ENCORE DES FENETRE POP-UP

Question

Bonjour, et ReBonjour, a se qui mon aidé il y a 4-5 jour sa marche bien mieu maitenant MAIS g toujour 1 fenétre pop-up qui souvre toute les 25-30 min a peuprer le nom c "apartementjackpot" voila donc si kelkun pouvai m'aider . . . . . encore.
La derniére foi c chiquitine29 et ^^marie^^ qui mon aider donc voila aider moi svp

eZula · Accepted Answer

Si ces fichiers n'ont pas été détectés, je te suggère de les soumettre dans un premier temps ici http://secubox.gateweb.org/mad.php

Ouvre le blocnote de windows puis copie-colle dedans ce qui est en gras juste ci-dessous (Les deux lignes et rien d'autre)

fyrevoyrkv
qcurch


Puis dans le blocnote, vas dans fichier/enregistrer sous :

Appelle-le NavScript.txt
Enregistre-le dans C:\program files\Navilog1 (C'est impératif)

Double-clique sur le raccourci Navilog1 présent sur ton bureau.
Laisse toi guider et patiente.
Le Fix va automatiquement démarrer sans passer par le menu principal.

Le fix va t'informer qu'il va alors redémarrer ton PC
Ferme toutes les fenêtres ouvertes et enregistre tes documents personnels ouverts
Appuie sur une touche comme demandé.
(si ton Pc ne redémarre pas automatiquement, fais-le toi-même)
Au redémarrage de ton PC, choisis ta session habituelle si nécessaire.
Patiente jusqu'au message :
*** Nettoyage Termine le ..... ***
Le blocnote va s'ouvrir.
Sauvegarde le rapport de manière à le retrouver
Ton bureau va réapparaitre.

Poste le rapport Cleannavi.txt

eZula · Answer

Bonjour,

télécharge GenProc http://www.alt-shift-return.org/Info/Fichiers/GenProc.zip sur ton bureau

dézippe le dossier, double-clique sur GenProc.bat [img]http://forum.telecharger.01net.com/forum/[/img] et poste le contenu du rapport qui s'ouvre

Aide en images : http://www.alt-shift-return.org/Info/GenProc-HowTo.html

gaetan · Answer

voila le raport

GenProc 2.119 [1] 15/10/2008 - Windows Vista : Aucune infection caractéristique trouvée . 
 
Merci de poster un rapport Nod32 https://www.eset.com/
(coche toutes les cases à chaque fois)
A la fin, colle le rapport : C:\Program Files\EsetOnlineScanner\log.txt

eZula · Answer

OK, fais le scan en ligne proposé

gaetan · Answer

commen je fais ??

eZula · Answer

comme indiqué https://www.eset.com/

gaetan · Answer

alor g annalysé mon pc et il a trouver un truc que g suprimmé comme sa cété une music infecter mé l'anti-virus la pa détecter je fé koi maitenant??

gaetan · Answer

voila le détail du rapport

"a variant of WMA/TrojanDownloader.GetCodec.gen trojan"
C:\User\gaetan\music\divers\greg edmonson - greatest hits.mp3

donc je sui aller dan ma music g trouver cette chanson et je les supprimé c pa sufisan, si ??????

gaetan · Answer

plus personne me répond ! ! ! ! ! ! ! ! ! ! !
pfffff encore -_-'

eZula · Answer

il me faut beaucoup de temps pour traduire ton dialecte SMS, pardonne-moi

et sinon le problème, c'est réglé ?

gaetan · Answer

-_-' (profon soupir) . . . . lOol 
enfin bref sa continu toujour j'ai toujour cette fenétre pop-up qui s'ouvre et qui et bloquer par l'anti-virus donc cété pas sa voila, mais la je refet une analyse pour voir si sa la vraiment supprimé. Donc voila j'attend la fin du scan !

eZula · Answer

Poste un rapport HijackThis plutot http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/hijackthis-version-install-sujet_199100_1.htm

gaetan · Answer

voila le rapport

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:04:39, on 16/10/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Program Files\Winamp\winampa.exe
C:\Windows\System32undll32.exe
C:\Program Files\Micro Application\Securite Internet 2007\avp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Winamp Remote\bin\OrbTray.exe
C:\Program Files\ppcbooster\ppcbooster.exe
C:\Windows\System32undll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Windows\system32\conime.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Winamp\elevator.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
O3 - Toolbar: Barre d'outils MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\fr\msntb.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Micro Application\Securite Internet 2007\avp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [Speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: ppcbooster.lnk = C:\Program Files\ppcbooster\ppcbooster.exe
O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbaresources\en-US\local\search.html
O8 - Extra context menu item: Ajouter à Anti-Banner - C:\Program Files\Micro Application\Securite Internet 2007\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Micro Application\Securite Internet 2007\scieplugin.dll
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O13 - Gopher Prefix: 
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - https://www.eset.com/
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\MICROA~1\SECURI~1\adialhk.dll,C:\PROGRA~1\MICROA~1\SECURI~13hook.dll
O23 - Service: Sécurité Internet 2007 (AVP) - Micro Application - C:\Program Files\Micro Application\Securite Internet 2007\avp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

eZula · Answer

Ouvre le dossier GenProc, puis le sous-dossier "outil". Double clique sur le fichier "Uninstall.txt" et poste son contenu.

gaetan · Answer

heu y a pas le fichier "Uninstall.txt" c'est "Uninstall.bat", c'est pareil,c'est sa ????

eZula · Answer

si tu doubles cliques sur ce fichier Uninstall.bat, tu n'obtiens pas un fichier Uninstall.txt ensuite ?

gaetan · Answer

non sa affiche une fenétre noir des truc défile et pui plu rien elle se ferme

gaetan · Answer

OUPS je vien de le voir il était juste en desou (je c'est c débile) :) javé pa vu :D hihi . . . voila le contenu

"Adobe Flash Player 9 ActiveX" 
"Adobe Flash Player ActiveX" 
"Adobe Reader 8" 
"Adobe Reader 8.1.1 - Français" 
"Adobe Shockwave Player" 
"Age of Empires III - The WarChiefs" 
"Age of Empires III - The WarChiefs" 
"Age of Empires III" 
"Age of Empires III" 
"Alexander" 
"Arcanum" 
"ArcSoft MediaConverter" 
"Assistant de connexion Windows Live" 
"Barre d'outils MSN" 
"Blitzkrieg" 
"Browser Address Error Redirector" 
"Celestia 1.5.1" 
"CleanUp!" 
"Cossacks - The Art of War" 
"Creator 9" 
"CursorXP" 
"Dealio Toolbar 3.4" 
"Deus Ex - Invisible War" 
"Diablo II" 
"Disciples: Sacred Lands" 
"Dungeon Lords" 
"EAX Unified" 
"Firefox" 
"Flash Player 9 Internet Explorer" 
"Free Mp3 Wma Converter V 1.7.3" 
"GameSpy Arcade" 
"Giants" 
"Glest 3.1.2" 
"Google BAE" 
"Google Toolbar for Internet Explorer" 
"Google Toolbar for Internet Explorer" 
"GoogleToolbar" 
"Guide routier France" 
"GUILD WARS" 
"HDReg France" 
"Heroes of Might & Magic V: Hammers of Fate" 
"Heroes of Might and Magic V" 
"Heroes of Might and Magic® IV" 
"HijackThis 2.0.2" 
"Infocentre Rev. 2.0" 
"Jarkanoid 3" 
"Java(TM) 6 Update 7" 
"LimeWire 4.16.7" 
"Metaboli" 
"Metal Wrath" 
"Microsoft .NET Framework 1.1 Hotfix (KB929729)" 
"Microsoft .NET Framework 1.1" 
"Microsoft .NET Framework 1.1" 
"Microsoft Silverlight" 
"Morrowind" 
"MS Access 97 SP2" 
"MSXML 4.0 SP2 (KB936181)" 
"MSXML 4.0 SP2 (KB941833)" 
"MSXML4 Parser" 
"Nero 7 Premium" 
"Neverwinter Nights 2" 
"NVIDIA Drivers" 
"OpenAL" 
"OpenOffice.org Installer 1.0" 
"Packard Bell Demo" 
"Packard Bell ImageWriter" 
"Packard Bell LCD Test" 
"Packard Bell Updator" 
"PPC Booster" 
"Prism Video Converter" 
"Purebreaker 2 version 1.0" 
"QuickTime" 
"RealPlayer" 
"Realtek HD Audio V6.0.1.5413" 
"Realtek High Definition Audio Driver" 
"RON Tool Bannerstyles15" 
"Roxio Creator 9 LE" 
"Search Settings 1.2" 
"Second Sight" 
"Security Update for CAPICOM (KB931906)" 
"Security Update for CAPICOM (KB931906)" 
"SetUp My PC" 
"Shockwave player 10" 
"SimCity 3000 World Edition" 
"Skype 2.5.2.151" 
"Skype™ 3.8" 
"Spellforce - Diamond Edition" 
"Sécurité Internet 2007" 
"Sécurité Internet 2007" 
"SweetIM for Messenger 2.5" 
"SweetIM Toolbar for Internet Explorer 3.1" 
"Switch" 
"TES Construction Set" 
"TrackMania Nations ESWC 1.7.9" 
"Video NVIDIA v158.34" 
"Warcraft III" 
"Warzone 2100" 
"Winamp Remote" 
"Winamp Toolbar for Firefox" 
"Winamp Toolbar for Internet Explorer" 
"Winamp" 
"Windows Live installer" 
"Windows Live Messenger" 
"WinRAR Archiveur" 
"Worms 4 Mayhem" 
"Xfire (remove only)" 
hex(2):45,00,53,00,45,00,54,00,20,00,4f,00,6e,00,6c,00,69,00,6e,\

eZula · Answer

Le "Blitzkrieg", ça me rappelle un téléfilm allemand, "hass in kopf", l'as-tu vu ? c'est assez spécial.


Pour en revenir à ton problème : Télécharge Toolbar-S&D (Team IDN) sur le Bureau.
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2 & Installe simplement le programme en exécutant le fichier téléchargé. double-clique sur son raccourci situé sur le Bureau. Tape sur "2" puis valide en appuyant sur "Entrée". Ne ferme pas la fenetre lors de la suppression.

Lorsque terminé, poste le contenu du rapport C:\TB.txt

gaetan · Answer

ok "Blitzkrieg" c un jeu de stratégie en tem réel sur la 2éme guerre mondiale enfin bref je fé sa et jenvoi le rapport

gaetan · Answer

voila le rapport


   -----------\  ToolBar S&D 1.2.2   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6001 ) Service Pack 1
   X86-based PC ( Multiprocessor Free : Genuine Intel(R) CPU            2140  @ 1.60GHz )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : gaetan ( Administrator )
   BOOT : Normal boot
   Antivirus : Sécurité Internet 2007 6.0.2.614 (Activated)
   Firewall  : Sécurité Internet 2007 6.0.2.614 (Not Activated)
   C:\ (Local Disk) - NTFS - Total : 290 Go Free : 188 Go
   D:\ (CD or DVD)
   E:\ (USB)
   F:\ (USB)
   G:\ (USB)
   H:\ (CD or DVD)
   I:\ (USB)

   "C:\ToolBar SD" ( MAJ : 04-10-2008|21:00 )
   Option : [2] ( 17/10/2008|17:35 )

   [ UAC => 0 ]

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\Windows\system32\blank.htm"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Start Page"="https://www.google.fr/?gws_rd=ssl"
   "Url"="https://www.msn.com/fr-fr/actualite/"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="https://www.msn.com/fr-fr/"
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"


   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [ UAC => 1 ]


   1 - "C:\ToolBar SD\TB_1.txt" - 17/10/2008|17:37 - Option : [2]

   -----------\  Fin du rapport a 17:37:20,91

gaetan · Answer

il y a quelqu'un ????

gaetan · Answer

quelqu'un peut me répondre svp !!!

eZula · Answer

Désinstalle ces programmes

"Dealio Toolbar 3.4"
"Search Settings 1.2"
"SweetIM for Messenger 2.5"
"SweetIM Toolbar for Internet Explorer 3.1"

puis redémarre l'ordi et dis-moi ce que ça donne. Si encore pubs, précise les url

gaetan · Answer

jarrive pas a désinstaller "SweetIM Toolbar for Internet Explorer 3.1" il reste dan la liste

eZula · Answer

Et le reste ?

gaetan · Answer

le reste c bon et les fenétre sont toujour la l'adresee c'est http://ww1.apartmentjackpot.com

eZula · Answer

Fais un scan nanoscan/totalscan et fais voir le rapport, il est pas trop mal pour détecter les adwares, je suppose que c'est quelque chose dans le style qui doit lancer ces fenêtres.

gaetan · Answer

hien . . . . et je le fais avec quoi le scan ?????? i a pa un lien ou un truc comme sa ????

eZula · Answer

https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan

Ne reviens pas sans le rapport

gaetan · Answer

voila le rapport

;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-10-18 22:13:29
PROTECTIONS: 2
MALWARE: 35
SUSPECTS: 2
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;===================================================================================================================================================================================
S&#65533;curit&#65533; Internet 2007                       6.0.2.614                     No        Yes
Windows Defender                             1.1.4005.0                    No        No
;===================================================================================================================================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;===================================================================================================================================================================================
00034347  dialer.su                          Dialers             No        0         Yes            No           hkey_local_machine\software\microsoft\windows\currentversion\uninstall\switch
00139059  Cookie/Traffic Marketplace         TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@trafficmp[1].txt
00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@doubleclick[1].txt
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@atdmt[2].txt
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@tradedoubler[1].txt
00145405  Cookie/RealMedia                   TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@247realmedia[1].txt
00145457  Cookie/FastClick                   TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@fastclick[1].txt
00145738  Cookie/Mediaplex                   TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@mediaplex[1].txt
00149046  Cookie/Casinotropez                TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@casinotropez[1].txt
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@xiti[1].txt
00167749  Cookie/Toplist                     TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@toplist[2].txt
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@statcounter[1].txt
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@ad.yieldmanager[1].txt
00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@apmebf[1].txt
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@serving-sys[1].txt
00168093  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@bs.serving-sys[2].txt
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@weborama[1].txt
00168109  Cookie/Adtech                      TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@adtech[1].txt
00168110  Cookie/Server.iad.Liveperson       TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@server.iad.liveperson[1].txt
00169190  Cookie/Advertising                 TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@advertising[2].txt
00170304  Cookie/WebtrendsLive               TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@statse.webtrendslive[1].txt
00170495  Cookie/PointRoll                   TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@ads.pointroll[1].txt
00172221  Cookie/Zedo                        TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@zedo[1].txt
00173520  Cookie/Bluestreak                  TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@bluestreak[1].txt
00184846  Cookie/Adrevolver                  TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@adrevolver[2].txt
00187950  Cookie/bravenetA                   TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@bravenet[1].txt
00199984  Cookie/Searchportal                TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@searchportal.information[1].txt
00207936  Cookie/Adviva                      TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@adviva[1].txt
00262020  Cookie/Atwola                      TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@atwola[2].txt
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@smartadserver[2].txt
01048936  Generic Malware                    Virus/Trojan        No        0         Yes            No           C:\Program Files\GameSpy Arcade\Services\_common\PortraitLoader.dll
01606636  Cookie/Adserver                    TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@adserver.easyad[1].txt
02555179  Adware/NaviPromo                   Adware              No        1         Yes            No           C:\Users\gaetan\AppData\Local\fyrevoyrkv.exe
02555179  Adware/NaviPromo                   Adware              No        1         Yes            No           C:\Users\gaetan\AppData\Local\qcurch.exe
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JFJPYK2B\popup[3].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JFJPYK2B\popup[2].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GR8RVWYC\popup[4].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GR8RVWYC\popup[1].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T0SFPKBU\popup[1].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y1Y6YTJ8\popup[4].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y1Y6YTJ8\popup[3].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T0SFPKBU\popup[4].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GB932MRQ\popup[5].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GB932MRQ\popup[4].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GB932MRQ\popup[3].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GB932MRQ\popup[2].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y1Y6YTJ8\popup[2].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H69U26D8\popup[4].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H69U26D8\popup[3].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GR8RVWYC\popup[2].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GB932MRQ\popup[1].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H69U26D8\popup[2].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CBSSWVH0\popup[1].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0C12IN0W\popup[1].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JFJPYK2B\popup[1].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H69U26D8\popup[1].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GR8RVWYC\popup[3].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y1Y6YTJ8\popup[1].htm
03738686  Generic Malware                    Virus/Trojan        No        0         No             No           C:\Users\gaetan\Downloads\ComboFix.exe[32788R22FWJFW\catchme.cfexe]
;===================================================================================================================================================================================
SUSPECTS
Sent      Location                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              D&#65533;`&#65533;Ks5
;===================================================================================================================================================================================
No        C:\Users\gaetan\Downloads\ComboFix.exe[32788R22FWJFW\psexec.cfexe]                                                                                                                                                                                                                                                                                                                                                                                                                                                    D&#65533;`&#65533;Ks5
No        C:\Users\gaetan\Downloads\installer-13144-845-DivX-French.exe                                                                                                                                                                                                                                                                                                                                                                                                                                                         D&#65533;`&#65533;Ks5
;===================================================================================================================================================================================
VULNERABILITIES
Id        Severity   Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                D&#65533;`&#65533;Ks5
;===================================================================================================================================================================================
;===================================================================================================================================================================================

eZula · Answer

bon, voilà les méchants :

02555179 Adware/NaviPromo Adware No 1 Yes No C:\Users\gaetan\AppData\Local\fyrevoyrkv.exe
02555179 Adware/NaviPromo Adware No 1 Yes No C:\Users\gaetan\AppData\Local\qcurch.exe 

n'essaye pas de les supprimer manuellement. Utilise Navilog1 pour t'en débarrasser http://il.mafioso.pagesperso-orange.fr/Navifix/presentation.htm

1. Option 1
2. Option 2

Et vérifie qu'il supprime bien ces deux fichiers, si tu veux tu peux poster le rapport final.

gaetan · Answer

bon j'ai fais le 1 puis le 2 mais sa me les a pas supprimé . J'ai vu que l'option 4 sert a supprimé les adware manuellement en idiquan le nom je peu pas fair sa plutot ?????????

gaetan · Answer

bon voila le rapport. c'est fini maitenan ???


Clean Navipromo version 3.6.6 commencé le 19/10/2008 à 18:35:24,42

Outil exécuté depuis C:\Program Files
avilog1
Session actuelle : "gaetan" 

Mise à jour le 29.09.2008 à 17h30 par IL-MAFIOSO

Microsoft Windows Vista 6.0.6001 
Internet Explorer : 7.0.6001.18000
Système de fichiers : NTFS


Mode suppression de fichiers Navipromo par Script

fyrevoyrkv
qcurch

Nettoyage exécuté au redémarrage de l'ordinateur

*** Recherche, création sauvegardes et suppression ***

* Suppression dans "C:\Windows\system32" *


* Suppression dans "C:\Users\gaetan\AppData\Local\Microsoft" *


* Suppression dans "C:\Users\gaetan\AppData\Local\virtualstore\windows\system32" *


* Suppression dans "C:\Users\gaetan\AppData\Local" *


fyrevoyrkv.dat trouvé ! 
Copie fyrevoyrkv.dat réalisée avec succès !
fyrevoyrkv.dat supprimé !

qcurch.exe trouvé ! 
Copie qcurch.exe réalisée avec succès !
qcurch.exe supprimé !

qcurch.dat trouvé ! 
Copie qcurch.dat réalisée avec succès !
qcurch.dat supprimé !


*** Suppression dossiers dans "C:\Windows" ***


*** Suppression dossiers dans "C:\Program Files" ***


*** Suppression dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***


*** Suppression dossiers dans "c:\progra~2\micros~1\windows\startm~1" ***


*** Suppression dossiers dans "C:\ProgramData" ***


*** Suppression dossiers dans c:\users\gaetan\appdataoaming\micros~1\windows\startm~1\programs ***


*** Suppression dossiers dans "C:\Users\gaetan\AppData\Local\virtualstore\Program Files" ***


*** Suppression dossiers dans "C:\Users\gaetan\AppData\Roaming" ***



*** Suppression fichiers ***


*** Suppression fichiers temporaires ***

Nettoyage contenu C:\Windows\Temp effectué !
Nettoyage contenu C:\Users\gaetan\AppData\Local\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\Windows\system32" *


* Dans "C:\Users\gaetan\AppData\Local\Microsoft" *


* Dans "C:\Users\gaetan\AppData\Local\virtualstore\windows\system32" *


* Dans "C:\Users\gaetan\AppData\Local" *


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltdt absent !


*** Nettoyage terminé le 19/10/2008 à 18:39:27,90 ***

eZula · Answer

refais un scan nanoscan pour voir

gaetan · Answer

avec quoi je fais sa ???? je sui pas trer fort en informatique.

eZula · Answer

souviens-toi, hier http://www.commentcamarche.net/forum/affich 8904810 encore des fenetre pop up?page=2#29

pareil

gaetan · Answer

a oui :) javé oublier merci !!!

gaetan · Answer

Les fenétre sont toujour la -_-' !! j'en et marre !!!!!!

eZula · Answer

si tu regardes bien le rapport navilog1, il ne semble pas avoir trouvé fyrevoyrkv.exe 

on va voir ce que dit panda

gaetan · Answer

voila le rapport

;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-10-19 22:04:38
PROTECTIONS: 2
MALWARE: 36
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;===================================================================================================================================================================================
S&#65533;curit&#65533; Internet 2007                       6.0.2.614                     No        Yes
Windows Defender                             1.1.4005.0                    No        No
;===================================================================================================================================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;===================================================================================================================================================================================
00034347  dialer.su                          Dialers             No        0         Yes            No           hkey_local_machine\software\microsoft\windows\currentversion\uninstall\switch
00139059  Cookie/Traffic Marketplace         TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@trafficmp[1].txt
00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@doubleclick[1].txt
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@atdmt[2].txt
00139535  Application/Processor              HackTools           No        0         Yes            No           C:\Program Files\Navilog1\Process.exe
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@tradedoubler[2].txt
00145405  Cookie/RealMedia                   TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@247realmedia[1].txt
00145457  Cookie/FastClick                   TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@fastclick[1].txt
00145738  Cookie/Mediaplex                   TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@mediaplex[1].txt
00149046  Cookie/Casinotropez                TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@casinotropez[1].txt
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@xiti[1].txt
00167749  Cookie/Toplist                     TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@toplist[2].txt
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@statcounter[1].txt
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@ad.yieldmanager[1].txt
00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@apmebf[1].txt
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@serving-sys[1].txt
00168093  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@bs.serving-sys[1].txt
00168106  Cookie/Weborama                    TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@weborama[2].txt
00168109  Cookie/Adtech                      TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@adtech[1].txt
00168110  Cookie/Server.iad.Liveperson       TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@server.iad.liveperson[1].txt
00169190  Cookie/Advertising                 TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@advertising[2].txt
00170304  Cookie/WebtrendsLive               TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@statse.webtrendslive[1].txt
00170495  Cookie/PointRoll                   TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@ads.pointroll[1].txt
00172221  Cookie/Zedo                        TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@zedo[1].txt
00173520  Cookie/Bluestreak                  TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@bluestreak[2].txt
00184846  Cookie/Adrevolver                  TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@adrevolver[2].txt
00187950  Cookie/bravenetA                   TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@bravenet[1].txt
00199984  Cookie/Searchportal                TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@searchportal.information[1].txt
00207936  Cookie/Adviva                      TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@adviva[1].txt
00262020  Cookie/Atwola                      TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@atwola[2].txt
00273339  Cookie/Smartadserver               TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@smartadserver[1].txt
01048936  Generic Malware                    Virus/Trojan        No        0         Yes            No           C:\Program Files\GameSpy Arcade\Services\_common\PortraitLoader.dll
01606636  Cookie/Adserver                    TrackingCookie      No        0         Yes            No           C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Cookies\gaetan@adserver.easyad[1].txt
02555179  Adware/NaviPromo                   Adware              No        1         Yes            No           C:\Program Files\Navilog1\Backupnavi\qcurch.exe
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JFJPYK2B\popup[4].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JFJPYK2B\popup[5].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T0SFPKBU\popup[1].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CBSSWVH0\popup[4].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T0SFPKBU\popup[3].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T0SFPKBU\popup[4].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T0SFPKBU\popup[5].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JFJPYK2B\popup[3].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JFJPYK2B\popup[1].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y1Y6YTJ8\popup[3].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y1Y6YTJ8\popup[4].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y1Y6YTJ8\popup[5].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CBSSWVH0\popup[3].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H69U26D8\popup[8].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H69U26D8\popup[7].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H69U26D8\popup[6].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y1Y6YTJ8\popup[1].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H69U26D8\popup[5].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H69U26D8\popup[4].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H69U26D8\popup[3].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H69U26D8\popup[2].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CBSSWVH0\popup[2].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H69U26D8\popup[1].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GR8RVWYC\popup[6].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GR8RVWYC\popup[5].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GR8RVWYC\popup[4].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CBSSWVH0\popup[1].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0C12IN0W\popup[2].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0C12IN0W\popup[1].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GR8RVWYC\popup[3].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GR8RVWYC\popup[2].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GB932MRQ\popup[6].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GB932MRQ\popup[5].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GB932MRQ\popup[4].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GB932MRQ\popup[3].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GB932MRQ\popup[2].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GB932MRQ\popup[1].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JFJPYK2B\popup[2].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y1Y6YTJ8\popup[2].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CBSSWVH0\popup[5].htm
02906154  Adware/AdsRevenue                  Adware              No        0         Yes            No           C:\Users\gaetan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T0SFPKBU\popup[2].htm
03738686  Generic Malware                    Virus/Trojan        No        0         No             No           C:\Users\gaetan\Downloads\ComboFix.exe[32788R22FWJFW\catchme.cfexe]
03738686  Generic Malware                    Virus/Trojan        No        0         Yes            No           C:\Program Files\Navilog1\catchme.exe
;===================================================================================================================================================================================
SUSPECTS
Sent      Location                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              &#65533;&#1711;(&#65533;s5
;===================================================================================================================================================================================
;===================================================================================================================================================================================
VULNERABILITIES
Id        Severity   Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                &#65533;&#1711;(&#65533;s5
;===================================================================================================================================================================================
;===================================================================================================================================================================================

eZula · Answer

Supprime cette clé de registre

hkey_local_machine\software\microsoft\windows\currentversion\uninstall\switch 

relance Navikog1 > option "saisie adware". Il faudra lui soumettre ce nom et exactement ce nom

fyrevoyrkv

poste le rapport avec tes commentaires

gaetan · Answer

commen je fé pour supprimé la clé de registre ??????? et ou je la trouve ?????

gaetan · Answer

voila le rapport et commen je suprime la cle registre ?


Clean Navipromo version 3.6.6 commencé le 20/10/2008 à 19:56:43,79

Outil exécuté depuis C:\Program Files
avilog1
Session actuelle : "gaetan" 

Mise à jour le 29.09.2008 à 17h30 par IL-MAFIOSO

Microsoft Windows Vista 6.0.6001 
Internet Explorer : 7.0.6001.18000
Système de fichiers : NTFS


Mode suppression par méthode manuelle

Nom du fichier saisi : fyrevoyrkv

Nettoyage exécuté au redémarrage de l'ordinateur

*** Recherche, création sauvegardes et suppression ***

* Suppression dans "C:\Windows\system32" *


* Suppression dans "C:\Users\gaetan\AppData\Local\Microsoft" *


* Suppression dans "C:\Users\gaetan\AppData\Local\virtualstore\windows\system32" *


* Suppression dans "C:\Users\gaetan\AppData\Local" *



*** Suppression dossiers dans "C:\Windows" ***


*** Suppression dossiers dans "C:\Program Files" ***


*** Suppression dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***


*** Suppression dossiers dans "c:\progra~2\micros~1\windows\startm~1" ***


*** Suppression dossiers dans "C:\ProgramData" ***


*** Suppression dossiers dans c:\users\gaetan\appdataoaming\micros~1\windows\startm~1\programs ***


*** Suppression dossiers dans "C:\Users\gaetan\AppData\Local\virtualstore\Program Files" ***


*** Suppression dossiers dans "C:\Users\gaetan\AppData\Roaming" ***



*** Suppression fichiers ***


*** Suppression fichiers temporaires ***

Nettoyage contenu C:\Windows\Temp effectué !
Nettoyage contenu C:\Users\gaetan\AppData\Local\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\Windows\system32" *


* Dans "C:\Users\gaetan\AppData\Local\Microsoft" *


* Dans "C:\Users\gaetan\AppData\Local\virtualstore\windows\system32" *


* Dans "C:\Users\gaetan\AppData\Local" *


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltdt absent !


*** Nettoyage terminé le 20/10/2008 à 20:05:38,47 ***

eZula · Answer

commen je suprime la cle registre ? 

Crée un nouveau document texte : clic droit de souris sur le bureau, "Nouveau"> "Document Texte". Ouvre-le et copie-colle dedans de ce qui est en gras ci-dessous, (copie tout d'un trait) :

REGEDIT4

[-hkey_local_machine\software\microsoft\windows\currentversion­\uninstall\switch]

Puis "fichier"/"enregistrer sous" :
dans : sur le bureau
Nom du fichier : fix0.reg
Type de fichier : "tous les fichiers"
clique sur "enregistrer"

L'icône de fix0.reg doit ressembler à cela [img]https://www.hiboox.com[/img]

quitte internet et double clique sur fix0.reg => tu dois obligatoirement avoir un message "voulez-vous vraiment ajouter les informations contenues dans ce fichier .reg au registre ?"
Si c'est bien le cas, clique sur "oui"


Tu as encore des pubs ? oui ? poste un nouveau rapport HijackThis

gaetan · Answer

bon pour la clé c bon mé g toujour les fenétre qui s'ouvre tou le temp . . . voila le rapport HijackThis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:39:21, on 21/10/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Program Files\Winamp\winampa.exe
C:\Windows\System32undll32.exe
C:\Program Files\Micro Application\Securite Internet 2007\avp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\ppcbooster\ppcbooster.exe
C:\Windows\System32undll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Windows\system32\conime.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Winamp\elevator.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
O3 - Toolbar: Barre d'outils MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\fr\msntb.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Micro Application\Securite Internet 2007\avp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [Speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: ppcbooster.lnk = C:\Program Files\ppcbooster\ppcbooster.exe
O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbaresources\en-US\local\search.html
O8 - Extra context menu item: Ajouter à Anti-Banner - C:\Program Files\Micro Application\Securite Internet 2007\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Micro Application\Securite Internet 2007\scieplugin.dll
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O13 - Gopher Prefix: 
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - https://www.eset.com/
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\MICROA~1\SECURI~1\adialhk.dll,C:\PROGRA~1\MICROA~1\SECURI~13hook.dll
O23 - Service: Sécurité Internet 2007 (AVP) - Micro Application - C:\Program Files\Micro Application\Securite Internet 2007\avp.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

eZula · Answer

Vas sur ce site https://www.virustotal.com/gui/
Colle dans la case à gauche de "parcourir" :
C:\Windows\system32\conime.exe
en cours de chargement ...mis en file d'attenteen attenteen cours d'analyse clique ensuite sur "Envoyer le fichier" puis patiente jusqu'à apparition du message "Situation actuelle: terminé " ; copie alors le rapport dans ta réponse

gaetan · Answer

voila le rapport g tou copier (je savé pa se qui falé prendre)   :)

Fichier conime.exe reçu le 2008.10.23 16:44:32 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE 


Résultat: 0/36 (0%)
en train de charger les informations du serveur... 
Votre fichier est dans la file d'attente, en position: 4.
L'heure estimée de démarrage est entre 55 et 78 secondes.
Ne fermez pas la fenêtre avant la fin de l'analyse. 
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier. 
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération. 
 Formaté Impression des résultats  
Votre fichier a expiré ou n'existe pas. 
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée. 
 Email:  
  

Antivirus Version Dernière mise à jour Résultat 
AhnLab-V3 2008.10.22.0 2008.10.23 - 
AntiVir 7.9.0.5 2008.10.23 - 
Authentium 5.1.0.4 2008.10.23 - 
Avast 4.8.1248.0 2008.10.23 - 
AVG 8.0.0.161 2008.10.23 - 
BitDefender 7.2 2008.10.23 - 
CAT-QuickHeal 9.50 2008.10.23 - 
ClamAV 0.93.1 2008.10.23 - 
DrWeb 4.44.0.09170 2008.10.23 - 
eSafe 7.0.17.0 2008.10.22 - 
eTrust-Vet 31.6.6164 2008.10.22 - 
Ewido 4.0 2008.10.23 - 
F-Prot 4.4.4.56 2008.10.23 - 
F-Secure 8.0.14332.0 2008.10.23 - 
Fortinet 3.113.0.0 2008.10.23 - 
GData 19 2008.10.23 - 
Ikarus T3.1.1.44.0 2008.10.23 - 
K7AntiVirus 7.10.505 2008.10.23 - 
Kaspersky 7.0.0.125 2008.10.23 - 
McAfee 5412 2008.10.23 - 
Microsoft 1.4005 2008.10.23 - 
NOD32 3548 2008.10.23 - 
Norman 5.80.02 2008.10.23 - 
Panda 9.0.0.4 2008.10.23 - 
PCTools 4.4.2.0 2008.10.23 - 
Prevx1 V2 2008.10.23 - 
Rising 21.00.32.00 2008.10.23 - 
SecureWeb-Gateway 6.7.6 2008.10.23 - 
Sophos 4.34.0 2008.10.23 - 
Sunbelt 3.1.1747.1 2008.10.23 - 
Symantec 10 2008.10.23 - 
TheHacker 6.3.1.0.124 2008.10.23 - 
TrendMicro 8.700.0.1004 2008.10.23 - 
VBA32 3.12.8.8 2008.10.22 - 
ViRobot 2008.10.23.1434 2008.10.23 - 
VirusBuster 4.5.11.0 2008.10.22 - 
Information additionnelle 
File size: 69120 bytes 
MD5...: f96ebc5a624349d81dcc7600a3c5dc43 
SHA1..: 97b4c1c6e8cd9707b2b67ed012e53581692b7514 
SHA256: 7812184afc24f7a245d3d140eb0c1a4a23e73b34bc0a8c1556715368086f0376 
SHA512: 933f3eddd29b1537ecdc9f4bfa087db535aebdf27571b6dd4e4d4d7a908cc715
346dcb8ef21831c97dc27355d2b63c1917d59f364976356abd7c69915e6d09fb 
PEiD..: - 
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%) 
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x100ec7d
timedatestamp.....: 0x47918c4d (Sat Jan 19 05:36:13 2008)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xf248 0xf400 6.57 89e2f77ae606d88dc541e9dd54d63570
.data 0x11000 0x56c 0x200 3.38 cc385fc56e8a4be70599de6e5dc91772
.rsrc 0x12000 0x8d8 0xa00 2.88 1d705b5a55918e5b78da8384ab01661b
.reloc 0x13000 0x9ce 0xa00 5.81 523278da76752c3fa3ba850fe4fed74c

( 10 imports ) 
> ADVAPI32.dll: RegQueryValueExW, RegOpenKeyExW, RegCloseKey
> KERNEL32.dll: lstrlenA, MultiByteToWideChar, VirtualQuery, RegisterConsoleIME, InterlockedExchange, Sleep, GetSystemInfo, VirtualAlloc, VirtualProtect, GetVersionExW, InterlockedDecrement, InterlockedIncrement, lstrlenW, WideCharToMultiByte, GetCommandLineW, RegisterApplicationRestart, HeapSetInformation, SetEvent, CreateThread, GetCurrentThreadId, OpenEventW, WaitForSingleObject, CloseHandle, GetACP, LocalAlloc, LocalReAlloc, LocalFree, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetSystemTimeAsFileTime, GetCurrentProcessId, GetTickCount, QueryPerformanceCounter, GetModuleHandleA, SetUnhandledExceptionFilter, GetStartupInfoA, InterlockedCompareExchange, UnregisterConsoleIME
> GDI32.dll: GetStockObject, TranslateCharsetInfo
> USER32.dll: IsWindowEnabled, EnableWindow, UnregisterClassW, CreateWindowExW, RegisterClassW, LoadCursorW, SetForegroundWindow, RegisterWindowMessageW, DispatchMessageW, TranslateMessage, GetMessageW, GetKeyState, GetKeyboardLayoutNameW, PostQuitMessage, DefWindowProcW, GetGUIThreadInfo, IsWindow, DestroyWindow, SetTimer, LoadIconW, PostMessageW, SendMessageTimeoutW, KillTimer, AttachThreadInput, ActivateKeyboardLayout
> msvcrt.dll: _vsnwprintf, memset, malloc, free, _amsg_exit, memcpy, _local_unwind4, __getmainargs, _cexit, _exit, _XcptFilter, _ismbblead, _acmdln, _initterm, _controlfp, _terminate@@YAXXZ, _onexit, _lock, __dllonexit, _unlock, _except_handler4_common, __set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, memmove, exit
> ole32.dll: CoUninitialize, CoCreateInstance, CoInitializeEx
> OLEAUT32.dll: -, -, -, -, -, -, -
> UxTheme.dll: SetThemeAppProperties
> IMM32.dll: ImmCreateContext, ImmReleaseContext, ImmGetContext, ImmGetGuideLineW, ImmGetConversionStatus, ImmGetOpenStatus, ImmSetConversionStatus, ImmGetProperty, ImmAssociateContext, ImmSimulateHotKey, ImmTranslateMessage, ImmCallImeConsoleIME, ImmGetIMEFileNameW, ImmEscapeW, ImmNotifyIME, ImmGetCandidateListW, ImmGetCompositionStringW, ImmGetHotKey, ImmSetActiveContextConsoleIME, ImmDestroyContext, ImmSetOpenStatus
> MSCTF.dll: TF_IsCtfmonRunning, TF_WaitForInitialized, TF_Notify

( 0 exports )

gaetan · Answer

Quelqu'un peu me répondre svp ! ! ! ! ! !

gaetan · Answer

et maitenant je fais koi g toujour les fenétre. Quelqu'un peu me répondre SVP !!!!!!!!!!!

eZula · Answer

Télécharge le script "Silent Runners" (Andrew Aronoff) : clic droit > "enregistrer sous" (et non pas clic gauche) sur le lien suivant :
https://www.silentrunners.org/Silent%20Runners.vbs
clique ensuite 2 fois sur "yes"
Laisse lui le temps de faire son analyse (compte une minute, montre en main)
Poste le rapport généré qui se trouve dans le meme dossier que Silent Runners...

Si ton antivirus s'affole, autorise ce script. Ou au pire, désactive-le juste le temps du téléchargement et du scan. Ce script n'est pas dangereux.

gaetan · Answer

voila le rapport en 2 parti "Silent Runners.vbs", revision 58, https://www.silentrunners.org/ Operating System: Windows Vista Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "Sidebar" = "C:\Program Files\Windows Sidebar\sidebar.exe /autoRun" [MS] "SmpcSys" = "C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe" ["Packard Bell BV"] "CursorXP" = "C:\Program Files\CursorXP\CursorXP.exe" [" "] "ehTray.exe" = "C:\Windows\ehome\ehTray.exe" [MS] "MsnMsgr" = ""C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background" [MS] "ISUSPM" = ""C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler" ["Macrovision Corporation"] "Speech Recognition" = ""C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup" [MS] "Orb" = ""C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background" ["Orb Networks"] "Skype" = ""C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized" ["Skype Technologies S.A."] "AdobeUpdater" = "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" ["Adobe Systems Incorporated"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "RtHDVCpl" = "RtHDVCpl.exe" ["Realtek Semiconductor"] "Skytel" = "Skytel.exe" ["Realtek Semiconductor Corp."] "RoxWatchTray" = ""C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"" ["Sonic Solutions"] "toolbar_eula_launcher" = "C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe" [null data] "NeroFilterCheck" = "C:\Windows\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "QuickTime Task" = ""C:\Program Files\QuickTime\QTTask.exe" -atboottime" ["Apple Inc."] "Adobe Reader Speed Launcher" = ""C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"" ["Adobe Systems Incorporated"] "TkBellExe" = ""C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."] "WinampAgent" = ""C:\Program Files\Winamp\winampa.exe"" [null data] "NvSvc" = "RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart" [MS] "NvCplDaemon" = "RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup" [MS] "NvMediaCenter" = "RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit" [MS] "AVP" = ""C:\Program Files\Micro Application\Securite Internet 2007\avp.exe"" ["Micro Application"] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"" ["Sun Microsystems, Inc."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "Aide pour le lien d'Adobe PDF Reader" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}\(Default) = "Winamp Toolbar Loader" -> {HKLM...CLSID} = "Winamp Toolbar Loader" \InProcServer32\(Default) = "C:\Program Files\Winamp Toolbar\winamptb.dll" ["AOL LLC."] {3049C3E9-B461-4BC5-8870-4C09146192CA}\(Default) = (no title provided) -> {HKLM...CLSID} = "RealPlayer Download and Record Plugin for Internet Explorer" \InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll" ["RealPlayer"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll" ["Sun Microsystems, Inc."] {9030D464-4C02-4ABF-8ECC-5164760863C6}\(Default) = (no title provided) -> {HKLM...CLSID} = "Programme d'aide de l'Assistant de connexion Windows Live" \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll" [MS] {CA6319C0-31B7-401E-A518-A07C3DB8F777}\(Default) = "Browser Address Error Redirector" -> {HKLM...CLSID} = "CBrowserHelperObject Object" \InProcServer32\(Default) = "C:\Program Files\Google\Google_BAE\BAE.dll" ["Packard Bell"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\Windows\system32\nvcpl.dll" ["NVIDIA Corporation"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler" -> {HKLM...CLSID} = "NeroDigitalIconHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] "{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler" -> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] "{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders" -> {HKLM...CLSID} = "Mes dossiers de partage" \InProcServer32\(Default) = "C:\Program Files\Windows Live\Messenger\fsshext.8.5.1302.1018.dll" [MS] "{BB7DF450-F119-11CD-8465-00AA00425D90}" = "Microsoft Access Custom Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office\soa800.dll" [MS] "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player" -> {HKLM...CLSID} = "RealOne Player Context Menu Class" \InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\Windows\system32\nvcpl.dll" ["NVIDIA Corporation"] "{85E0B171-04FA-11D1-B7DA-00A0C90348D6}" = "Statistiques d’Anti-Virus Internet" -> {HKLM...CLSID} = "Statistiques d’Anti-Virus Internet" \InProcServer32\(Default) = "C:\Program Files\Micro Application\Securite Internet 2007\scieplugin.dll" ["Kaspersky Lab"] HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\ {7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler" -> {HKLM...CLSID} = "NeroDigitalColumnHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Micro Application\Securite Internet 2007\ShellEx.dll" ["Micro Application"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Micro Application\Securite Internet 2007\ShellEx.dll" ["Micro Application"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Default executables: -------------------- <> HKLM\SOFTWARE\Classes\.com\(Default) = "ComFile" Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoDrives" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoDrives" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "LogonHoursAction" = (REG_DWORD) dword:0x00000002 {unrecognized setting} "DontDisplayLogonHoursWarnings" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "HideLegacyLogonScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideLogoffScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideStartupScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "RunLogonScriptSync" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "RunStartupScriptSync" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ "ConsentPromptBehaviorAdmin" = (REG_DWORD) dword:0x00000002 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| User Account Control: Behavior Of The Elevation Prompt For Administrators In Admin Approval Mode} "ConsentPromptBehaviorUser" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| User Account Control: Behavior Of The Elevation Prompt For Standard Users} "EnableInstallerDetection" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| User Account Control: Detect Application Installations And Prompt For Elevation} "EnableLUA" = (REG_DWORD) dword:0x00000000 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| User Account Control: Run All Administrators In Admin Approval Mode} "EnableSecureUIAPaths" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| User Account Control: Only elevate UIAccess applications that are installed in secure locations} "EnableVirtualization" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| User Account Control: Virtualize file and registry write failures to per-user locations} "PromptOnSecureDesktop" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| User Account Control: Switch to the secure desktop when prompting for elevation} "shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} "FilterAdministratorToken" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| User Account Control: Admin Approval Mode for the Built-in Administrator Account} "EnableUIADesktopToggle" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "DisableRegistryTools" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideLegacyLogonScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideLogoffScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "RunLogonScriptSync" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "RunStartupScriptSync" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideStartupScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows Photo Gallery\Papier peint de la Galerie de photos Windows.jpg" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Users\gaetan\AppData\Roaming\Microsoft\Windows Photo Gallery\Papier peint de la Galerie de photos Windows.jpg" Windows Portable Device AutoPlay Handlers ----------------------------------------- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\ RoxioSCAudioCDTask33\ "Provider" = "Roxio Creator Audio" "InvokeProgID" = "Roxio.RoxioCentral33" "InvokeVerb" = "AudioCDTask" HKLM\SOFTWARE\Classes\Roxio.RoxioCentral33\shell\AudioCDTask\Command\(Default) = ""C:\Program Files\Common Files\Roxio Shared\9.0\Roxio Central33\Main\Roxio_Central33.exe" /Launch {8E376824-EA6C-4CB7-AA05-A30CB84D359B}" [null data] RoxioSCCopyCD33\ "Provider" = "Roxio Creator Copy" "InvokeProgID" = "Roxio.RoxioCentral33" "InvokeVerb" = "ExactCopyJob" HKLM\SOFTWARE\Classes\Roxio.RoxioCentral33\shell\ExactCopyJob\Command\(Default) = ""C:\Program Files\Common Files\Roxio Shared\9.0\Roxio Central33\Main\Roxio_Central33.exe" /Launch {6123D5C0-0B6A-4B67-A692-C0863AB98CDA}" [null data] RoxioSCCopyDisc33\ "Provider" = "Roxio Creator Copy" "InvokeProgID" = "Roxio.RoxioCentral33" "InvokeVerb" = "ExactCopyJob" HKLM\SOFTWARE\Classes\Roxio.RoxioCentral33\shell\ExactCopyJob\Command\(Default) = ""C:\Program Files\Common Files\Roxio Shared\9.0\Roxio Central33\Main\Roxio_Central33.exe" /Launch {6123D5C0-0B6A-4B67-A692-C0863AB98CDA}" [null data] RoxioSCDataProject33\ "Provider" = "Roxio Creator Data" "InvokeProgID" = "Roxio.RoxioCentral33" "InvokeVerb" = "DataGuide" HKLM\SOFTWARE\Classes\Roxio.RoxioCentral33\shell\DataGuide\Command\(Default) = ""C:\Program Files\Common Files\Roxio Shared\9.0\Roxio Central33\Main\Roxio_Central33.exe" /Launch Data" [null data] RoxioSCDataTask33\ "Provider" = "Roxio Creator Data" "InvokeProgID" = "Roxio.RoxioCentral33" "InvokeVerb" = "DataTask" HKLM\SOFTWARE\Classes\Roxio.RoxioCentral33\shell\DataTask\Command\(Default) = ""C:\Program Files\Common Files\Roxio Shared\9.0\Roxio Central33\Main\Roxio_Central33.exe" /Launch {D085B12D-4D9B-49C2-8323-5053831CBD54}" [null data] RPCDBurningOnArrival\ "Provider" = "RealPlayer" "InvokeProgID" = "RealPlayer.CDBurn.6" "InvokeVerb" = "open" HKCU\Software\Classes\RealPlayer.CDBurn.6\shell\open\command\(Default) = ""C:\Program Files\Real\RealPlayer\RealPlay.exe" /burn "%1"" ["RealNetworks, Inc."] RPDeviceOnArrival\ "Provider" = "RealPlayer" "ProgID" = "RealPlayer.HWEventHandler" HKLM\SOFTWARE\Classes\RealPlayer.HWEventHandler\CLSID\(Default) = "{67E76F1D-BDE2-4052-913C-2752366192D2}" -> {HKLM...CLSID} = "RealNetworks Scheduler" \LocalServer32\(Default) = ""C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -autoplay" ["RealNetworks, Inc."] RPPlayCDAudioOnArrival\ "Provider" = "RealPlayer" "InvokeProgID" = "RealPlayer.AudioCD.6" "InvokeVerb" = "play" HKCU\Software\Classes\RealPlayer.AudioCD.6\shell\play\command\(Default) = ""C:\Program Files\Real\RealPlayer\RealPlay.exe" /play %1 " ["RealNetworks, Inc."] RPPlayDVDMovieOnArrival\ "Provider" = "RealPlayer" "InvokeProgID" = "RealPlayer.DVD.6" "InvokeVerb" = "play" HKCU\Software\Classes\RealPlayer.DVD.6\shell\play\command\(Default) = ""C:\Program Files\Real\RealPlayer\RealPlay.exe" /dvd %1 " ["RealNetworks, Inc."] RPPlayMediaOnArrival\ "Provider" = "RealPlayer" "InvokeProgID" = "RealPlayer.AutoPlay.6" "InvokeVerb" = "open" HKCU\Software\Classes\RealPlayer.AutoPlay.6\shell\open\command\(Default) = ""C:\Program Files\Real\RealPlayer\RealPlay.exe" /autoplay "%1"" ["RealNetworks, Inc."] WinampMTPHandler\ "Provider" = "Winamp" "ProgID" = "Shell.HWEventHandlerShellExecute" "InitCmdLine" = "C:\Program Files\Winamp\winamp.exe" HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" -> {HKLM...CLSID} = "Shell Execute Hardware Event Handler" \LocalServer32\(Default) = "C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS] WinampPlayMediaOnArrival\ "Provider" = "Winamp" "InvokeProgID" = "Winamp.File" "InvokeVerb" = "Play" HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\command\(Default) = ""C:\Program Files\Winamp\Winamp.exe" "%1"" ["Nullsoft"] HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\DropTarget\CLSID = "{46986115-84D6-459c-8F95-52DD653E532E}" -> {HKLM...CLSID} = (no title provided) \LocalServer32\(Default) = ""C:\Program Files\Winamp\Winamp.exe"" ["Nullsoft"] Startup items in "gaetan" & "All Users" startup folders: -------------------------------------------------------- C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup "ppcbooster" -> shortcut to: "C:\Program Files\ppcbooster\ppcbooster.exe" ["BB Inc"]

gaetan · Answer

Non-disabled Scheduled Tasks:
-----------------------------

C:\Windows\System32\Tasks
"Extension de garantie" ->  launches: "C:\Program Files\Packard Bell\SetupmyPC\PBCarNot.exe" ["Packard Bell BV"]
"Recovery DVD Creator" ->  launches: "C:\Program Files\Packard Bell\SetupMyPc\MCDCheck.exe" ["Packard Bell BV"]
"User_Feed_Synchronization-{0A49DB88-7C7A-43BD-9A98-D3516BEAB586}" -> (HIDDEN!) launches: "C:\Windows\system32\msfeedssync.exe sync" [MS]
"{0FDFB5FE-AC5A-42EB-A448-DB4F55847877}" ->  launches: "C:\Windows\system32\pcalua.exe -a H:\Setup.exe -d H:\" [MS]
"{2757C239-C431-453B-A767-E874EBC7D103}" ->  launches: "C:\Windows\system32\pcalua.exe -a "C:\Users\gaetan\Warcraft 2 - The Tides of Darkness\SETUP.EXE" -d "C:\Users\gaetan\Warcraft 2 - The Tides of Darkness"" [MS]
"{2BC78422-C14F-4E99-AFE1-3F9879F9FF92}" ->  launches: "C:\Windows\system32\pcalua.exe -a H:\TheGladiators.exe -d H:\" [MS]
"{6166B418-A64F-4202-9724-045B6BD1F4E3}" ->  launches: "C:\Windows\system32\pcalua.exe -a H:\instmsiw.exe -d H:\" [MS]
"{6EB6A404-22BB-4E4C-B923-6A0CDAB47089}" ->  launches: "C:\Windows\system32\pcalua.exe -a C:\Windows\system32\ImageDrive.cpl -c Nero ImageDrive" [MS]
"{76CE492B-2033-49C3-AED5-CFFA958FF078}" ->  launches: "C:\Windows\system32\pcalua.exe -a C:\Users\gaetan\Downloads\INSTALL.EXE -d C:\Users\gaetan\Downloads" [MS]
"{81F4CBAB-B8B1-4F53-9BFE-FA21F19DBF46}" ->  launches: "C:\Windows\system32\pcalua.exe -a "C:\Program Files\Ubisoft\GSC Game World\Alexandre\uninstall.exe"" [MS]
"{82D91A8E-E463-4BEA-959C-4CD362D82FC7}" ->  launches: "C:\Windows\system32\pcalua.exe -a H:\setup.exe -d H:\" [MS]
"{B305E9B9-D1C6-48BB-AB74-FC6F9911920C}" ->  launches: "C:\Windows\system32\pcalua.exe -a C:\Users\gaetan\Downloads\Arcanes12h.exe -d C:\Users\gaetan\Downloads" [MS]
"{CCBF9A7C-97F7-4822-AF15-39ADB1F33BA8}" ->  launches: "C:\Windows\system32\pcalua.exe -a H:\autorun\Setup.exe -d H:\autorun" [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Active Directory Rights Management Services Client
"AD RMS Rights Policy Template Management (Manual)" ->  launches: "{BF5CB148-7C77-4d8a-A53E-D81C70CF743C}"
  -> {HKLM...CLSID} = "AD RMS Rights Policy Template Management (Manual) Task Handler"
                   \InProcServer32\(Default) = "C:\Windows\system32\msdrm.dll" [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Bluetooth
"UninstallDeviceTask" ->  launches: "BthUdTask.exe $(Arg0)" [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\CertificateServicesClient
"SystemTask" ->  launches: "{58fb76b9-ac85-4e55-ac04-427593b1d060}"
  -> {HKLM...CLSID} = "Certificate Services Client Task Handler"
                   \InProcServer32\(Default) = "C:\Windows\system32\dimsjob.dll" [MS]
"UserTask" ->  launches: "{58fb76b9-ac85-4e55-ac04-427593b1d060}"
  -> {HKLM...CLSID} = "Certificate Services Client Task Handler"
                   \InProcServer32\(Default) = "C:\Windows\system32\dimsjob.dll" [MS]
"UserTask-Roam" ->  launches: "{58fb76b9-ac85-4e55-ac04-427593b1d060}"
  -> {HKLM...CLSID} = "Certificate Services Client Task Handler"
                   \InProcServer32\(Default) = "C:\Windows\system32\dimsjob.dll" [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program
"Consolidator" ->  launches: "%SystemRoot%\System32\wsqmcons.exe" [MS]
"OptinNotification" ->  launches: "%SystemRoot%\System32\wsqmcons.exe -n 0x1C577FA2B69CAD0" [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Defrag
"ManualDefrag" ->  launches: "%windir%\system32\defrag.exe -c" [MS]
"ScheduledDefrag" ->  launches: "%windir%\system32\defrag.exe -c -i" [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Media Center
"ehDRMInit" ->  launches: "%SystemRoot%\ehome\ehPrivJob.exe /DRMInit" [MS]
"mcupdate" ->  launches: "%SystemRoot%\ehome\mcupdate $(Arg0) -gc" [MS]
"OCURActivate" ->  launches: "%SystemRoot%\ehome\ehPrivJob.exe /OCURActivate" [MS]
"OCURDiscovery" ->  launches: "%SystemRoot%\ehome\ehPrivJob.exe /OCURDiscovery" [MS]
"UpdateRecordPath" ->  launches: "%SystemRoot%\ehome\ehPrivJob.exe /DoUpdateRecordPath $(Arg0)" [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\MobilePC
"HotStart" ->  launches: "{06DA0625-9701-43da-BFD7-FBEEA2180A1E}"
  -> {HKLM...CLSID} = "HotStart User Agent"
                   \InProcServer32\(Default) = "C:\Windows\System32\HotStartUserAgent.dll" [MS]
"TMM" ->  launches: "{35EF4182-F900-4632-B072-8639E4478A61}"
  -> {HKLM...CLSID} = "Transient Multi-Monitor Manager"
                   \InProcServer32\(Default) = "C:\Windows\System32\TMM.dll" [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\MUI
"LPRemove" ->  launches: "%windir%\system32\lpremove.exe" [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Multimedia
"SystemSoundsService" ->  launches: "{2DEA658F-54C1-4227-AF9B-260AB5FC3543}"
  -> {HKLM...CLSID} = "Microsoft PlaySoundService Class"
                   \InProcServer32\(Default) = "C:\Windows\System32\PlaySndSrv.dll" [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\NetworkAccessProtection
"NAPStatus UI" ->  launches: "{f09878a1-4652-4292-aa63-8c7d4fd7648f}"
  -> {HKLM...CLSID} = "Nap ITask Handler Implementation"
                   \InProcServer32\(Default) = "C:\Windows\System32\QAgent.dll" [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\PLA\System
"ConvertLogEntries" -> (HIDDEN!) launches: "%windir%\system32\rundll32.exe %windir%\system32\pla.dll,PlaConvertLogEntries" [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\RAC
"RACAgent" -> (HIDDEN!) launches: "%windir%\system32\RacAgent.exe" [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\RemoteAssistance
"RemoteAssistanceTask" -> (HIDDEN!) launches: "%windir%\system32\RAServer.exe /offerraupdate" [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Shell
"CrawlStartPages" ->  launches: "{51653423-e62d-4ff7-894a-dabb2b8e21e2}"
  -> {HKLM...CLSID} = "CrawlStartPages Task Handler"
                   \InProcServer32\(Default) = "C:\Windows\System32\srchadmin.dll" [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\SideShow
"GadgetManager" ->  launches: "{FF87090D-4A9A-4f47-879B-29A80C355D61}"
  -> {HKLM...CLSID} = "GadgetsManager Class"
                   \InProcServer32\(Default) = "C:\Windows\System32\AuxiliaryDisplayServices.dll" [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\SystemRestore
"SR" ->  launches: "%windir%\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation" [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Tcpip
"IpAddressConflict1" ->  launches: "rundll32 ndfapi.dll,NdfRunDllDuplicateIPOffendingSystem" [MS]
"IpAddressConflict2" ->  launches: "rundll32 ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem" [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework
"MsCtfMonitor" -> (HIDDEN!) launches: "{01575cfe-9a55-4003-a5e1-f38d1ebdcbe1}"
  -> {HKLM...CLSID} = "MsCtfMonitor task handler"
                   \InProcServer32\(Default) = "C:\Windows\system32\MsCtfMonitor.dll" [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\UPnP
"UPnPHostConfig" ->  launches: "sc.exe config upnphost start= auto" [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\WDI
"ResolutionHost" -> (HIDDEN!) launches: "{900be39d-6be8-461a-bc4d-b0fa71f5ecb1}"
  -> {HKLM...CLSID} = "DiagnosticInfrastructureCustomHandler"
                   \InProcServer32\(Default) = "C:\Windows\System32\wdi.dll" [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Windows Error Reporting
"QueueReporting" ->  launches: "%windir%\system32\wermgr.exe -queuereporting" [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Wired
"GatherWiredInfo" ->  launches: "%windir%\system32\gatherWiredInfo.vbs" [null data]

C:\Windows\System32\Tasks\Microsoft\Windows\Wireless
"GatherWirelessInfo" ->  launches: "%windir%\system32\gatherWirelessInfo.vbs" [null data]

C:\Windows\System32\Tasks\Microsoft\Windows Defender
"MP Scheduled Scan" -> (HIDDEN!) launches: "c:\program files\windows defender\MpCmdRun.exe Scan -RestrictPrivileges" [MS]
"MP Scheduled Signature Update" -> (HIDDEN!) launches: "c:\program files\windows defender\MpCmdRun.exe SignatureUpdate" [MS]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\system32\NLAapi.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\system32\napinsp.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\system32\pnrpnsp.dll" [MS]
000000000004\LibraryPath = "%SystemRoot%\system32\pnrpnsp.dll" [MS]
000000000005\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000006\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]

Transport Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 18


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{F2CF5485-4E02-4F68-819C-B92DE9277049}"
  -> {HKLM...CLSID} = "&Links"
                   \InProcServer32\(Default) = "C:\Windows\system32\ieframe.dll" [MS]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"
  -> {HKLM...CLSID} = "Winamp Toolbar"
                   \InProcServer32\(Default) = "C:\Program Files\Winamp Toolbar\winamptb.dll" ["AOL LLC."]
"{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F}"
  -> {HKLM...CLSID} = "Dealio"
                   \InProcServer32\(Default) = "C:\Program Files\Dealio\kb127\Dealio.dll" [file not found]

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\
"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" = "0"
  -> {HKLM...CLSID} = "Barre d'outils MSN"
                   \InProcServer32\(Default) = "C:\Program Files\MSN Toolbar\01.01.2607.0\fr\msntb.dll" [MS]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}" = "Winamp Toolbar"
  -> {HKLM...CLSID} = "Winamp Toolbar"
                   \InProcServer32\(Default) = "C:\Program Files\Winamp Toolbar\winamptb.dll" ["AOL LLC."]

Explorer Bars

HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\

HKLM\SOFTWARE\Classes\CLSID\{85E0B171-04FA-11D1-B7DA-00A0C90348D6}\(Default) = "Statistiques d’Anti-Virus Internet"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\Program Files\Micro Application\Securite Internet 2007\scieplugin.dll" ["Kaspersky Lab"]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Console Java (Sun)"
"CLSIDExtension" = "{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}"
  -> {HKCU...CLSID} = "Java Plug-in 1.6.0_07"
                   \InProcServer32\(Default) = "C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll" ["Sun Microsystems, Inc."]
  -> {HKLM...CLSID} = "Java Plug-in 1.6.0_07"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll" ["Sun Microsystems, Inc."]

{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E}\
"ButtonText" = "Statistiques d’Anti-Virus Internet"


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Acquisition d'image Windows (WIA), stisvc, "C:\Windows\system32\svchost.exe -k imgsvc" {"C:\Windows\System32\wiaservc.dll" [MS]}
Explorateur d'ordinateurs, Browser, "C:\Windows\system32\svchost.exe -k netsvcs" {"C:\Windows\System32\browser.dll" [MS]}
Service Messenger Sharing Folders USN Journal Reader, usnjsvc, ""C:\Program Files\Windows Live\Messenger\usnsvc.exe"" [MS]
Service*SSTP (Secure Socket Tunneling Protocol) (unwritable string), SstpSvc, "C:\Windows\system32\svchost.exe -k LocalService" {"C:\Windows\system32\sstpsvc.dll" [MS]}
Sécurité Internet 2007, AVP, ""C:\Program Files\Micro Application\Securite Internet 2007\avp.exe" -r" ["Micro Application"]
Windows CardSpace, idsvc, ""C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe"" [MS]
Windows Driver Foundation - Infrastructure de pilote mode-utilisateur, wudfsvc, "C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted" {"C:\Windows\System32\WUDFSvc.dll" [MS]}


Accessibility Tools:
--------------------

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\
"Configuration" = "magnifierpane"

HKCU\Software\Microsoft\Windows NT\CurrentVersion\AccessibilityTemp\
"magnifierpane" = dword:0x00000000

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility\Session1\
"Configuration" = "magnifierpane"

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs\magnifierpane\
"Description" = "Screen Magnifier"
"StartExe" = "C:\Windows\System32\Magnify.exe" [MS]


---------- (launch time: 2008-10-25 12:51:40)
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
  launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
  DLL launch points, use the -supp parameter or answer "No" at the
  first message box and "Yes" at the second message box.
---------- (total run time: 83 seconds, including 8 seconds for message boxes)

eZula · Answer

ce n'est guère plus bavard. Essayons de voir les derniers fichiers créés et eéventuellement s'il y a un résidu d'adware navipromo

Télécharge http://download.bleepingcomputer.com/sUBs/ComboFix.exe (sUBs) sur ton Bureau
Désactive tes protections résidentes et double clique combofix.exe
 Tape sur la touche [b]Y[/b] (Yes) pour démarrer le scan.
Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

gaetan · Answer

désoler pour la lenteur de ma réponse mais voila le rapport ComboFix 08-10-24.02 - gaetan 2008-10-26 21:25:52.2 - NTFSx86 Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1275 [GMT 1:00] Lancé depuis: C:\Users\gaetan\ComboFix.exe . ((((((((((((((((((((((((((((( Fichiers créés du 2008-09-26 au 2008-10-26 )))))))))))))))))))))))))))))))))))) . 2008-10-25 17:52 . 2008-10-25 17:52 2,995,773 -ra------ C:\Users\gaetan\ComboFix.exe 2008-10-25 11:51 . 2008-10-25 11:51 399,648 --a------ C:\Users\gaetan\Silent Runners.vbs 2008-10-22 20:58 . 2008-10-22 20:58 d-------- C:\Windows\Sun 2008-10-18 21:22 . 2008-10-20 19:05 d-------- C:\Program Files\Navilog1 2008-10-18 21:21 . 2008-10-18 21:22 571,687 --a------ C:\Users\gaetan\Navilog1.exe 2008-10-18 18:24 . 2008-06-19 16:24 28,544 --a------ C:\Windows\System32\drivers\pavboot.sys 2008-10-18 18:23 . 2008-10-18 18:23 d-------- C:\Program Files\Panda Security 2008-10-17 16:35 . 2008-10-17 16:37 d-------- C:\ToolBar SD 2008-10-17 16:35 . 2008-10-17 16:35 364,558 --a------ C:\Users\gaetan\ToolBarSD.exe 2008-10-16 20:04 . 2008-10-16 20:04 812,344 --a------ C:\Users\gaetan\HJTInstall.exe 2008-10-16 15:42 . 2008-10-16 18:12 d-------- C:\Program Files\EsetOnlineScanner 2008-10-15 19:52 . 2008-10-15 19:53 56 --ah----- C:\Windows\System32\ezsidmv.dat 2008-10-15 19:48 . 2008-10-15 19:48 d-------- C:\Users\gaetan\GenProc 2008-10-15 19:48 . 2008-10-15 19:48 417,527 --a------ C:\Users\gaetan\GenProc.zip 2008-10-15 18:36 . 2008-09-18 06:09 3,601,464 --a------ C:\Windows\System32 tkrnlpa.exe 2008-10-15 18:36 . 2008-09-18 06:09 3,549,240 --a------ C:\Windows\System32 toskrnl.exe 2008-10-15 18:36 . 2008-09-18 03:16 2,032,640 --a------ C:\Windows\System32\win32k.sys 2008-10-15 18:36 . 2008-10-02 02:32 1,383,424 --a------ C:\Windows\System32\mshtml.tlb 2008-10-15 18:36 . 2008-10-02 04:49 827,392 --a------ C:\Windows\System32\wininet.dll 2008-10-15 18:36 . 2008-08-27 02:06 288,768 --a------ C:\Windows\System32\drivers\srv.sys 2008-10-14 19:40 . 2008-10-14 19:40 d-------- C:\Program Files\Celestia 2008-10-14 19:39 . 2008-10-14 19:39 23,790,082 --a------ C:\Users\gaetan\celestia-win32-1.5.1.exe 2008-10-13 17:04 . 2008-10-13 17:05 d-------- C:\Program Files\Java 2008-10-13 17:04 . 2008-10-13 17:04 d-------- C:\Program Files\Common Files\Java 2008-10-11 13:43 . 2008-10-16 20:04 d-------- C:\Program Files\Trend Micro 2008-10-08 20:36 . 2007-10-28 21:56 838,515 --a------ C:\Windows\_detmp.1 2008-10-08 20:36 . 2000-04-14 10:11 86,016 --a------ C:\Windows\_detmp.2 2008-10-08 16:37 . 2008-10-08 16:37 d-------- C:\GAMES 2008-10-08 16:29 . 2008-10-08 16:29 d-------- C:\Program Files\ppcbooster 2008-10-08 14:09 . 2008-10-24 20:15 d-------- C:\Users\gaetan\jeu . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-26 20:27 49,693,984 --sha-w C:\Windows\system32\drivers\fidbox.dat 2008-10-26 20:16 --------- d-----w C:\Users\gaetan\AppData\Roaming\Skype 2008-10-26 20:12 --------- d-----w C:\Program Files\Warcraft III 2008-10-26 15:05 --------- d-----w C:\Users\gaetan\AppData\Roaming\skypePM 2008-10-26 11:54 --------- d-----w C:\ProgramData\Micro Application 2008-10-25 21:10 660,188 --sha-w C:\Windows\system32\drivers\fidbox.idx 2008-10-23 17:35 --------- d-----w C:\Users\gaetan\AppData\Roaming\LimeWire 2008-10-21 16:27 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-10-18 13:55 --------- d-----w C:\Program Files\Google 2008-10-17 16:50 --------- d-----w C:\Program Files\Metin2_France 2008-10-16 14:13 --------- d-----w C:\Program Files\Windows Mail 2008-10-13 18:21 --------- d-----w C:\Program Files\Microsoft Games 2008-10-11 10:43 --------- d-----w C:\ProgramData\OrbNetworks 2008-10-08 19:36 --------- d-----w C:\Program Files\Tetris 3000 2008-10-08 19:35 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-10-04 17:10 --------- d-----w C:\Program Files\Cossacks - The Art Of War 2008-09-22 19:43 --------- d-----w C:\Program Files\Free Audio Pack 2008-09-10 18:19 --------- d-----w C:\Program Files\Glest_3.1.2 2008-09-04 21:02 --------- d-----w C:\Users\gaetan\AppData\Roaming\GetRightToGo 2008-08-02 03:26 36,864 ----a-w C:\Windows\System32\cdd.dll 2008-07-31 03:32 460,288 ----a-w C:\Windows\AppPatch\AcSpecfc.dll 2008-07-31 03:32 28,160 ----a-w C:\Windows\System32\Apphlpdm.dll 2008-07-31 03:32 2,154,496 ----a-w C:\Windows\AppPatch\AcGenral.dll 2008-07-31 03:32 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll 2008-07-31 01:13 4,240,384 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll 2008-07-30 17:30 2,829 ----a-w C:\Windows\DIIUnin.pif 2008-07-30 17:30 102,400 ----a-w C:\Windows\DIIUnin.exe 2008-07-29 11:22 21,840 ----atw C:\Windows\System32\SIntfNT.dll 2008-07-29 11:22 17,212 ----atw C:\Windows\System32\SIntf32.dll 2008-07-29 11:22 12,067 ----atw C:\Windows\System32\SIntf16.dll 2008-07-25 12:00 174 --sha-w C:\Program Files\desktop.ini 2008-07-05 20:34 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2008-07-05 20:34 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2008-07-05 20:34 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat 2008-01-03 14:29 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2008-01-03 14:29 32,768 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2008-01-03 14:29 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920] "SmpcSys"="C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe" [2007-05-03 1116728] "CursorXP"="C:\Program Files\CursorXP\CursorXP.exe" [2005-01-19 128000] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 125952] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184] "ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032] "Speech Recognition"="C:\Windows\Speech\Common\sapisvr.exe" [2008-01-19 49664] "Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 507904] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-08-12 21741864] "AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 2321600] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-01-11 232184] "toolbar_eula_launcher"="C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe" [2007-02-20 28672] "NeroFilterCheck"="C:\Windows\system32\NeroCheck.exe" [2001-07-09 155648] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-10-19 286720] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB ealsched.exe" [2008-05-16 185896] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-07-09 36352] "NvSvc"="C:\Windows\system32 vsvc.dll" [2007-09-12 86016] "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-09-12 8497696] "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-09-12 81920] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "RtHDVCpl"="RtHDVCpl.exe" [2007-05-10 C:\Windows\RtHDVCpl.exe] "Skytel"="Skytel.exe" [2007-05-07 C:\Windows\SkyTel.exe] C:\Users\gaetan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ ppcbooster.lnk - C:\Program Files\ppcbooster\ppcbooster.exe [2008-10-08 20480] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "FilterAdministratorToken"= 1 (0x1) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "LogonHoursAction"= 2 (0x2) "DontDisplayLogonHoursWarnings"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.SP54"= SP5X_32.DLL [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UacDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{A5339627-E33F-4F74-A621-6094E86725B3}"= UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype "{95095CE9-163A-4BDD-B427-20949BDAB151}"= TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype "{5E45B4AF-B939-4CA2-B07A-133AB80FB86B}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{394C6BA2-C96A-4BBD-9F60-4F515EEBA77F}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{FD0C1E39-A528-493F-9760-4C4843F9E02A}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{AE8F2CC7-E273-4232-B1BD-D354146370E4}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{46085E9B-7974-4DC8-9794-D1CC8F4B7376}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "{577A7DBF-45D8-4828-B37B-5FDFC66821AB}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0 "TCP Query User{FFB85EA8-6B9E-4F43-A81F-1DA6E69C6593}C:\program files\jowood\spellforce - diamond edition\spellforce.exe"= UDP:C:\program files\jowood\spellforce - diamond edition\spellforce.exe:SpellForce "UDP Query User{F274A370-0311-4948-9C00-87A5C244DFDC}C:\program files\jowood\spellforce - diamond edition\spellforce.exe"= TCP:C:\program files\jowood\spellforce - diamond edition\spellforce.exe:SpellForce "TCP Query User{985E93B6-BA64-4D9B-ADD7-0CD1AC6DAF25}C:\program files\emule\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule "UDP Query User{3644BD2E-7A11-4783-8710-CEFEB4116421}C:\program files\emule\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule "{90806C1F-8895-440C-B227-08E0D48F0987}"= UDP:C:\Windows\System32\WindowsAnytimeUpgrade.exe:Achat de mise à niveau en ligne "{D446BD00-BBE9-478B-9619-4D452BDB9759}"= TCP:C:\Windows\System32\WindowsAnytimeUpgrade.exe:Achat de mise à niveau en ligne "{DEE7FC4B-D651-41CC-81D7-8F6C3D7205D9}"= UDP:C:\Sierra\Arcanum\Arcanum.exe:Arcanum "{EC54DAB7-FEBA-4550-818E-5C2D411A2B29}"= TCP:C:\Sierra\Arcanum\Arcanum.exe:Arcanum "{263CADE6-F851-450D-96C1-082AB8AA19BA}"= UDP:C:\Program Files\Cossacks - The Art Of War\dmcr.exe:Cossacks - The Art of War "{4C4F4181-AB1A-499D-B561-41DE31A6B5A1}"= TCP:C:\Program Files\Cossacks - The Art Of War\dmcr.exe:Cossacks - The Art of War "{00AE8FAA-9A09-4854-A5D1-EC24CA422CC7}"= UDP:C:\Program Files\Strategy First\Disciples Gold\Exe\Disciple.exe:Disciples - Sacred Lands "{39617411-470F-48F4-A924-CFD9D565AA87}"= TCP:C:\Program Files\Strategy First\Disciples Gold\Exe\Disciple.exe:Disciples - Sacred Lands "{003BCC81-5806-46CD-876C-B72CFCA1ADEA}"= UDP:C:\Program Files\Ubisoft\Heroes of Might and Magic V\bin\H5_Game.exe:Heroes of Might and Magic V "{F239920F-2B88-472B-A5D5-76CA9035B9CE}"= TCP:C:\Program Files\Ubisoft\Heroes of Might and Magic V\bin\H5_Game.exe:Heroes of Might and Magic V "{43A9E2F3-9C50-46F9-9BB9-8F79888FA03A}"= UDP:C:\Program Files\3DO\Heroes of Might and Magic IV\heroes4f.exe:Heroes of Might and Magic IV "{3BEAD466-553E-47FE-9EFF-363A0969C7E2}"= TCP:C:\Program Files\3DO\Heroes of Might and Magic IV\heroes4f.exe:Heroes of Might and Magic IV "{9536B881-DD0F-4B9E-B48F-0F1572E0A1B6}"= UDP:C:\Program Files\Warcraft III\Warcraft III.exe:Warcraft III "{EBBA2F99-F856-45EE-A1F1-7142EBEFDDF0}"= TCP:C:\Program Files\Warcraft III\Warcraft III.exe:Warcraft III "{EE17DB73-4A90-435A-8F2B-C3E107D41848}"= UDP:C:\Program Files\Eidos Interactive\Pyro Studios\Praetorians\Praetorians.exe:Praetorians "{B1E9F990-D2E4-426B-963F-F61AAA926EFE}"= TCP:C:\Program Files\Eidos Interactive\Pyro Studios\Praetorians\Praetorians.exe:Praetorians "{315A0922-576B-4C34-912E-172ADCC367EB}"= UDP:C:\Program Files\Port Royale\PortRoyale.exe:Port Royale "{BD87D139-CC2D-42D2-83A5-9CFAFF9CF995}"= TCP:C:\Program Files\Port Royale\PortRoyale.exe:Port Royale "TCP Query User{DC42F8CF-5A2F-4BFD-92A4-2D4B22296815}C:\windows\system32\dplaysvr.exe"= UDP:C:\windows\system32\dplaysvr.exe:Application d'assistance Microsoft DirectPlay "UDP Query User{61AD9EF0-F75E-43BD-B095-D069C95428D5}C:\windows\system32\dplaysvr.exe"= TCP:C:\windows\system32\dplaysvr.exe:Application d'assistance Microsoft DirectPlay "TCP Query User{A8D9876F-D393-40B8-A956-EB5B51AE5521}C:\program files\internet explorer\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{8667E890-E0C1-4E1D-9947-56DBE1A838C1}C:\program files\internet explorer\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "TCP Query User{035A7B05-D664-4341-B6B0-675BE266701A}C:\program files\warcraft iii\war3.exe"= UDP:C:\program files\warcraft iii\war3.exe:Warcraft III "UDP Query User{C5AE43CF-0B11-4066-B4FC-89C971968756}C:\program files\warcraft iii\war3.exe"= TCP:C:\program files\warcraft iii\war3.exe:Warcraft III "TCP Query User{F2817DE4-BAFD-4FF6-B909-D0E722A92A61}C:\program files\maxis\simcity 3000 world edition\apps\updater\updater.exe"= UDP:C:\program files\maxis\simcity 3000 world edition\apps\updater\updater.exe:SC3UpdaterMFC "UDP Query User{F97870DA-D57B-40CF-88FF-CB7AD76BD659}C:\program files\maxis\simcity 3000 world edition\apps\updater\updater.exe"= TCP:C:\program files\maxis\simcity 3000 world edition\apps\updater\updater.exe:SC3UpdaterMFC "TCP Query User{E951D5EF-F6E7-467A-8B44-F83509473BA6}C:\program files\warzone 2100\warzone2100.exe"= UDP:C:\program files\warzone 2100\warzone2100.exe:Warzone 2100 "UDP Query User{50B8AE86-CC7D-4DD3-A5A8-681CAE5FA1F1}C:\program files\warzone 2100\warzone2100.exe"= TCP:C:\program files\warzone 2100\warzone2100.exe:Warzone 2100 "TCP Query User{03229C4D-E7BE-4981-8383-9142626D2EA8}C:\program files\microsoft games\age of mythology\aomx.exe"= UDP:C:\program files\microsoft games\age of mythology\aomx.exe:Age of Mythology - The Titans Expansion "UDP Query User{986D858B-4E6B-4C2F-8680-B4DA7EDAF5F5}C:\program files\microsoft games\age of mythology\aomx.exe"= TCP:C:\program files\microsoft games\age of mythology\aomx.exe:Age of Mythology - The Titans Expansion "TCP Query User{6912C221-A7D0-4505-A14A-6D759795AF3F}C:\bluebyte\the settlers iv\exe\s4_main.exe"= UDP:C:\bluebyte he settlers iv\exe\s4_main.exe:S4_Main "UDP Query User{825DA880-72D0-47AC-95C1-D7D0C1CFBF84}C:\bluebyte\the settlers iv\exe\s4_main.exe"= TCP:C:\bluebyte he settlers iv\exe\s4_main.exe:S4_Main "TCP Query User{FA1AAFE1-D686-477F-8C7B-46DFC492ECE0}C:\program files\giants\giants.exe"= UDP:C:\program files\giants\giants.exe:Giants "UDP Query User{1AC13B7B-D5AF-4AA7-ABBA-741E73EE8CB6}C:\program files\giants\giants.exe"= TCP:C:\program files\giants\giants.exe:Giants "TCP Query User{8F180B30-77F4-402C-8F7F-0E7E0A772811}C:\program files\dreamcatcher\dungeon lords\dlords.exe"= UDP:C:\program files\dreamcatcher\dungeon lords\dlords.exe:dlords "UDP Query User{1F7CA572-467C-421D-A2FD-D474704478BA}C:\program files\dreamcatcher\dungeon lords\dlords.exe"= TCP:C:\program files\dreamcatcher\dungeon lords\dlords.exe:dlords "{E6942491-2D7E-4373-BBFA-A038575FBDAE}"= UDP:C:\Program Files\Microsoft Games\Age of Empires III\age3x.exe:Age of Empires III - The WarChiefs "{10512A4C-5354-4DED-A488-3BF0D65A5986}"= TCP:C:\Program Files\Microsoft Games\Age of Empires III\age3x.exe:Age of Empires III - The WarChiefs "{20C65265-96D9-4A19-B34E-D406DCFA0F1A}"= UDP:C:\Program Files\Atari\Neverwinter Nights 2 wn2main.exe:Neverwinter Nights 2 Main "{220287E5-AA44-466B-9D32-F6F73593096C}"= TCP:C:\Program Files\Atari\Neverwinter Nights 2 wn2main.exe:Neverwinter Nights 2 Main "{47C66D78-D87D-49E1-B813-B60D6EAA0BFF}"= UDP:C:\Program Files\Atari\Neverwinter Nights 2 wn2main_amdxp.exe:Neverwinter Nights 2 AMD "{C1165618-5246-4897-B163-00E18B76447C}"= TCP:C:\Program Files\Atari\Neverwinter Nights 2 wn2main_amdxp.exe:Neverwinter Nights 2 AMD "{1435300C-09D2-4658-91E4-5C164BD15F2C}"= UDP:C:\Program Files\Atari\Neverwinter Nights 2 wupdate.exe:Neverwinter Nights 2 Updater "{0C5C33D6-DB3E-4F78-9C38-20125F092EB0}"= TCP:C:\Program Files\Atari\Neverwinter Nights 2 wupdate.exe:Neverwinter Nights 2 Updater "{41E719C3-4818-4293-84DB-9BABFF382CC4}"= UDP:C:\Program Files\Atari\Neverwinter Nights 2 wn2server.exe:Neverwinter Nights 2 Server "{E06D12E1-F75F-435E-8854-D808F4365EAA}"= TCP:C:\Program Files\Atari\Neverwinter Nights 2 wn2server.exe:Neverwinter Nights 2 Server "TCP Query User{9DDAF048-3287-46BD-9E53-FC85F7D8A4AC}C:\program files\microsoft games\dungeon siege\dungeonsiege.exe"= UDP:C:\program files\microsoft games\dungeon siege\dungeonsiege.exe:Dungeon Siege Game Executable "UDP Query User{68A9DE2C-0F8B-4689-AD2F-7F274C73E3E3}C:\program files\microsoft games\dungeon siege\dungeonsiege.exe"= TCP:C:\program files\microsoft games\dungeon siege\dungeonsiege.exe:Dungeon Siege Game Executable "TCP Query User{3B1844B2-F152-4446-B412-03398EB8967D}C:\windows\system32\dpnsvr.exe"= UDP:C:\windows\system32\dpnsvr.exe:Serveur Microsoft DirectPlay 8 "UDP Query User{59A8433A-1785-4A27-AC17-2E2412E1110A}C:\windows\system32\dpnsvr.exe"= TCP:C:\windows\system32\dpnsvr.exe:Serveur Microsoft DirectPlay 8 "TCP Query User{2395DCB8-6253-4551-AE0F-3A7006889658}C:\program files\codemasters\worms 4 mayhem\worms 4 mayhem.exe"= UDP:C:\program files\codemasters\worms 4 mayhem\worms 4 mayhem.exe:Worms 4 Mayhem "UDP Query User{5E134F99-A986-4A88-8786-3000C0ACEA78}C:\program files\codemasters\worms 4 mayhem\worms 4 mayhem.exe"= TCP:C:\program files\codemasters\worms 4 mayhem\worms 4 mayhem.exe:Worms 4 Mayhem "TCP Query User{8CB693D6-A8CE-42F8-A038-535B36683717}C:\program files\trackmania nations eswc\tmnationseswc.exe"= UDP:C:\program files rackmania nations eswc mnationseswc.exe:TmNationsESWC "UDP Query User{38D6F906-C58F-4B64-852A-B99543CF097D}C:\program files\trackmania nations eswc\tmnationseswc.exe"= TCP:C:\program files rackmania nations eswc mnationseswc.exe:TmNationsESWC "{24E3B5BF-E5AC-4430-AF66-BBA075F31D22}"= UDP:C:\Program Files\Warcraft III\Frozen Throne.exe:Warcraft III - The Frozen Throne "{3D0A14F5-1760-40D6-A1F8-7F2ACEF42530}"= TCP:C:\Program Files\Warcraft III\Frozen Throne.exe:Warcraft III - The Frozen Throne "TCP Query User{09FA9CD2-64D4-4C5A-A412-DEF58DDBBF1F}C:\program files\limewire\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire "UDP Query User{14D50DFC-4056-4E26-A43B-A2DDD65362DF}C:\program files\limewire\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire "{B4FE32BB-43C8-47AF-882A-1F7ED376DC33}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{6D7EF8BA-406B-498B-BD76-3BF3F54ACD72}"= UDP:4377:H4_4377_TCP "{661046D7-846A-41FF-BA4F-09EDF11AF06E}"= UDP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb "{257B1C6D-F537-4D7E-A96F-B67E1819594E}"= TCP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb "{147B8CF6-4754-4684-97BF-46487EEF0354}"= UDP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray "{F92AE674-A755-4E33-A8FD-29CEE08D927A}"= TCP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray "{4C3AFC98-E1C7-4DF0-BFB8-BD23B2768E5A}"= UDP:C:\Program Files\Winamp Remote\bin\OrbIR.exe:OrbIR "{75226A16-502B-4002-94A7-CE8299DD9CBF}"= TCP:C:\Program Files\Winamp Remote\bin\OrbIR.exe:OrbIR "{2406255A-46C6-4AAB-9F3F-130E58A6CD4E}"= UDP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client "{73BFB7C6-41F5-4728-8D87-35AAC0C19B00}"= TCP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client "{86F538DB-2279-43BB-902A-D118F9CBEC25}"= UDP:C:\Program Files\Diablo II\Diablo II.exe:Diablo II - Lord of Destruction "{39D35ABD-D3C7-4D5C-A042-F712804F4730}"= TCP:C:\Program Files\Diablo II\Diablo II.exe:Diablo II - Lord of Destruction "{1AA52F01-4CD9-40C2-9AD6-9488D13CBFCD}"= UDP:C:\Program Files\Metin2_France\metin2.exe:metin2 "{17C65EC1-655C-4B2E-B30A-93589BA3589D}"= TCP:C:\Program Files\Metin2_France\metin2.exe:metin2 "TCP Query User{65664738-28C3-4EAB-AB2C-B70E68588B70}C:\program files\teamspeak2_rc2\server_windows.exe"= UDP:C:\program files eamspeak2_rc2\server_windows.exe:Server "UDP Query User{E7E9A406-C4D7-41BF-8BF1-A15060AE257D}C:\program files\teamspeak2_rc2\server_windows.exe"= TCP:C:\program files eamspeak2_rc2\server_windows.exe:Server "{60C25528-AE63-48C6-A7C7-A81EF6A94630}"= UDP:C:\Program Files\Teamspeak2_RC2\TeamSpeak.exe:Teamspeak RC2 "{F91A0A54-0084-4909-AAEE-3B825188DF24}"= TCP:C:\Program Files\Teamspeak2_RC2\TeamSpeak.exe:Teamspeak RC2 "TCP Query User{4E36F86F-76F9-4502-A889-CCFAC4228CC7}C:\skype\phone\skype.exe"= UDP:C:\skype\phone\skype.exe:Skype "TCP Query User{745DA644-BAAA-402E-A58F-CEC014CB3432}C:\program files\metin2_france\metin2.bin"= UDP:C:\program files\metin2_france\metin2.bin:metin2.bin "UDP Query User{96DAEB0E-5DF9-44F7-A455-6E1848380577}C:\program files\metin2_france\metin2.bin"= TCP:C:\program files\metin2_france\metin2.bin:metin2.bin "{8E6B8276-37C6-4733-A7B2-65B6E79D65CC}"= UDP:C:\Program Files\GUILD WARS\Gw.exe:GUILD WARS "{0D9EA4F3-F864-4B74-B01D-C72FEFD2A06E}"= TCP:C:\Program Files\GUILD WARS\Gw.exe:GUILD WARS "TCP Query User{D34672FF-FBB7-4438-9088-E0EF131F68B2}C:\program files\glest_3.1.2\glest.exe"= UDP:C:\program files\glest_3.1.2\glest.exe:glest "UDP Query User{1BAB26A5-A2BF-4484-A848-409CC772EEA2}C:\program files\glest_3.1.2\glest.exe"= TCP:C:\program files\glest_3.1.2\glest.exe:glest "TCP Query User{0048870A-F567-4043-A360-21E845C6953A}C:\users\gaetan\c&c sdt\game.exe"= UDP:C:\users\gaetan\c&c sdt\game.exe:game.exe "UDP Query User{098608C5-B191-48B3-9F37-63A5F39ECAC7}C:\users\gaetan\c&c sdt\game.exe"= TCP:C:\users\gaetan\c&c sdt\game.exe:game.exe "{8A5F95CE-0D1A-4C9A-A4E6-CFA204948D49}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) R0 pavboot;pavboot;C:\Windows\system32\drivers\pavboot.sys [2008-06-19 28544] R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\system32\DRIVERS\klim6.sys [2007-01-25 20760] R1 SSHDRV52;SSHDRV52;C:\Windows\system32\drivers\SSHDRV52.sys [2007-10-02 29184] R1 SSHDRV85;SSHDRV85;C:\Windows\system32\drivers\SSHDRV85.sys [2007-12-05 78848] S3 ARCSOFTVIRTUALCAPTURE;Magic-i Virtual Driver;C:\Windows\system32\DRIVERS\ArcSoftVirtualCapture.sys [2006-12-07 17024] S3 PAC207;Webcam 1200;C:\Windows\system32\DRIVERS\PFC027.SYS [2007-06-29 611584] . Contenu du dossier 'Tâches planifiées' 2008-10-26 C:\Windows\Tasks\Extension de garantie.job - C:\Program Files\Packard Bell\SetupmyPC\PBCarNot.exe [2006-11-21 17:38] 2008-10-26 C:\Windows\Tasks\Recovery DVD Creator.job - C:\Program Files\Packard Bell\SetupMyPc\MCDCheck.exe [2006-11-21 17:34] 2008-10-25 C:\Windows\Tasks\User_Feed_Synchronization-{0A49DB88-7C7A-43BD-9A98-D3516BEAB586}.job - C:\Windows\system32\msfeedssync.exe [2008-01-19 08:33] . . ------- Examen supplémentaire ------- . FireFox -: Profile - C:\Users\gaetan\AppData\Roaming\Mozilla\Firefox\Profiles go1i7xo.default\ . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-26 21:30:02 Windows 6.0.6001 Service Pack 1 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . Heure de fin: 2008-10-26 21:31:32 ComboFix-quarantined-files.txt 2008-10-26 20:31:19 Avant-CF: 183 644 364 800 octets libres Après-CF: 183,669,374,976 octets libres 262 --- E O F --- 2008-10-25 10:26:58

gaetan · Answer

Alor le verdicte ????

eZula · Answer

Répond :

- depuis quand précisément tu as des pubs ?
- depuis quoi ?
- sous IE et aussi sous Firefox ?

Crée un nouveau document texte : clic droit de souris sur le bureau, "Nouveau"> "Document texte". Ouvre-le et copie-colle dedans ces lignes en italique :

netstat -abnov > netstat.txt
notepad netstat.txt
del netstat.txt

Dans le menu "fichier"/"enregistrer sous", sélectionne :
"Nom du fichier" : list.bat
"Type" : "tous les fichiers"
Clique ensuite sur "enregistrer".

double-clique dessus, le bloc-notes s'ouvre au bout de quelques instants. Copie et poste son contenu.

eZula · Answer

Et que te donne ce fichier sur VirusTotal C:\Program Files\ppcbooster\ppcbooster.exe ?

ne me demande pas comment on fait, tu as déjà effectué cette procédure

eZula · Answer

Vas sur ce site https://www.virustotal.com/gui/
Colle dans la case à gauche de "parcourir" :
C:\Program Files\ppcbooster\ppcbooster.exe
en cours de chargement ...mis en file d'attenteen attenteen cours d'analyse clique ensuite sur "Envoyer le fichier" puis patiente jusqu'à apparition du message "Situation actuelle: terminé " ; copie alors le rapport dans ta réponse.

gaetan · Answer

Bon voila le rapport

AhnLab-V3 2008.10.28.3 2008.10.29 - 
AntiVir 7.9.0.10 2008.10.29 HEUR/Malware 
Authentium 5.1.0.4 2008.10.29 - 
Avast 4.8.1248.0 2008.10.28 - 
AVG 8.0.0.161 2008.10.29 - 
BitDefender 7.2 2008.10.29 - 
CAT-QuickHeal 9.50 2008.10.29 - 
ClamAV 0.93.1 2008.10.29 - 
DrWeb 4.44.0.09170 2008.10.29 - 
eSafe 7.0.17.0 2008.10.29 - 
eTrust-Vet 31.6.6179 2008.10.29 - 
Ewido 4.0 2008.10.29 - 
F-Prot 4.4.4.56 2008.10.29 - 
F-Secure 8.0.14332.0 2008.10.29 - 
Fortinet 3.117.0.0 2008.10.28 - 
GData 19 2008.10.29 - 
Ikarus T3.1.1.44.0 2008.10.29 - 
K7AntiVirus 7.10.511 2008.10.29 - 
Kaspersky 7.0.0.125 2008.10.29 - 
McAfee 5417 2008.10.28 - 
Microsoft 1.4005 2008.10.29 - 
NOD32 3566 2008.10.29 - 
Norman 5.80.02 2008.10.29 - 
Panda 9.0.0.4 2008.10.29 - 
PCTools 4.4.2.0 2008.10.29 - 
Prevx1 V2 2008.10.29 - 
Rising 21.01.22.00 2008.10.29 - 
SecureWeb-Gateway 6.7.6 2008.10.29 Heuristic.Malware 
Sophos 4.35.0 2008.10.29 - 
Sunbelt 3.1.1762.1 2008.10.28 - 
Symantec 10 2008.10.29 - 
TheHacker 6.3.1.1.133 2008.10.28 - 
TrendMicro 8.700.0.1004 2008.10.29 - 
VBA32 3.12.8.8 2008.10.28 - 
ViRobot 2008.10.29.1443 2008.10.29 - 
VirusBuster 4.5.11.0 2008.10.28 - 
Information additionnelle 
File size: 20480 bytes 
MD5...: 99014a34b2a8b46c190c7cb943ad8dcd 
SHA1..: 43144f2331bc11d9df4ee03cbaaacd93aff84c56 
SHA256: 75b6c501fc80bd6f4e98512e7cd2ca5b74640da0cf40e8f6666a8a751da1d6a5 
SHA512: 1c66ebe1cb30e17a1ab3daddee33b3e96b723a437dc430a552e7abf1ae26c778
06ede0536fb23650c2e6e41a295ffa8b1549fea4b3992a2c2b296a4e4864948b 
PEiD..: - 
TrID..: File type identification
Win32 Executable Microsoft Visual Basic 6 (96.9%)
Generic Win/DOS Executable (1.5%)
DOS Executable Generic (1.5%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) 
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x401330
timedatestamp.....: 0x48ecc4fb (Wed Oct 08 14:34:35 2008)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x1fb8 0x2000 5.32 891c5893d47255e4d10570e588c7953a
.data 0x3000 0xa14 0x1000 0.00 620f0b67a91f7f74151bc5be745b7110
.rsrc 0x4000 0x8e0 0x1000 1.90 32736490cb941d7c86f1d2c33e0dd0c4

( 1 imports ) 
> MSVBVM60.DLL: _CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, _adj_fdiv_m64, _adj_fprem1, __vbaStrCat, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaOnError, __vbaObjSet, _adj_fdiv_m16i, _adj_fdivr_m16i, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaObjVar, DllFunctionCall, _adj_fpatan, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, __vbaStrToUnicode, -, _adj_fprem, _adj_fdivr_m64, -, __vbaFPException, __vbaStrVarVal, _CIlog, __vbaErrorOverflow, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, -, __vbaVarSetVar, __vbaI4Var, __vbaLateMemCall, __vbaStrToAnsi, __vbaVarCopy, -, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj

( 0 exports )

eZula · Answer

Ce n'est pas très convaincant mais on peut toujours essayer : lance HijackThis en cliquant sur "do a system scan only" et coche ces lignes (uniquement ces lignes) si tu les trouves encore :

O4 - Startup: ppcbooster.lnk = C:\Program Files\ppcbooster\ppcbooster.exe 

- Ferme toutes les fenêtres, applications, messagerie... et clique sur "fix checked". Valide, puis quitte HijackThis.

ensuite redémarre ton ordinateur et regarde si tu as tjs des pubs

eZula · Answer

c'est donc cette saloperie de ppcbooster qui envoyait des pubs depuis le début ?

ça a l'air d'être le cas, ne te prive surtout pas de supprimer le répertoire C:\Program Files\ppcbooster

ENCORE DES FENETRE POP-UP

62 réponses

Votre réponse

Discussions similaires

Newsletters