ordi tres lentFermé

Question

Bonjour,
Je trouve que mon ordi est tres lent. Pouvez-vous m'aider a le fixer?
Voici le rapport de hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:14:14 PM, on 11/3/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\ScsiAccess.EXE
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\mqsvc.exe
C:\WINDOWS\System32\mqtgsvc.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Browser Mouse\mouse32a.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Muiltmedia keyboard utility\1.1\KbdAp32A.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Support.com\bin	gcmd.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/sbcydsl/*https://fr.yahoo.com/?p=us
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/?p=us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*https://fr.yahoo.com/?p=us
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: (no name) - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - (no file)
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Browser Mouse\mouse32a.exe
O4 - HKLM\..\Run: [FLMK08KB] C:\Program Files\Muiltmedia keyboard utility\1.1\MMKEYBD.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [tgcmd] C:\Program Files\Support.com\bin	gcmd.exe /server /startmonitor /deaf
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [System Soap Pro] C:\PROGRA~1\SYSTEM~1\soap.exe min
O4 - HKCU\..\Run: [HBt9RTH3W] clsaysvr.exe
O4 - HKCU\..\Run: [ufqz] C:\PROGRA~1\COMMON~1\ufqz\ufqzm.exe
O4 - HKCU\..\Run: [SRS Audio Sandbox] "C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe" /hideme
O4 - HKCU\..\Run: [VoipStunt] "C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe" -nosplash -minimized
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Download with Go!Zilla - file://C:\PROGRA~1\Go!Zilla\download-with-gozilla.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O15 - Trusted Zone: http://www.listen.com
O15 - Trusted Zone: https://us.napster.com/
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://kazaliou.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {50647AB5-18FD-4142-82B0-5852478DD0D5} (Keynote Connector Launcher 2) - http://webeffective.keynote.com/applications/pconnector/download/ConnectorLauncher.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/webplayer/stage6/windows/AutoDLDivXWebPlayerInstaller.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\system32\ScsiAccess.EXE

geoffrey5 · Answer

Salut !!

&#x25B6; Télécharge Toolbar-S&D (de Team IDN) sur ton Bureau

(c est le numéro 6 en bas de la page) :  
 

&#x25B6; Lance l'installation du programme en exécutant le fichier téléchargé. 
&#x25B6; Double-clique maintenant sur le raccourci de Toolbar-S&D. 
&#x25B6; Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée. 
&#x25B6; Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche. 
&#x25B6; Poste le rapport généré. (C:\TB.txt)

grandtoure · Answer

-----------\  ToolBar S&D 1.2.4   XP/Vista

   Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Uniprocessor Free : AMD Duron(tm) processor )
   BIOS : Award Modular BIOS v6.00PG
   USER : Owner ( Administrator )
   BOOT : Normal boot
   Antivirus : McAfee VirusScan  (Activated)
   Firewall  : McAfee Personal Firewall  (Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:37 Go (Free:20 Go)
   D:\ (CD or DVD)
   E:\ (CD or DVD)
   F:\ (USB)

   "C:\ToolBar SD" ( MAJ : 27-10-2008|09:25 )
   Option : [1] ( Mon 11/03/2008|16:28 )

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="https://fr.yahoo.com/?p=us"
   "Search Page"="http://red.clientapps.yahoo.com/customize/ie/defaults/sp/sbcydsl/*https://fr.yahoo.com/?p=us"
   "Search Bar"="http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html"
   "SearchMigratedDefaultURL"="https://search.yahoo.com/web{searchTerms}&ei=utf-8&fr=b1ie7"
   "Url"="http://www.microsoft.com/atwork/community/rss.xml"
   "Url"="http://www.microsoft.com/athome/community/rss.xml"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Search Bar"="http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html"
   "SearchAssistant"="https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm"


   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !


   1 - "C:\ToolBar SD\TB_1.txt" - Mon 11/03/2008|16:34 - Option : [1]

   -----------\  Fin du rapport a 16:34:01.41

geoffrey5 · Answer

euh... C est un rapport du mois de Mars ça  mdr


1 - "C:\ToolBar SD\TB_1.txt" - Mon 11/03/2008|16:34 - Option : [1]

-----------\ Fin du rapport a 16:34:01.41

grandtoure · Answer

non pas du tout. Je viens tout juste de faire la recherche. Je suis aux usa et ici c est comme ca qu'il marque la date.(mois/jour/annee)

geoffrey5 · Answer

ah ok  lol

&#x25B6; Télécharge malwarebytes 
 
&#x25B6; Voici mon tuto pour bien l installer et bien l utiliser : 

https://www.androidworld.fr/

aide toi bien du tuto pour supprimer correctement ce qu il aura trouvé
 

Après l analyse, redémarre le pc et poste le rapport !!

Et refais un nouveau rapport hijackthis stp

grandtoure · Answer

Malwarebytes' Anti-Malware 1.30
Database version: 1360
Windows 5.1.2600 Service Pack 2

11/4/2008 12:43:46 PM
mbam-log-2008-11-04 (12-43-45).txt

Scan type: Full Scan (C:\|F:\|)
Objects scanned: 103764
Time elapsed: 1 hour(s), 39 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:46:36 PM, on 11/4/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\ScsiAccess.EXE
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\mqsvc.exe
C:\WINDOWS\System32\mqtgsvc.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Browser Mouse\mouse32a.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Muiltmedia keyboard utility\1.1\KbdAp32A.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Support.com\bin	gcmd.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/sbcydsl/*https://fr.yahoo.com/?p=us
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/?p=us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*https://fr.yahoo.com/?p=us
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: (no name) - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - (no file)
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Browser Mouse\mouse32a.exe
O4 - HKLM\..\Run: [FLMK08KB] C:\Program Files\Muiltmedia keyboard utility\1.1\MMKEYBD.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [tgcmd] C:\Program Files\Support.com\bin	gcmd.exe /server /startmonitor /deaf
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [System Soap Pro] C:\PROGRA~1\SYSTEM~1\soap.exe min
O4 - HKCU\..\Run: [HBt9RTH3W] clsaysvr.exe
O4 - HKCU\..\Run: [ufqz] C:\PROGRA~1\COMMON~1\ufqz\ufqzm.exe
O4 - HKCU\..\Run: [SRS Audio Sandbox] "C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe" /hideme
O4 - HKCU\..\Run: [VoipStunt] "C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe" -nosplash -minimized
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Download with Go!Zilla - file://C:\PROGRA~1\Go!Zilla\download-with-gozilla.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O15 - Trusted Zone: http://www.listen.com
O15 - Trusted Zone: https://us.napster.com/
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://kazaliou.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {50647AB5-18FD-4142-82B0-5852478DD0D5} (Keynote Connector Launcher 2) - http://webeffective.keynote.com/applications/pconnector/download/ConnectorLauncher.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/webplayer/stage6/windows/AutoDLDivXWebPlayerInstaller.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\system32\ScsiAccess.EXE

grandtoure · Answer

J'ai delete tout ce qui se trouvait dans la quarantaine de malwarebite

geoffrey5 · Answer

Salut !!

&#x25B6; Télécharger et enregistrer lopSD sur le Bureau 
 
&#x25B6; Double-clic Lop S&D
 
&#x25B6; Faire l'installation 

&#x25B6; Fermer toutes les applications 

&#x25B6; Le lancer par un double-clic sur le raccourci qui est sur le bureau 
Avec VISTA => clic-droit et => Exécuter en tant qu'administrateur
 
&#x25B6; Taper F pour français , puis presser entrée 

&#x25B6; Taper 1 

&#x25B6; Presser Entrée 

&#x25B6; Le PC va redémarrer 
Note= si l'antivirus annonce une infection dans TEMP , l'ignorer
 
&#x25B6; Attendre l'apparition du rapport 
&#x25B6; Copier le rapport et le coller dans la réponse 
le rapport se trouve aussi à C:\lopR

grandtoure · Answer

--------------------\ Lop S&D 4.2.4-9c XP/Vista Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 2 X86-based PC ( Uniprocessor Free : AMD Duron(tm) processor ) BIOS : Award Modular BIOS v6.00PG USER : Owner ( Administrator ) BOOT : Normal boot Antivirus : McAfee VirusScan (Activated) Firewall : McAfee Personal Firewall (Activated) A:\ (USB) C:\ (Local Disk) - NTFS - Total:37 Go (Free:20 Go) D:\ (CD or DVD) E:\ (CD or DVD) "C:\Lop SD" ( MAJ : 01-11-2008|16:30 ) Option : [1] ( Wed 11/05/2008|12:34 ) --------------------\ Listing des dossiers dans APPLIC~1 [06/15/2007|05:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Adobe [01/08/2007|11:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Ahead [02/26/2005|10:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ AOL [01/10/2005|10:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ AOL Downloads [02/13/2008|12:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple [02/18/2008|02:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple Computer [05/14/2004|11:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Broderbund [12/20/2004|05:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Broderbund LLC [01/10/2007|03:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ CA [02/08/2005|08:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ CyberLink [01/27/2005|03:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ GTek [12/13/2006|01:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ HP [01/26/2005|10:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Kodak [10/10/2008|01:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Malwarebytes [05/12/2007|11:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ McAfee [12/12/2006|01:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Microsoft [11/17/2007|03:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Microsoft Help [01/10/2007|03:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Motive [05/14/2004|06:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ MSN6 [02/08/2007|03:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ NVIDIA Corporation [01/10/2005|11:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Pure Networks [01/13/2005|06:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ QuickTime [12/11/2007|05:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Skype [12/13/2006|12:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Sonic [03/22/2007|11:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SRS Labs [05/11/2007|06:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Support.com [05/11/2007|04:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Symantec [03/21/2005|10:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Viewpoint [05/11/2007|04:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Visual Networks [10/29/2005|04:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Windows Genuine Advantage [01/10/2007|03:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Yahoo [04/11/2007|10:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Yahoo! [05/14/2004|02:35] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Microsoft [10/29/2005|05:38] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Microsoft [02/08/2005|09:49] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Microsoft [04/15/2005|01:29] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Symantec [02/13/2008|05:29] C:\DOCUME~1\Owner\APPLIC~1\ Adobe [02/10/2007|07:19] C:\DOCUME~1\Owner\APPLIC~1\ AdobeUM [12/20/2006|12:37] C:\DOCUME~1\Owner\APPLIC~1\ Ahead [01/11/2005|01:13] C:\DOCUME~1\Owner\APPLIC~1\ Aim [02/26/2005|10:32] C:\DOCUME~1\Owner\APPLIC~1\ AOL [03/26/2008|07:10] C:\DOCUME~1\Owner\APPLIC~1\ Apple Computer [05/14/2004|11:51] C:\DOCUME~1\Owner\APPLIC~1\ Broderbund [02/08/2005|08:57] C:\DOCUME~1\Owner\APPLIC~1\ CyberLink [10/30/2005|01:46] C:\DOCUME~1\Owner\APPLIC~1\ Exodus [01/28/2005|04:29] C:\DOCUME~1\Owner\APPLIC~1\ GTek [01/08/2005|05:08] C:\DOCUME~1\Owner\APPLIC~1\ Help [12/13/2006|01:26] C:\DOCUME~1\Owner\APPLIC~1\ HP [05/14/2004|02:43] C:\DOCUME~1\Owner\APPLIC~1\ Identities [09/10/2007|12:52] C:\DOCUME~1\Owner\APPLIC~1\ ivivo [10/04/2007|01:13] C:\DOCUME~1\Owner\APPLIC~1\ Keynote Systems [05/14/2004|11:43] C:\DOCUME~1\Owner\APPLIC~1\ Leadertech [05/21/2004|02:26] C:\DOCUME~1\Owner\APPLIC~1\ Macromedia [10/10/2008|01:03] C:\DOCUME~1\Owner\APPLIC~1\ Malwarebytes [08/18/2007|04:29] C:\DOCUME~1\Owner\APPLIC~1\ Microsoft [03/20/2007|02:00] C:\DOCUME~1\Owner\APPLIC~1\ Motive [04/11/2008|04:40] C:\DOCUME~1\Owner\APPLIC~1\ Mozilla [01/28/2005|04:28] C:\DOCUME~1\Owner\APPLIC~1\ MSN6 [01/23/2005|04:56] C:\DOCUME~1\Owner\APPLIC~1\ NeroVision [11/12/2007|04:46] C:\DOCUME~1\Owner\APPLIC~1\ Real [06/15/2007|12:16] C:\DOCUME~1\Owner\APPLIC~1\ Skype [12/12/2004|05:45] C:\DOCUME~1\Owner\APPLIC~1\ Symantec [04/11/2008|04:41] C:\DOCUME~1\Owner\APPLIC~1\ Talkback [10/25/2008|12:39] C:\DOCUME~1\Owner\APPLIC~1\ VoipStunt [11/03/2008|03:11] C:\DOCUME~1\Owner\APPLIC~1\ WinRAR [12/19/2005|05:05] C:\DOCUME~1\Owner\APPLIC~1\ yahoo! [02/16/2005|04:38] C:\DOCUME~1\Owner\APPLIC~1\ Yahoo! Messenger [01/10/2005|11:04] C:\DOCUME~1\Owner\APPLIC~1\ You've Got Pictures Screensaver --------------------\ Tâches planifiées dans C:\WINDOWS asks [10/30/2008 12:39 PM][--a------] C:\WINDOWS asks\AppleSoftwareUpdate.job [10/15/2008 01:05 AM][--a------] C:\WINDOWS asks\McDefragTask.job [04/01/2008 01:00 AM][--a------] C:\WINDOWS asks\McQcTask.job [11/03/2008 03:14 PM][--ah-----] C:\WINDOWS asks\SA.DAT [08/23/2001 07:00 AM][-r-h-----] C:\WINDOWS asks\desktop.ini --------------------\ Listing des dossiers dans C:\Program Files [06/19/2007|11:09] C:\Program Files\ Adobe [02/08/2007|03:06] C:\Program Files\ Ahead [10/24/2008|12:06] C:\Program Files\ Apple Software Update [07/14/2007|08:17] C:\Program Files\ ASIO4ALL v2 [05/11/2007|04:32] C:\Program Files\ BroadJump [05/14/2004|11:50] C:\Program Files\ Broderbund [02/26/2005|10:25] C:\Program Files\ Browser Mouse [02/08/2007|02:56] C:\Program Files\ Cliprex DVD Player Professional [05/09/2008|12:51] C:\Program Files\ Common Files [02/08/2005|08:54] C:\Program Files\ CyberLink [09/29/2007|12:54] C:\Program Files\ DivineIslam [12/11/2007|05:16] C:\Program Files\ DivX [05/14/2004|11:42] C:\Program Files\ Executive Software [02/21/2006|08:35] C:\Program Files\ fsupport [12/13/2006|12:28] C:\Program Files\ Hewlett-Packard [05/14/2004|11:21] C:\Program Files\ HighMAT CD Writing Wizard [10/17/2007|06:15] C:\Program Files\ HP [01/10/2007|03:05] C:\Program Files\ illiminable [12/15/2007|11:49] C:\Program Files\ Image-Line [11/17/2007|03:45] C:\Program Files\ InstallShield Installation Information [10/15/2008|05:27] C:\Program Files\ Internet Explorer [04/04/2008|03:26] C:\Program Files\ iPod [04/04/2008|03:27] C:\Program Files\ iTunes [01/26/2005|10:38] C:\Program Files\ Kodak [11/03/2008|04:58] C:\Program Files\ Malwarebytes' Anti-Malware [08/07/2007|06:15] C:\Program Files\ MARS [10/10/2008|04:01] C:\Program Files\ McAfee [05/12/2007|11:17] C:\Program Files\ McAfee.com [10/10/2008|05:19] C:\Program Files\ Messenger [02/26/2005|10:25] C:\Program Files\ Microsoft ActiveSync [05/11/2007|05:04] C:\Program Files\ Microsoft CAPICOM 2.1.0.2 [05/14/2004|02:36] C:\Program Files\ microsoft frontpage [11/17/2007|04:01] C:\Program Files\ Microsoft Office [05/14/2004|12:54] C:\Program Files\ Microsoft Visual Studio [11/17/2007|04:01] C:\Program Files\ Microsoft Works [05/14/2004|12:53] C:\Program Files\ Microsoft.NET [01/26/2005|10:57] C:\Program Files\ Movie Maker [11/04/2008|07:27] C:\Program Files\ Mozilla Firefox [02/26/2005|10:25] C:\Program Files\ MSN [11/02/2005|07:34] C:\Program Files\ MSN Apps [05/14/2004|02:30] C:\Program Files\ MSN Gaming Zone [04/27/2007|04:38] C:\Program Files\ MSN Messenger [02/07/2005|10:58] C:\Program Files\ Muiltmedia keyboard utility [11/03/2008|01:29] C:\Program Files\ Navilog1 [01/29/2007|03:56] C:\Program Files\ NetMeeting [05/11/2007|04:52] C:\Program Files\ Norton SystemWorks [02/26/2005|10:25] C:\Program Files\ OfficeUpdate11 [05/14/2004|02:34] C:\Program Files\ Online Services [06/15/2007|11:53] C:\Program Files\ Outlook Express [10/29/2005|03:50] C:\Program Files\ PeerCast [01/14/2005|03:23] C:\Program Files\ Pure Networks [04/04/2008|03:14] C:\Program Files\ QuickTime [11/29/2007|02:36] C:\Program Files\ Real [03/26/2008|11:31] C:\Program Files\ Safari [03/20/2007|02:01] C:\Program Files\ SBC Self Support Tool [05/21/2007|02:19] C:\Program Files\ Support.com [10/10/2008|12:13] C:\Program Files\ Trend Micro [02/13/2005|04:53] C:\Program Files\ Visual Networks [10/25/2008|12:34] C:\Program Files\ VoipStunt.com [07/16/2007|11:02] C:\Program Files\ VstPlugins [05/14/2004|11:27] C:\Program Files\ Windows Journal Viewer [01/11/2007|06:54] C:\Program Files\ Windows Media Connect [11/13/2007|05:38] C:\Program Files\ Windows Media Connect 2 [11/19/2007|11:57] C:\Program Files\ Windows Media Player [01/26/2005|10:44] C:\Program Files\ Windows NT [06/19/2007|11:18] C:\Program Files\ WindowsUpdate [11/03/2008|03:10] C:\Program Files\ WinRAR [04/26/2007|02:51] C:\Program Files\ WriteExpress [05/14/2004|02:36] C:\Program Files\ xerox --------------------\ Listing des dossiers dans C:\Program Files\Common Files [06/19/2007|11:08] C:\Program Files\Common Files\ Adobe [02/08/2007|03:05] C:\Program Files\Common Files\ Ahead [02/18/2008|02:33] C:\Program Files\Common Files\ Apple [05/14/2004|12:54] C:\Program Files\Common Files\ DESIGNER [12/13/2006|12:22] C:\Program Files\Common Files\ Hewlett-Packard [01/12/2007|02:06] C:\Program Files\Common Files\ HP [04/26/2007|02:48] C:\Program Files\Common Files\ InstallShield [01/26/2005|10:37] C:\Program Files\Common Files\ Kodak [05/14/2004|12:57] C:\Program Files\Common Files\ L&H [12/12/2006|01:19] C:\Program Files\Common Files\ Logitech [10/10/2008|02:03] C:\Program Files\Common Files\ McAfee [03/06/2008|11:37] C:\Program Files\Common Files\ Microsoft Shared [03/20/2007|02:01] C:\Program Files\Common Files\ Motive [05/14/2004|02:32] C:\Program Files\Common Files\ MSSoap [10/31/2005|06:18] C:\Program Files\Common Files\ ODBC [05/09/2008|12:46] C:\Program Files\Common Files\ Real [05/11/2007|04:28] C:\Program Files\Common Files\ Scanner [05/14/2004|02:32] C:\Program Files\Common Files\ Services [12/31/2000|08:12] C:\Program Files\Common Files\ SpeechEngines [02/21/2006|08:38] C:\Program Files\Common Files\ SWF Studio [05/11/2007|08:42] C:\Program Files\Common Files\ Symantec Shared [06/15/2007|11:53] C:\Program Files\Common Files\ System [05/09/2008|12:51] C:\Program Files\Common Files\ xing shared --------------------\ Process ( 56 Processes ) ... OK ! --------------------\ Recherche avec S_Lop Aucun fichier / dossier Lop trouvé ! --------------------\ Recherche de Fichiers / Dossiers Lop Aucun fichier / dossier Lop trouvé ! --------------------\ Verification du Registre ..... OK ! --------------------\ Verification du fichier Hosts Fichier Hosts PROPRE --------------------\ Recherche de fichiers avec Catchme catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-05 12:44:42 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden files: 4 --------------------\ Recherche d'autres infections Aucune autre infection trouvée ! [F:56][D:5]-> C:\DOCUME~1\Owner\LOCALS~1\Temp [F:47][D:0]-> C:\DOCUME~1\Owner\Cookies [F:532][D:45]-> C:\DOCUME~1\Owner\LOCALS~1\TEMPOR~1\content.IE5 1 - "C:\Lop SD\LopR_1.txt" - Wed 11/05/2008|12:51 - Option : [1] --------------------\ Fin du rapport a 12:51:13

geoffrey5 · Answer

Salut !!

rien dans le rapport de lopSD...

Option 1 - Recherche :


&#x25B6; télécharge smitfraudfix et enregistre le sur le bureau 
 
&#x25B6; Ensuite double clique sur smitfraudfix puis exécuter

&#x25B6; Sélectionner 1 pour créer un rapport des fichiers responsables de l'infection.

(attention : N utilises pas l option 2 si je ne te l ai pas demandé !!)

&#x25B6; copier/coller le rapport dans la réponse.


Voici un tutoriel sonore et animé en cas de problème d'utilisation



(Attention : "process.exe", un composant de l'outil, est détecté par certains antivirus comme étant un "RiskTool". 
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, 
cet utilitaire pourrait arrêter des logiciels de sécurité.)

grandtoure · Answer

SmitFraudFix v2.371

Scan done at 13:12:37.82, Wed 11/05/2008
Run from C:\Program Files\Mozilla Firefox\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\ScsiAccess.EXE
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\mqsvc.exe
C:\WINDOWS\System32\mqtgsvc.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Browser Mouse\mouse32a.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Muiltmedia keyboard utility\1.1\KbdAp32A.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Support.com\bin	gcmd.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Owner


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Owner\LOCALS~1\Temp


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Owner\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Owner\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
 

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, following keys are not inevitably infected!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, following keys are not inevitably infected!!!

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: ADMtek AN983 based ethernet adapter - Packet Scheduler Miniport
DNS Server Search Order: 192.168.0.1
DNS Server Search Order: 192.168.0.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{719099A9-4C71-4995-8E27-3C6BDBF1F7E2}: DhcpNameServer=192.168.0.1 192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{719099A9-4C71-4995-8E27-3C6BDBF1F7E2}: DhcpNameServer=192.168.0.1 192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{719099A9-4C71-4995-8E27-3C6BDBF1F7E2}: DhcpNameServer=192.168.0.1 192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1 192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1 192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1 192.168.0.1


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

grandtoure · Answer

etes vous toujours la?

geoffrey5 · Answer

Salut !!

&#x25B6; Télécharge a-squared free 3.5

&#x25B6; Voici un tutoriel pour bien l utiliser.

&#x25B6; fais la mise à jour et une analyse complète.

&#x25B6; poste le rapport stp

grandtoure · Answer

a-squared Free - Version 3.5
Last update: 11/6/2008 7:55:52 PM

Scan settings:

Objects: Memory, Traces, Cookies, C:\
Scan archives: On
Heuristics: On
ADS Scan: On

Scan start:	11/7/2008 1:09:08 PM

c:\program files\cliprex dvd player professional 	detected: Trace.Directory.Cliprex DVD Player Professional!A2
c:\program files\partygaming 	detected: Trace.Directory.PartyPoker!A2
c:\program files\partygaming\partycasino 	detected: Trace.Directory.PartyPoker!A2
c:\program files\partygaming\partycasino\language 	detected: Trace.Directory.PartyPoker!A2
c:\program files\partygaming\partycasino\language\en_us 	detected: Trace.Directory.PartyPoker!A2
c:\program files\partygaming\partycasino\language\en_us\images 	detected: Trace.Directory.PartyPoker!A2
c:\program files\partygaming\partycasino\language\en_us\images\games 	detected: Trace.Directory.PartyPoker!A2
c:\program files\partygaming\partycasino\language\en_us\images\games\cardgames 	detected: Trace.Directory.PartyPoker!A2
c:\program files\partygaming\partycasino\language\en_us\images\games\cardgames\blackjack 	detected: Trace.Directory.PartyPoker!A2
c:\program files\partygaming\partycasino\language\en_us\images\games\cardgames\blackjack\blackjack 	detected: Trace.Directory.PartyPoker!A2
c:\program files\partygaming\partycasino\language\en_us\images\games\cardgames\multiplayerbj 	detected: Trace.Directory.PartyPoker!A2
c:\program files\partygaming\partycasino\language\en_us\images\games\cardgames\multiplayerbj\multiplayerblackjack 	detected: Trace.Directory.PartyPoker!A2
c:\program files\partygaming\partypoker 	detected: Trace.Directory.PartyPoker!A2
c:\program files\partygaming\partypoker\language 	detected: Trace.Directory.PartyPoker!A2
c:\program files\partygaming\partypoker\language\en_us 	detected: Trace.Directory.PartyPoker!A2
c:\program files\partygaming\partypoker\language\en_us\articles 	detected: Trace.Directory.PartyPoker!A2
c:\poker	itan poker 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data\blackjack 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data\lobby 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data\lobby\buttons 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data\lobby\dialogs 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data\lobby\login 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data\lobby\sidegames 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data\lobby	ables 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data\lobby\waitinglist 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data\shared 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data\shared\buttons 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data\shared\history 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data\shared\history\cards 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data\shared\html 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data\shared\html\chat 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data\shared\html\chat\emoticons 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data\shared\sounds 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data\shared\sounds\playersounds 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data\shared\sounds\playersounds\baseballer 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data\shared\sounds\playersounds\blackdude 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data\shared\sounds\playersounds\bond 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data\shared\sounds\playersounds\cowboy 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data\shared\sounds\playersounds\frenchgirl 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data\shared\sounds\playersounds\frenchman 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data\shared\sounds\playersounds\mafiaguy 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data\shared\sounds\playersounds\olderbusinesswoman 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data\shared\sounds\playersounds\oldtourist 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data\shared\sounds\playersounds\valleygirl 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data	able 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data	able\smallview 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data	able\smallview\chat 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data	able	opview 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data	able	opview\anim 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data	able	opview\avatars 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data	able	opview\buttons 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data	able	opview\cards 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data	able	opview\chat 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data	able	opview\chat\chat_bottom 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data	able	opview\chat\chat_side 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data	able	opview\coins 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data	able	opview\dialogs 	detected: Trace.Directory.Titan Poker!A2
c:\poker	itan poker\data	able	opview\history 	detected: Trace.Directory.Titan Poker!A2
c:\documents and settings\all users\start menu\programs	itan poker 	detected: Trace.Directory.Titan Poker!A2
c:\documents and settings\owner\application data\microsoft\internet explorer\quick launch	itan poker.lnk 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\_setuppoker.exe 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\cactivex.dll 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\casino.exe 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\casino.hlp 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\casino.ico 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data\blackjack.dll 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data\blackjack.gam 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data\cashier.dll 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data\cashier.gam 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data\common.dll 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data\common.gam 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data\loader.dll 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data\loader.gam 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data\poker_common.dll 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data\poker_common.gam 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data\poker_lobby.dll 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data\poker_lobby.gam 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data\poker_table.dll 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data\shared\bubble_lobby.jpg 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data\shared\bubble_lobby-alpha.jpg 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data\shared\html\cashier_offline.css 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data\shared\html\cashier_offline.js 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data\shared\html\cashier_offline_functions.js 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data\shared\html\cashier_offline_poker.html 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data\shared\html\chat\chat.html 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data\shared\html\chat\colors.html 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data\shared\html\chat\edit.html 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data\shared\html\chat\emoticons.html 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data	able\smallview\chat\chat.html 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data	able	opview\cards\card.lwo 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data	able	opview\chat\chat.html 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data	able	opview\chat\chat_options_back.jpg 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data	able	opview\chat\send.jpg 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data	able	opview\coins\coins.bmp 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data	able	opview\coins\coins-alpha.bmp 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data	able	opview\coins\dealer.jpg 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data	able	opview\coins\dealer-alpha.jpg 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\data	opview.gam 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\directsounddriver.dll 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\fileinfo.dat 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\fileinfo2.dat 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\fileinfo2r.dat 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\gdigraphdriver.dll 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\ptsetup.lang 	detected: Trace.File.Titan Poker!A2
c:\poker	itan poker\ptsetup.log 	detected: Trace.File.Titan Poker!A2
c:\poker	itan pokereplace.exe 	detected: Trace.File.Titan Poker!A2
c:\documents and settings\all users\start menu\programs	itan poker	itan poker.lnk 	detected: Trace.File.Titan Poker!A2
c:\documents and settings\all users\start menu\programs	itan poker\uninstall titan poker.lnk 	detected: Trace.File.Titan Poker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\PartyGaming\PartyPoker --> 1 	detected: Trace.Registry.PartyPoker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\PartyGaming\PartyPoker --> 10 	detected: Trace.Registry.PartyPoker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\PartyGaming\PartyPoker --> 2 	detected: Trace.Registry.PartyPoker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\PartyGaming\PartyPoker --> 4 	detected: Trace.Registry.PartyPoker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\PartyGaming\PartyPoker --> 5 	detected: Trace.Registry.PartyPoker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\PartyGaming\PartyPoker --> 6 	detected: Trace.Registry.PartyPoker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\PartyGaming\PartyPoker --> 7 	detected: Trace.Registry.PartyPoker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\PartyGaming\PartyPoker --> 9 	detected: Trace.Registry.PartyPoker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\PartyGaming\PartyPoker --> AdsLastKnownState 	detected: Trace.Registry.PartyPoker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\PartyGaming\PartyPoker --> AppPath 	detected: Trace.Registry.PartyPoker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\PartyGaming\PartyPoker --> id 	detected: Trace.Registry.PartyPoker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\PartyGaming\PartyPoker --> InitialPort 	detected: Trace.Registry.PartyPoker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\PartyGaming\PartyPoker --> InstallState 	detected: Trace.Registry.PartyPoker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\PartyGaming\PartyPoker --> SL 	detected: Trace.Registry.PartyPoker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\PartyGaming\PartyPoker --> TableType 	detected: Trace.Registry.PartyPoker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\PartyGaming\PartyPoker --> useCount 	detected: Trace.Registry.PartyPoker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\PartyGaming --> AutoLoginToOtherGames 	detected: Trace.Registry.PartyPoker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\PartyGaming --> CFDialogShown 	detected: Trace.Registry.PartyPoker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\PartyGaming --> FreshInstall 	detected: Trace.Registry.PartyPoker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\PartyGaming --> OldCFformat 	detected: Trace.Registry.PartyPoker!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} --> ButtonText 	detected: Trace.Registry.PartyPoker!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} --> CLSID 	detected: Trace.Registry.PartyPoker!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} --> Default Visible 	detected: Trace.Registry.PartyPoker!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} --> Exec 	detected: Trace.Registry.PartyPoker!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} --> HotIcon 	detected: Trace.Registry.PartyPoker!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} --> Icon 	detected: Trace.Registry.PartyPoker!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} --> MenuStatusBar 	detected: Trace.Registry.PartyPoker!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} --> MenuText 	detected: Trace.Registry.PartyPoker!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} --> Path 	detected: Trace.Registry.PartyPoker!A2
Key: HKEY_LOCAL_MACHINE\software\system soap 	detected: Trace.Registry.SystemSoapPro
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\Titan Poker --> global_login_hint 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\Titan Poker --> options_dealervoices 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\Titan Poker --> options_music 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\Titan Poker --> options_poker_avatar_num 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\Titan Poker --> options_poker_filter_empty 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\Titan Poker --> options_poker_filter_finished 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\Titan Poker --> options_poker_filter_full 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\Titan Poker --> options_poker_filter_inprogress 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\Titan Poker --> options_poker_showsidegames 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\Titan Poker --> options_poker_smallview 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\Titan Poker --> options_sounds 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\Titan Poker --> options_xlslots 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\Titan Poker --> options-fullscreen 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\Titan Poker --> options-volume 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\Titan Poker --> poker_login_type 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\Titan Poker --> poker_nickname 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\Titan Poker --> ptdevm 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\Titan Poker --> tribeca_playernotes 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\Titan Poker --> username 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{49783ED4-258D-4f9f-BE11-137C18D3E543} --> ButtonText 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{49783ED4-258D-4f9f-BE11-137C18D3E543} --> CLSID 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{49783ED4-258D-4f9f-BE11-137C18D3E543} --> Default Visible 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{49783ED4-258D-4f9f-BE11-137C18D3E543} --> Exec 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{49783ED4-258D-4f9f-BE11-137C18D3E543} --> HotIcon 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{49783ED4-258D-4f9f-BE11-137C18D3E543} --> Icon 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{49783ED4-258D-4f9f-BE11-137C18D3E543} --> MenuText 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{49783ED4-258D-4f9f-BE11-137C18D3E543} --> ToolTip 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Titan Poker --> DisplayName 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Titan Poker --> UninstallString 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Titan Poker --> account 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Titan Poker --> advertisercode 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Titan Poker --> banner 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Titan Poker --> creferer 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Titan Poker --> homedir 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Titan Poker --> profile 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Titan Poker --> referer 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Titan Poker --> safemode 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Titan Poker --> uninstall 	detected: Trace.Registry.Titan Poker!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Titan Poker --> uninstall_lang 	detected: Trace.Registry.Titan Poker!A2
c:\windows\downloaded program files\default.inf 	detected: Trace.File.iePlugin!A2
c:\program files\partygaming\partycasino\gra.ini 	detected: Trace.File.PartyPoker!A2
c:\program files\partygaming\partycasino\partycasino.dll 	detected: Trace.File.PartyPoker!A2
c:\program files\partygaming\partycasino\sys.ini 	detected: Trace.File.PartyPoker!A2
c:\program files\partygaming\partypoker\language\en_us\articles\2.html 	detected: Trace.File.PartyPoker!A2
c:\program files\partygaming\partypoker\language\en_us\articles\4.html 	detected: Trace.File.PartyPoker!A2
c:\program files\partygaming\partypoker\language\en_us\articles\54708.html 	detected: Trace.File.PartyPoker!A2
c:\program files\partygaming\partypoker
otes.txt 	detected: Trace.File.PartyPoker!A2
c:\program files\partygaming\partypoker\usertab.txt 	detected: Trace.File.PartyPoker!A2
Value: HKEY_USERS\S-1-5-21-1547161642-839522115-1957994488-1003\Software\Cliprex DVD Player Professional --> Volume 	detected: Trace.Registry.Cliprex DVD Player Professional!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\itbill --> Changed 	detected: Trace.Registry.MediaPipe!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\itbill --> SlowInfoCache 	detected: Trace.Registry.MediaPipe!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\p2pnetworks --> Changed 	detected: Trace.Registry.MediaPipe!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\p2pnetworks --> SlowInfoCache 	detected: Trace.Registry.MediaPipe!A2
Key: HKEY_CLASSES_ROOT\clsid\{147a976e-eee1-4377-8ea7-4716e4cdd239} 	detected: Trace.Registry.MyWebSearchToobar
C:\Documents and Settings\Owner\Cookies\owner@atdmt[2].txt 	detected: Trace.TrackingCookie.atdmt!A2
C:\Documents and Settings\Owner\Cookies\owner@bs.serving-sys[1].txt 	detected: Trace.TrackingCookie.bs.serving-sys!A2
C:\Documents and Settings\Owner\Cookies\owner@doubleclick[2].txt 	detected: Trace.TrackingCookie.doubleclick!A2
C:\Documents and Settings\Owner\Cookies\owner@questionmarket[1].txt 	detected: Trace.TrackingCookie.questionmarket!A2
C:\Documents and Settings\Owner\Cookies\owner@serving-sys[2].txt 	detected: Trace.TrackingCookie.serving-sys!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:71 	detected: Trace.TrackingCookie.doubleclick.net!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:74 	detected: Trace.TrackingCookie.doubleclick.net!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:75 	detected: Trace.TrackingCookie.ad.yieldmanager.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:76 	detected: Trace.TrackingCookie.ad.yieldmanager.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:77 	detected: Trace.TrackingCookie.ad.yieldmanager.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:78 	detected: Trace.TrackingCookie.ad.yieldmanager.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:79 	detected: Trace.TrackingCookie.ad.yieldmanager.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:80 	detected: Trace.TrackingCookie.ad.yieldmanager.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:81 	detected: Trace.TrackingCookie.ad.yieldmanager.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:82 	detected: Trace.TrackingCookie.ad.yieldmanager.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:84 	detected: Trace.TrackingCookie.ad.yieldmanager.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:89 	detected: Trace.TrackingCookie.zedo.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:90 	detected: Trace.TrackingCookie.zedo.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:91 	detected: Trace.TrackingCookie.zedo.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:92 	detected: Trace.TrackingCookie.zedo.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:93 	detected: Trace.TrackingCookie.zedo.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:94 	detected: Trace.TrackingCookie.zedo.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:95 	detected: Trace.TrackingCookie.zedo.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:133 	detected: Trace.TrackingCookie.media!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:133 	detected: Trace.TrackingCookie.media.adrevolver.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:134 	detected: Trace.TrackingCookie.media!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:134 	detected: Trace.TrackingCookie.media.adrevolver.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:135 	detected: Trace.TrackingCookie.media!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:135 	detected: Trace.TrackingCookie.media.adrevolver.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:136 	detected: Trace.TrackingCookie.media!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:136 	detected: Trace.TrackingCookie.media.adrevolver.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:155 	detected: Trace.TrackingCookie.ads.bridgetrack.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:156 	detected: Trace.TrackingCookie.ads.bridgetrack.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:157 	detected: Trace.TrackingCookie.ads.bridgetrack.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:158 	detected: Trace.TrackingCookie.ads.bridgetrack.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:159 	detected: Trace.TrackingCookie.ads.bridgetrack.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:160 	detected: Trace.TrackingCookie.ads.bridgetrack.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:161 	detected: Trace.TrackingCookie.ads.bridgetrack.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:166 	detected: Trace.TrackingCookie.server.iad.livepers!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:166 	detected: Trace.TrackingCookie.server.iad.liveperson.net!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:167 	detected: Trace.TrackingCookie.server.iad.livepers!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:167 	detected: Trace.TrackingCookie.server.iad.liveperson.net!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:168 	detected: Trace.TrackingCookie.server.iad.livepers!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:168 	detected: Trace.TrackingCookie.server.iad.liveperson.net!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:172 	detected: Trace.TrackingCookie.casalemedia.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:173 	detected: Trace.TrackingCookie.casalemedia.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:174 	detected: Trace.TrackingCookie.casalemedia.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:175 	detected: Trace.TrackingCookie.casalemedia.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:210 	detected: Trace.TrackingCookie.azjmp.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:211 	detected: Trace.TrackingCookie.azjmp.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:212 	detected: Trace.TrackingCookie.azjmp.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:213 	detected: Trace.TrackingCookie.azjmp.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:216 	detected: Trace.TrackingCookie.myspace.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:217 	detected: Trace.TrackingCookie.myspace.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:218 	detected: Trace.TrackingCookie.myspace.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:219 	detected: Trace.TrackingCookie.myspace.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:220 	detected: Trace.TrackingCookie.myspace.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:254 	detected: Trace.TrackingCookie.www.googleadservices.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:319 	detected: Trace.TrackingCookie.tribalfusion.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:351 	detected: Trace.TrackingCookie.ads.monster.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:355 	detected: Trace.TrackingCookie.server.iad.livepers!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:355 	detected: Trace.TrackingCookie.server.iad.liveperson.net!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:476 	detected: Trace.TrackingCookie.trafficmp.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:477 	detected: Trace.TrackingCookie.trafficmp.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:478 	detected: Trace.TrackingCookie.trafficmp.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:479 	detected: Trace.TrackingCookie.trafficmp.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:480 	detected: Trace.TrackingCookie.trafficmp.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:505 	detected: Trace.TrackingCookie.tag.contextweb.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:506 	detected: Trace.TrackingCookie.tag.contextweb.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:550 	detected: Trace.TrackingCookie.statse.webtrendslive!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:550 	detected: Trace.TrackingCookie.statse.webtrendslive.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:565 	detected: Trace.TrackingCookie.sdc.radio-canada.ca!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:582 	detected: Trace.TrackingCookie.www.burstbeacon.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:584 	detected: Trace.TrackingCookie.www.burstnet.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:687 	detected: Trace.TrackingCookie.www.googleadservices.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:739 	detected: Trace.TrackingCookie.www.googleadservices.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:744 	detected: Trace.TrackingCookie.visit.theglobeandmail.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:778 	detected: Trace.TrackingCookie.adbrite.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:779 	detected: Trace.TrackingCookie.adbrite.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:780 	detected: Trace.TrackingCookie.adbrite.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:795 	detected: Trace.TrackingCookie.www.googleadservices.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:845 	detected: Trace.TrackingCookie.www.googleadservices.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:849 	detected: Trace.TrackingCookie.www.googleadservices.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:865 	detected: Trace.TrackingCookie.data.coremetrics!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:865 	detected: Trace.TrackingCookie.data.coremetrics.com!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:866 	detected: Trace.TrackingCookie.sec1.liveperson.net!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:867 	detected: Trace.TrackingCookie.sec1.liveperson.net!A2
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\cookies.txt:915 	detected: Trace.TrackingCookie.adknowledge!A2
C:\Documents and Settings\All Users\Application Data\Kodak\EasyShareSetup\KSU\KSU.CAB/backWeb_7288971.exe 	detected: Adware.BackWeb.a!A2
C:\Documents and Settings\All Users\Application Data\Kodak\EasyShareSetup\KSU\KSU.CAB/runner.exe 	detected: Adware.BackWeb.a!A2
C:\Program Files\Kodak\KODAK Software Updater\7288971\6.1.4.37-7288971L\Programunner.exe 	detected: Adware.BackWeb.a!A2
C:\Program Files\Mozilla Firefox\SmitfraudFix\IEDFix.exe 	detected: Hoax.Win32.Renos.vaoz!A2
C:\Program Files\Mozilla Firefox\SmitfraudFix\Process.exe 	detected: Riskware.RiskTool.Win32.Processor.20!A2
C:\System Volume Information\_restore{3D04D4D0-9194-4DD1-8578-5EF7FA091078}\RP646\A0241756.exe 	detected: Riskware.RiskTool.Win32.Processor.20!A2
C:\WINDOWS\abiloader.exe 	detected: Adware.Win32.BetterInternet.t!A2
C:\WINDOWS\system32\IEDFix.exe 	detected: Hoax.Win32.Renos.vaoz!A2
C:\WINDOWS\system32\Process.exe 	detected: Riskware.RiskTool.Win32.Processor.20!A2

Scanned

Files: 	83898
Traces: 	573196
Cookies: 	1062
Processes: 	54

Found

Files: 	9
Traces: 	193
Cookies: 	88
Processes: 	0
Registry keys: 	0

Scan end:	11/7/2008 5:20:20 PM
Scan time:	4:11:12

geoffrey5 · Answer

Salut !!

Tu peux aller supprimer tout ce qu il y a dans la quarantaine d a-squared..

ensuite :

&#x25B6; Télécharger SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau. 
 
&#x25B6; Double cliquer sur SDFix.exe et choisir Install pour l'extraire dans un dossier dédié sur ton disque C:.
 
/!\ Démarre en mode sans échec : après le bip et avant le logo windows tapoter sur la touche F8 (ou F5): menu M.S.E.. 

&#x25B6; Choisir son compte, pas celui de l'Administrateur ou autre. 

Dérouler la liste des instructions ci-dessous :
 
• Ouvrir le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script. 
• Appuyer sur Y pour commencer le processus de nettoyage. 
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer. 
• Appuyer sur une touche pour redémarrer le PC. 
• Le système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers. 
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished. 
• Appuyer sur une touche pour finir l'exécution du script et charger les icônes du Bureau. 
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt. 
• Enfin, copier/coller le contenu du fichier Report.txt dans la prochaine réponse sur le forum

grandtoure · Answer

veux tu que je supprime seulement ce qu'il y a dans la quarantaine ? Que dois je faire de ceux detectes dans le scan?

geoffrey5 · Answer

tu supprimes tout et tu vides la quarantaine

grandtoure · Answer

[b]SDFix: Version 1.240 [/b]
Run by Owner on Fri 11/07/2008 at 20:42

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:

AUTOEXEC.NT Restored from backups

Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

No Trojan Files Found






Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-08 18:58:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\WINDOWS\system32\mqsvc.exe"="C:\WINDOWS\system32\mqsvc.exe:*:Enabled:Message Queuing"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe"="C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe:*:Enabled:backWeb-7288971"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe:*:Enabled:Logitech Desktop Messenger"
"C:\PROGRA~1\Yahoo!\MESSEN~1\YPAGER.EXE"="C:\PROGRA~1\Yahoo!\MESSEN~1\YPAGER.EXE:*:Enabled:Yahoo! Messenger"
"C:\PROGRA~1\Yahoo!\MESSEN~1\yserver.exe"="C:\PROGRA~1\Yahoo!\MESSEN~1\yserver.exe:*:Enabled:Yahoo! FT Server"
"C:\Program Files\Yahoo!\browser\ybrowser.exe"="C:\Program Files\Yahoo!\browser\ybrowser.exe:*:Enabled:Yahoo! Browser"
"C:\Program Files\Yahoo!\Messenger\YPAGER.EXE"="C:\Program Files\Yahoo!\Messenger\YPAGER.EXE:*:Enabled:Yahoo! Messenger"
"C:\Program Files\Yahoo!\Messenger\yserver.exe"="C:\Program Files\Yahoo!\Messenger\yserver.exe:*:Enabled:Yahoo! FT Server"
"C:\Program Files\Real\RealPlayer\realplay.exe"="C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer"
"C:\Program Files\PeerCast\PeerCast.exe"="C:\Program Files\PeerCast\PeerCast.exe:*:Enabled:PeerCast"
"C:\Program Files\America Online 9.0c\waol.exe"="C:\Program Files\America Online 9.0c\waol.exe:*:Disabled:America Online 9.0c"
"C:\Program Files\p2pnetworks\p2pnetworks.exe"=" "
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
"C:\Program Files\inKline Global\TVolution\TVolution.exe"="C:\Program Files\inKline Global\TVolution\TVolution.exe:*:Enabled:TVolution"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer"
"C:\Program Files\NetMeeting\conf.exe"="C:\Program Files\NetMeeting\conf.exe:*:Enabled:Windowsr NetMeetingr"
"C:\Program Files\Windows Media Player\wmplayer.exe"="C:\Program Files\Windows Media Player\wmplayer.exe:*:Enabled:Windows Media Player"
"C:\Program Files\QuickTime\QuickTimePlayer.exe"="C:\Program Files\QuickTime\QuickTimePlayer.exe:*:Enabled:QuickTime Player"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe"="C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:*:Enabled:McAfee Network Agent"
"C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe"="C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe:*:Enabled:VoipStunt"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"C:\WINDOWS\system32\mqsvc.exe"="C:\WINDOWS\system32\mqsvc.exe:*:Enabled:Message Queuing"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[b]Remaining Files [/b]:



[b]Files with Hidden Attributes [/b]:

Fri 27 Feb 2004       233,472 A..H. --- "C:\RECYCLER\NPROTECT\00391518.DLL"
Wed 19 Jan 2005         4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun  8 May 2005           401 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv11.bak"
Thu 15 Aug 2002       266,240 A..H. --- "C:\Program Files\Broderbund\Mavis Beacon Teaches Typing Deluxe 15\Mavis Beacon Teaches Typing.exe"
Fri 27 Feb 2004       233,472 A..H. --- "C:\Program Files\Image-Line\FL Studio 7\REX Shared Library.dll"
Fri 10 Oct 2008        20,487 A.SHR --- "C:\Program Files\McAfee\MQC\MRU.bak"
Fri 10 Oct 2008           265 A.SHR --- "C:\Program Files\McAfee\MQC\qcconf.bak"
Tue 13 Nov 2007             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Fri 14 May 2004         1,206 A..HR --- "C:\Program Files\Common Files\Symantec Shared\Registry Backup\ccReg.reg"
Fri 14 May 2004        12,888 A..HR --- "C:\Program Files\Common Files\Symantec Shared\Registry Backup\CommonClient.reg"
Fri 10 Oct 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\c9f50bc388914012dca1d6d24cf3016d\BIT70.tmp"
Mon 12 Dec 2005           401 A..H. --- "C:\Documents and Settings\Owner\My Documents\My Music\License Backup\drmv1lic.bak"
Mon 12 Nov 2007           401 A..H. --- "C:\Documents and Settings\Owner\Application Data\Real\Rhapsody\wmlicbackup\drmv1lic.bak"
Thu 27 Jan 2005             8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\lock.tmp"

[b]Finished![/b]

geoffrey5 · Answer

Salut !!

vas faire une analyse en ligne avec bitdefender à cette adresse stp (sous internet explorer) :

http://www.zebulon.fr/outils/antivirus/antivirus-en-ligne.php

et poste le rapport

grandtoure · Answer

La mise en jour de bitdefender ne s'effectue pas. Quand je commence le scan, ca echoue. En gros ca marche pas

geoffrey5 · Answer

essaye celui de panda

grandtoure · Answer

Le resultat marque que mon ordi est infecte . Que Mc Afee antivirus n'est  pas update ni active.
Veux tu que je le mette a jour ?

geoffrey5 · Answer

Salut !!

Oui mets le à jour, fais une analyse et poste le rapport stp

grandtoure · Answer

je l'ai mis a jour et j'ai passe le scan. J'ai effaces les fichiers infectes. Il y a juste le SDfix.exe qui n a pas pu etre efface completement. J'arrive pas a poster le rapport. Comment faire?

geoffrey5 · Answer

Salut !!

Pourquoi n arrives tu pas à le poster ??

grandtoure · Answer

Parce que aucun rapport ne s est affiche ni apparu. Je ne pense pas qu Mcafee affiche un rapport apres le scan

geoffrey5 · Answer

télécharge Trojan Remover

voici un tuto pour bien le faire fonctionner : http://www.malekal.com/tutorial_TrojanRemover.php

poste le rapport stp

grandtoure · Answer

***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.7.4.2551. For information, email support@simplysup1.com
[Unregistered version]
Scan started at: 4:24:23 PM 12 Nov 2008
Using Database v7197
Operating System:  Windows XP SP2 [Windows XP Professional Service Pack 2 (Build 2600)]
File System:       NTFS
Data directory:     C:\Documents and Settings\Owner\Application Data\Simply Super Software\Trojan Remover\
Database directory: C:\Program Files\Trojan Remover\
Logfile directory:  C:\Documents and Settings\Owner\My Documents\Simply Super Software\Trojan Remover Logfiles\
Program directory:  C:\Program Files\Trojan Remover\
Running with Administrator privileges

************************************************************
The following Anti-Malware program(s) are loaded:
McAfee Anti-Virus

************************************************************


************************************************************
4:24:25 PM: Scanning ----------WIN.INI-----------
WIN.INI found in C:\WINDOWS

************************************************************
4:24:25 PM: Scanning --------SYSTEM.INI---------
SYSTEM.INI found in C:\WINDOWS

************************************************************
4:24:26 PM: ----- SCANNING FOR ROOTKIT SERVICES -----
No hidden Services were detected.

************************************************************
4:24:39 PM: Scanning -----WINDOWS REGISTRY-----
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
This key's "Shell" value calls the following program(s):
File: Explorer.exe
C:\WINDOWS\Explorer.exe
1033216 bytes
Created:  5/11/2003
Modified: 6/13/2007
Company:  Microsoft Corporation
----------
This key's "Userinit" value calls the following program(s):
File: C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\userinit.exe
24576 bytes
Created:  8/23/2001
Modified: 8/4/2004
Company:  Microsoft Corporation
----------
This key's "System" value appears to be blank
----------
This key's "UIHost" value calls the following program:
File: logonui.exe
C:\WINDOWS\system32\logonui.exe
514560 bytes
Created:  5/14/2004
Modified: 8/4/2004
Company:  Microsoft Corporation
----------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
Value Name: load
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: InCD
Value Data: C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Ahead\InCD\InCD.exe
1155122 bytes
Created:  5/14/2004
Modified: 7/24/2003
Company:  Ahead Software AG
--------------------
Value Name: NeroFilterCheck
Value Data: C:\WINDOWS\system32\NeroCheck.exe
C:\WINDOWS\system32\NeroCheck.exe
155648 bytes
Created:  5/14/2004
Modified: 7/9/2001
Company:  Ahead Software Gmbh
--------------------
Value Name: MsmqIntCert
Value Data: regsvr32 /s mqrt.dll
C:\WINDOWS\system32\mqrt.dll
177152 bytes
Created:  5/14/2004
Modified: 7/6/2007
Company:  Microsoft Corporation
--------------------
Value Name: Pure Networks Port Magic
Value Data: "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe
99480 bytes
Created:  1/14/2005
Modified: 5/7/2004
Company:  Pure Networks, Inc.
--------------------
Value Name: FLMOFFICE4DMOUSE
Value Data: C:\Program Files\Browser Mouse\mouse32a.exe
C:\Program Files\Browser Mouse\mouse32a.exe
360448 bytes
Created:  2/7/2005
Modified: 2/7/2005
Company:  
--------------------
Value Name: FLMK08KB
Value Data: C:\Program Files\Muiltmedia keyboard utility\1.1\MMKEYBD.EXE
C:\Program Files\Muiltmedia keyboard utility\1.1\MMKEYBD.EXE
207360 bytes
Created:  2/7/2005
Modified: 2/7/2005
Company:  
--------------------
Value Name: RemoteControl
Value Data: "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
32768 bytes
Created:  2/8/2005
Modified: 10/31/2003
Company:  Cyberlink Corp.
--------------------
Value Name: YOP
Value Data: C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
C:\PROGRA~1\Yahoo!\YOP\yop.exe [file not found to scan]
--------------------
Value Name: HP Software Update
Value Data: C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
54840 bytes
Created:  5/8/2007
Modified: 5/8/2007
Company:  Hewlett-Packard
--------------------
Value Name: Motive SmartBridge
Value Data: C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
442455 bytes
Created:  1/10/2007
Modified: 8/24/2005
Company:  Motive, Inc.
--------------------
Value Name: tgcmd
Value Data: C:\Program Files\Support.com\bin	gcmd.exe /server /startmonitor /deaf
C:\Program Files\Support.com\bin	gcmd.exe
1773568 bytes
Created:  6/2/2006
Modified: 3/7/2007
Company:  SupportSoft, Inc.
--------------------
Value Name: Adobe Photo Downloader
Value Data: "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe [file not found to scan]
--------------------
Value Name: QuickTime Task
Value Data: "C:\Program Files\QuickTime\QTTask.exe" -atboottime
C:\Program Files\QuickTime\QTTask.exe
413696 bytes
Created:  3/28/2008
Modified: 3/28/2008
Company:  Apple Inc.
--------------------
Value Name: iTunesHelper
Value Data: "C:\Program Files\iTunes\iTunesHelper.exe"
C:\Program Files\iTunes\iTunesHelper.exe
267048 bytes
Created:  3/30/2008
Modified: 3/30/2008
Company:  Apple Inc.
--------------------
Value Name: TkBellExe
Value Data: "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
C:\Program Files\Common Files\Real\Update_OBealsched.exe
185896 bytes
Created:  3/8/2006
Modified: 5/9/2008
Company:  RealNetworks, Inc.
--------------------
Value Name: mcagent_exe
Value Data: C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
C:\Program Files\McAfee.com\Agent\mcagent.exe
582992 bytes
Created:  5/12/2007
Modified: 11/1/2007
Company:  McAfee, Inc.
--------------------
Value Name: TrojanScanner
Value Data: C:\Program Files\Trojan Remover\Trjscan.exe /boot
C:\Program Files\Trojan Remover\Trjscan.exe
1233800 bytes
Created:  11/12/2008
Modified: 11/8/2008
Company:  Simply Super Software
--------------------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value Name: ctfmon.exe
Value Data: C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\ctfmon.exe
15360 bytes
Created:  5/14/2004
Modified: 8/4/2004
Company:  Microsoft Corporation
--------------------
Value Name: System Soap Pro
Value Data: C:\PROGRA~1\SYSTEM~1\soap.exe min
C:\PROGRA~1\SYSTEM~1\soap.exe [file not found to scan]
--------------------
Value Name: HBt9RTH3W
Value Data: clsaysvr.exe
clsaysvr.exe [file not found to scan]
--------------------
Value Name: ufqz
Value Data: C:\PROGRA~1\COMMON~1\ufqz\ufqzm.exe
C:\PROGRA~1\COMMON~1\ufqz\ufqzm.exe [file not found to scan]
--------------------
Value Name: SRS Audio Sandbox
Value Data: "C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe" /hideme
C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe [file not found to scan]
--------------------
Value Name: VoipStunt
Value Data: "C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe" -nosplash -minimized
C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe
8824112 bytes
Created:  10/25/2008
Modified: 12/13/2007
Company:  VoipStunt
--------------------
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
Value Name: FlashPlayerUpdate
Value Data: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe -p
C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
218496 bytes
Created:  11/20/2007
Modified: 11/20/2007
Company:  Adobe Systems, Inc.
--------------------
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty

************************************************************
4:25:33 PM: Scanning -----SHELLEXECUTEHOOKS-----
ValueName: {AEB6717E-7E19-11d0-97EE-00C04FD91972}
File:      shell32.dll - this file is expected and has been left in place
----------

************************************************************
4:25:33 PM: Scanning -----HIDDEN REGISTRY ENTRIES-----
Taskdir check completed
----------
No Hidden File-loading Registry Entries found
----------

************************************************************
4:25:39 PM: Scanning -----ACTIVE SCREENSAVER-----
No active ScreenSaver found to scan.

************************************************************
4:25:39 PM: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----
Key:  {6BF52A52-394A-11d3-B153-00C04F79FAA6}
Path: rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub
C:\WINDOWS\INF\wmp10.inf
34751 bytes
Created:  1/24/2005
Modified: 1/28/2005
Company:  
----------
Key:  {8b15971b-5355-4c82-8c07-7e181ea07608}
Path: rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser
C:\WINDOWS\INF\fxsocm.inf
50680 bytes
Created:  8/4/2004
Modified: 8/4/2004
Company:  
----------

************************************************************
4:25:46 PM: Scanning ----- SERVICEDLL REGISTRY KEYS -----
Key: HidServ
%SystemRoot%\System32\hidserv.dll - file is globally excluded (file cannot be found)
--------------------
Key:  NWCWorkstation
Path: %SystemRoot%\System32
wwks.dll
C:\WINDOWS\System32
wwks.dll
65536 bytes
Created:  5/14/2004
Modified: 10/13/2006
Company:  Microsoft Corporation
--------------------

************************************************************
4:25:56 PM: Scanning ----- SERVICES REGISTRY KEYS -----
Key:       a2free
ImagePath: "C:\Program Files\a-squared Free\a2service.exe"
C:\Program Files\a-squared Free\a2service.exe
419448 bytes
Created:  11/6/2008
Modified: 11/6/2008
Company:  Emsi Software GmbH
----------
Key:       AN983
ImagePath: System32\DRIVERS\AN983.sys
C:\WINDOWS\System32\DRIVERS\AN983.sys
36224 bytes
Created:  5/21/2004
Modified: 8/28/2002
Company:  ADMtek Incorporated.
----------
Key:       aspnet_state
ImagePath: %SystemRoot%\Microsoft.NET\Framework\v2.0.50215\aspnet_state.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50215\aspnet_state.exe
22016 bytes
Created:  4/8/2005
Modified: 4/8/2005
Company:  Microsoft Corporation
----------
Key:       catchme
ImagePath: \??\C:\DOCUME~1\Owner\LOCALS~1\Temp\catchme.sys - this file is globally excluded
----------
Key:       clr_optimization_v2.0.50215_32
ImagePath: C:\WINDOWS\Microsoft.NET\Framework\v2.0.50215\mscorsvw.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50215\mscorsvw.exe
56320 bytes
Created:  4/8/2005
Modified: 4/8/2005
Company:  Microsoft Corporation
----------
Key:       Diskeeper
ImagePath: C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
426098 bytes
Created:  8/22/2003
Modified: 8/22/2003
Company:  Executive Software International, Inc.
----------
Key:       FastNIC
ImagePath: System32\DRIVERS\FastNIC.sys
C:\WINDOWS\System32\DRIVERS\FastNIC.sys
38528 bytes
Created:  5/21/2002
Modified: 5/21/2002
Company:  ADMtek Incorporated.
----------
Key:       HPZid412
ImagePath: system32\DRIVERS\HPZid412.sys
C:\WINDOWS\system32\DRIVERS\HPZid412.sys
-R- 49664 bytes
Created:  12/13/2006
Modified: 4/12/2006
Company:  HP
----------
Key:       HPZipr12
ImagePath: system32\DRIVERS\HPZipr12.sys
C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
-R- 16496 bytes
Created:  12/13/2006
Modified: 4/12/2006
Company:  HP
----------
Key:       HPZius12
ImagePath: system32\DRIVERS\HPZius12.sys
C:\WINDOWS\system32\DRIVERS\HPZius12.sys
21568 bytes
Created:  4/12/2006
Modified: 4/12/2006
Company:  HP
----------
Key:       IISADMIN
ImagePath: C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
15872 bytes
Created:  5/14/2004
Modified: 8/4/2004
Company:  Microsoft Corporation
----------
Key:       InCDPass
ImagePath: System32\DRIVERS\InCDPass.sys
C:\WINDOWS\System32\DRIVERS\InCDPass.sys
28432 bytes
Created:  5/14/2004
Modified: 7/24/2003
Company:  Ahead Software
----------
Key:       InCDsrv
ImagePath: C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
786484 bytes
Created:  5/14/2004
Modified: 7/24/2003
Company:  AHEAD Software
----------
Key:       LVUSBSta
ImagePath: system32\drivers\lvusbsta.sys
C:\WINDOWS\system32\drivers\lvusbsta.sys [file not found to scan]
----------
Key:       mcmscsvc
ImagePath: C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
767976 bytes
Created:  5/12/2007
Modified: 1/9/2008
Company:  McAfee, Inc.
----------
Key:       McNASvc
ImagePath: "c:\program files\common files\mcafee\mna\mcnasvc.exe"
c:\program files\common files\mcafee\mna\mcnasvc.exe
2458128 bytes
Created:  5/12/2007
Modified: 1/25/2008
Company:  McAfee, Inc.
----------
Key:       McODS
ImagePath: C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
378184 bytes
Created:  5/12/2007
Modified: 11/7/2007
Company:  McAfee, Inc.
----------
Key:       McProxy
ImagePath: c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
359248 bytes
Created:  10/10/2008
Modified: 8/15/2007
Company:  McAfee, Inc.
----------
Key:       McShield
ImagePath: C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
144704 bytes
Created:  5/12/2007
Modified: 7/24/2007
Company:  McAfee, Inc.
----------
Key:       McSysmon
ImagePath: C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
695624 bytes
Created:  5/12/2007
Modified: 12/5/2007
Company:  McAfee, Inc.
----------
Key:       mfeavfk
ImagePath: system32\drivers\mfeavfk.sys
C:\WINDOWS\system32\drivers\mfeavfk.sys
79304 bytes
Created:  5/12/2007
Modified: 11/22/2007
Company:  McAfee, Inc.
----------
Key:       mfebopk
ImagePath: system32\drivers\mfebopk.sys
C:\WINDOWS\system32\drivers\mfebopk.sys
35240 bytes
Created:  5/12/2007
Modified: 11/22/2007
Company:  McAfee, Inc.
----------
Key:       mfehidk
ImagePath: system32\drivers\mfehidk.sys
C:\WINDOWS\system32\drivers\mfehidk.sys
201320 bytes
Created:  5/12/2007
Modified: 11/22/2007
Company:  McAfee, Inc.
----------
Key:       mferkdk
ImagePath: system32\drivers\mferkdk.sys
C:\WINDOWS\system32\drivers\mferkdk.sys
33832 bytes
Created:  5/12/2007
Modified: 11/22/2007
Company:  McAfee, Inc.
----------
Key:       mfesmfk
ImagePath: system32\drivers\mfesmfk.sys
C:\WINDOWS\system32\drivers\mfesmfk.sys
40488 bytes
Created:  5/12/2007
Modified: 12/2/2007
Company:  McAfee, Inc.
----------
Key:       MPFP
ImagePath: System32\Drivers\Mpfp.sys
C:\WINDOWS\System32\Drivers\Mpfp.sys
113952 bytes
Created:  5/12/2007
Modified: 7/13/2007
Company:  McAfee, Inc.
----------
Key:       MpfService
ImagePath: "C:\Program Files\McAfee\MPF\MPFSrv.exe"
C:\Program Files\McAfee\MPF\MPFSrv.exe
856864 bytes
Created:  5/12/2007
Modified: 7/18/2007
Company:  McAfee, Inc.
----------
Key:       MQAC
ImagePath: \??\C:\WINDOWS\System32\drivers\mqac.sys
C:\WINDOWS\System32\drivers\mqac.sys
72960 bytes
Created:  5/14/2004
Modified: 7/6/2007
Company:  Microsoft Corporation
----------
Key:       MR97310_USB_DUAL_CAMERA
ImagePath: system32\DRIVERS\mr97310c.sys
C:\WINDOWS\system32\DRIVERS\mr97310c.sys
130309 bytes
Created:  8/7/2007
Modified: 9/9/2002
Company:  DUCam Technology Inc.
----------
Key:       MSFtpsvc
ImagePath: %SystemRoot%\System32\inetsrv\inetinfo.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
15872 bytes
Created:  5/14/2004
Modified: 8/4/2004
Company:  Microsoft Corporation
----------
Key:       MSMQ
ImagePath: C:\WINDOWS\System32\mqsvc.exe
C:\WINDOWS\System32\mqsvc.exe
4608 bytes
Created:  8/23/2001
Modified: 8/4/2004
Company:  Microsoft Corporation
----------
Key:       MSMQTriggers
ImagePath: C:\WINDOWS\System32\mqtgsvc.exe
C:\WINDOWS\System32\mqtgsvc.exe
117248 bytes
Created:  8/23/2001
Modified: 8/4/2004
Company:  Microsoft Corporation
----------
Key:       ms_mpu401
ImagePath: system32\drivers\msmpu401.sys
C:\WINDOWS\system32\drivers\msmpu401.sys
2944 bytes
Created:  12/31/2000
Modified: 8/17/2001
Company:  Microsoft Corporation
----------
Key:       nvport
ImagePath: \??\C:\WINDOWS\system32\Drivers
vport.sys
C:\WINDOWS\system32\Drivers
vport.sys [file not found to scan]
----------
Key:       NwlnkIpx
ImagePath: System32\DRIVERS
wlnkipx.sys
C:\WINDOWS\System32\DRIVERS
wlnkipx.sys
88448 bytes
Created:  8/23/2001
Modified: 8/4/2004
Company:  Microsoft Corporation
----------
Key:       NwlnkNb
ImagePath: System32\DRIVERS
wlnknb.sys
C:\WINDOWS\System32\DRIVERS
wlnknb.sys
63232 bytes
Created:  8/23/2001
Modified: 8/23/2001
Company:  Microsoft Corporation
----------
Key:       NwlnkSpx
ImagePath: System32\DRIVERS
wlnkspx.sys
C:\WINDOWS\System32\DRIVERS
wlnkspx.sys
55936 bytes
Created:  8/23/2001
Modified: 8/23/2001
Company:  Microsoft Corporation
----------
Key:       NWRDR
ImagePath: System32\DRIVERS
wrdr.sys
C:\WINDOWS\System32\DRIVERS
wrdr.sys
163584 bytes
Created:  5/14/2004
Modified: 10/13/2006
Company:  Microsoft Corporation
----------
Key:       OVT511Plus
ImagePath: System32\Drivers\omcamvid.sys
C:\WINDOWS\System32\Drivers\omcamvid.sys
160073 bytes
Created:  10/11/2000
Modified: 9/18/2000
Company:  OmniVision Technologies, Inc.
----------
Key:       pavboot
ImagePath: system32\drivers\pavboot.sys
C:\WINDOWS\system32\drivers\pavboot.sys
28544 bytes
Created:  11/10/2008
Modified: 6/19/2008
Company:  Panda Security, S.L.
----------
Key:       pfc
ImagePath: system32\drivers\pfc.sys
C:\WINDOWS\system32\drivers\pfc.sys
9856 bytes
Created:  1/16/2007
Modified: 3/29/2006
Company:  Padus, Inc.
----------
Key:       PID_08A0
ImagePath: system32\DRIVERS\LV302AV.SYS
C:\WINDOWS\system32\DRIVERS\LV302AV.SYS [file not found to scan]
----------
Key:       Pml Driver HPZ12
ImagePath: C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\HPZipm12.exe
73728 bytes
Created:  12/13/2006
Modified: 8/9/2007
Company:  HP
----------
Key:       RMCAST
ImagePath: \??\C:\WINDOWS\System32\drivers\RMCast.sys
C:\WINDOWS\System32\drivers\RMCast.sys
202752 bytes
Created:  8/23/2001
Modified: 5/8/2008
Company:  Microsoft Corporation
----------
Key:       rtl8029
ImagePath: System32\DRIVERS\RTL8029.SYS
C:\WINDOWS\System32\DRIVERS\RTL8029.SYS
19017 bytes
Created:  5/14/2004
Modified: 8/17/2001
Company:  Realtek Semiconductor Corporation
----------
Key:       S3SavageNB
ImagePath: System32\DRIVERS\s3gnbm.sys
C:\WINDOWS\System32\DRIVERS\s3gnbm.sys
-R- 156288 bytes
Created:  5/21/2004
Modified: 8/13/2002
Company:  S3 Graphics, Inc.
----------
Key:       ScsiAccess
ImagePath: C:\WINDOWS\system32\ScsiAccess.EXE
C:\WINDOWS\system32\ScsiAccess.EXE
181312 bytes
Created:  2/4/2003
Modified: 2/4/2003
Company:  
----------
Key:       SMTPSVC
ImagePath: C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
15872 bytes
Created:  5/14/2004
Modified: 8/4/2004
Company:  Microsoft Corporation
----------
Key:       SNMP
ImagePath: %SystemRoot%\System32\snmp.exe
C:\WINDOWS\System32\snmp.exe
33280 bytes
Created:  5/14/2004
Modified: 11/20/2006
Company:  Microsoft Corporation
----------
Key:       SRS_SSCFilter
ImagePath: system32\drivers\srs_sscfilter_i386.sys
C:\WINDOWS\system32\drivers\srs_sscfilter_i386.sys
-R- 38400 bytes
Created:  3/22/2007
Modified: 3/12/2007
Company:  
----------
Key:       SwPrv
ImagePath: C:\WINDOWS\System32\dllhost.exe /Processid:{F8C47B10-142D-4F62-82CE-02883089E7CA}
C:\WINDOWS\System32\dllhost.exe 
5120 bytes
Created:  8/23/2001
Modified: 8/4/2004
Company:  Microsoft Corporation
----------
Key:       usnjsvc
ImagePath: "C:\Program Files\MSN Messenger\usnsvc.exe"
C:\Program Files\MSN Messenger\usnsvc.exe
97136 bytes
Created:  1/19/2007
Modified: 1/19/2007
Company:  Microsoft Corporation
----------
Key:       viaagp
ImagePath: System32\DRIVERS\viaagp.sys
C:\WINDOWS\System32\DRIVERS\viaagp.sys
42240 bytes
Created:  12/31/2000
Modified: 8/4/2004
Company:  Microsoft Corporation
----------
Key:       viaagp1
ImagePath: System32\DRIVERS\viaagp1.sys
C:\WINDOWS\System32\DRIVERS\viaagp1.sys
27904 bytes
Created:  7/2/2003
Modified: 7/2/2003
Company:  VIA Technologies, Inc.
----------
Key:       VIAudio
ImagePath: system32\drivers\ac97via.sys
C:\WINDOWS\system32\drivers\ac97via.sys
84480 bytes
Created:  5/21/2004
Modified: 8/28/2002
Company:  VIA Technologies, Inc.
----------
Key:       W3SVC
ImagePath: %SystemRoot%\System32\inetsrv\inetinfo.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
15872 bytes
Created:  5/14/2004
Modified: 8/4/2004
Company:  Microsoft Corporation
----------
Key:       wanatw
ImagePath: System32\DRIVERS\wanatw4.sys
C:\WINDOWS\System32\DRIVERS\wanatw4.sys [file not found to scan]
----------

************************************************************
4:27:38 PM: Scanning -----VXD ENTRIES-----
Checking the following VxD entries:
C:\WINDOWS\system32\JAVASUP.VXD
7315 bytes
Created:  2/13/2005
Modified: 2/28/2003
Company:  
VxD Key = JAVASUP
----------
----------

************************************************************
4:27:40 PM: Scanning ----- WINLOGON\NOTIFY DLLS -----

************************************************************
4:27:41 PM: Scanning ----- CONTEXTMENUHANDLERS -----
Key:   McCtxMenu
CLSID: {01576F39-90DE-4D6E-A068-5B20C22BAAEE}
Path:  c:\PROGRA~1\mcafee\VIRUSS~1\mcctxmnu.dll
c:\PROGRA~1\mcafee\VIRUSS~1\mcctxmnu.dll
165192 bytes
Created:  10/10/2008
Modified: 11/7/2007
Company:  McAfee, Inc.
----------

************************************************************
4:27:42 PM: Scanning ----- FOLDER\COLUMNHANDLERS -----

************************************************************
4:27:43 PM: Scanning ----- BROWSER HELPER OBJECTS -----
Key: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
BHO: C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
59032 bytes
Created:  12/18/2006
Modified: 12/18/2006
Company:  Adobe Systems Incorporated
----------
Key: {3049C3E9-B461-4BC5-8870-4C09146192CA}
BHO: C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
308856 bytes
Created:  5/9/2008
Modified: 5/9/2008
Company:  RealPlayer
----------
Key: {7DB2D5A0-7241-4E79-B68D-6309F01C5231}
BHO: C:\Program Files\McAfee\VirusScan\scriptsn.dll
C:\Program Files\McAfee\VirusScan\scriptsn.dll
58688 bytes
Created:  10/10/2008
Modified: 11/9/2007
Company:  McAfee, Inc.
----------
Key: {9030D464-4C02-4ABF-8ECC-5164760863C6}
BHO: C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
322368 bytes
Created:  8/31/2006
Modified: 8/31/2006
Company:  Microsoft Corporation
----------

************************************************************
4:27:48 PM: Scanning ----- SHELLSERVICEOBJECTS -----

************************************************************
4:27:48 PM: Scanning ----- SHAREDTASKSCHEDULER ENTRIES -----

************************************************************
4:27:48 PM: Scanning ----- IMAGEFILE DEBUGGERS -----
No "Debugger" entries found.

************************************************************
4:27:48 PM: Scanning ----- APPINIT_DLLS -----
The AppInit_DLLs value is blank or does not exist

************************************************************
4:27:56 PM: Scanning ----- SECURITY PROVIDER DLLS -----

************************************************************
4:27:57 PM: Scanning ------ COMMON STARTUP GROUP ------
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
The Common Startup Group attempts to load the following file(s) at boot time:
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini
-HS- 84 bytes
Created:  12/31/2000
Modified: 5/14/2004
Company:  
--------------------
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
288472 bytes
Created:  2/19/2006
Modified: 2/19/2006
Company:  Hewlett-Packard Development Company, L.P.
HP Digital Imaging Monitor.lnk - links to C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
--------------------
C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
64864 bytes
Created:  4/19/2007
Modified: 4/19/2007
Company:  Microsoft Corporation
Microsoft Office OneNote 2003 Quick Launch.lnk - links to C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
--------------------

************************************************************
4:28:00 PM: Scanning ------ USER STARTUP GROUPS ------
--------------------
Checking Startup Group for: Owner
[C:\Documents and Settings\Owner\START MENU\PROGRAMS\STARTUP]
The Startup Group for Owner attempts to load the following file(s):
C:\Documents and Settings\Owner\START MENU\PROGRAMS\STARTUP\desktop.ini
-HS- 84 bytes
Created:  5/14/2004
Modified: 5/14/2004
Company:  
----------

************************************************************
4:28:01 PM: Scanning ----- SCHEDULED TASKS -----
Taskname:      AppleSoftwareUpdate.job
File:          C:\Program Files\Apple Software Update\SoftwareUpdate.exe
C:\Program Files\Apple Software Update\SoftwareUpdate.exe
566592 bytes
Created:  8/29/2007
Modified: 7/30/2008
Company:  Apple Inc.
Parameters:    -task
Next Run Time: 11/13/2008 12:39:00 PM
Status:        The task is ready to run at its next scheduled time
Creator:       SYSTEM
Comments:      [blank]
----------
Taskname:      McDefragTask.job
File:          c:\program files\mcafee\mqc\QcConsol.exe
c:\program files\mcafee\mqc\QcConsol.exe
222496 bytes
Created:  5/12/2007
Modified: 12/4/2007
Company:  McAfee, Inc.
Parameters:    "C:\WINDOWS\system32\defrag.exe" C: -f
Next Run Time: 11/15/2008 1:00:00 AM
Status:        The task is ready to run at its next scheduled time
Creator:       Owner
Comments:      Disk Defragmenter
----------
Taskname:      McQcTask.job
File:          c:\program files\mcafee\mqc\QcConsol.exe
c:\program files\mcafee\mqc\QcConsol.exe
222496 bytes
Created:  5/12/2007
Modified: 12/4/2007
Company:  McAfee, Inc.
Parameters:    14 0
Next Run Time: 12/1/2008 1:00:00 AM
Status:        The task is ready to run at its next scheduled time
Creator:       Owner
Comments:      McAfee McAfee QuickClean
----------

************************************************************
4:28:04 PM: Scanning ----- SHELLICONOVERLAYIDENTIFIERS -----

************************************************************
4:28:04 PM: ----- ADDITIONAL CHECKS -----
PE386 rootkit checks completed
----------
Winlogon registry rootkit checks completed
----------
Heuristic checks for hidden files/drivers completed
----------
Layered Service Provider entries checks completed
----------
Windows Explorer Policies checks completed
----------
Desktop Wallpaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
1440054 bytes
Created:  12/21/2004
Modified: 7/25/2007
Company:  
----------
Web Desktop Wallpaper: %USERPROFILE%\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
1440054 bytes
Created:  12/21/2004
Modified: 7/25/2007
Company:  
----------
Additional checks completed

************************************************************
4:28:08 PM: Scanning ----- RUNNING PROCESSES -----

C:\WINDOWS\System32\smss.exe
--------------------
C:\WINDOWS\system32\csrss.exe
--------------------
C:\WINDOWS\system32\winlogon.exe
--------------------
C:\WINDOWS\system32\services.exe
--------------------
C:\WINDOWS\system32\lsass.exe
--------------------
C:\WINDOWS\system32\svchost.exe
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
--------------------
C:\WINDOWS\System32\svchost.exe - file already scanned
--------------------
C:\WINDOWS\System32\svchost.exe - file already scanned
--------------------
C:\WINDOWS\system32\spoolsv.exe
--------------------
C:\Program Files\a-squared Free\a2service.exe - file already scanned
--------------------
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
--------------------
C:\Program Files\Executive Software\Diskeeper\DkService.exe - file already scanned
--------------------
C:\WINDOWS\System32\inetsrv\inetinfo.exe - file already scanned
--------------------
C:\Program Files\Ahead\InCD\InCDsrv.exe - file already scanned
--------------------
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe - file already scanned
--------------------
c:\program files\common files\mcafee\mna\mcnasvc.exe - file already scanned
--------------------
C:\WINDOWS\Explorer.EXE - file already scanned
--------------------
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe - file already scanned
--------------------
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
--------------------
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe - file already scanned
--------------------
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
--------------------
C:\Program Files\McAfee\MPF\MPFSrv.exe - file already scanned
--------------------
C:\WINDOWS\System32\msdtc.exe
--------------------
C:\WINDOWS\system32\ScsiAccess.EXE - file already scanned
--------------------
C:\WINDOWS\System32\snmp.exe - file already scanned
--------------------
C:\WINDOWS\System32\svchost.exe - file already scanned
--------------------
C:\WINDOWS\system32\wdfmgr.exe
--------------------
C:\WINDOWS\System32\mqsvc.exe - file already scanned
--------------------
C:\WINDOWS\System32\mqtgsvc.exe - file already scanned
--------------------
C:\WINDOWS\System32\alg.exe
--------------------
C:\WINDOWS\system32\WgaTray.exe
--------------------
C:\WINDOWS\system32\wuauclt.exe
--------------------
C:\Program Files\Ahead\InCD\InCD.exe - file already scanned
--------------------
C:\Program Files\Browser Mouse\mouse32a.exe - file already scanned
--------------------
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe - file already scanned
--------------------
C:\Program Files\Muiltmedia keyboard utility\1.1\KbdAp32A.exe
--------------------
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe - file already scanned
--------------------
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe - file already scanned
--------------------
C:\Program Files\QuickTime\QTTask.exe - file already scanned
--------------------
C:\Program Files\iTunes\iTunesHelper.exe - file already scanned
--------------------
C:\WINDOWS\system32\ctfmon.exe - file already scanned
--------------------
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
--------------------
C:\Program Files\iPod\bin\iPodService.exe
--------------------
C:\Program Files\Support.com\bin	gcmd.exe - file already scanned
--------------------
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
--------------------
C:\Program Files\Internet Explorer\iexplore.exe
--------------------
C:\Program Files\MSN Messenger\msnmsgr.exe
--------------------
C:\Program Files\MSN Messenger\usnsvc.exe - file already scanned
--------------------
C:\Program Files\Mozilla Firefox\firefox.exe
--------------------
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe - file already scanned
--------------------
c:\PROGRA~1\mcafee\msc\mcshell.exe
--------------------
C:\Program Files\Common Files\Real\Update_OBealsched.exe - file already scanned
--------------------
C:\Documents and Settings\Owner\Application Data\Simply Super Software\Trojan Remover\ucj8E9.exe
FileSize:          2888568
[This is a Trojan Remover component]
--------------------
--------------------
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
--------------------
C:\WINDOWS\system32\wscntfy.exe
--------------------

************************************************************
4:28:59 PM: Checking AUTOEXEC.NT file
AUTOEXEC.NT found in C:\WINDOWS\system32
No malicious entries were found in the AUTOEXEC.NT file

************************************************************
4:29:00 PM: Checking HOSTS file
No malicious entries were found in the HOSTS file

************************************************************
------ INTERNET EXPLORER HOME/START/SEARCH SETTINGS ------
HKLM\Software\Microsoft\Internet Explorer\Main\"Start Page":
https://www.msn.com/fr-fr/?ocid=iehp
HKLM\Software\Microsoft\Internet Explorer\Main\"Local Page":
%SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main\"Search Page":
https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Page_URL":
https://www.msn.com/fr-fr/?ocid=iehp
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Search_URL":
https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
HKLM\Software\Microsoft\Internet Explorer\Search\"CustomizeSearch":
https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm
HKLM\Software\Microsoft\Internet Explorer\Search\"SearchAssistant":
https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Start Page":
https://fr.yahoo.com/?p=us
HKCU\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\WINDOWS\system32\blank.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Search Page":
http://red.clientapps.yahoo.com/customize/ie/defaults/sp/sbcydsl/*https://fr.yahoo.com/?p=us
HKCU\Software\Microsoft\Internet Explorer\Search\"CustomizeSearch":
https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm
HKCU\Software\Microsoft\Internet Explorer\Search\"SearchAssistant":
https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm

************************************************************
=== NO CHANGES HAVE BEEN MADE TO YOUR SYSTEM FILES ===
Scan completed at: 4:29:00 PM 12 Nov 2008
Total Scan time: 00:04:35
************************************************************


***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.7.4.2551. For information, email support@simplysup1.com
[Unregistered version]
Scan started at: 4:24:23 PM 12 Nov 2008
Using Database v7197
Operating System:  Windows XP SP2 [Windows XP Professional Service Pack 2 (Build 2600)]
File System:       NTFS
Data directory:     C:\Documents and Settings\Owner\Application Data\Simply Super Software\Trojan Remover\
Database directory: C:\Program Files\Trojan Remover\
Logfile directory:  C:\Documents and Settings\Owner\My Documents\Simply Super Software\Trojan Remover Logfiles\
Program directory:  C:\Program Files\Trojan Remover\
Running with Administrator privileges

************************************************************
The following Anti-Malware program(s) are loaded:
McAfee Anti-Virus

************************************************************


************************************************************
4:24:25 PM: Scanning ----------WIN.INI-----------
WIN.INI found in C:\WINDOWS

************************************************************
4:24:25 PM: Scanning --------SYSTEM.INI---------
SYSTEM.INI found in C:\WINDOWS

************************************************************
4:24:26 PM: ----- SCANNING FOR ROOTKIT SERVICES -----
No hidden Services were detected.

************************************************************
4:24:39 PM: Scanning -----WINDOWS REGISTRY-----
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
This key's "Shell" value calls the following program(s):
File: Explorer.exe
C:\WINDOWS\Explorer.exe
1033216 bytes
Created:  5/11/2003
Modified: 6/13/2007
Company:  Microsoft Corporation
----------
This key's "Userinit" value calls the following program(s):
File: C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\userinit.exe
24576 bytes
Created:  8/23/2001
Modified: 8/4/2004
Company:  Microsoft Corporation
----------
This key's "System" value appears to be blank
----------
This key's "UIHost" value calls the following program:
File: logonui.exe
C:\WINDOWS\system32\logonui.exe
514560 bytes
Created:  5/14/2004
Modified: 8/4/2004
Company:  Microsoft Corporation
----------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
Value Name: load
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: InCD
Value Data: C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Ahead\InCD\InCD.exe
1155122 bytes
Created:  5/14/2004
Modified: 7/24/2003
Company:  Ahead Software AG
--------------------
Value Name: NeroFilterCheck
Value Data: C:\WINDOWS\system32\NeroCheck.exe
C:\WINDOWS\system32\NeroCheck.exe
155648 bytes
Created:  5/14/2004
Modified: 7/9/2001
Company:  Ahead Software Gmbh
--------------------
Value Name: MsmqIntCert
Value Data: regsvr32 /s mqrt.dll
C:\WINDOWS\system32\mqrt.dll
177152 bytes
Created:  5/14/2004
Modified: 7/6/2007
Company:  Microsoft Corporation
--------------------
Value Name: Pure Networks Port Magic
Value Data: "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe
99480 bytes
Created:  1/14/2005
Modified: 5/7/2004
Company:  Pure Networks, Inc.
--------------------
Value Name: FLMOFFICE4DMOUSE
Value Data: C:\Program Files\Browser Mouse\mouse32a.exe
C:\Program Files\Browser Mouse\mouse32a.exe
360448 bytes
Created:  2/7/2005
Modified: 2/7/2005
Company:  
--------------------
Value Name: FLMK08KB
Value Data: C:\Program Files\Muiltmedia keyboard utility\1.1\MMKEYBD.EXE
C:\Program Files\Muiltmedia keyboard utility\1.1\MMKEYBD.EXE
207360 bytes
Created:  2/7/2005
Modified: 2/7/2005
Company:  
--------------------
Value Name: RemoteControl
Value Data: "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
32768 bytes
Created:  2/8/2005
Modified: 10/31/2003
Company:  Cyberlink Corp.
--------------------
Value Name: YOP
Value Data: C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
C:\PROGRA~1\Yahoo!\YOP\yop.exe [file not found to scan]
--------------------
Value Name: HP Software Update
Value Data: C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
54840 bytes
Created:  5/8/2007
Modified: 5/8/2007
Company:  Hewlett-Packard
--------------------
Value Name: Motive SmartBridge
Value Data: C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
442455 bytes
Created:  1/10/2007
Modified: 8/24/2005
Company:  Motive, Inc.
--------------------
Value Name: tgcmd
Value Data: C:\Program Files\Support.com\bin	gcmd.exe /server /startmonitor /deaf
C:\Program Files\Support.com\bin	gcmd.exe
1773568 bytes
Created:  6/2/2006
Modified: 3/7/2007
Company:  SupportSoft, Inc.
--------------------
Value Name: Adobe Photo Downloader
Value Data: "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe [file not found to scan]
--------------------
Value Name: QuickTime Task
Value Data: "C:\Program Files\QuickTime\QTTask.exe" -atboottime
C:\Program Files\QuickTime\QTTask.exe
413696 bytes
Created:  3/28/2008
Modified: 3/28/2008
Company:  Apple Inc.
--------------------
Value Name: iTunesHelper
Value Data: "C:\Program Files\iTunes\iTunesHelper.exe"
C:\Program Files\iTunes\iTunesHelper.exe
267048 bytes
Created:  3/30/2008
Modified: 3/30/2008
Company:  Apple Inc.
--------------------
Value Name: TkBellExe
Value Data: "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
C:\Program Files\Common Files\Real\Update_OBealsched.exe
185896 bytes
Created:  3/8/2006
Modified: 5/9/2008
Company:  RealNetworks, Inc.
--------------------
Value Name: mcagent_exe
Value Data: C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
C:\Program Files\McAfee.com\Agent\mcagent.exe
582992 bytes
Created:  5/12/2007
Modified: 11/1/2007
Company:  McAfee, Inc.
--------------------
Value Name: TrojanScanner
Value Data: C:\Program Files\Trojan Remover\Trjscan.exe /boot
C:\Program Files\Trojan Remover\Trjscan.exe
1233800 bytes
Created:  11/12/2008
Modified: 11/8/2008
Company:  Simply Super Software
--------------------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value Name: ctfmon.exe
Value Data: C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\ctfmon.exe
15360 bytes
Created:  5/14/2004
Modified: 8/4/2004
Company:  Microsoft Corporation
--------------------
Value Name: System Soap Pro
Value Data: C:\PROGRA~1\SYSTEM~1\soap.exe min
C:\PROGRA~1\SYSTEM~1\soap.exe [file not found to scan]
--------------------
Value Name: HBt9RTH3W
Value Data: clsaysvr.exe
clsaysvr.exe [file not found to scan]
--------------------
Value Name: ufqz
Value Data: C:\PROGRA~1\COMMON~1\ufqz\ufqzm.exe
C:\PROGRA~1\COMMON~1\ufqz\ufqzm.exe [file not found to scan]
--------------------
Value Name: SRS Audio Sandbox
Value Data: "C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe" /hideme
C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe [file not found to scan]
--------------------
Value Name: VoipStunt
Value Data: "C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe" -nosplash -minimized
C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe
8824112 bytes
Created:  10/25/2008
Modified: 12/13/2007
Company:  VoipStunt
--------------------
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
Value Name: FlashPlayerUpdate
Value Data: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe -p
C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
218496 bytes
Created:  11/20/2007
Modified: 11/20/2007
Company:  Adobe Systems, Inc.
--------------------
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty

************************************************************
4:25:33 PM: Scanning -----SHELLEXECUTEHOOKS-----
ValueName: {AEB6717E-7E19-11d0-97EE-00C04FD91972}
File:      shell32.dll - this file is expected and has been left in place
----------

************************************************************
4:25:33 PM: Scanning -----HIDDEN REGISTRY ENTRIES-----
Taskdir check completed
----------
No Hidden File-loading Registry Entries found
----------

************************************************************
4:25:39 PM: Scanning -----ACTIVE SCREENSAVER-----
No active ScreenSaver found to scan.

************************************************************
4:25:39 PM: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----
Key:  {6BF52A52-394A-11d3-B153-00C04F79FAA6}
Path: rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub
C:\WINDOWS\INF\wmp10.inf
34751 bytes
Created:  1/24/2005
Modified: 1/28/2005
Company:  
----------
Key:  {8b15971b-5355-4c82-8c07-7e181ea07608}
Path: rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser
C:\WINDOWS\INF\fxsocm.inf
50680 bytes
Created:  8/4/2004
Modified: 8/4/2004
Company:  
----------

************************************************************
4:25:46 PM: Scanning ----- SERVICEDLL REGISTRY KEYS -----
Key: HidServ
%SystemRoot%\System32\hidserv.dll - file is globally excluded (file cannot be found)
--------------------
Key:  NWCWorkstation
Path: %SystemRoot%\System32
wwks.dll
C:\WINDOWS\System32
wwks.dll
65536 bytes
Created:  5/14/2004
Modified: 10/13/2006
Company:  Microsoft Corporation
--------------------

************************************************************
4:25:56 PM: Scanning ----- SERVICES REGISTRY KEYS -----
Key:       a2free
ImagePath: "C:\Program Files\a-squared Free\a2service.exe"
C:\Program Files\a-squared Free\a2service.exe
419448 bytes
Created:  11/6/2008
Modified: 11/6/2008
Company:  Emsi Software GmbH
----------
Key:       AN983
ImagePath: System32\DRIVERS\AN983.sys
C:\WINDOWS\System32\DRIVERS\AN983.sys
36224 bytes
Created:  5/21/2004
Modified: 8/28/2002
Company:  ADMtek Incorporated.
----------
Key:       aspnet_state
ImagePath: %SystemRoot%\Microsoft.NET\Framework\v2.0.50215\aspnet_state.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50215\aspnet_state.exe
22016 bytes
Created:  4/8/2005
Modified: 4/8/2005
Company:  Microsoft Corporation
----------
Key:       catchme
ImagePath: \??\C:\DOCUME~1\Owner\LOCALS~1\Temp\catchme.sys - this file is globally excluded
----------
Key:       clr_optimization_v2.0.50215_32
ImagePath: C:\WINDOWS\Microsoft.NET\Framework\v2.0.50215\mscorsvw.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50215\mscorsvw.exe
56320 bytes
Created:  4/8/2005
Modified: 4/8/2005
Company:  Microsoft Corporation
----------
Key:       Diskeeper
ImagePath: C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
426098 bytes
Created:  8/22/2003
Modified: 8/22/2003
Company:  Executive Software International, Inc.
----------
Key:       FastNIC
ImagePath: System32\DRIVERS\FastNIC.sys
C:\WINDOWS\System32\DRIVERS\FastNIC.sys
38528 bytes
Created:  5/21/2002
Modified: 5/21/2002
Company:  ADMtek Incorporated.
----------
Key:       HPZid412
ImagePath: system32\DRIVERS\HPZid412.sys
C:\WINDOWS\system32\DRIVERS\HPZid412.sys
-R- 49664 bytes
Created:  12/13/2006
Modified: 4/12/2006
Company:  HP
----------
Key:       HPZipr12
ImagePath: system32\DRIVERS\HPZipr12.sys
C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
-R- 16496 bytes
Created:  12/13/2006
Modified: 4/12/2006
Company:  HP
----------
Key:       HPZius12
ImagePath: system32\DRIVERS\HPZius12.sys
C:\WINDOWS\system32\DRIVERS\HPZius12.sys
21568 bytes
Created:  4/12/2006
Modified: 4/12/2006
Company:  HP
----------
Key:       IISADMIN
ImagePath: C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
15872 bytes
Created:  5/14/2004
Modified: 8/4/2004
Company:  Microsoft Corporation
----------
Key:       InCDPass
ImagePath: System32\DRIVERS\InCDPass.sys
C:\WINDOWS\System32\DRIVERS\InCDPass.sys
28432 bytes
Created:  5/14/2004
Modified: 7/24/2003
Company:  Ahead Software
----------
Key:       InCDsrv
ImagePath: C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
786484 bytes
Created:  5/14/2004
Modified: 7/24/2003
Company:  AHEAD Software
----------
Key:       LVUSBSta
ImagePath: system32\drivers\lvusbsta.sys
C:\WINDOWS\system32\drivers\lvusbsta.sys [file not found to scan]
----------
Key:       mcmscsvc
ImagePath: C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
767976 bytes
Created:  5/12/2007
Modified: 1/9/2008
Company:  McAfee, Inc.
----------
Key:       McNASvc
ImagePath: "c:\program files\common files\mcafee\mna\mcnasvc.exe"
c:\program files\common files\mcafee\mna\mcnasvc.exe
2458128 bytes
Created:  5/12/2007
Modified: 1/25/2008
Company:  McAfee, Inc.
----------
Key:       McODS
ImagePath: C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
378184 bytes
Created:  5/12/2007
Modified: 11/7/2007
Company:  McAfee, Inc.
----------
Key:       McProxy
ImagePath: c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
359248 bytes
Created:  10/10/2008
Modified: 8/15/2007
Company:  McAfee, Inc.
----------
Key:       McShield
ImagePath: C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
144704 bytes
Created:  5/12/2007
Modified: 7/24/2007
Company:  McAfee, Inc.
----------
Key:       McSysmon
ImagePath: C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
695624 bytes
Created:  5/12/2007
Modified: 12/5/2007
Company:  McAfee, Inc.
----------
Key:       mfeavfk
ImagePath: system32\drivers\mfeavfk.sys
C:\WINDOWS\system32\drivers\mfeavfk.sys
79304 bytes
Created:  5/12/2007
Modified: 11/22/2007
Company:  McAfee, Inc.
----------
Key:       mfebopk
ImagePath: system32\drivers\mfebopk.sys
C:\WINDOWS\system32\drivers\mfebopk.sys
35240 bytes
Created:  5/12/2007
Modified: 11/22/2007
Company:  McAfee, Inc.
----------
Key:       mfehidk
ImagePath: system32\drivers\mfehidk.sys
C:\WINDOWS\system32\drivers\mfehidk.sys
201320 bytes
Created:  5/12/2007
Modified: 11/22/2007
Company:  McAfee, Inc.
----------
Key:       mferkdk
ImagePath: system32\drivers\mferkdk.sys
C:\WINDOWS\system32\drivers\mferkdk.sys
33832 bytes
Created:  5/12/2007
Modified: 11/22/2007
Company:  McAfee, Inc.
----------
Key:       mfesmfk
ImagePath: system32\drivers\mfesmfk.sys
C:\WINDOWS\system32\drivers\mfesmfk.sys
40488 bytes
Created:  5/12/2007
Modified: 12/2/2007
Company:  McAfee, Inc.
----------
Key:       MPFP
ImagePath: System32\Drivers\Mpfp.sys
C:\WINDOWS\System32\Drivers\Mpfp.sys
113952 bytes
Created:  5/12/2007
Modified: 7/13/2007
Company:  McAfee, Inc.
----------
Key:       MpfService
ImagePath: "C:\Program Files\McAfee\MPF\MPFSrv.exe"
C:\Program Files\McAfee\MPF\MPFSrv.exe
856864 bytes
Created:  5/12/2007
Modified: 7/18/2007
Company:  McAfee, Inc.
----------
Key:       MQAC
ImagePath: \??\C:\WINDOWS\System32\drivers\mqac.sys
C:\WINDOWS\System32\drivers\mqac.sys
72960 bytes
Created:  5/14/2004
Modified: 7/6/2007
Company:  Microsoft Corporation
----------
Key:       MR97310_USB_DUAL_CAMERA
ImagePath: system32\DRIVERS\mr97310c.sys
C:\WINDOWS\system32\DRIVERS\mr97310c.sys
130309 bytes
Created:  8/7/2007
Modified: 9/9/2002
Company:  DUCam Technology Inc.
----------
Key:       MSFtpsvc
ImagePath: %SystemRoot%\System32\inetsrv\inetinfo.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
15872 bytes
Created:  5/14/2004
Modified: 8/4/2004
Company:  Microsoft Corporation
----------
Key:       MSMQ
ImagePath: C:\WINDOWS\System32\mqsvc.exe
C:\WINDOWS\System32\mqsvc.exe
4608 bytes
Created:  8/23/2001
Modified: 8/4/2004
Company:  Microsoft Corporation
----------
Key:       MSMQTriggers
ImagePath: C:\WINDOWS\System32\mqtgsvc.exe
C:\WINDOWS\System32\mqtgsvc.exe
117248 bytes
Created:  8/23/2001
Modified: 8/4/2004
Company:  Microsoft Corporation
----------
Key:       ms_mpu401
ImagePath: system32\drivers\msmpu401.sys
C:\WINDOWS\system32\drivers\msmpu401.sys
2944 bytes
Created:  12/31/2000
Modified: 8/17/2001
Company:  Microsoft Corporation
----------
Key:       nvport
ImagePath: \??\C:\WINDOWS\system32\Drivers
vport.sys
C:\WINDOWS\system32\Drivers
vport.sys [file not found to scan]
----------
Key:       NwlnkIpx
ImagePath: System32\DRIVERS
wlnkipx.sys
C:\WINDOWS\System32\DRIVERS
wlnkipx.sys
88448 bytes
Created:  8/23/2001
Modified: 8/4/2004
Company:  Microsoft Corporation
----------
Key:       NwlnkNb
ImagePath: System32\DRIVERS
wlnknb.sys
C:\WINDOWS\System32\DRIVERS
wlnknb.sys
63232 bytes
Created:  8/23/2001
Modified: 8/23/2001
Company:  Microsoft Corporation
----------
Key:       NwlnkSpx
ImagePath: System32\DRIVERS
wlnkspx.sys
C:\WINDOWS\System32\DRIVERS
wlnkspx.sys
55936 bytes
Created:  8/23/2001
Modified: 8/23/2001
Company:  Microsoft Corporation
----------
Key:       NWRDR
ImagePath: System32\DRIVERS
wrdr.sys
C:\WINDOWS\System32\DRIVERS
wrdr.sys
163584 bytes
Created:  5/14/2004
Modified: 10/13/2006
Company:  Microsoft Corporation
----------
Key:       OVT511Plus
ImagePath: System32\Drivers\omcamvid.sys
C:\WINDOWS\System32\Drivers\omcamvid.sys
160073 bytes
Created:  10/11/2000
Modified: 9/18/2000
Company:  OmniVision Technologies, Inc.
----------
Key:       pavboot
ImagePath: system32\drivers\pavboot.sys
C:\WINDOWS\system32\drivers\pavboot.sys
28544 bytes
Created:  11/10/2008
Modified: 6/19/2008
Company:  Panda Security, S.L.
----------
Key:       pfc
ImagePath: system32\drivers\pfc.sys
C:\WIND

geoffrey5 · Answer

ok... Est ce que tu as les logiciels ad-aware et spybot ??

grandtoure · Answer

non, je ne les ai pas

geoffrey5 · Answer

les voici :

Ad-aware

Spybot

Fais une mise à jour et une analyse complete avec chaques logiciels (une analyse à la fois)

grandtoure · Answer

ca y est. c est fait. je comprends pas, l ordi est toujours un peu lent.

geoffrey5 · Answer

Salut !!

refais une mise à jour et une analyse complete avec malwarebytes stp

grandtoure · Answer

Malwarebytes' Anti-Malware 1.30
Database version: 1360
Windows 5.1.2600 Service Pack 2

11/14/2008 4:14:36 PM
mbam-log-2008-11-14 (16-14-36).txt

Scan type: Full Scan (C:\|)
Objects scanned: 105563
Time elapsed: 3 hour(s), 51 minute(s), 29 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

geoffrey5 · Answer

Salut !!

&#x25B6; Télécharge Combofix de sUBs 


&#x25B6; et enregistre le sur le Bureau. 

  
&#x25B6; désactive tes protections et ferme toutes tes applications(antivirus, parefeu, garde en temps réel de l'antispyware) 


Voici le tutoriel officiel de Bleeping Computer pour savoir l utiliser :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
 

ensuite envois le rapport et refais un nouveau rapport hijackthis stp

grandtoure · Answer

ComboFix 08-11-17.06 - Owner 2008-11-18 14:31:08.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.149 [GMT -5:00] Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\IE4 Error Log.txt c:\windows\system32\Cache . ((((((((((((((((((((((((( Files Created from 2008-10-18 to 2008-11-18 ))))))))))))))))))))))))))))))) . 2008-11-13 15:34 . 2008-11-13 15:34 d-------- c:\windows\Sun 2008-11-13 15:17 . 2008-11-13 15:16 410,976 --a------ c:\windows\system32\deploytk.dll 2008-11-13 15:17 . 2008-11-13 15:16 73,728 --a------ c:\windows\system32\javacpl.cpl 2008-11-13 15:15 . 2008-11-13 15:15 d-------- c:\program files\Java 2008-11-13 14:21 . 2008-11-13 14:27 d-------- c:\documents and settings\All Users\Application Data\Lavasoft 2008-11-12 19:30 . 2008-11-13 12:48 d-------- c:\program files\Spybot - Search & Destroy 2008-11-12 19:30 . 2008-11-13 13:14 d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2008-11-12 17:39 . 2008-11-12 17:39 1,172 --a------ c:\windows\mozver.dat 2008-11-12 17:36 . 2008-11-12 17:36 d-------- c:\program files\MSXML 4.0 2008-11-12 16:16 . 2008-11-12 16:16 d-------- c:\documents and settings\All Users\Application Data\TEMP 2008-11-10 15:18 . 2008-11-13 15:53 d-------- c:\program files\Panda Security 2008-11-10 12:49 . 2008-11-10 12:56 d-------- c:\windows\BDOSCAN8 2008-11-07 20:33 . 2008-11-07 20:34 d-------- c:\windows\ERUNT 2008-11-07 20:33 . 2001-08-18 12:00 1,688 --a------ c:\windows\system32\AUTOEXEC.NT 2008-11-07 19:59 . 2008-11-08 19:13 d-------- C:\SDFix 2008-11-06 19:53 . 2008-11-06 19:53 d-------- C:\Poker 2008-11-05 13:15 . 2008-11-05 13:15 3,452 --a------ c:\windows\system32 mp.reg 2008-11-05 13:12 . 2007-09-05 23:22 289,144 --a------ c:\windows\system32\VCCLSID.exe 2008-11-05 13:12 . 2006-04-27 16:49 288,417 --a------ c:\windows\system32\SrchSTS.exe 2008-11-05 13:12 . 2008-09-08 22:38 88,576 --a------ c:\windows\system32\AntiXPVSTFix.exe 2008-11-05 13:12 . 2008-10-01 14:51 87,552 --a------ c:\windows\system32\VACFix.exe 2008-11-05 13:12 . 2008-10-10 07:58 82,944 --a------ c:\windows\system32\o4Patch.exe 2008-11-05 13:12 . 2008-10-10 07:58 82,944 --a------ c:\windows\system32\IEDFix.C.exe 2008-11-05 13:12 . 2008-08-18 11:19 82,432 --a------ c:\windows\system32\404Fix.exe 2008-11-05 13:12 . 2004-07-31 17:50 51,200 --a------ c:\windows\system32\dumphive.exe 2008-11-05 13:12 . 2007-10-03 23:36 25,600 --a------ c:\windows\system32\WS2Fix.exe 2008-11-05 12:31 . 2008-11-05 12:51 d-------- C:\Lop SD 2008-11-03 16:58 . 2008-11-07 05:20 d-------- c:\program files\Malwarebytes' Anti-Malware 2008-11-03 16:58 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2008-11-03 16:58 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2008-11-03 16:27 . 2008-11-03 16:34 d-------- C:\ToolBar SD 2008-10-25 12:36 . 2008-10-25 12:39 d-------- c:\documents and settings\Owner\Application Data\VoipStunt 2008-10-25 12:34 . 2008-10-25 12:34 d-------- c:\program files\VoipStunt.com . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-03 18:29 --------- d-----w c:\program files\Navilog1 2008-10-24 17:06 --------- d-----w c:\program files\Apple Software Update 2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-16 19:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 19:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 19:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 19:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 19:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 19:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 19:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 19:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-10 21:01 --------- d-----w c:\program files\McAfee 2008-10-10 19:03 --------- d-----w c:\program files\Common Files\McAfee 2008-10-10 18:03 --------- d-----w c:\documents and settings\Owner\Application Data\Malwarebytes 2008-10-10 18:02 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes 2008-10-10 17:13 --------- d-----w c:\program files\Trend Micro 2008-09-30 21:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll 2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\win32k.sys 2008-09-04 16:42 1,106,944 ----a-w c:\windows\system32\msxml3.dll 2008-08-28 08:00 74,752 ----a-w c:\windows\system32\msw3prt.dll 2008-08-28 08:00 104,448 ----a-w c:\windows\system32\win32spl.dll 2008-08-26 07:24 826,368 ----a-w c:\windows\system32\wininet.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "VoipStunt"="c:\program files\VoipStunt.com\VoipStunt\VoipStunt.exe" [2007-12-13 8824112] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "InCD"="c:\program files\Ahead\InCD\InCD.exe" [2003-07-24 1155122] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "Pure Networks Port Magic"="c:\progra~1\PURENE~1\PORTMA~1\PortAOL.exe" [2004-05-07 99480] "FLMOFFICE4DMOUSE"="c:\program files\Browser Mouse\mouse32a.exe" [2005-02-07 360448] "FLMK08KB"="c:\program files\Muiltmedia keyboard utility\1.1\MMKEYBD.EXE" [2005-02-07 207360] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "Motive SmartBridge"="c:\progra~1\SBCSEL~1\SMARTB~1\MotiveSB.exe" [2005-08-24 442455] "tgcmd"="c:\program files\Support.com\bin gcmd.exe" [2007-03-07 1773568] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-03-28 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048] "TkBellExe"="c:\program files\Common Files\Real\Update_OB ealsched.exe" [2008-05-09 185896] "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-13 136600] "MsmqIntCert"="mqrt.dll" [2007-07-06 c:\windows\system32\mqrt.dll] c:\documents and settings\All Users\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472] Microsoft Office OneNote 2003 Quick Launch.lnk - c:\program files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-04-19 64864] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "SpecifyDefaultButtons"= 1 (0x1) "Btn_Search"= 2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.MJPG"= m3jpeg32.dll "vidc.dmb1"= m3jpeg32.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\WINDOWS\system32\mqsvc.exe"= "%windir%\system32\sessmgr.exe"= "c:\Program Files\Messenger\msmsgs.exe"= "c:\Program Files\Real\RealPlayer\realplay.exe"= "c:\Program Files\PeerCast\PeerCast.exe"= "c:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"= "c:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"= "c:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"= "c:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"= "c:\Program Files\HP\Digital Imaging\bin\hposid01.exe"= "c:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"= "c:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"= "c:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"= "c:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"= "c:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"= "c:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"= "c:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"= "c:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"= "c:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"= "c:\Program Files\NetMeeting\conf.exe"= "c:\Program Files\Windows Media Player\wmplayer.exe"= "c:\Program Files\QuickTime\QuickTimePlayer.exe"= "c:\Program Files\MSN Messenger\msnmsgr.exe"= "c:\Program Files\MSN Messenger\livecall.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "c:\Program Files\iTunes\iTunes.exe"= "c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe"= "c:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "7144:TCP"= 7144:TCP:AITVPornPeer "7143:TCP"= 7143:TCP:hotmail.com R3 FastNIC;SMC EZ Card 10/100 (SMC1244TX V2);c:\windows\system32\DRIVERS\FastNIC.sys [2002-05-21 38528] S3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter;c:\windows\system32\DRIVERS\AN983.sys [2004-05-21 36224] S4 hpt3xx;hpt3xx; [] . Contents of the 'Scheduled Tasks' folder 2008-11-13 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34] 2008-10-15 c:\windows\Tasks\McDefragTask.job - c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 13:32] 2008-04-01 c:\windows\Tasks\McQcTask.job - c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 13:32] . - - - - ORPHANS REMOVED - - - - HKCU-Run-System Soap Pro - c:\progra~1\SYSTEM~1\soap.exe HKCU-Run-ufqz - c:\progra~1\COMMON~1\ufqz\ufqzm.exe HKCU-Run-SRS Audio Sandbox - c:\program files\SRS Labs\Audio Sandbox\SRSSSC.exe HKCU-Run-HBt9RTH3W - clsaysvr.exe HKLM-Run-YOP - c:\progra~1\Yahoo!\YOP\yop.exe HKLM-Run-Adobe Photo Downloader - c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe HKLM-Run-TrojanScanner - c:\program files\Trojan Remover\Trjscan.exe . ------- Supplementary Scan ------- . FireFox -: Profile - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\327gjg5p.default\ . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-18 14:41:59 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... c:\windows\TEMP\g3h6kjdk.TMP 616448 bytes scan completed successfully hidden files: 1 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Executive Software\Diskeeper\DkService.exe c:\windows\system32\inetsrv\inetinfo.exe c:\program files\Ahead\InCD\incdsrv.exe c:\program files\Java\jre6\bin\jqs.exe c:\progra~1\McAfee\MSC\mcmscsvc.exe c:\program files\Common Files\McAfee\MNA\McNASvc.exe c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\program files\McAfee\MPF\MpfSrv.exe c:\windows\system32\msdtc.exe c:\windows\system32\HPZipm12.exe c:\windows\system32\ScsiAccess.EXE c:\windows\system32\snmp.exe c:\windows\system32\wdfmgr.exe c:\windows\system32\mqsvc.exe c:\windows\system32\mqtgsvc.exe c:\windows\system32\WgaTray.exe c:\program files\Muiltmedia keyboard utility\1.1\KBDAP32A.EXE c:\progra~1\McAfee\MSC\mcuimgr.exe c:\program files\HP\Digital Imaging\bin\hpqste08.exe c:\windows\system32\imapi.exe . ************************************************************************** . Completion time: 2008-11-18 14:53:59 - machine was rebooted ComboFix-quarantined-files.txt 2008-11-18 19:53:34 Pre-Run: 23,065,554,944 bytes free Post-Run: 23,058,710,528 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn 222 --- E O F --- 2008-11-12 23:15:08 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:54:51, on 11/18/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Executive Software\Diskeeper\DkService.exe C:\WINDOWS\System32\inetsrv\inetinfo.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\McAfee\MPF\MPFSrv.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\ScsiAccess.EXE C:\WINDOWS\System32\snmp.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\mqsvc.exe c:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\WINDOWS\System32\mqtgsvc.exe C:\WINDOWS\system32\WgaTray.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Ahead\InCD\InCD.exe C:\Program Files\Browser Mouse\mouse32a.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Muiltmedia keyboard utility\1.1\KbdAp32A.exe C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\Common Files\Real\Update_OB ealsched.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe c:\PROGRA~1\mcafee\msc\mcuimgr.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Support.com\bin gcmd.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32 otepad.exe C:\WINDOWS\system32\CF14766.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/?p=us R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*https://fr.yahoo.com/?p=us O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer pbrowserrecordplugin.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file) O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: (no name) - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - (no file) O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Browser Mouse\mouse32a.exe O4 - HKLM\..\Run: [FLMK08KB] C:\Program Files\Muiltmedia keyboard utility\1.1\MMKEYBD.EXE O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe O4 - HKLM\..\Run: [tgcmd] C:\Program Files\Support.com\bin gcmd.exe /server /startmonitor /deaf O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB ealsched.exe" -osboot O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [VoipStunt] "C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe" -nosplash -minimized O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar oolbar.dll/SEARCH.HTML O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Download with Go!Zilla - file://C:\PROGRA~1\Go!Zilla\download-with-gozilla.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {49783ED4-258D-4f9f-BE11-137C18D3E543} - (no file) O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file) O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32 wprovau.dll O15 - Trusted Zone: http://www.listen.com O15 - Trusted Zone: https://us.napster.com/ O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} - O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://kazaliou.spaces.live.com//PhotoUpload/MsnPUpld.cab O16 - DPF: {50647AB5-18FD-4142-82B0-5852478DD0D5} (Keynote Connector Launcher 2) - http://webeffective.keynote.com/applications/pconnector/download/ConnectorLauncher.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/webplayer/stage6/windows/AutoDLDivXWebPlayerInstaller.cab O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\system32\ScsiAccess.EXE

geoffrey5 · Answer

Salut !!

relance hijackthis en cliquant sur scan only et coches ces lignes stp :

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html     
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*https://fr.yahoo.com/?p=us     
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file) 
O3 - Toolbar: (no name) - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - (no file) 
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe     
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"     
O9 - Extra button: (no name) - {49783ED4-258D-4f9f-BE11-137C18D3E543} - (no file) 
O9 - Extra button: (no name) - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file) 
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) 
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime     

puis tu cliques sur fix checked.


ensuite :

&#x25B6; Télécharge RegCleaner

&#x25B6; Une fois installé, double-clique sur son icône pour l'exécuter

&#x25B6; Dans la barre de menu, clique sur Options puis sélectionne Language => Choose the language

&#x25B6; recherche French.rlg et double-clique dessus pour appliquer la langue

&#x25B6; Clique ensuite sur Outils dans la barre de menu

&#x25B6; Sélectionne Nettoyage du registre => Nettoyeur de registre automatique

&#x25B6; RegCleaner va alors lancer le nettoyage automatiquement

&#x25B6; Coche ensuite les entrées invalides et clique sur Supprimer sélections => Terminer => Quitter


ensuite :


&#x25B6; Télécharge JavaRa.zip
 
&#x25B6; Décompresse le fichier sur ton bureau (clique droit > Extraire tout.)

&#x25B6; Double-clique sur le répertoire JavaRa obtenu.

&#x25B6; Puis double-clique sur le fichier JavaRa.exe (le .exe peut ne pas s'afficher)

&#x25B6; Clique sur Search For Updates.

&#x25B6; Sélectionne Update Using jucheck.exe puis clique sur Search.

&#x25B6; Autorise le processus à se connecter s'il te le demande, clique sur Install et suis les instructions d'installation. Cela prendra quelques minutes.

&#x25B6; Quand l'installation est terminée, revient à l'écran de JavaRa et clique sur Remove Older Versions.

&#x25B6; Clique sur Oui pour confirmer. L'outil va travailler, clique ensuite sur Ok, puis une deuxième fois sur Ok.

&#x25B6; Un rapport va s'ouvrir, copie-colle le dans ta prochaine réponse.

 * Note : le rapport se trouve aussi là : ( C:\JavaRa.log )

&#x25B6; Ferme l'application et dis moi si tu as encore des problèmes.

geoffrey5 · Answer

Tu regardes les vidéos avec quel logiciel ??

grandtoure · Answer

Et lorsque je cherchais des updates pour java..ils m'ont indique que j avais la derniere version de java

geoffrey5 · Answer

ok... je suis peut etre passé à coté dans le rapport  :s

geoffrey5 · Answer

Pour ton problème de lecture vidéo je ne vois pas ce que ça pourrait être...

Vas faire une analyse en ligne avec bitdefender à cette adresse stp (sous internet explorer) :

http://www.zebulon.fr/outils/antivirus/antivirus-en-ligne.php

et poste le rapport

grandtoure · Answer

Il y a une fenetre qui apparait et qui dit que bitdefender n a pas pu mettre a jour les definitions de virus.  Dois-je quand meme commencer l'analyse?

geoffrey5 · Answer

Salut !!

As-tu téléchargé l activeX qui s affiche dans le cadre jaune en haut de la page ??

grandtoure · Answer

BitDefender Online Scanner - Rapport virus en temps réel
  
  
 
Généré à: Wed, Nov 19, 2008 - 16:12:22
 

--------------------------------------------------------------------------------

 
  
  
 
Info d'analyse
  
  
 
Fichiers scannés
 85458
 
Infectés Fichiers
 3
 
  
  
 
 
  
  
 
Virus Détectés
  
  
 
IRC-Worm.Generic.3868
 3
 
  
  
 
 
  
  
 
 

--------------------------------------------------------------------------------
  
  
 
Ce sommaire du processus d'analyse sera utilisé par les laboratoires Antivirus BitDefender pour créer des statistiques agréguées sur l'activité des virus dans le monde.

geoffrey5 · Answer

bizarre comme rapport...

As tu encore des problèmes ??

grandtoure · Answer

L'ordi est quand meme plus rapide qu'avant. Sais-tu ou je pourra avoir de l'aide pour la lecture des videos de mon pc

geoffrey5 · Answer

est ce que tu as le logiciel Spybot ??

grandtoure · Answer

oui je l'ai. A chaque fois  que je redemarre l'ordi il y a des fenetres de spybot qui apparaossent et qui me demandent i je veux changer les modifications. Que dois-je repondre?

geoffrey5 · Answer

Tu devrais désactiver le bouclier résident, il embete plus qu autre chose...

pour le faire, fais ceci :

- ouvre spybot

- dans la barre de menu, cliques sur mode puis sélectionnes Mode avancé => réponds oui à la question

- ensuite en bas à gauche, cliques sur Outils puis sur Résidents

- décoches les 2 cases 

- ensuite recliques sur mode et sélectionnes mode par défaut

grandtoure · Answer

Sais-tu ou je pourra avoir de l'aide pour la lecture des videos de mon pc

geoffrey5 · Answer

Salut !!

tu devrais aller poster un nouveau sujet dans vidéo numérique en cliquant ici et expose ton problèmes..

Tu peux faire ceci stp :

Pour supprimer toutes les traces des logiciels qui ont servi à traiter les infections spécifiques :  

&#x25B6; Télécharge Toolscleaner sur ton Bureau  


&#x25B6; Double-clique sur ToolsCleaner2.exe et laisse le travailler 
&#x25B6; Clique sur Recherche et laisse le scan se terminer. 
&#x25B6; Clique sur Suppression pour finaliser. 
&#x25B6; Tu peux, si tu le souhaites, te servir des Options facultatives. 
&#x25B6; Clique sur Quitter, pour que le rapport puisse se créer. 
&#x25B6; Le rapport (TCleaner.txt) se trouve à la racine de votre disque dur (C:\)...colle le dans ta réponse




Désactive et réactive la Restauration du système :


Le fait de faire cette manipulation va supprimer tous les virus qui auraient pu se loger dans les
points de restauration que tu avais créé auparavant.. Il est donc recommandé de la faire : 

 
1 Dans la barre des tâches de Windows, clique sur Démarrer.
 
2 Clique avec le bouton droit de la souris sur Poste de travail puis clique sur Propriétés.
 
3 Dans l'onglet Restauration du système, coche "Désactiver la Restauration du système"

4 Clique sur Appliquer.
  
5 Ensuite décoche "Désactiver la restauration du systeme"

6 clique sur appliquer puis ok

7 vas créer un point de restauration en cliquant sur démarrer => tous les programmes => accessoires =>

outils systeme => restauration du systeme => créer un point de restauration => tu mets un nom

(exemple : après désinfection sur CCM) puis tu valides.

pour XP : Voici un tutoriel en cas de problèmes.

grandtoure · Answer

J arrive plus a voir mes messages dans hotmail sur firefox. Est-ce normal? Ca fait 3 jours

geoffrey5 · Answer

Salut !!

Peut-être à cause de la nouvelle version de Hotmail, j'avais eu un problème dans ce genre aussi y a 3 semaines

Ordi tres lent

53 réponses

Discussions similaires

Newsletters