 8.1.1.11 172406 Bytes 13/10/2008 19:08:10 AEBB.DLL : 8.1.0.1 53617 Bytes 10/07/2008 12:44:48 AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05 AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01 AVREP.DLL : 8.0.0.2 98344 Bytes 13/10/2008 19:08:09 AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40 AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23 AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49 SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02 SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40 NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10 RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07 RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37 Configuration settings for the scan: Jobname..........................: Manual Selection Configuration file...............: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\PROFILES\folder.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: on Scan boot sector.................: on Boot sectors.....................: C:, D:, Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: lundi 13 octobre 2008 21:13 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 11 processes with 11 modules were scanned Starting master boot sector scan: Master boot sector HD0 [INFO] No virus was found! Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Boot sector 'D:\' [INFO] No virus was found! Starting to scan the registry. C:\Copy.EXE [DETECTION] Contains recognition pattern of the W32/Perlovga.A.1 Windows virus [NOTE] The file was moved to '49639e75.qua'! The registry was scanned ( '67' files ). Starting the file scan: Begin scan in 'C:\' C:\host.exe [DETECTION] Is the TR/Drop.Small.apl Trojan [NOTE] The file was moved to '49669e7a.qua'! C:\pagefile.sys [WARNING] The file could not be opened! C:\Documents and Settings\celine billard\Temporary Internet Files\Content.IE5\8L27SPQJ\PCAntispy_Installer_fra[1].exe [DETECTION] Is the TR/Dropper.Gen Trojan [NOTE] The file was moved to '4934a12a.qua'! C:\SDFix\backups\backups.zip [0] Archive type: ZIP --> backups/svchost.exe [DETECTION] Is the TR/Drop.Small.apl Trojan [NOTE] The file was moved to '4956aac5.qua'! C:\SDFix\backups\catchme.zip [0] Archive type: ZIP --> beep.sys [DETECTION] Is the TR/Rootkit.Gen Trojan --> beep.sys.1 [DETECTION] Is the TR/Rootkit.Gen Trojan [NOTE] The file was moved to '4967aac9.qua'! C:\WINDOWS\xcopy.exe [DETECTION] Contains recognition pattern of the W32/Perlovga.A.1 Windows virus [NOTE] The file was moved to '4962ad31.qua'! C:\WINDOWS\system32 emp1.exe [DETECTION] Contains recognition pattern of the WORM/Perlovga.F worm [NOTE] The file was moved to '4960b040.qua'! C:\WINDOWS\system32 emp2.exe [DETECTION] Contains a recognition pattern of the (harmful) BDS/Small.LO back-door program [NOTE] The file was moved to '4960b043.qua'! C:\WINDOWS\system32\drivers\sptd.sys [WARNING] The file could not be opened! Begin scan in 'D:\' D:\copy.exe [DETECTION] Contains recognition pattern of the W32/Perlovga.A.1 Windows virus [NOTE] The file was moved to '4963b0bc.qua'! D:\host.exe [DETECTION] Is the TR/Drop.Small.apl Trojan [NOTE] The file was moved to '4966b0bf.qua'! D:\System Volume Information\_restore{B0D22BE2-A227-4068-A48A-E6B79217B4BA}\RP801\A0062073.exe [DETECTION] Contains recognition pattern of the W32/Perlovga.A.1 Windows virus [NOTE] The file was moved to '4923b09c.qua'! D:\System Volume Information\_restore{B0D22BE2-A227-4068-A48A-E6B79217B4BA}\RP801\A0062074.exe [DETECTION] Is the TR/Drop.Small.apl Trojan [NOTE] The file was moved to '4923b09e.qua'! End of the scan: lundi 13 octobre 2008 22:32 Used time: 1:18:56 Hour(s) The scan has been done completely. 10776 Scanning directories 464935 Files were scanned 13 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 12 files were moved to quarantine 0 files were renamed 2 Files cannot be scanned 464920 Files not concerned 9921 Archives were scanned 2 Warnings 12 Notes

mouick · Answer

et 'ai toujours le message qui s'affinche concernant un trojan W32... je dois juste fermer la fenetre ou je clic sur enable?

chimay8 · Answer

enable c'est permettre
que dit le message?

mouick · Answer

j'ai une alert Windows security qui me demande si je veux enable the protection pour un trojan nommé trojan downloader.win32.agent.bq!!!

J'ai cliqué sur la croix pour fermer la fenetre, il reviens regulierement...

bobicool · Answer

Juste pour t'aide mouik:

essaye malwarebyte anti-malware pour t'aidé:

http://www.commentcamarche.net/telecharger/telecharger 34055379 malwarebyte s anti malware

tutoriel:
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/


après le scan post ton log (rapport de scan) si il n'apparait pas dans un bloc note va dans l'onglet log et click sur le fichier.

ne te fis pas seulement sur ça!


ensuite de ca, repost un rapport hijackthis


et ensuite je te conseil d'aller voir:
https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan

https://www.kaspersky.fr/downloads

https://www.trendmicro.com/en_us/forHome/products/housecall.html

https://www.virustotal.com/gui/



Bonne chance!

chimay8 · Answer

J'ai cliqué sur la croix pour fermer la fenetre
tu as raison

tu vas faire ceci(demain car je serai au lit quant le scan sera terminé)

Télécharge Malwarebytes' Anti-Malware et enregistre le sur ton Bureau. 
https://www.malwarebytes.com/ 

(NB : S'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharges le ici : https://www.malekal.com/tutorial-aboutbuster/ )

A la fin du téléchargement, ferme toutes les fenêtres et programmes, y compris celui-ci. 
Double-clique sur l'icône "Download_mbam-setup.exe" sur ton bureau pour démarrer le programme d'installation. 
Pendant l'installation, suis les indications n'apporte aucune modification aux réglages par défaut et, en fin d'installation, vérifie que les options Update Malwarebytes' Anti-Malware et Launch Malwarebytes' Anti-Malware sont cochées. 
MBAM démarrera automatiquement et enverra un message demandant à mettre à jour le programme avant de lancer une analyse. Comme MBAM se met automatiquement à jour en fin d'installation, clique sur OK pour fermer la boîte de dialogue. 
Ferme MBAM 
Redémarre en mode sans échec, pour cela, redémarre l'ordinateur, avant le logo Windows, tapote sur la touche F8, un menu va apparaître, choisis Mode sans échec et appuye sur la touche entrée du clavier. 

Relance MBAM 
La fenêtre principale de MBAM s'affiche : 
Dans l'onglet analyse, vérifie que "Exécuter un examen complet" est coché et clique sur le bouton Rechercher pour démarrer l'analyse. 
MBAM analyse ton ordinateur. L'analyse peut prendre un certain temps. Il suffit de vérifier de temps en temps son avancement. 

A la fin de l'analyse, un message s'affiche indiquant la fin de l'analyse. Clique sur OK pour poursuivre. 
Si des malwares ont été détectés, leur liste s'affiche. 
***EN CLIQUANT SUR SUPPRESSION(?)FAIT LE***, MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine. 

MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Ferme le Bloc-notes. (Le rapport peut être retrouvé sous l'onglet Rapports/logs) 
Ferme MBAM en cliquant sur Quitter. 
Poste le rapport dans ta réponse

bobicool · Answer

Scuse chimay,

Mon intention n'était pas de polluer ta désinfection mais de te donner un coup de pousse,

si j'aurais su avant je l'aurait pas fait, parce que c'est la même chose (même poste) . :(


accept tu mes excuses

mouick · Answer

bonne nuit et merci, j'y vais aussi :) voici le rapport ...

Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1266
Windows 5.1.2600 Service Pack 3

13/10/2008 23:54:22
mbam-log-2008-10-13 (23-54-22).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 129497
Temps écoulé: 37 minute(s), 45 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 4
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 4

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{621483C7-EF15-1660-0E71-00BE5E159BBC} (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\c:/windows/downloaded program files/uninst.bat (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER	ypelib (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\wkey (Malware.Trace) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\sysmsg (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\strcfgadm (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\Downloaded Program Files\uninst.bat (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Program Files\lxgaheb\SysMsg.dll (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\yvidwhkt.exe (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
C:\WINDOWS\Downloaded Program Files\uninst.bat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\celine billard\delself.bat (Malware.Trace) -> Quarantined and deleted successfully.

chimay8 · Answer

ok,

tu as toujours l'alerte?

mouick · Answer

ouiantivir m'a deja demandé 2 fois quoi faire, la premiere j'ai mis en quarantaine, la seconde , j'ai mis refuser...

chimay8 · Answer

c'est toujours le rogue qui esaye de s'installer...

Télécharge Combofix sUBs : http://download.bleepingcomputer.com/sUBs/ComboFix.exe 
et sauvegarde le sur ton bureau et pas ailleurs! 

deconnecte toi d'internet,ferme tout les programmes
**Désactive les logiciels de protection** (Antivirus, Antispywares) puis : 
 
Double-clique sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider. 
ne touche plus à rien, même pas ta souris!! 
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport. 

Copie/colle un nouveau rapport HiJackThis avec.

mouick · Answer

ca dit anti vir guard attention detection!
TR/Rootkit.Gen Trojan
la j'ai plusieurs options, move to quarantine
delete
rename
deny acces
ignore
ilest dans C/system volume information/.../A0061599.sys

mouick · Answer

voila pour le premier rapport, je lance hijack ComboFix 08-10-12.01 - celine billard 2008-10-14 10:14:03.1 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.591 [GMT 2:00] Lancé depuis: C:\Documents and Settings\celine billard\Bureau\ComboFix.exe * Un nouveau point de restauration a été créé [COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\celine billard\Application Data\inst.exe . ((((((((((((((((((((((((((((( Fichiers créés du 2008-09-14 au 2008-10-14 )))))))))))))))))))))))))))))))))))) . 2008-10-13 23:11 . 2008-10-13 23:11 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-10-13 23:11 . 2008-10-13 23:11 d-------- C:\Documents and Settings\celine billard\Application Data\Malwarebytes 2008-10-13 23:11 . 2008-10-13 23:11 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-10-13 23:11 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-10-13 23:11 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-10-13 21:06 . 2008-10-13 21:06 d-------- C:\Program Files\Avira 2008-10-13 21:06 . 2008-10-13 21:06 d-------- C:\Documents and Settings\All Users\Application Data\Avira 2008-10-13 17:33 . 2008-10-13 17:33 579,584 --a------ C:\WINDOWS\system32\dllcache\user32.dll 2008-10-13 17:30 . 2008-10-13 17:30 d-------- C:\WINDOWS\ERUNT 2008-10-13 17:29 . 2008-10-13 17:58 d-------- C:\SDFix 2008-10-13 17:24 . 2008-10-13 07:07 81,920 --a------ C:\WINDOWS\system\mstsc.exe 2008-10-13 15:17 . 2008-10-13 07:07 81,920 --a------ C:\Documents and Settings\celine billard\Application Data\mstinit.exe 2008-10-13 14:12 . 2008-10-13 15:48 d-------- C:\Lop SD 2008-10-13 13:45 . 2008-10-13 15:10 5,080 --a------ C:\WINDOWS\system32 mp.reg 2008-10-13 12:25 . 2008-10-13 07:07 81,920 --a------ C:\WINDOWS svp.exe 2008-10-13 11:23 . 2008-10-13 15:29 d-------- C:\Program Files\Enigma Software Group 2008-10-13 07:15 . 2008-10-13 07:15 d-------- C:\Documents and Settings\All Users\Application Data\jsnunsfm 2008-10-13 07:15 . 2008-10-13 07:15 d-------- C:\Documents and Settings\All Users\Application Data\dqtcdwfo 2008-10-13 07:14 . 2008-10-13 14:03 d-------- C:\Documents and Settings\All Users\Application Data wbgpuly 2008-10-13 07:07 . 2008-10-13 07:07 81,920 --a------ C:\WINDOWS\system32\drivers\ieudinit.exe 2008-10-13 07:07 . 2008-10-13 07:07 81,920 --a------ C:\WINDOWS\dllhst3g.exe 2008-10-12 22:39 . 2008-10-13 02:55 d-------- C:\Program Files\Fighters 2008-10-12 22:39 . 2008-10-12 22:39 d-------- C:\Documents and Settings\All Users\Application Data\Fighters 2008-10-12 21:13 . 2008-10-12 22:28 32 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx 2008-10-12 21:13 . 2008-10-12 22:28 32 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2008-10-12 21:13 . 2008-10-12 22:28 32 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2008-10-12 21:13 . 2008-10-12 22:28 32 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-10-12 20:09 . 2008-10-12 20:09 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files 2008-10-12 19:47 . 2008-10-12 19:47 d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-10-12 17:52 . 2008-10-12 17:52 1,152 --a------ C:\WINDOWS\system32\windrv.sys 2008-10-12 17:19 . 2008-10-13 23:54 d-------- C:\Program Files\lxgaheb 2008-10-12 17:18 . 2008-10-12 17:18 d-------- C:\Documents and Settings\All Users\Application Data\wfgvilmf 2008-09-23 21:20 . 2008-09-23 21:20 214 --a------ C:\WINDOWS\HP_48BitScanUpdatePatch.ini 2008-09-23 21:12 . 2008-09-23 21:12 221 --a------ C:\WINDOWS\HP_RedboxHprblog_HPSU.ini 2008-09-23 21:11 . 2008-09-23 21:11 d-------- C:\Documents and Settings\celine billard\Application Data\Image Zone Express 2008-09-23 21:01 . 2008-09-23 21:10 113,622 --a------ C:\WINDOWS\hpoins07.dat 2008-09-23 21:01 . 2005-05-24 08:50 21,124 --------- C:\WINDOWS\hpomdl07.dat 2008-09-21 15:27 . 2008-09-22 07:03 d-------- C:\Program Files\NOS 2008-09-21 15:27 . 2008-09-22 07:03 d-------- C:\Documents and Settings\All Users\Application Data\NOS . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-14 04:42 --------- d-----w C:\Program Files\Mozilla Thunderbird 2008-10-13 19:34 --------- d-----w C:\Program Files\CopyPod 2008-10-13 12:12 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-10-13 12:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-10-13 05:12 --------- d-----w C:\Program Files\eMule 2008-10-10 06:58 82,944 ----a-w C:\WINDOWS\system32\o4Patch.exe 2008-10-10 06:58 82,944 ----a-w C:\WINDOWS\system32\IEDFix.C.exe 2008-10-08 10:46 --------- d-----w C:\Documents and Settings\celine billard\Application Data\Vso 2008-10-08 10:46 --------- d-----w C:\Documents and Settings\celine billard\Application Data\CopyToDvd 2008-10-08 10:28 --------- d-----w C:\Program Files\VSO 2008-10-08 06:41 --------- d-----w C:\Documents and Settings\celine billard\Application Data\uTorrent 2008-10-07 05:22 --------- d-----w C:\Documents and Settings\celine billard\Application Data\AdobeUM 2008-10-01 13:51 87,552 ----a-w C:\WINDOWS\system32\VACFix.exe 2008-09-24 06:33 --------- d-----w C:\Documents and Settings\celine billard\Application Data\HP 2008-09-23 19:37 --------- d-----w C:\Program Files\Fichiers communs\Adobe 2008-09-23 19:12 139,264 ----a-w C:\WINDOWS\system32\hpzjrd01.dll 2008-09-23 19:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP 2008-09-23 19:08 --------- d-----w C:\Program Files\Hp 2008-09-15 20:36 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-15 20:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\BVRP Software 2008-09-10 20:20 --------- d-----w C:\Documents and Settings\celine billard\Application Data\Apple Computer 2008-09-10 19:28 --------- d-----w C:\Program Files\Safari 2008-09-10 19:15 --------- d-----w C:\Program Files\Apple Software Update 2008-09-10 19:14 --------- d-----w C:\Program Files\iTunes 2008-09-10 19:14 --------- d-----w C:\Program Files\iPod 2008-09-10 19:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-09-10 19:13 --------- d-----w C:\Program Files\QuickTime 2008-09-10 19:13 --------- d-----w C:\Program Files\Fichiers communs\Apple 2008-09-10 14:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-09-08 21:38 88,576 ----a-w C:\WINDOWS\system32\AntiXPVSTFix.exe 2008-09-07 20:46 --------- d-----w C:\Program Files\DivX 2008-09-03 10:03 --------- d-----w C:\Program Files\Fichiers communs\Hewlett-Packard 2008-08-19 18:59 --------- d-----w C:\Documents and Settings\celine billard\Application Data\Windows Search 2008-08-19 15:41 --------- d-----w C:\Program Files\Windows Desktop Search 2008-08-19 15:41 --------- d-----w C:\Documents and Settings\celine billard\Application Data\Windows Desktop Search 2008-08-19 13:29 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-08-18 10:19 82,432 ----a-w C:\WINDOWS\system32\404Fix.exe 2008-08-15 14:02 --------- d-----w C:\Program Files\Electronic Arts 2008-08-07 14:27 4,224 ----a-w C:\WINDOWS\system32\dllcache\beep.sys 2008-07-25 08:36 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe 2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2008-07-23 16:48 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2008-07-23 16:48 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll 2008-07-23 16:46 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll 2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll 2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe 2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\dllcache\wups.dll 2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll 2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll 2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll 2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll 2008-07-18 20:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll 2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll 2008-05-26 20:31 92,064 ----a-w C:\Documents and Settings\celine billard\mqdmmdm.sys 2008-05-26 20:31 9,232 ----a-w C:\Documents and Settings\celine billard\mqdmmdfl.sys 2008-05-26 20:31 79,328 ----a-w C:\Documents and Settings\celine billard\mqdmserd.sys 2008-05-26 20:31 66,656 ----a-w C:\Documents and Settings\celine billard\mqdmbus.sys 2008-05-26 20:31 6,208 ----a-w C:\Documents and Settings\celine billard\mqdmcmnt.sys 2008-05-26 20:31 5,936 ----a-w C:\Documents and Settings\celine billard\mqdmwhnt.sys 2008-05-26 20:31 4,048 ----a-w C:\Documents and Settings\celine billard\mqdmcr.sys 2008-05-26 20:31 25,600 ----a-w C:\Documents and Settings\celine billard\usbsermptxp.sys 2008-05-26 20:31 22,768 ----a-w C:\Documents and Settings\celine billard\usbsermpt.sys 2008-04-11 13:37 47,360 ----a-w C:\Documents and Settings\celine billard\Application Data\pcouffin.sys 2006-12-22 21:31 87,608 ----a-w C:\Documents and Settings\celine billard\Application Data\ezpinst.exe 2006-08-28 17:01 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe 2006-08-25 20:26 22 --sha-w C:\WINDOWS\SMINST\HPCD.sys . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-06-26 1211176] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360] "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-24 204288] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-02-14 454656] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-04-15 7561216] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-04-15 86016] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-09-15 1015808] "QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2006-04-11 102400] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 49152] "Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2006-02-22 40960] "RecGuard"="C:\Windows\SMINST\RecGuard.exe" [2005-10-11 1187840] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe" [2005-06-23 57344] "ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184] "ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-08-09 81920] "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940] "SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400] "IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-11-01 995328] "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-11-01 1101824] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-09-08 289576] "AppleSyncNotifier"="C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 483328] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497] "nwiz"="nwiz.exe" [2006-04-15 C:\WINDOWS\system32 wiz.exe] "High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-06-02 C:\WINDOWS\system32\CHDAudPropShortcut.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.X264"= x264vfw.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "C:\Program Files\Microsoft ActiveSync apimgr.exe"= C:\Program Files\Microsoft ActiveSync apimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "C:\Program Files\eMule\eMule.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "C:\Program Files\uTorrent\uTorrent.exe"= "C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "C:\Program Files\Windows Live\Messenger\livecall.exe"= "C:\Program Files\iTunes\iTunes.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpqste08.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpofxm08.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hposfx08.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hposid01.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpqscnvw.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpqkygrp.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpqCopy.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpfccopy.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpzwiz01.exe"= "C:\Program Files\Hp\Digital Imaging\Unload\HpqPhUnl.exe"= "C:\Program Files\Hp\Digital Imaging\bin\hpoews01.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service S3 SG760_XP;SAGEM 802.11g XG760 1211 Driver;C:\WINDOWS\system32\DRIVERS\WlanUZXP.sys [2005-07-13 260608] S3 SIS163u;SiS163 usb Wireless LAN Adapter Driver;C:\WINDOWS\system32\DRIVERS\sis163u.sys [2005-06-20 215040] S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 58320] S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 8304] S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 94000] S3 ZSMC0305;VIMICRO USB PC Camera V;C:\WINDOWS\system32\Drivers\usbVM305.sys [ ] *Newly Created Service* - PROCEXP90 . Contenu du dossier 'Tâches planifiées' 2008-10-08 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34] . - - - - ORPHELINS SUPPRIMES - - - - HKCU-Run-WOOKIT - C:\PROGRA~1\Wanadoo\Shell.exe HKLM-Run-BigDog305 - C:\WINDOWS\VM305_STI.EXE . ------- Examen supplémentaire ------- . FireFox -: Profile - C:\Documents and Settings\celine billard\Application Data\Mozilla\Firefox\Profiles\d9z2f3kh.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.orange.fr/ FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser ppdf32.dll FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins pitunes.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-14 10:17:50 Windows 5.1.2600 Service Pack 3 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe?????? ???@???????????????@? ??? T??????(?@???????@ BigDog305 = C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)???????????????????0?????????@?????????????? Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . Heure de fin: 2008-10-14 10:21:30 ComboFix-quarantined-files.txt 2008-10-14 08:20:45 Avant-CF: 7 079 112 704 octets libres Après-CF: 7,308,304,384 octets libres 237 --- E O F --- 2008-09-10 14:10:24

mouick · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:29:07, on 14/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Inventel\Gateway\wlancfg.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\celine billard\Bureau\HiJackthis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {2EF3FB47-7B1E-4536-BA4D-51427BD45DFA} - https://www.pixaco.fr/static/download/pixacodndupload.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{674C9B90-1461-46F6-86E7-F398B0D6087E}: NameServer = 80.10.246.1,80.10.246.132
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SsBeSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\Program Files\Inventel\Gateway\wlancfg.exe

chimay8 · Answer

ca dit anti vir guard attention detection!

tu n'as pas désactivé Antivir...
tu clique droit sur le parapluie puis tu clique sur Antivir guard enable
le parapluie va se fermer puis tu recommence

deconnecte toi d'internet,ferme tout les programmes 
**Désactive les logiciels de protection** (Antivirus, Antispywares) puis : 

Double-clique sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider. 
ne touche plus à rien, même pas ta souris!! 
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport. 

Copie/colle un nouveau rapport HiJackThis avec.

chimay8 · Answer

ca va c'est ok 
oublie le dernier mess,je regarde

mouick · Answer

bah pourtant je l'ai desactivé!!! :blonde qui se gratte la tete!!!:

chimay8 · Answer

bon,

Télécharge OTMoveIt3( de Old Timer ) 
http://oldtimer.geekstogo.com/OTMoveIt3.exe
Une fois téléchargé double-clique sur OTMoveIt2.exe pour le lancer. 
Assure toi que la case "Unregister Dll's and Ocx's" est cochée 
Copie/colle les lignes en gras qui se trouvent en dessous : 

C:\Program Files\Enigma Software Group
C:\Documents and Settings\All Users\Application Data\jsnunsfm
C:\Documents and Settings\All Users\Application Data\dqtcdwfo
C:\Documents and Settings\All Users\Application Data
wbgpuly
C:\Program Files\Fighters
C:\Documents and Settings\All Users\Application Data\Fighters
C:\Program Files\lxgaheb
C:\Documents and Settings\All Users\Application Data\wfgvilmf

et colle-les dans le cadre de gauche de OTMoveIt : "Paste List Of Files/Folders to Move." 
Clique sur "MoveIt!" pour lancer la suppression. 
Le résultat apparaitra dans le cadre "Results". 
Clique sur Exit pour fermer. 
Poste le rapport situé dans C:\_OTMoveIt\MovedFiles. 
 -Il te sera peut-être demander de redémarrer le pc pour achever la suppression -> Accepte ( si il ne fait pas automatiquement , fait-le toi même ) 

/!\ Note : Au démarrage ton bureau RISQUE de ne plus apparaître, dans ce cas fait --> CTRL+ALT+SUPP pour ouvrir le Gestionnaire des tâches. 
Puis rends toi sur l'onglet "Processus". Clique en haut à gauche sur "Fichiers" et choisis "Exécuter" 
Tape "explorer.exe"(sans les guillemèts) et valide. Cela fera réapparaître le Bureau.

mouick · Answer

Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! OTMoveIt3 by OldTimer - Version 1.0.5.0 log created on 10142008_113801

chimay8 · Answer

me***
il est chi*** celui la

fais ceci

"Démarrer" dans la Barre des tâches
Cliquer sur "Panneau de configuration"
Cliquer sur "Options des dossiers"
Cliquer sur l'onglet "Affichage"
**dans fichiers et dossiers cachés:
Cocher "Afficher les fichiers et dossiers cachés"
Décocher "Masquer les extensions des fichiers dont le type est connu"
Décocher "masquer les fichiers protégés du système d'exploitation(recommandé)"
**Note**il ne faut pas tenir compte de l'avertissement.==>Cliquer sur  OUI 
Cliquer sur "Appliquer à tous les dossiers"
Cliquer sur "Ok"

ensuite recherche les fichier cités et supprimes les!

C:\Program Files\Enigma Software Group 
C:\Documents and Settings\All Users\Application Data\jsnunsfm 
C:\Documents and Settings\All Users\Application Data\dqtcdwfo 
C:\Documents and Settings\All Users\Application Data
wbgpuly 
C:\Program Files\Fighters 
C:\Documents and Settings\All Users\Application Data\Fighters 
C:\Program Files\lxgaheb 
C:\Documents and Settings\All Users\Application Data\wfgvilmf

si ça ne fonctionne pas,essaye en mode sans échec

Redémarre l'ordinateur en mode sans échec . 
Comment aller en Mode sans échec 
1) Redémarre ton ordi 
2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip" 
3) Tu verras un écran avec options de démarrage apparaître 
4) Choisis la première option : Sans Échec, et valide avec "Entrée" 
5) Choisis ton compte habituel, et non Administrateur (si besoin ... )

mouick · Answer

c'est fait et maintenant? :)
mon pauvre, t'as pas de bol avec moi :D il ni a jamais rien de simple :D

chimay8 · Answer

lol
non,c'est vrai j'ai pas de bol...hi hi

ok,

on va faire un scan en ligne pour être sur qu'il n'y a plus rien

Ouvre internet explorer --> Outils --> Options internet --> onglet "sécurité" --> Valide "niveau par défaut".
Toujours sur Internet explorer --> Outils --> Options internet --> onglet "avancé" --> valide "Paramètres par défaut".

Pour éffectuer les scans,
**désactive ton antivirus, logiciels de protections et logiciels pouvant bloquer les popups (barres Google, barres Yahoo etc..).**

Scan en ligne avec Kaspersky :
- https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr  en utilisant Internet Explorer et pas Firefox, ça ne marchera pas!.
- Si tu es perdu, tu peux suivre l'aide pour les scans en ligne https://www.malekal.com/scan-antivirus-ligne-nod32/#mozTocId291566 

AIDE : Configurer le contrôle des ActiveX < http://www.inoculer.com/activex.php3 > 
Tuto ici si problème : http://www.vista-xp.fr/forum/topic109.html , ou là : https://forum.pcastuces.com/sujet.asp?f=25&s=37641 (par Morgane & nico_dodo)
 
- Au moment de choisir la cible à analyser, clique sur le bouton Paramètres d'analyse
- Dans la nouvelle fenêtre, coche "étendu" au milieu puis clique sur OK.
- Choisis le poste de travail dans la cible à analyser
- Copie/colle le rapport du scan ici

NOTE : Si tu reçois le message "La licence de Kaspersky On-line Scanner est périmée", va dans Ajout/Suppression de programmes puis désinstalle On-Line Scanner,
 reconnecte-toi sur le site de Kaspersky pour retenter le scan en ligne.

mouick · Answer

je vais faire ce que tu me dis mais je viens d'avoir une fenetre avec la meme chose mais TR Rootkit.gen

chimay8 · Answer

mwouais...
on va voir ou sont les fichiers avec le scan

mouick · Answer

pétard!!! c'est normal de n'avoir scanné que 2% en 25 mn???

mouick · Answer

Tuesday, October 14, 2008 3:52:42 PM
Système d'exploitation : Microsoft Windows XP Home Edition, Service Pack 3 (Build 2600)
Kaspersky On-line Scanner version : 5.0.84.2
Dernière mise à jour de la base antivirus Kaspersky : 14/10/2008
Enregistrements dans la base antivirus Kaspersky : 1310847
Paramètres d'analyse
Analyser avec la base antivirus suivante 	étendue
Analyser les archives 	vrai
Analyser les bases de messagerie 	vrai
Cible de l'analyse 	Poste de travail
C:\
D:\
E:\
Statistiques de l'analyse
Total d'objets analysés 	83864
Nombre de virus trouvés 	1
Nombre d'objets infectés 	1 / 0
Nombre d'objets suspects 	0
Durée de l'analyse 	02:20:44

Nom de l'objet infecté 	Nom du virus 	Dernière action
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.55.Crwl 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.55.gthr 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\MSS.log 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\MSStmp.log 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.wid 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010003.wid 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010004.wid 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010005.wid 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010006.wid 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010007.wid 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010008.wid 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010009.wid 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000B.wid 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000F.ci 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000F.wid 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000F.wsb 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001001A.wid 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001001F.wid 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010022.wid 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010024.wid 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010026.wid 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010045.wid 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010046.wid 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010088.wid 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001008A.wid 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001008B.wid 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001008C.wid 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\INDEX.000 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.000 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\Used0000.000 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\CiST0000.000 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk1.gthr 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk2.gthr 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.Ntfy16.gthr 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows	mp.edb 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Windows.edb 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Perflib_Perfdata_1d8.dat 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\celine billard\Application Data\$_hpcst$.hpc 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\celine billard\Bureau\SmitfraudFix\Reboot.exe 	Infecté : not-a-virus:RiskTool.Win32.Reboot.f 	ignoré
C:\Documents and Settings\celine billard\Cookies\index.dat 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\celine billard\Historique\History.IE5\index.dat 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\celine billard\Local Settings\Application Data\Microsoft\CardSpace\CardSpace.db 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\celine billard\Local Settings\Application Data\Microsoft\CardSpace\CardSpace.db.shadow 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\celine billard\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\celine billard\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\celine billard\Local Settings\Application Data\Mozilla\Firefox\Profiles\d9z2f3kh.default\Cache\_CACHE_001_ 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\celine billard\Local Settings\Application Data\Mozilla\Firefox\Profiles\d9z2f3kh.default\Cache\_CACHE_002_ 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\celine billard\Local Settings\Application Data\Mozilla\Firefox\Profiles\d9z2f3kh.default\Cache\_CACHE_003_ 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\celine billard\Local Settings\Application Data\Mozilla\Firefox\Profiles\d9z2f3kh.default\Cache\_CACHE_MAP_ 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\celine billard\Local Settings\Application Data\Mozilla\Firefox\Profiles\d9z2f3kh.default\urlclassifier3.sqlite 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\celine billard\Local Settings\Temp\etilqs_E7VqL4e7t7Ghpc9qktPI 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\celine billard\Local Settings\Temp\WCESLog.log 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\celine billard\NTUSER.DAT 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\celine billard
tuser.dat.LOG 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\celine billard\Temporary Internet Files\Content.IE5\FTWY37PW\11260879[1].jpg 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\celine billard\Temporary Internet Files\Content.IE5\index.dat 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\celine billard\Temporary Internet Files\Content.IE5\YAIZ0Z5G\11258104[1].jpg 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\LocalService\Cookies\index.dat 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\LocalService\NTUSER.DAT 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\LocalService
tuser.dat.LOG 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\NetworkService\NTUSER.DAT 	L'objet est verrouillé 	ignoré
C:\Documents and Settings\NetworkService
tuser.dat.LOG 	L'objet est verrouillé 	ignoré
C:\System Volume Information\MountPointManagerRemoteDatabase 	L'objet est verrouillé 	ignoré
C:\WINDOWS\Debug\PASSWD.LOG 	L'objet est verrouillé 	ignoré
C:\WINDOWS\SchedLgU.Txt 	L'objet est verrouillé 	ignoré
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log 	L'objet est verrouillé 	ignoré
C:\WINDOWS\Sti_Trace.log 	L'objet est verrouillé 	ignoré
C:\WINDOWS\system32\CatRoot2\edb.log 	L'objet est verrouillé 	ignoré
C:\WINDOWS\system32\CatRoot2	mp.edb 	L'objet est verrouillé 	ignoré
C:\WINDOWS\system32\config\AppEvent.Evt 	L'objet est verrouillé 	ignoré
C:\WINDOWS\system32\config\default 	L'objet est verrouillé 	ignoré
C:\WINDOWS\system32\config\default.LOG 	L'objet est verrouillé 	ignoré
C:\WINDOWS\system32\config\Internet.evt 	L'objet est verrouillé 	ignoré
C:\WINDOWS\system32\config\ODiag.evt 	L'objet est verrouillé 	ignoré
C:\WINDOWS\system32\config\OSession.evt 	L'objet est verrouillé 	ignoré
C:\WINDOWS\system32\config\SAM 	L'objet est verrouillé 	ignoré
C:\WINDOWS\system32\config\SAM.LOG 	L'objet est verrouillé 	ignoré
C:\WINDOWS\system32\config\SecEvent.Evt 	L'objet est verrouillé 	ignoré
C:\WINDOWS\system32\config\SECURITY 	L'objet est verrouillé 	ignoré
C:\WINDOWS\system32\config\SECURITY.LOG 	L'objet est verrouillé 	ignoré
C:\WINDOWS\system32\config\software 	L'objet est verrouillé 	ignoré
C:\WINDOWS\system32\config\software.LOG 	L'objet est verrouillé 	ignoré
C:\WINDOWS\system32\config\SysEvent.Evt 	L'objet est verrouillé 	ignoré
C:\WINDOWS\system32\config\system 	L'objet est verrouillé 	ignoré
C:\WINDOWS\system32\config\system.LOG 	L'objet est verrouillé 	ignoré
C:\WINDOWS\system32\drivers\sptd.sys 	L'objet est verrouillé 	ignoré
C:\WINDOWS\system32\h323log.txt 	L'objet est verrouillé 	ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR 	L'objet est verrouillé 	ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP 	L'objet est verrouillé 	ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER 	L'objet est verrouillé 	ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP 	L'objet est verrouillé 	ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP 	L'objet est verrouillé 	ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA 	L'objet est verrouillé 	ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP 	L'objet est verrouillé 	ignoré
C:\WINDOWS\wiadebug.log 	L'objet est verrouillé 	ignoré
C:\WINDOWS\wiaservc.log 	L'objet est verrouillé 	ignoré
C:\WINDOWS\WindowsUpdate.log 	L'objet est verrouillé 	ignoré
Analyse terminée.

mouick · Answer

est ce que tu penses que c'ets ok maintenant?

chimay8 · Answer

je pense que c'est bon...il y a juste l'alerte de Antivir qui dit qu'il a détecté un rootkit!!

tu l'as encore eu cette alerte?

mouick · Answer

non pas ce soir, est ce que kaperski les detruits?

chimay8 · Answer

non,car c'est un scan en ligne qui sert juste à regarder si il y a une infection
Antivir que tu as installer est tout aussi bon

tu peux si tu le veux passer Antivir en mode sans échec pour être certain
après cela on entame la petite partie nettoyage et ce sera bon

mouick · Answer

ok je pass en mode sans echec, je scan et je te dis :)

mouick · Answer

Avira AntiVir Personal Report file date: mercredi 15 octobre 2008 13:48 Scanning for 1684294 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 3) [5.1.2600] Boot mode: Normally booted Username: SYSTEM Computer name: ANGELE Version information: BUILD.DAT : 8.1.0.331 16934 Bytes 12/08/2008 11:46:00 AVSCAN.EXE : 8.1.4.7 315649 Bytes 26/06/2008 08:57:53 AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40 LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19 LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34 ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 13:54:15 ANTIVIR2.VDF : 7.0.7.12 4066816 Bytes 08/10/2008 19:08:06 ANTIVIR3.VDF : 7.0.7.40 214016 Bytes 14/10/2008 19:07:31 Engineversion : 8.1.1.35 AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21 AESCRIPT.DLL : 8.1.0.76 319867 Bytes 13/10/2008 19:08:23 AESCN.DLL : 8.1.0.23 119156 Bytes 10/07/2008 12:44:49 AERDL.DLL : 8.1.1.2 438644 Bytes 13/10/2008 19:08:22 AEPACK.DLL : 8.1.2.3 364918 Bytes 13/10/2008 19:08:21 AEOFFICE.DLL : 8.1.0.25 196986 Bytes 13/10/2008 19:08:18 AEHEUR.DLL : 8.1.0.59 1438071 Bytes 13/10/2008 19:08:15 AEHELP.DLL : 8.1.0.15 115063 Bytes 10/07/2008 12:44:48 AEGEN.DLL : 8.1.0.36 315764 Bytes 13/10/2008 19:08:11 AEEMU.DLL : 8.1.0.7 430452 Bytes 31/07/2008 08:33:21 AECORE.DLL : 8.1.1.11 172406 Bytes 13/10/2008 19:08:10 AEBB.DLL : 8.1.0.1 53617 Bytes 10/07/2008 12:44:48 AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05 AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01 AVREP.DLL : 8.0.0.2 98344 Bytes 13/10/2008 19:08:09 AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40 AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23 AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49 SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02 SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40 NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10 RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07 RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: on Scan boot sector.................: on Boot sectors.....................: C:, D:, Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: mercredi 15 octobre 2008 13:48 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'searchfilterhost.exe' - '1' Module(s) have been scanned Scan process 'searchprotocolhost.exe' - '1' Module(s) have been scanned Scan process 'wuauclt.exe' - '1' Module(s) have been scanned Scan process 'alg.exe' - '1' Module(s) have been scanned Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned Scan process 'searchindexer.exe' - '1' Module(s) have been scanned Scan process 'wmpnetwk.exe' - '1' Module(s) have been scanned Scan process 'WLANCFG.EXE' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'RegSrvc.exe' - '1' Module(s) have been scanned Scan process 'HPZipm12.exe' - '1' Module(s) have been scanned Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'EvtEng.exe' - '1' Module(s) have been scanned Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'S24EvMon.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 31 processes with 31 modules were scanned Starting master boot sector scan: Master boot sector HD0 [INFO] No virus was found! Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Boot sector 'D:\' [INFO] No virus was found! Starting to scan the registry. The registry was scanned ( '63' files ). Starting the file scan: Begin scan in 'C:\' C:\hiberfil.sys [WARNING] The file could not be opened! C:\pagefile.sys [WARNING] The file could not be opened! C:\WINDOWS\system32\drivers\sptd.sys [WARNING] The file could not be opened! Begin scan in 'D:\' End of the scan: mercredi 15 octobre 2008 14:41 Used time: 53:03 Minute(s) The scan has been done completely. 10672 Scanning directories 455925 Files were scanned 0 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 0 files were moved to quarantine 0 files were renamed 3 Files cannot be scanned 455922 Files not concerned 9916 Archives were scanned 3 Warnings 0 Notes

mouick · Answer

Avira AntiVir Personal Report file date: mercredi 15 octobre 2008 12:35 Scanning for 1684294 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 3) [5.1.2600] Boot mode: Save mode Username: celine billard Computer name: ANGELE Version information: BUILD.DAT : 8.1.0.331 16934 Bytes 12/08/2008 11:46:00 AVSCAN.EXE : 8.1.4.7 315649 Bytes 26/06/2008 08:57:53 AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40 LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19 LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34 ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 13:54:15 ANTIVIR2.VDF : 7.0.7.12 4066816 Bytes 08/10/2008 19:08:06 ANTIVIR3.VDF : 7.0.7.40 214016 Bytes 14/10/2008 19:07:31 Engineversion : 8.1.1.35 AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21 AESCRIPT.DLL : 8.1.0.76 319867 Bytes 13/10/2008 19:08:23 AESCN.DLL : 8.1.0.23 119156 Bytes 10/07/2008 12:44:49 AERDL.DLL : 8.1.1.2 438644 Bytes 13/10/2008 19:08:22 AEPACK.DLL : 8.1.2.3 364918 Bytes 13/10/2008 19:08:21 AEOFFICE.DLL : 8.1.0.25 196986 Bytes 13/10/2008 19:08:18 AEHEUR.DLL : 8.1.0.59 1438071 Bytes 13/10/2008 19:08:15 AEHELP.DLL : 8.1.0.15 115063 Bytes 10/07/2008 12:44:48 AEGEN.DLL : 8.1.0.36 315764 Bytes 13/10/2008 19:08:11 AEEMU.DLL : 8.1.0.7 430452 Bytes 31/07/2008 08:33:21 AECORE.DLL : 8.1.1.11 172406 Bytes 13/10/2008 19:08:10 AEBB.DLL : 8.1.0.1 53617 Bytes 10/07/2008 12:44:48 AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05 AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01 AVREP.DLL : 8.0.0.2 98344 Bytes 13/10/2008 19:08:09 AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40 AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23 AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49 SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02 SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40 NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10 RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07 RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: on Scan boot sector.................: on Boot sectors.....................: C:, D:, Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: mercredi 15 octobre 2008 12:35 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'ctfmon.exe' - '1' Module(s) have been scanned Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 13 processes with 13 modules were scanned Starting master boot sector scan: Master boot sector HD0 [INFO] No virus was found! Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Boot sector 'D:\' [INFO] No virus was found! Starting to scan the registry. The registry was scanned ( '64' files ). Starting the file scan: Begin scan in 'C:\' C:\pagefile.sys [WARNING] The file could not be opened! C:\WINDOWS\system32\drivers\sptd.sys [WARNING] The file could not be opened! Begin scan in 'D:\' End of the scan: mercredi 15 octobre 2008 13:42 Used time: 1:07:34 Hour(s) The scan has been done completely. 10658 Scanning directories 455782 Files were scanned 0 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 0 files were moved to quarantine 0 files were renamed 2 Files cannot be scanned 455780 Files not concerned 9915 Archives were scanned 2 Warnings 0 Notes

chimay8 · Answer

c'est ok,

Télécharge ToolsCleaner sur ton bureau. 
--> 
http://www.commentcamarche.net/telecharger/telechargement 34055291 toolscleaner

# Clique sur "Recherche" et laisse le scan agir ... 
# Clique sur "Suppression" pour finaliser. 
# Tu peux, si tu le souhaites, te servir des Options facultatives. 
# Clique sur Quitter pour obtenir le rapport. 
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

ensuite

Télécharges : - CCleaner (n'installe pas la barre d'outil Yahoo)
https://www.pcastuces.com/logitheque/ccleaner.htm 
Ce logiciel va permettre de supprimer tous les fichiers temporaires et de corrigé ton registre .Lors de l'installation, avant de cliquer sur le bouton "installer", décoche toutes les "options supplémentaires" sauf les 2 première. 
Une fois le prg instalé et lancé, Clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures"( Par la suite, laisse-le avec ses réglages par défaut. C'est tout ). 

Un tuto ( aide ): 
http://perso.orange.fr/jesses/Docs/Logiciels/CCleaner.htm 

---> Utilisation: 
! déconnectes toi et fermes toutes applications en cours ! 
* vas dans "nettoyeur" : fait analyse puis nettoyage 
* vas dans "registre" : fait chercher les erreurs et réparer ( plusieurs fois jusqu'à ce qu'il n'y est plus d'erreur ) . 

( CCleaner : soft à garder sur son PC , super utile pour de bons nettoyages ... )

***très important***

Suppression des points de restauration : 
1.Ouvre le Menu Démarrer 
2.Clique-droit sur Poste de travail 
3.Clique sur Propriétés 
4.Positionne-toi dans l'onglet Restauration du système 
5.Coche "Désactiver la restauration système" 
6.Valide par Ok 
7.Redémarre ton pc
8.Reproduis les manipulations 1 à 3 
9.Décoche "Désactiver la restauration système" 
10.Valide par Ok

si tu n as pas d autres soucis change le statut du sujet en resolu stp 

https://www.commentcamarche.net/list 11365 marquer un fil de discussion comme etant resolu

mouick · Answer

[ Rapport ToolsCleaner version 2.2.3 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

C:\Combofix.txt: trouvé !
C:\lopR.txt: trouvé !
C:\SDFIX: trouvé !
C:\Combofix: trouvé !
C:\Lop SD: trouvé !
C:\Qoobox: trouvé !
C:\_OtMoveIt: trouvé !
C:\Documents and Settings\celine billard\Bureau\SdFix.exe: trouvé !
C:\Documents and Settings\celine billard\Bureau\LopSD.exe: trouvé !
C:\Documents and Settings\celine billard\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\celine billard\Bureau\HijackThis.exe: trouvé !
C:\Documents and Settings\celine billard\Bureau\SmitFraudfix: trouvé !

---------------------------------
-->- Suppression: 

C:\Documents and Settings\celine billard\Bureau\SdFix.exe: supprimé !
C:\Documents and Settings\celine billard\Bureau\LopSD.exe: supprimé !
C:\Documents and Settings\celine billard\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Documents and Settings\celine billard\Bureau\HijackThis.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\lopR.txt: supprimé !
C:\SDFIX: supprimé !
C:\Combofix: supprimé !
C:\Lop SD: supprimé !
C:\Qoobox: supprimé !
C:\_OtMoveIt: supprimé !
C:\Documents and Settings\celine billard\Bureau\SmitFraudfix: supprimé !

Fichiers temporaires nettoyés !
Sauvegarde du registre crée !

chimay8 · Answer

alors,
pour supprimer combofix
clic sur démarrer-->executer
tape ou copie/colle ComboFix /u
clic sur ok

et donc te voila guérie,très chère tête blonde

voici un lien pour securiser ton pc,il est très complet

https://www.malekal.com/proteger-pc-virus-pirates/

je te souhaite un bon surf
@+

mouick · Answer

merci merci mille fois merci et encoore merci
La blonde :)

mouick · Answer

Ayé :)

chimay8 · Answer

lol
merci
++

Windows has detected spyware infection

81 réponses

Newsletters