Virus podnuha

BuTHora -  
jfkpresident Messages postés 13877 Statut Contributeur sécurité -
Bonjour,
J'&i un problème de sécurité sur mon ordinateur, à chaque fois que j'ouvre une fenêtre un message s'affiche disant je cite :

Code dangereux détecté dans le fichier C:\WINDOWS\system32\c_g1803.dll
Infection : Rootkit.Win32.Podnuha.ss
Action : échec

J'ai Neuf pack sécurité plus comme anti-virus et il n'arrive pas à le suprimer ni à le mettre en quarantaine, j'ai essayer avec norton anti-virus et c'est le même résultat.
Pourriez vous m'aider car je ne suis pas une flêche en informatique.
Merci d'avance.
A voir également:

11 réponses

jfkpresident Messages postés 13877 Statut Contributeur sécurité 1 175
 
Bonsoir ;

1) télécharge hijackthis ici:hijackthis
ceci est un outil pour diagnostiquer ton pc .

*.Enregistre HJTInstall.exe sur ton bureau
*. Double-clique sur HJTInstall.exe pour lancer le programme
*. Par défaut, il s'installera là C:\Program Files\Trend Micro\HijackThis
*. Accepte la license en cliquant sur le bouton "I Accept"
*. Choisis l'option "Do a system scan and save a log file"
*. Clique sur "Save log" pour enregistrer le rapport qui s'ouvrira avec le bloc-note
*. Clique sur "Edition -> Sélectionner tout", puis sur "Edition -> Copier" pour copier tout le contenu du rapport
*. Colle le rapport que tu viens de copier sur ce forum
*. Ne fixe encore AUCUNE ligne, cela pourrait empêcher ton PC de fonctionner correctement

tutoriel générer un rapport
0
BuTHora
 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:33:08, on 13/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
C:\Program Files\Pack Securite\Common\FSMA32.EXE
C:\Program Files\Pack Securite\Anti-Virus\FSGK32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\Pack Securite\Common\FSMB32.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Pack Securite\Common\FCH32.EXE
C:\Program Files\Pack Securite\Common\FAMEH32.EXE
C:\Program Files\Pack Securite\Anti-Virus\fsqh.exe
C:\Program Files\Pack Securite\FSPC\fspc.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Pack Securite\Anti-Virus\fssm32.exe
C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Pack Securite\FSAUA\program\fsus.exe
C:\Program Files\Pack Securite\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Pack Securite\FSGUI\fsguidll.exe
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NetWaiting\netWaiting.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Fichiers communs\AOL\1169114695\ee\aolsoftware.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=5061010
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {FC6F74C0-145D-4815-B9AD-CE29318696B3} - C:\WINDOWS\system32\c_g1803.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Pack Securite\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Pack Securite\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Army browse cdrom vga] C:\Documents and Settings\All Users\Application Data\Mfcd upload army browse\dupe bolt.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [AOL Dialer] C:\Program Files\Fichiers communs\AOL\ACS\AOlDial.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [Saxo] C:\Program Files\Saxo\Saxo.exe regstart
O4 - HKCU\..\Run: [Pando] "C:\Program Files\Pando Networks\Pando\Pando.exe" /Minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Parental... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Parental... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {87AF076E-D86D-4E87-ADDD-F05804E1F150} - https://www.virginmega.fr/DownloadManager/Release/Prod/DownMan.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Pack Securite\Common\FSMA32.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
0
jfkpresident Messages postés 13877 Statut Contributeur sécurité 1 175
 
Ok ,on va commencer par ça :

télécharge lopS&D

*double-cliquez dessus pour installer le programme.
* Un raccourci sera créé sur votre bureau , double-cliquez dessus pour lancer l'outil.
*choisis la langue .
*choisis l'option 1 (recherche) .
*copie/colle le rapport sur le forum.
0
BuTHora
 
--------------------\\ Lop S&D 4.2.4-9c XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU T5500 @ 1.66GHz )
BIOS : Phoenix ROM BIOS PLUS Version 1.10 A08
USER : Ludo ( Administrator )
BOOT : Normal boot
Antivirus : Pack Securite Plus 7.00 7.00 (Activated)
Firewall : Pack Securite Plus 7.00 7.00 (Activated)
C:\ (Local Disk) - NTFS - Total:51 Go (Free:6 Go)
D:\ (Local Disk) - NTFS - Total:17 Go (Free:8 Go)
E:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
Option : [1] ( 13/11/2008|19:04 )

--------------------\\ Listing des dossiers dans APPLIC~1

[19/03/2008|18:25] C:\DOCUME~1\ADMINI~1\APPLIC~1\ATI
[10/10/2006|10:09] C:\DOCUME~1\ADMINI~1\APPLIC~1\Corel
[10/10/2006|10:17] C:\DOCUME~1\ADMINI~1\APPLIC~1\GTek
[01/09/2005|06:25] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
[10/10/2006|10:04] C:\DOCUME~1\ADMINI~1\APPLIC~1\Intel
[10/10/2006|10:02] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
[10/10/2006|10:13] C:\DOCUME~1\ADMINI~1\APPLIC~1\Symantec

[13/10/2008|21:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[28/03/2008|11:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[12/05/2008|20:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Age of Empires 3
[19/03/2008|21:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
[10/09/2007|13:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL Downloads
[12/07/2008|14:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
[12/07/2008|15:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[19/10/2006|21:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CanonBJ
[13/02/2007|10:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Creative Labs
[07/10/2008|09:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Downloaded Installations
[19/03/2007|10:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
[22/10/2008|14:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Flood Light Games
[11/09/2007|18:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\FloodLightGames
[19/03/2008|12:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\F-Secure
[19/03/2008|12:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\fssg
[29/01/2007|20:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[17/12/2007|11:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft
[10/10/2006|10:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\GTek
[10/10/2006|10:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
[10/10/2006|10:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Intel
[24/10/2008|17:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\JollyBear
[14/06/2008|16:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
[10/09/2007|14:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Macromedia
[20/03/2008|11:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
[02/03/2007|17:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee.com
[11/06/2008|12:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
[04/08/2008|02:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Mfcd upload army browse
[04/06/2008|13:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[14/07/2007|14:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Mozilla
[16/10/2006|21:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Otto
[17/03/2007|21:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
[19/03/2008|11:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SiteAdvisor
[05/01/2008|11:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
[10/05/2007|18:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
[24/10/2008|18:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[24/09/2007|12:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
[25/02/2007|12:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[04/07/2007|10:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WindowsLiveInstaller
[29/02/2008|08:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
[19/01/2008|19:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion
[24/09/2007|20:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom


[19/03/2008|18:25] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ATI
[10/10/2006|10:09] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Corel
[10/10/2006|10:17] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Gtek
[01/09/2005|06:25] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[10/10/2006|10:04] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Intel
[06/09/2007|23:33] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Macromedia
[04/07/2007|10:27] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
[10/10/2006|10:13] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec

[02/03/2007|15:47] C:\DOCUME~1\LOCALS~1\APPLIC~1\Google
[22/01/2007|09:10] C:\DOCUME~1\LOCALS~1\APPLIC~1\Macromedia
[19/10/2007|23:59] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[18/04/2008|01:00] C:\DOCUME~1\LOCALS~1\APPLIC~1\SiteAdvisor

[10/10/2006|10:09] C:\DOCUME~1\Lu\APPLIC~1\Corel
[04/12/2007|12:27] C:\DOCUME~1\Lu\APPLIC~1\Gtek
[10/10/2006|10:04] C:\DOCUME~1\Lu\APPLIC~1\Intel
[06/09/2007|23:33] C:\DOCUME~1\Lu\APPLIC~1\Macromedia
[04/12/2007|12:27] C:\DOCUME~1\Lu\APPLIC~1\Microsoft
[02/12/2007|21:47] C:\DOCUME~1\Lu\APPLIC~1\SiteAdvisor
[03/12/2007|14:06] C:\DOCUME~1\Lu\APPLIC~1\Template

[20/01/2008|18:10] C:\DOCUME~1\Ludo\APPLIC~1\Adobe
[26/01/2007|12:51] C:\DOCUME~1\Ludo\APPLIC~1\AdobeUM
[12/09/2007|22:53] C:\DOCUME~1\Ludo\APPLIC~1\AOL
[12/07/2008|16:51] C:\DOCUME~1\Ludo\APPLIC~1\Apple Computer
[10/10/2006|10:16] C:\DOCUME~1\Ludo\APPLIC~1\ATI
[22/12/2007|01:22] C:\DOCUME~1\Ludo\APPLIC~1\AutoTransfer
[10/10/2006|10:09] C:\DOCUME~1\Ludo\APPLIC~1\Corel
[07/11/2006|18:39] C:\DOCUME~1\Ludo\APPLIC~1\Corel Photo Album
[20/04/2007|12:31] C:\DOCUME~1\Ludo\APPLIC~1\CyberLink
[27/02/2007|11:03] C:\DOCUME~1\Ludo\APPLIC~1\DivX
[19/05/2008|16:16] C:\DOCUME~1\Ludo\APPLIC~1\dvdcss
[07/03/2008|21:07] C:\DOCUME~1\Ludo\APPLIC~1\EoRezo
[11/09/2007|18:31] C:\DOCUME~1\Ludo\APPLIC~1\FloodLightGames
[26/03/2008|12:16] C:\DOCUME~1\Ludo\APPLIC~1\F-Secure
[16/07/2007|09:57] C:\DOCUME~1\Ludo\APPLIC~1\Google
[17/12/2007|11:32] C:\DOCUME~1\Ludo\APPLIC~1\Grisoft
[10/10/2006|10:17] C:\DOCUME~1\Ludo\APPLIC~1\Gtek
[26/02/2007|17:46] C:\DOCUME~1\Ludo\APPLIC~1\Help
[01/09/2005|06:25] C:\DOCUME~1\Ludo\APPLIC~1\Identities
[10/10/2006|10:04] C:\DOCUME~1\Ludo\APPLIC~1\Intel
[06/03/2008|21:56] C:\DOCUME~1\Ludo\APPLIC~1\ItsLabel
[03/03/2007|09:48] C:\DOCUME~1\Ludo\APPLIC~1\Leadertech
[18/01/2007|08:55] C:\DOCUME~1\Ludo\APPLIC~1\Macromedia
[23/01/2008|19:28] C:\DOCUME~1\Ludo\APPLIC~1\mags grey audio
[27/02/2007|13:46] C:\DOCUME~1\Ludo\APPLIC~1\McAfee
[31/10/2007|11:53] C:\DOCUME~1\Ludo\APPLIC~1\Microsoft
[24/07/2007|10:00] C:\DOCUME~1\Ludo\APPLIC~1\Mozilla
[01/11/2007|20:15] C:\DOCUME~1\Ludo\APPLIC~1\MSNInstaller
[07/11/2006|18:16] C:\DOCUME~1\Ludo\APPLIC~1\Otto
[19/09/2007|12:19] C:\DOCUME~1\Ludo\APPLIC~1\Real
[10/08/2007|09:04] C:\DOCUME~1\Ludo\APPLIC~1\Samsung
[24/10/2008|12:26] C:\DOCUME~1\Ludo\APPLIC~1\SiteAdvisor
[07/06/2007|12:17] C:\DOCUME~1\Ludo\APPLIC~1\SMov
[03/03/2007|09:48] C:\DOCUME~1\Ludo\APPLIC~1\Sonic
[25/02/2007|19:27] C:\DOCUME~1\Ludo\APPLIC~1\SoundSpectrum
[22/01/2007|09:42] C:\DOCUME~1\Ludo\APPLIC~1\Sun
[10/10/2006|10:13] C:\DOCUME~1\Ludo\APPLIC~1\Symantec
[24/07/2007|10:01] C:\DOCUME~1\Ludo\APPLIC~1\Talkback
[11/12/2006|12:52] C:\DOCUME~1\Ludo\APPLIC~1\Template
[24/09/2007|12:04] C:\DOCUME~1\Ludo\APPLIC~1\Viewpoint
[11/09/2007|00:48] C:\DOCUME~1\Ludo\APPLIC~1\vlc
[18/03/2008|22:39] C:\DOCUME~1\Ludo\APPLIC~1\VMNTOOLBAR
[20/10/2007|14:37] C:\DOCUME~1\Ludo\APPLIC~1\Windows Desktop Search
[20/01/2008|18:09] C:\DOCUME~1\Ludo\APPLIC~1\Yahoo!

[19/10/2007|23:50] C:\DOCUME~1\NETWOR~1\APPLIC~1\Identities
[16/10/2006|23:20] C:\DOCUME~1\NETWOR~1\APPLIC~1\Intel
[19/10/2007|23:50] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

[20/01/2008|10:18] C:\DOCUME~1\Seb\APPLIC~1\Adobe
[19/06/2007|15:56] C:\DOCUME~1\Seb\APPLIC~1\AOL
[26/08/2008|16:41] C:\DOCUME~1\Seb\APPLIC~1\Apple Computer
[19/03/2008|18:25] C:\DOCUME~1\Seb\APPLIC~1\ATI
[10/10/2006|10:09] C:\DOCUME~1\Seb\APPLIC~1\Corel
[26/06/2007|11:28] C:\DOCUME~1\Seb\APPLIC~1\Corel Photo Album
[22/02/2008|16:40] C:\DOCUME~1\Seb\APPLIC~1\DivX
[19/04/2008|21:54] C:\DOCUME~1\Seb\APPLIC~1\dvdcss
[08/03/2008|09:50] C:\DOCUME~1\Seb\APPLIC~1\EoRezo
[17/04/2008|14:40] C:\DOCUME~1\Seb\APPLIC~1\F-Secure
[20/06/2007|13:23] C:\DOCUME~1\Seb\APPLIC~1\Google
[18/12/2007|17:14] C:\DOCUME~1\Seb\APPLIC~1\Grisoft
[10/10/2006|10:17] C:\DOCUME~1\Seb\APPLIC~1\Gtek
[22/03/2008|10:08] C:\DOCUME~1\Seb\APPLIC~1\gtk-2.0
[25/06/2007|11:16] C:\DOCUME~1\Seb\APPLIC~1\Help
[01/09/2005|06:25] C:\DOCUME~1\Seb\APPLIC~1\Identities
[10/10/2006|10:04] C:\DOCUME~1\Seb\APPLIC~1\Intel
[06/03/2008|19:47] C:\DOCUME~1\Seb\APPLIC~1\ItsLabel
[12/11/2008|14:55] C:\DOCUME~1\Seb\APPLIC~1\LimeWire
[04/07/2007|13:55] C:\DOCUME~1\Seb\APPLIC~1\Macromedia
[31/10/2008|15:54] C:\DOCUME~1\Seb\APPLIC~1\mags grey audio
[31/10/2007|23:43] C:\DOCUME~1\Seb\APPLIC~1\McAfee
[09/11/2008|14:31] C:\DOCUME~1\Seb\APPLIC~1\Microsoft
[15/07/2007|18:40] C:\DOCUME~1\Seb\APPLIC~1\Mozilla
[31/10/2007|23:39] C:\DOCUME~1\Seb\APPLIC~1\Real
[12/04/2008|10:29] C:\DOCUME~1\Seb\APPLIC~1\Samsung
[11/06/2008|13:30] C:\DOCUME~1\Seb\APPLIC~1\SiteAdvisor
[12/07/2007|20:28] C:\DOCUME~1\Seb\APPLIC~1\SoundSpectrum
[29/06/2007|16:58] C:\DOCUME~1\Seb\APPLIC~1\Sun
[10/10/2006|10:13] C:\DOCUME~1\Seb\APPLIC~1\Symantec
[15/07/2007|18:45] C:\DOCUME~1\Seb\APPLIC~1\Talkback
[20/06/2007|15:20] C:\DOCUME~1\Seb\APPLIC~1\Template
[25/08/2008|19:03] C:\DOCUME~1\Seb\APPLIC~1\Viewpoint
[17/09/2007|17:09] C:\DOCUME~1\Seb\APPLIC~1\vlc
[18/03/2008|17:59] C:\DOCUME~1\Seb\APPLIC~1\vmntoolbar
[23/10/2007|19:05] C:\DOCUME~1\Seb\APPLIC~1\Windows Desktop Search
[19/01/2008|19:34] C:\DOCUME~1\Seb\APPLIC~1\Yahoo!

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[03/11/2008 10:12][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[13/11/2008 17:35][--a------] C:\WINDOWS\tasks\GoogleUpdateTaskUser.job
[13/11/2008 19:00][--ah-----] C:\WINDOWS\tasks\A03D0B6D91B2B52D.job
[13/11/2008 18:10][--a------] C:\WINDOWS\tasks\V‚rifier les mises … jour de Windows Live Toolbar.job
[31/10/2008 17:23][--a------] C:\WINDOWS\tasks\Norton Security Scan.job
[07/11/2008 18:30][--a------] C:\WINDOWS\tasks\Recherche de virus de McAfee.com - Mon ordinateur (CATH-cathy).job
[13/11/2008 16:24][--ah-----] C:\WINDOWS\tasks\SA.DAT
[10/08/2004 12:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

( A03D0B6D91B2B52D.job )=( c:\docume~1\seb\applic~1\magsgr~1\AMENTRAYSIXTH.exe )

--------------------\\ Listing des dossiers dans C:\Program Files

[28/03/2008|11:17] C:\Program Files\Adobe
[22/10/2007|12:21] C:\Program Files\aips
[16/06/2007|17:52] C:\Program Files\AKVIS
[05/11/2008|23:02] C:\Program Files\ALCATEL PC Suite
[18/10/2007|19:35] C:\Program Files\Alwil Software
[07/09/2007|09:28] C:\Program Files\AOL 9.0a
[13/10/2008|21:35] C:\Program Files\Apple Software Update
[19/03/2008|18:21] C:\Program Files\a-squared Free
[10/10/2006|10:02] C:\Program Files\ATI Technologies
[31/08/2008|22:44] C:\Program Files\BAE
[04/01/2008|18:44] C:\Program Files\BitDefender
[13/10/2008|21:13] C:\Program Files\Bonjour
[10/10/2006|10:02] C:\Program Files\Broadcom
[19/10/2006|21:33] C:\Program Files\Canon
[04/01/2008|18:51] C:\Program Files\CCleaner
[17/09/2007|09:07] C:\Program Files\Codemasters
[10/10/2006|09:59] C:\Program Files\CONEXANT
[05/02/2007|14:22] C:\Program Files\Configs
[10/10/2006|10:09] C:\Program Files\Corel
[19/03/2008|18:36] C:\Program Files\Creative
[10/10/2006|10:04] C:\Program Files\CyberLink
[09/09/2008|11:02] C:\Program Files\Datel
[09/12/2007|14:13] C:\Program Files\Dcads Games Collection
[07/09/2007|09:28] C:\Program Files\Dell
[10/10/2006|10:17] C:\Program Files\Dell Support
[22/10/2007|12:20] C:\Program Files\Diablo II
[10/10/2006|10:03] C:\Program Files\Digital Line Detect
[09/11/2008|19:09] C:\Program Files\DivX
[21/12/2007|17:06] C:\Program Files\eMule
[08/03/2008|09:50] C:\Program Files\EoRezo
[11/04/2007|09:05] C:\Program Files\Eurobarre
[12/07/2008|14:54] C:\Program Files\Fichiers communs
[15/07/2008|14:51] C:\Program Files\Free iPod Video Converter
[01/09/2005|06:27] C:\Program Files\FrenchOtto
[17/01/2008|17:29] C:\Program Files\Fx Audio Conveter
[23/10/2007|17:03] C:\Program Files\Gamenext
[23/10/2007|16:59] C:\Program Files\GemMasterFrench
[01/03/2008|11:28] C:\Program Files\Google
[05/11/2008|23:30] C:\Program Files\Incomplete
[25/08/2008|10:26] C:\Program Files\InstallShield Installation Information
[10/10/2006|10:03] C:\Program Files\Intel
[16/10/2008|02:20] C:\Program Files\Internet Explorer
[06/10/2007|18:13] C:\Program Files\Inventel
[13/10/2008|21:32] C:\Program Files\iPod
[13/10/2008|21:33] C:\Program Files\iTunes
[07/11/2007|10:04] C:\Program Files\Java
[14/09/2007|10:02] C:\Program Files\Labtec
[14/06/2008|16:07] C:\Program Files\Lavasoft
[03/12/2006|13:29] C:\Program Files\LEGO Media
[17/04/2007|06:24] C:\Program Files\LexmarkX83
[06/11/2008|20:17] C:\Program Files\LimeWire
[04/12/2007|12:27] C:\Program Files\LocalCooling
[23/07/2008|19:35] C:\Program Files\mags grey audio
[22/10/2007|12:21] C:\Program Files\Maps
[04/09/2008|16:54] C:\Program Files\Messenger
[31/08/2008|21:58] C:\Program Files\Messenger Plus! Live
[02/11/2006|21:22] C:\Program Files\Micro Application
[04/07/2007|16:37] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[01/09/2005|06:18] C:\Program Files\microsoft frontpage
[15/08/2008|21:17] C:\Program Files\Microsoft Games
[04/12/2006|20:41] C:\Program Files\Microsoft Money
[04/12/2006|20:40] C:\Program Files\Microsoft Office
[21/10/2008|15:02] C:\Program Files\Microsoft Silverlight
[19/10/2007|23:50] C:\Program Files\Microsoft SQL Server Compact Edition
[10/09/2008|09:14] C:\Program Files\Microsoft Works
[07/09/2007|09:29] C:\Program Files\Modem Helper
[25/09/2007|07:27] C:\Program Files\Mortimer Beckett And The Secrets Of Spooky Manor
[23/10/2007|17:05] C:\Program Files\Motherboard Monitor 5
[04/09/2008|16:47] C:\Program Files\Movie Maker
[22/10/2007|12:24] C:\Program Files\movies
[13/11/2008|19:01] C:\Program Files\Mozilla Firefox
[01/11/2007|20:19] C:\Program Files\MSN
[24/10/2008|17:29] C:\Program Files\MSN Games
[01/09/2005|06:12] C:\Program Files\MSN Gaming Zone
[12/04/2008|09:57] C:\Program Files\Msncolor
[09/09/2008|11:03] C:\Program Files\MSXML 4.0
[02/07/2008|07:42] C:\Program Files\NetBattle
[04/09/2008|16:39] C:\Program Files\NetMeeting
[10/10/2006|10:03] C:\Program Files\NetWaiting
[16/06/2008|17:21] C:\Program Files\Neuf
[13/11/2008|17:06] C:\Program Files\Norton Security Scan
[24/10/2008|17:29] C:\Program Files\Oberon Media
[12/02/2008|17:47] C:\Program Files\Odebit Multim‚dia
[01/09/2005|06:13] C:\Program Files\Online Services
[04/09/2008|16:58] C:\Program Files\Outlook Express
[21/10/2008|11:47] C:\Program Files\Pack Securite
[31/08/2007|16:22] C:\Program Files\Pando Networks
[13/10/2008|21:29] C:\Program Files\QuickTime
[14/06/2007|19:58] C:\Program Files\Real
[22/10/2007|12:24] C:\Program Files\redist
[19/09/2007|23:37] C:\Program Files\ReflexiveArcade
[03/08/2007|16:45] C:\Program Files\Samsung
[22/10/2007|12:24] C:\Program Files\scenario
[22/10/2007|12:24] C:\Program Files\scriptlibs
[01/09/2005|06:15] C:\Program Files\Services en ligne
[22/10/2007|12:24] C:\Program Files\shaders
[15/08/2008|20:42] C:\Program Files\Shareaza
[22/10/2007|12:33] C:\Program Files\Sierra
[10/10/2006|09:59] C:\Program Files\Sigmatel
[22/05/2008|19:05] C:\Program Files\SiteAdvisor
[05/02/2007|14:22] C:\Program Files\Skins
[18/10/2007|12:11] C:\Program Files\SLD Codec Pack
[10/10/2006|10:07] C:\Program Files\Sonic
[30/03/2007|15:55] C:\Program Files\SoundSpectrum
[10/05/2007|18:02] C:\Program Files\SpeedFan
[05/01/2008|11:19] C:\Program Files\Spybot - Search & Destroy
[10/10/2006|10:01] C:\Program Files\Synaptics
[04/01/2008|20:05] C:\Program Files\Trend Micro
[24/07/2007|12:48] C:\Program Files\TurnTool
[01/11/2007|13:05] C:\Program Files\VideoLAN
[13/01/2007|16:46] C:\Program Files\Viewpoint
[07/10/2008|09:02] C:\Program Files\VirginMega
[06/03/2008|19:45] C:\Program Files\Visicom Media
[19/03/2008|14:25] C:\Program Files\vmntoolbar
[19/10/2007|23:50] C:\Program Files\Windows Desktop Search
[01/03/2008|00:23] C:\Program Files\Windows Live
[02/11/2007|00:07] C:\Program Files\Windows Live Toolbar
[25/02/2007|12:53] C:\Program Files\Windows Media Connect 2
[05/11/2008|23:25] C:\Program Files\Windows Media Player
[04/09/2008|16:38] C:\Program Files\Windows NT
[01/09/2005|06:12] C:\Program Files\Windows Plus
[01/09/2005|06:18] C:\Program Files\xerox
[19/01/2008|19:29] C:\Program Files\Yahoo!
[22/10/2007|12:24] C:\Program Files\zips
[25/09/2007|07:28] C:\Program Files\Zylom Games

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[28/03/2008|11:24] C:\Program Files\Fichiers communs\Adobe
[25/08/2008|10:27] C:\Program Files\Fichiers communs\AIPTEK HD-DV
[19/03/2008|18:16] C:\Program Files\Fichiers communs\AOL
[13/01/2007|16:47] C:\Program Files\Fichiers communs\aolback
[13/10/2008|21:28] C:\Program Files\Fichiers communs\Apple
[04/01/2008|21:15] C:\Program Files\Fichiers communs\BitDefender
[13/02/2007|10:51] C:\Program Files\Fichiers communs\Creative Labs Shared
[10/10/2006|10:07] C:\Program Files\Fichiers communs\InstallShield
[10/10/2006|09:54] C:\Program Files\Fichiers communs\Java
[08/04/2007|10:10] C:\Program Files\Fichiers communs\Logitech
[29/02/2008|08:55] C:\Program Files\Fichiers communs\Microsoft Shared
[01/09/2005|06:15] C:\Program Files\Fichiers communs\MSSoap
[13/01/2007|16:46] C:\Program Files\Fichiers communs\Nullsoft
[09/09/2007|13:23] C:\Program Files\Fichiers communs\Real
[01/09/2005|06:15] C:\Program Files\Fichiers communs\Services
[10/10/2006|10:07] C:\Program Files\Fichiers communs\Sonic Shared
[01/09/2005|06:08] C:\Program Files\Fichiers communs\SpeechEngines
[13/11/2008|17:06] C:\Program Files\Fichiers communs\Symantec Shared
[04/09/2008|16:58] C:\Program Files\Fichiers communs\System
[10/10/2006|10:06] C:\Program Files\Fichiers communs\TiVo Shared
[29/02/2008|08:53] C:\Program Files\Fichiers communs\WindowsLiveInstaller
[14/06/2008|16:05] C:\Program Files\Fichiers communs\Wise Installation Wizard
[09/09/2007|13:23] C:\Program Files\Fichiers communs\xing shared

--------------------\\ Process

( 75 Processes )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

C:\DOCUME~1\ALLUSE~1\APPLIC~1\Mfcd upload army browse
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Mfcd upload army browse\dupe bolt.0xe
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Mfcd upload army browse\Eggs Camp.0xe
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Mfcd upload army browse\Rect 1.0xe
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Mfcd upload army browse\Software noun.0xe
C:\DOCUME~1\Ludo\APPLIC~1\magsgr~1
C:\DOCUME~1\Seb\APPLIC~1\magsgr~1
C:\DOCUME~1\Seb\APPLIC~1\magsgr~1\AMEN TRAY SIXTH.0xe
C:\DOCUME~1\Seb\APPLIC~1\magsgr~1\enciktvo.0xe
C:\DOCUME~1\Seb\APPLIC~1\magsgr~1\htxyyyxq.0xe
C:\DOCUME~1\Seb\APPLIC~1\magsgr~1\kmntoplz.0xe
C:\DOCUME~1\Seb\APPLIC~1\magsgr~1\nbxmpjvf.0xe
C:\DOCUME~1\Seb\APPLIC~1\magsgr~1\vsvzvdvx.0xe
C:\DOCUME~1\Seb\APPLIC~1\magsgr~1\vuwtoabi.0xe
C:\DOCUME~1\Seb\APPLIC~1\magsgr~1\xolmnimx.0xe
C:\DOCUME~1\Seb\APPLIC~1\magsgr~1\ymgdjojf.0xe
C:\DOCUME~1\Seb\APPLIC~1\magsgr~1\zwofzkds.0xe
C:\Program Files\magsgr~1
C:\DOCUME~1\Ludo\LOCALS~1\Temp\nsc1403.tmp
C:\DOCUME~1\Ludo\Cookies\ludo@bigpoint[3].txt
C:\DOCUME~1\Ludo\Cookies\ludo@fr1.seafight.bigpoint[2].txt
C:\DOCUME~1\Ludo\Cookies\ludo@banner.cotedazurpalace[2].txt
C:\DOCUME~1\Ludo\Cookies\ludo@cotedazurpalace[1].txt
C:\DOCUME~1\Ludo\Cookies\ludo@fr1.seafight.bigpoint[2].txt
C:\DOCUME~1\Ludo\Cookies\ludo@banner.32vegas[2].txt
C:\DOCUME~1\Ludo\Cookies\ludo@2xmoinscher[1].txt
C:\DOCUME~1\Ludo\Cookies\ludo@www.2xmoinscher[1].txt
C:\WINDOWS\Tasks\A03D0B6D91B2B52D.job

--------------------\\ Verification du Registre

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Army browse cdrom vga"="C:\\Documents and Settings\\All Users\\Application Data\\Mfcd upload army browse\\dupe bolt.exe"

--------------------\\ Verification du fichier Hosts

Fichier Hosts MODIFIE

127.0.0.1 bin.errorprotector.com ## added by CiD
127.0.0.1 br.errorsafe.com ## added by CiD
127.0.0.1 br.winantivirus.com ## added by CiD
127.0.0.1 br.winfixer.com ## added by CiD
127.0.0.1 cdn.drivecleaner.com ## added by CiD
127.0.0.1 cdn.errorsafe.com ## added by CiD
127.0.0.1 cdn.winsoftware.com ## added by CiD
127.0.0.1 de.errorsafe.com ## added by CiD
127.0.0.1 de.winantivirus.com ## added by CiD
127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
127.0.0.1 download.cdn.errorsafe.com ## added by CiD
127.0.0.1 download.cdn.winsoftware.com ## added by CiD
127.0.0.1 download.errorsafe.com ## added by CiD
127.0.0.1 download.systemdoctor.com ## added by CiD
127.0.0.1 download.winantispyware.com ## added by CiD
127.0.0.1 download.windrivecleaner.com ## added by CiD
127.0.0.1 download.winfixer.com ## added by CiD
127.0.0.1 drivecleaner.com ## added by CiD
127.0.0.1 dynamique.drivecleaner.com ## added by CiD
127.0.0.1 errorprotector.com ## added by CiD
127.0.0.1 errorsafe.com ## added by CiD
127.0.0.1 es.winantivirus.com ## added by CiD
127.0.0.1 fr.winantivirus.com ## added by CiD
127.0.0.1 fr.winfixer.com ## added by CiD
127.0.0.1 go.drivecleaner.com ## added by CiD
127.0.0.1 go.errorsafe.com ## added by CiD
127.0.0.1 go.winantispyware.com ## added by CiD
127.0.0.1 go.winantivirus.com ## added by CiD
127.0.0.1 hk.winantivirus.com ## added by CiD
127.0.0.1 instlog.errorsafe.com ## added by CiD
127.0.0.1 instlog.winantivirus.com ## added by CiD
127.0.0.1 instlog.winfixer.com ## added by CiD
127.0.0.1 jsp.drivecleaner.com ## added by CiD
127.0.0.1 kb.errorsafe.com ## added by CiD
127.0.0.1 kb.winantivirus.com ## added by CiD
127.0.0.1 nl.errorsafe.com ## added by CiD
127.0.0.1 se.errorsafe.com ## added by CiD
127.0.0.1 secure.drivecleaner.com ## added by CiD
127.0.0.1 secure.errorsafe.com ## added by CiD
127.0.0.1 secure.winantispam.com ## added by CiD
127.0.0.1 secure.winantispy.com ## added by CiD
127.0.0.1 secure.winantivirus.com ## added by CiD
127.0.0.1 support.winantivirus.com ## added by CiD
127.0.0.1 trial.updates.winsoftware.com ## added by CiD
127.0.0.1 ulog.winantivirus.com ## added by CiD
127.0.0.1 utils.errorsafe.com ## added by CiD
127.0.0.1 utils.winantivirus.com ## added by CiD
127.0.0.1 utils.winfixer.com ## added by CiD
127.0.0.1 winantispyware.com ## added by CiD
127.0.0.1 winantivirus.com ## added by CiD
127.0.0.1 winfixer.com ## added by CiD
127.0.0.1 winfixer2006.com ## added by CiD
127.0.0.1 winsoftware.com ## added by CiD
127.0.0.1 [i]ww/iw.drivecleaner.com ## added by CiD
127.0.0.1 [i]ww/iw.errorprotector.com ## added by CiD
127.0.0.1 [i]ww/iw.errorsafe.com ## added by CiD
127.0.0.1 [i]ww/iw.systemdoctor.com ## added by CiD
127.0.0.1 [i]ww/iw.utils.winfixer.com ## added by CiD
127.0.0.1 [i]ww/iw.win-anti-virus-pro.com ## added by CiD
127.0.0.1 [i]ww/iw.win-virus-pro.com ## added by CiD
127.0.0.1 [i]ww/iw.winantispam.com ## added by CiD
127.0.0.1 [i]ww/iw.winantispy.com ## added by CiD
127.0.0.1 [i]ww/iw.winantispyware.com ## added by CiD
127.0.0.1 [i]ww/iw.winantivirus.com ## added by CiD
127.0.0.1 [i]ww/iw.winantiviruspro.com ## added by CiD
127.0.0.1 [i]ww/iw.windrivecleaner.com ## added by CiD
127.0.0.1 [i]ww/iw.windrivesafe.com ## added by CiD
127.0.0.1 [i]ww/iw.winfixer.com ## added by CiD
127.0.0.1 [i]ww/iw.winfixer2006.com ## added by CiD
127.0.0.1 [i]ww/iw.winsoftware.com ## added by CiD

-> 7775 [ 70 ## added by CiD ]

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-13 19:07:06
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 32

--------------------\\ Recherche d'autres infections

C:\WINDOWS\Pack.epk
[b]==> EGDACCESS <==/b



[F:3833][D:47]-> C:\DOCUME~1\Ludo\LOCALS~1\Temp
[F:523][D:0]-> C:\DOCUME~1\Ludo\Cookies
[F:659][D:19]-> C:\DOCUME~1\Ludo\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 13/11/2008|19:09 - Option : [1]

--------------------\\ Fin du rapport a 19:09:25
0
jfkpresident Messages postés 13877 Statut Contributeur sécurité 1 175
 
re;

Il y a encore du monde !

relance LopS&D et choisis l'option 2 .
ensuite colle le rapport généré .

ensuite :

Clique sur ce lien :
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe
pour télécharger navilog1.exe.

Choisis Enregistrer

et enregistre-le sur ton bureau.

Ensuite double clique sur navilog1.exe pour lancer l'installation.

double-clique sur le raccourci Navilog1 présent sur le bureau .

Laisse-toi guider. Au menu principal, choisis 1 et valides.
(ne fais pas le choix 2,3 ou 4 sans notre avis/accord)

Patiente jusqu'au message :
*** Analyse Termine le ..... ***
Appuie sur une touche comme demandé, le blocnote va s'ouvrir.
Copie-colle l'intégralité du rapport dans ta réponse. Referme le blocnote.
Le rapport est en outre sauvegardé à la racine du disque (fixnavi.txt)
0
BuTHora
 
--------------------\\ Lop S&D 4.2.4-9c XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU T5500 @ 1.66GHz )
BIOS : Phoenix ROM BIOS PLUS Version 1.10 A08
USER : Ludo ( Administrator )
BOOT : Normal boot
Antivirus : Pack Securite Plus 7.00 7.00 (Activated)
Firewall : Pack Securite Plus 7.00 7.00 (Activated)
C:\ (Local Disk) - NTFS - Total:51 Go (Free:6 Go)
D:\ (Local Disk) - NTFS - Total:17 Go (Free:8 Go)
E:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
Option : [2] ( 13/11/2008|20:35 )


\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION

Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Mfcd upload army browse\dupe bolt.0xe
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Mfcd upload army browse\Eggs Camp.0xe
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Mfcd upload army browse\Rect 1.0xe
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Mfcd upload army browse\Software noun.0xe
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\magsgr~1\AMEN TRAY SIXTH.0xe
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\magsgr~1\enciktvo.0xe
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\magsgr~1\htxyyyxq.0xe
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\magsgr~1\kmntoplz.0xe
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\magsgr~1\nbxmpjvf.0xe
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\magsgr~1\vsvzvdvx.0xe
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\magsgr~1\vuwtoabi.0xe
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\magsgr~1\xolmnimx.0xe
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\magsgr~1\ymgdjojf.0xe
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\magsgr~1\zwofzkds.0xe
Supprime! - C:\DOCUME~1\Ludo\LOCALS~1\Temp\nsc1403.tmp
Supprime! - C:\DOCUME~1\Ludo\Cookies\ludo@bigpoint[3].txt
Supprime! - C:\DOCUME~1\Ludo\Cookies\ludo@fr1.seafight.bigpoint[2].txt
Supprime! - C:\DOCUME~1\Ludo\Cookies\ludo@banner.cotedazurpalace[2].txt
Supprime! - C:\DOCUME~1\Ludo\Cookies\ludo@cotedazurpalace[1].txt
Supprime! - C:\DOCUME~1\Ludo\Cookies\ludo@banner.32vegas[2].txt
Supprime! - C:\DOCUME~1\Ludo\Cookies\ludo@2xmoinscher[1].txt
Supprime! - C:\DOCUME~1\Ludo\Cookies\ludo@www.2xmoinscher[1].txt
Supprime! - C:\WINDOWS\Tasks\A03D0B6D91B2B52D.job
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Mfcd upload army browse
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\magsgr~1
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\magsgr~1
Supprime! - C:\Program Files\magsgr~1
-
[ Fichier Hosts ] .. Restaure!

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

Supprime! - C:\Program Files\Viewpoint
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\Viewpoint
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\


--------------------\\ Listing des dossiers dans APPLIC~1

[19/03/2008|18:25] C:\DOCUME~1\ADMINI~1\APPLIC~1\ATI
[10/10/2006|10:09] C:\DOCUME~1\ADMINI~1\APPLIC~1\Corel
[10/10/2006|10:17] C:\DOCUME~1\ADMINI~1\APPLIC~1\GTek
[01/09/2005|06:25] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
[10/10/2006|10:04] C:\DOCUME~1\ADMINI~1\APPLIC~1\Intel
[10/10/2006|10:02] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
[10/10/2006|10:13] C:\DOCUME~1\ADMINI~1\APPLIC~1\Symantec

[13/10/2008|21:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[28/03/2008|11:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[12/05/2008|20:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Age of Empires 3
[19/03/2008|21:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
[10/09/2007|13:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL Downloads
[12/07/2008|14:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
[12/07/2008|15:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[19/10/2006|21:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CanonBJ
[13/02/2007|10:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Creative Labs
[07/10/2008|09:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Downloaded Installations
[19/03/2007|10:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
[22/10/2008|14:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Flood Light Games
[11/09/2007|18:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\FloodLightGames
[19/03/2008|12:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\F-Secure
[19/03/2008|12:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\fssg
[29/01/2007|20:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[17/12/2007|11:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft
[10/10/2006|10:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\GTek
[10/10/2006|10:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
[10/10/2006|10:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Intel
[24/10/2008|17:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\JollyBear
[14/06/2008|16:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
[10/09/2007|14:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Macromedia
[20/03/2008|11:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
[02/03/2007|17:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee.com
[11/06/2008|12:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
[04/06/2008|13:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[14/07/2007|14:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Mozilla
[16/10/2006|21:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Otto
[17/03/2007|21:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
[19/03/2008|11:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SiteAdvisor
[05/01/2008|11:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
[10/05/2007|18:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
[24/10/2008|18:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[25/02/2007|12:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[04/07/2007|10:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WindowsLiveInstaller
[29/02/2008|08:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
[19/01/2008|19:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion
[24/09/2007|20:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom


[19/03/2008|18:25] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ATI
[10/10/2006|10:09] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Corel
[10/10/2006|10:17] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Gtek
[01/09/2005|06:25] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[10/10/2006|10:04] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Intel
[06/09/2007|23:33] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Macromedia
[04/07/2007|10:27] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
[10/10/2006|10:13] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec

[02/03/2007|15:47] C:\DOCUME~1\LOCALS~1\APPLIC~1\Google
[22/01/2007|09:10] C:\DOCUME~1\LOCALS~1\APPLIC~1\Macromedia
[19/10/2007|23:59] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[18/04/2008|01:00] C:\DOCUME~1\LOCALS~1\APPLIC~1\SiteAdvisor

[10/10/2006|10:09] C:\DOCUME~1\Lu\APPLIC~1\Corel
[04/12/2007|12:27] C:\DOCUME~1\Lu\APPLIC~1\Gtek
[10/10/2006|10:04] C:\DOCUME~1\Lu\APPLIC~1\Intel
[06/09/2007|23:33] C:\DOCUME~1\Lu\APPLIC~1\Macromedia
[04/12/2007|12:27] C:\DOCUME~1\Lu\APPLIC~1\Microsoft
[02/12/2007|21:47] C:\DOCUME~1\Lu\APPLIC~1\SiteAdvisor
[03/12/2007|14:06] C:\DOCUME~1\Lu\APPLIC~1\Template

[20/01/2008|18:10] C:\DOCUME~1\Ludo\APPLIC~1\Adobe
[26/01/2007|12:51] C:\DOCUME~1\Ludo\APPLIC~1\AdobeUM
[12/09/2007|22:53] C:\DOCUME~1\Ludo\APPLIC~1\AOL
[12/07/2008|16:51] C:\DOCUME~1\Ludo\APPLIC~1\Apple Computer
[10/10/2006|10:16] C:\DOCUME~1\Ludo\APPLIC~1\ATI
[22/12/2007|01:22] C:\DOCUME~1\Ludo\APPLIC~1\AutoTransfer
[10/10/2006|10:09] C:\DOCUME~1\Ludo\APPLIC~1\Corel
[07/11/2006|18:39] C:\DOCUME~1\Ludo\APPLIC~1\Corel Photo Album
[20/04/2007|12:31] C:\DOCUME~1\Ludo\APPLIC~1\CyberLink
[27/02/2007|11:03] C:\DOCUME~1\Ludo\APPLIC~1\DivX
[19/05/2008|16:16] C:\DOCUME~1\Ludo\APPLIC~1\dvdcss
[07/03/2008|21:07] C:\DOCUME~1\Ludo\APPLIC~1\EoRezo
[11/09/2007|18:31] C:\DOCUME~1\Ludo\APPLIC~1\FloodLightGames
[26/03/2008|12:16] C:\DOCUME~1\Ludo\APPLIC~1\F-Secure
[16/07/2007|09:57] C:\DOCUME~1\Ludo\APPLIC~1\Google
[17/12/2007|11:32] C:\DOCUME~1\Ludo\APPLIC~1\Grisoft
[10/10/2006|10:17] C:\DOCUME~1\Ludo\APPLIC~1\Gtek
[26/02/2007|17:46] C:\DOCUME~1\Ludo\APPLIC~1\Help
[01/09/2005|06:25] C:\DOCUME~1\Ludo\APPLIC~1\Identities
[10/10/2006|10:04] C:\DOCUME~1\Ludo\APPLIC~1\Intel
[06/03/2008|21:56] C:\DOCUME~1\Ludo\APPLIC~1\ItsLabel
[03/03/2007|09:48] C:\DOCUME~1\Ludo\APPLIC~1\Leadertech
[18/01/2007|08:55] C:\DOCUME~1\Ludo\APPLIC~1\Macromedia
[27/02/2007|13:46] C:\DOCUME~1\Ludo\APPLIC~1\McAfee
[31/10/2007|11:53] C:\DOCUME~1\Ludo\APPLIC~1\Microsoft
[24/07/2007|10:00] C:\DOCUME~1\Ludo\APPLIC~1\Mozilla
[01/11/2007|20:15] C:\DOCUME~1\Ludo\APPLIC~1\MSNInstaller
[07/11/2006|18:16] C:\DOCUME~1\Ludo\APPLIC~1\Otto
[19/09/2007|12:19] C:\DOCUME~1\Ludo\APPLIC~1\Real
[10/08/2007|09:04] C:\DOCUME~1\Ludo\APPLIC~1\Samsung
[24/10/2008|12:26] C:\DOCUME~1\Ludo\APPLIC~1\SiteAdvisor
[07/06/2007|12:17] C:\DOCUME~1\Ludo\APPLIC~1\SMov
[03/03/2007|09:48] C:\DOCUME~1\Ludo\APPLIC~1\Sonic
[25/02/2007|19:27] C:\DOCUME~1\Ludo\APPLIC~1\SoundSpectrum
[22/01/2007|09:42] C:\DOCUME~1\Ludo\APPLIC~1\Sun
[10/10/2006|10:13] C:\DOCUME~1\Ludo\APPLIC~1\Symantec
[24/07/2007|10:01] C:\DOCUME~1\Ludo\APPLIC~1\Talkback
[11/12/2006|12:52] C:\DOCUME~1\Ludo\APPLIC~1\Template
[11/09/2007|00:48] C:\DOCUME~1\Ludo\APPLIC~1\vlc
[18/03/2008|22:39] C:\DOCUME~1\Ludo\APPLIC~1\VMNTOOLBAR
[20/10/2007|14:37] C:\DOCUME~1\Ludo\APPLIC~1\Windows Desktop Search
[20/01/2008|18:09] C:\DOCUME~1\Ludo\APPLIC~1\Yahoo!

[19/10/2007|23:50] C:\DOCUME~1\NETWOR~1\APPLIC~1\Identities
[16/10/2006|23:20] C:\DOCUME~1\NETWOR~1\APPLIC~1\Intel
[19/10/2007|23:50] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

[20/01/2008|10:18] C:\DOCUME~1\Seb\APPLIC~1\Adobe
[19/06/2007|15:56] C:\DOCUME~1\Seb\APPLIC~1\AOL
[26/08/2008|16:41] C:\DOCUME~1\Seb\APPLIC~1\Apple Computer
[19/03/2008|18:25] C:\DOCUME~1\Seb\APPLIC~1\ATI
[10/10/2006|10:09] C:\DOCUME~1\Seb\APPLIC~1\Corel
[26/06/2007|11:28] C:\DOCUME~1\Seb\APPLIC~1\Corel Photo Album
[22/02/2008|16:40] C:\DOCUME~1\Seb\APPLIC~1\DivX
[19/04/2008|21:54] C:\DOCUME~1\Seb\APPLIC~1\dvdcss
[08/03/2008|09:50] C:\DOCUME~1\Seb\APPLIC~1\EoRezo
[17/04/2008|14:40] C:\DOCUME~1\Seb\APPLIC~1\F-Secure
[20/06/2007|13:23] C:\DOCUME~1\Seb\APPLIC~1\Google
[18/12/2007|17:14] C:\DOCUME~1\Seb\APPLIC~1\Grisoft
[10/10/2006|10:17] C:\DOCUME~1\Seb\APPLIC~1\Gtek
[22/03/2008|10:08] C:\DOCUME~1\Seb\APPLIC~1\gtk-2.0
[25/06/2007|11:16] C:\DOCUME~1\Seb\APPLIC~1\Help
[01/09/2005|06:25] C:\DOCUME~1\Seb\APPLIC~1\Identities
[10/10/2006|10:04] C:\DOCUME~1\Seb\APPLIC~1\Intel
[06/03/2008|19:47] C:\DOCUME~1\Seb\APPLIC~1\ItsLabel
[12/11/2008|14:55] C:\DOCUME~1\Seb\APPLIC~1\LimeWire
[04/07/2007|13:55] C:\DOCUME~1\Seb\APPLIC~1\Macromedia
[31/10/2007|23:43] C:\DOCUME~1\Seb\APPLIC~1\McAfee
[09/11/2008|14:31] C:\DOCUME~1\Seb\APPLIC~1\Microsoft
[15/07/2007|18:40] C:\DOCUME~1\Seb\APPLIC~1\Mozilla
[31/10/2007|23:39] C:\DOCUME~1\Seb\APPLIC~1\Real
[12/04/2008|10:29] C:\DOCUME~1\Seb\APPLIC~1\Samsung
[11/06/2008|13:30] C:\DOCUME~1\Seb\APPLIC~1\SiteAdvisor
[12/07/2007|20:28] C:\DOCUME~1\Seb\APPLIC~1\SoundSpectrum
[29/06/2007|16:58] C:\DOCUME~1\Seb\APPLIC~1\Sun
[10/10/2006|10:13] C:\DOCUME~1\Seb\APPLIC~1\Symantec
[15/07/2007|18:45] C:\DOCUME~1\Seb\APPLIC~1\Talkback
[20/06/2007|15:20] C:\DOCUME~1\Seb\APPLIC~1\Template
[25/08/2008|19:03] C:\DOCUME~1\Seb\APPLIC~1\Viewpoint
[17/09/2007|17:09] C:\DOCUME~1\Seb\APPLIC~1\vlc
[18/03/2008|17:59] C:\DOCUME~1\Seb\APPLIC~1\vmntoolbar
[23/10/2007|19:05] C:\DOCUME~1\Seb\APPLIC~1\Windows Desktop Search
[19/01/2008|19:34] C:\DOCUME~1\Seb\APPLIC~1\Yahoo!

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[03/11/2008 10:12][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[13/11/2008 17:35][--a------] C:\WINDOWS\tasks\GoogleUpdateTaskUser.job
[13/11/2008 20:10][--a------] C:\WINDOWS\tasks\V‚rifier les mises … jour de Windows Live Toolbar.job
[31/10/2008 17:23][--a------] C:\WINDOWS\tasks\Norton Security Scan.job
[07/11/2008 18:30][--a------] C:\WINDOWS\tasks\Recherche de virus de McAfee.com - Mon ordinateur (CATH-cathy).job
[13/11/2008 16:24][--ah-----] C:\WINDOWS\tasks\SA.DAT
[10/08/2004 12:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing des dossiers dans C:\Program Files

[28/03/2008|11:17] C:\Program Files\Adobe
[22/10/2007|12:21] C:\Program Files\aips
[16/06/2007|17:52] C:\Program Files\AKVIS
[05/11/2008|23:02] C:\Program Files\ALCATEL PC Suite
[18/10/2007|19:35] C:\Program Files\Alwil Software
[07/09/2007|09:28] C:\Program Files\AOL 9.0a
[13/10/2008|21:35] C:\Program Files\Apple Software Update
[19/03/2008|18:21] C:\Program Files\a-squared Free
[10/10/2006|10:02] C:\Program Files\ATI Technologies
[31/08/2008|22:44] C:\Program Files\BAE
[04/01/2008|18:44] C:\Program Files\BitDefender
[13/10/2008|21:13] C:\Program Files\Bonjour
[10/10/2006|10:02] C:\Program Files\Broadcom
[19/10/2006|21:33] C:\Program Files\Canon
[04/01/2008|18:51] C:\Program Files\CCleaner
[17/09/2007|09:07] C:\Program Files\Codemasters
[10/10/2006|09:59] C:\Program Files\CONEXANT
[05/02/2007|14:22] C:\Program Files\Configs
[10/10/2006|10:09] C:\Program Files\Corel
[19/03/2008|18:36] C:\Program Files\Creative
[10/10/2006|10:04] C:\Program Files\CyberLink
[09/09/2008|11:02] C:\Program Files\Datel
[09/12/2007|14:13] C:\Program Files\Dcads Games Collection
[07/09/2007|09:28] C:\Program Files\Dell
[10/10/2006|10:17] C:\Program Files\Dell Support
[22/10/2007|12:20] C:\Program Files\Diablo II
[10/10/2006|10:03] C:\Program Files\Digital Line Detect
[09/11/2008|19:09] C:\Program Files\DivX
[21/12/2007|17:06] C:\Program Files\eMule
[08/03/2008|09:50] C:\Program Files\EoRezo
[11/04/2007|09:05] C:\Program Files\Eurobarre
[12/07/2008|14:54] C:\Program Files\Fichiers communs
[15/07/2008|14:51] C:\Program Files\Free iPod Video Converter
[01/09/2005|06:27] C:\Program Files\FrenchOtto
[17/01/2008|17:29] C:\Program Files\Fx Audio Conveter
[23/10/2007|17:03] C:\Program Files\Gamenext
[23/10/2007|16:59] C:\Program Files\GemMasterFrench
[01/03/2008|11:28] C:\Program Files\Google
[05/11/2008|23:30] C:\Program Files\Incomplete
[25/08/2008|10:26] C:\Program Files\InstallShield Installation Information
[10/10/2006|10:03] C:\Program Files\Intel
[16/10/2008|02:20] C:\Program Files\Internet Explorer
[06/10/2007|18:13] C:\Program Files\Inventel
[13/10/2008|21:32] C:\Program Files\iPod
[13/10/2008|21:33] C:\Program Files\iTunes
[07/11/2007|10:04] C:\Program Files\Java
[14/09/2007|10:02] C:\Program Files\Labtec
[14/06/2008|16:07] C:\Program Files\Lavasoft
[03/12/2006|13:29] C:\Program Files\LEGO Media
[17/04/2007|06:24] C:\Program Files\LexmarkX83
[06/11/2008|20:17] C:\Program Files\LimeWire
[04/12/2007|12:27] C:\Program Files\LocalCooling
[22/10/2007|12:21] C:\Program Files\Maps
[04/09/2008|16:54] C:\Program Files\Messenger
[31/08/2008|21:58] C:\Program Files\Messenger Plus! Live
[02/11/2006|21:22] C:\Program Files\Micro Application
[04/07/2007|16:37] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[01/09/2005|06:18] C:\Program Files\microsoft frontpage
[15/08/2008|21:17] C:\Program Files\Microsoft Games
[04/12/2006|20:41] C:\Program Files\Microsoft Money
[04/12/2006|20:40] C:\Program Files\Microsoft Office
[21/10/2008|15:02] C:\Program Files\Microsoft Silverlight
[19/10/2007|23:50] C:\Program Files\Microsoft SQL Server Compact Edition
[10/09/2008|09:14] C:\Program Files\Microsoft Works
[07/09/2007|09:29] C:\Program Files\Modem Helper
[25/09/2007|07:27] C:\Program Files\Mortimer Beckett And The Secrets Of Spooky Manor
[23/10/2007|17:05] C:\Program Files\Motherboard Monitor 5
[04/09/2008|16:47] C:\Program Files\Movie Maker
[22/10/2007|12:24] C:\Program Files\movies
[13/11/2008|19:01] C:\Program Files\Mozilla Firefox
[01/11/2007|20:19] C:\Program Files\MSN
[24/10/2008|17:29] C:\Program Files\MSN Games
[01/09/2005|06:12] C:\Program Files\MSN Gaming Zone
[12/04/2008|09:57] C:\Program Files\Msncolor
[09/09/2008|11:03] C:\Program Files\MSXML 4.0
[02/07/2008|07:42] C:\Program Files\NetBattle
[04/09/2008|16:39] C:\Program Files\NetMeeting
[10/10/2006|10:03] C:\Program Files\NetWaiting
[16/06/2008|17:21] C:\Program Files\Neuf
[13/11/2008|17:06] C:\Program Files\Norton Security Scan
[24/10/2008|17:29] C:\Program Files\Oberon Media
[12/02/2008|17:47] C:\Program Files\Odebit Multim‚dia
[01/09/2005|06:13] C:\Program Files\Online Services
[04/09/2008|16:58] C:\Program Files\Outlook Express
[21/10/2008|11:47] C:\Program Files\Pack Securite
[31/08/2007|16:22] C:\Program Files\Pando Networks
[13/10/2008|21:29] C:\Program Files\QuickTime
[14/06/2007|19:58] C:\Program Files\Real
[22/10/2007|12:24] C:\Program Files\redist
[19/09/2007|23:37] C:\Program Files\ReflexiveArcade
[03/08/2007|16:45] C:\Program Files\Samsung
[22/10/2007|12:24] C:\Program Files\scenario
[22/10/2007|12:24] C:\Program Files\scriptlibs
[01/09/2005|06:15] C:\Program Files\Services en ligne
[22/10/2007|12:24] C:\Program Files\shaders
[15/08/2008|20:42] C:\Program Files\Shareaza
[22/10/2007|12:33] C:\Program Files\Sierra
[10/10/2006|09:59] C:\Program Files\Sigmatel
[22/05/2008|19:05] C:\Program Files\SiteAdvisor
[05/02/2007|14:22] C:\Program Files\Skins
[18/10/2007|12:11] C:\Program Files\SLD Codec Pack
[10/10/2006|10:07] C:\Program Files\Sonic
[30/03/2007|15:55] C:\Program Files\SoundSpectrum
[10/05/2007|18:02] C:\Program Files\SpeedFan
[05/01/2008|11:19] C:\Program Files\Spybot - Search & Destroy
[10/10/2006|10:01] C:\Program Files\Synaptics
[04/01/2008|20:05] C:\Program Files\Trend Micro
[24/07/2007|12:48] C:\Program Files\TurnTool
[01/11/2007|13:05] C:\Program Files\VideoLAN
[07/10/2008|09:02] C:\Program Files\VirginMega
[06/03/2008|19:45] C:\Program Files\Visicom Media
[19/03/2008|14:25] C:\Program Files\vmntoolbar
[19/10/2007|23:50] C:\Program Files\Windows Desktop Search
[01/03/2008|00:23] C:\Program Files\Windows Live
[02/11/2007|00:07] C:\Program Files\Windows Live Toolbar
[25/02/2007|12:53] C:\Program Files\Windows Media Connect 2
[05/11/2008|23:25] C:\Program Files\Windows Media Player
[04/09/2008|16:38] C:\Program Files\Windows NT
[01/09/2005|06:12] C:\Program Files\Windows Plus
[01/09/2005|06:18] C:\Program Files\xerox
[19/01/2008|19:29] C:\Program Files\Yahoo!
[22/10/2007|12:24] C:\Program Files\zips
[25/09/2007|07:28] C:\Program Files\Zylom Games

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[28/03/2008|11:24] C:\Program Files\Fichiers communs\Adobe
[25/08/2008|10:27] C:\Program Files\Fichiers communs\AIPTEK HD-DV
[19/03/2008|18:16] C:\Program Files\Fichiers communs\AOL
[13/01/2007|16:47] C:\Program Files\Fichiers communs\aolback
[13/10/2008|21:28] C:\Program Files\Fichiers communs\Apple
[04/01/2008|21:15] C:\Program Files\Fichiers communs\BitDefender
[13/02/2007|10:51] C:\Program Files\Fichiers communs\Creative Labs Shared
[10/10/2006|10:07] C:\Program Files\Fichiers communs\InstallShield
[10/10/2006|09:54] C:\Program Files\Fichiers communs\Java
[08/04/2007|10:10] C:\Program Files\Fichiers communs\Logitech
[29/02/2008|08:55] C:\Program Files\Fichiers communs\Microsoft Shared
[01/09/2005|06:15] C:\Program Files\Fichiers communs\MSSoap
[13/01/2007|16:46] C:\Program Files\Fichiers communs\Nullsoft
[09/09/2007|13:23] C:\Program Files\Fichiers communs\Real
[01/09/2005|06:15] C:\Program Files\Fichiers communs\Services
[10/10/2006|10:07] C:\Program Files\Fichiers communs\Sonic Shared
[01/09/2005|06:08] C:\Program Files\Fichiers communs\SpeechEngines
[13/11/2008|17:06] C:\Program Files\Fichiers communs\Symantec Shared
[04/09/2008|16:58] C:\Program Files\Fichiers communs\System
[10/10/2006|10:06] C:\Program Files\Fichiers communs\TiVo Shared
[29/02/2008|08:53] C:\Program Files\Fichiers communs\WindowsLiveInstaller
[14/06/2008|16:05] C:\Program Files\Fichiers communs\Wise Installation Wizard
[09/09/2007|13:23] C:\Program Files\Fichiers communs\xing shared

--------------------\\ Process

( 73 Processes )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE


--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-13 20:38:13
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 32

--------------------\\ Recherche d'autres infections

C:\WINDOWS\Pack.epk
[b]==> EGDACCESS <==/b



[F:3832][D:46]-> C:\DOCUME~1\Ludo\LOCALS~1\Temp
[F:516][D:0]-> C:\DOCUME~1\Ludo\Cookies
[F:659][D:19]-> C:\DOCUME~1\Ludo\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 13/11/2008|19:09 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - 13/11/2008|20:40 - Option : [2]

--------------------\\ Fin du rapport a 20:40:04
0
jfkpresident Messages postés 13877 Statut Contributeur sécurité 1 175
 
tres bien enuite le rapport de navilog .
0
BuTHora
 
Search Navipromo version 3.6.9 commencé le 13/11/2008 à 20:44:07,06

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "Ludo"

Mise à jour le 05.11.2008 à 21h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11
Système de fichiers : NTFS

Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "C:\WINDOWS" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Ludo\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\Lu\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\Seb\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Ludo\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\Lu\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\Seb\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Ludo\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\Seb\menudm~1\progra~1" ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings\Ludo\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\Lu\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\Seb\locals~1\applic~1" *



*** Recherche fichiers ***


C:\WINDOWS\pack.epk trouvé !

*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :


* Dans "C:\Documents and Settings\Ludo\locals~1\applic~1" :


* Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" :


* Dans "C:\DOCUME~1\Lu\locals~1\applic~1" :


* Dans "C:\DOCUME~1\Seb\locals~1\applic~1" :


3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :



*** Analyse terminée le 13/11/2008 à 21:00:24,52 ***
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
jfkpresident Messages postés 13877 Statut Contributeur sécurité 1 175
 
Double clique sur le raccourci Navilog1 présent sur le bureau et laisse-toi guider.
Au menu principal, choisis 2 et valide.

Le fix va t'informer qu'il va alors redémarrer ton PC
Ferme toutes les fenêtres ouvertes et enregistre tes documents personnels ouverts
Appuie sur une touche comme demandé.
(si ton Pc ne redémarre pas automatiquement, fais le toi même)
Au redémarrage de ton PC, choisis ta session habituelle.

Patiente jusqu'au message :
*** Nettoyage Termine le ..... ***
Le blocnote va s'ouvrir.
Sauvegarde le rapport de manière à le retrouver
Referme le blocnote. Ton bureau va réapparaitre

PS:Si ton bureau ne réapparait pas, fais CTRL+ALT+SUPP pour ouvrir le gestionnaire de tâches.
Puis rends-toi à l'onglet "processus". Clique en haut à gauche sur fichiers et choisis "exécuter"
Tape explorer et valide. Celà te fera apparaitre ton bureau.

Postes le rapport içi.

ensuite recolle moi un nouveau hijack .
0
BuTHora
 
Clean Navipromo version 3.6.9 commencé le 13/11/2008 à 21:48:33,38

Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "Ludo"

Mise à jour le 05.11.2008 à 21h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11
Système de fichiers : NTFS

Mode suppression automatique
avec prise en charge résultats Catchme et GNS


Nettoyage exécuté au redémarrage de l'ordinateur


*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)


*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\WINDOWS\System32" *


* Suppression dans "C:\Documents and Settings\Ludo\locals~1\applic~1" *


* Suppression dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *

* Suppression dans "C:\DOCUME~1\Lu\locals~1\applic~1" *

* Suppression dans "C:\DOCUME~1\Seb\locals~1\applic~1" *


*** Suppression dossiers dans "C:\WINDOWS" ***


*** Suppression dossiers dans "C:\Program Files" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\Ludo\applic~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\applic~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\Lu\applic~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\Seb\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\Ludo\locals~1\applic~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\Lu\locals~1\applic~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\Seb\locals~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\Ludo\menudm~1\progra~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\Seb\menudm~1\progra~1" ***



*** Suppression fichiers ***

C:\WINDOWS\pack.epk supprimé !

*** Suppression fichiers temporaires ***

Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\Ludo\locals~1\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\WINDOWS\system32" *


* Dans "C:\Documents and Settings\Ludo\locals~1\applic~1" *


* Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *


* Dans "C:\DOCUME~1\Lu\locals~1\applic~1" *


* Dans "C:\DOCUME~1\Seb\locals~1\applic~1" *


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltdt absent !

*** Nettoyage terminé le 13/11/2008 à 21:55:26,18 ***
0
BuTHora > BuTHora
 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:02:45, on 13/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
C:\Program Files\Pack Securite\Common\FSMA32.EXE
C:\Program Files\Pack Securite\Anti-Virus\FSGK32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\Pack Securite\Common\FSMB32.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Pack Securite\Common\FCH32.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Pack Securite\Common\FAMEH32.EXE
C:\Program Files\Pack Securite\Anti-Virus\fsqh.exe
C:\Program Files\Pack Securite\FSPC\fspc.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Pack Securite\Anti-Virus\fssm32.exe
C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Pack Securite\FSAUA\program\fsus.exe
C:\Program Files\Pack Securite\Anti-Virus\fsav32.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Pack Securite\Common\FSM32.EXE
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NetWaiting\netWaiting.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Pack Securite\FSGUI\fsguidll.exe
C:\Program Files\Fichiers communs\AOL\ACS\AOlDial.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Fichiers communs\AOL\1169114695\ee\aolsoftware.exe
C:\WINDOWS\system32\msiexec.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Neuf\Media Center\MediaCenter.exe
C:\Program Files\Neuf\Media Center\httpd\httpd.exe
C:\Program Files\Neuf\Media Center\httpd\httpd.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=5061010
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {FC6F74C0-145D-4815-B9AD-CE29318696B3} - C:\WINDOWS\system32\c_g1803.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Pack Securite\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Pack Securite\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [AOL Dialer] C:\Program Files\Fichiers communs\AOL\ACS\AOlDial.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [Saxo] C:\Program Files\Saxo\Saxo.exe regstart
O4 - HKCU\..\Run: [Pando] "C:\Program Files\Pando Networks\Pando\Pando.exe" /Minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Parental... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Parental... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {87AF076E-D86D-4E87-ADDD-F05804E1F150} - https://www.virginmega.fr/DownloadManager/Release/Prod/DownMan.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Pack Securite\Common\FSMA32.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
0
BuTHora > BuTHora
 
ça donne quoi?
0
jfkpresident Messages postés 13877 Statut Contributeur sécurité 1 175
 
Il va falloir analyser un ou des fichier(s) suspect(s) !

Il se peut qu'il se trouvent dans les " dossiers cachés " du systeme.
Il faut donc les rendre visibles pour le scan.

Pour afficher les dossiers et fichiers cachés:

Panneau de configuration > Options des dossiers > onglet Affichage.

Coche Afficher les fichiers et dossiers cachés,
Décoche Masquer les extensions de fichiers connus
Décoche Masquer les fichiers protégés du Système.
Un message de mise en garde va apparaitre. Clique sur OK pour confirmer ton choix.
Les fichiers et dossiers cachés du système apparaitront alors dans l'explorateur Windows en transparence.

Rends toi sur ce site :

https://www.virustotal.com/gui/

Clique sur parcourir et cherche ce fichier : C:\Program Files\Saxo\Saxo.exe regstart

Clique sur Send File.

Un rapport va s'élaborer ligne à ligne.

Attends la fin. Il doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note.

Copie le dans ta réponse.

je ragarderais le résultat demain ; Bonne nuit .
0
BuTHora
 
Désolé, je n'ai aucun fichier saxo. Merci pour tout, à demain
0
jfkpresident Messages postés 13877 Statut Contributeur sécurité 1 175
 
Désolé, je n'ai aucun fichier saxo. Merci pour tout, à demain

Pourtant il est bien dans ton log hijack : O4 - HKCU\..\Run: [Saxo] C:\Program Files\Saxo\Saxo.exe regstart

Tu devrais le trouver ici: C:\Program Files\Saxo ?
0
BuTHora
 
Désolé pour le temps que j'ai mis à répondre mais il y a eu un léger bug mes réponses ne s'affichaient plus.
Enfin bon je te promets que je n'ai pas de fichier saxo dans program files.
Désolé
0
jfkpresident Messages postés 13877 Statut Contributeur sécurité 1 175
 
salut ;

tu peux faire ceci :

télécharge GenProc http://www.alt-shift-return.org/Info/Fichiers/GenProc.zip sur ton bureau
Pour Vista : Désactive l'UAC jusqu'à la résolution du problème http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/desactiver-controle-utilisateurs-sujet_198996_1.htm
dézippe le dossier, double-clique sur GenProc.bat http://forum.telecharger.01net.com/forum/­jeanchretien1-3.gif et poste le contenu du rapport qui s'ouvre

Aide en images : http://www.alt-shift-return.org/Info/GenProc-­HowTo.html</code>
0
BuTHora
 
Je ne peux pas accéder au lien télécharger.com
Je te poste mon rapport ici.

Rapport GenProc 2.223 [1] le 21/11/2008 à 23:14:18,79 - Windows XP


Dans CCleaner, clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures".
Par la suite, laisse-le avec ses réglages par défaut. C'est tout.


# Etape 1 / Télécharge :

- Toolbar-S&D https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2 (Team IDN) sur ton Bureau.
Installe simplement le programme en exécutant le fichier téléchargé.


Redémarre en mode sans échec comme indiqué ici https://www.wekyo.com/demarrer-le-pc-en-mode-sans-echec-windows-7-et-8/ ; pour retrouver le rapport, clique sur le raccourci "GenProc" sur ton bureau. Choisis ta session courante *** Ludo ***


# Etape 2/

Relance Toolbar-S&D en double-cliquant sur son raccourci situé sur le Bureau.
Tape sur "2" puis valide en appuyant sur "Entrée". Ne ferme pas la fenêtre lors de la suppression.

# Etape 3/

Lance CCleaner : "Nettoyeur"/"lancer le nettoyage" et c'est tout.

# Etape 4/

Redémarre normalement et poste, dans la même réponse :

- Le contenu du rapport C:\TB.txt ;
- Un nouveau rapport HijackThis http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/hijackthis-version-install-sujet_199100_1.htm ;

Précise les difficultés que tu as eu (ce que tu n'as pas pu faire...) ainsi que l'évolution de la situation.
0
jfkpresident Messages postés 13877 Statut Contributeur sécurité 1 175
 
Peux tu faire les étapes une par une et me coller les rapports .
0
BuTHora
 
Etape 2 :

-----------\\ ToolBar S&D 1.2.5 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU T5500 @ 1.66GHz )
BIOS : Phoenix ROM BIOS PLUS Version 1.10 A08
USER : Ludo ( Administrator )
BOOT : Fail-safe boot
Antivirus : Pack Securite Plus 7.00 7.00 (Activated)
Firewall : Pack Securite Plus 7.00 7.00 (Activated)
C:\ (Local Disk) - NTFS - Total:51 Go (Free:7 Go)
D:\ (Local Disk) - NTFS - Total:17 Go (Free:8 Go)
E:\ (CD or DVD)

"C:\ToolBar SD" ( MAJ : 20-11-2008|20:25 )
Option : [2] ( 25/11/2008|21:00 )
C:\WINDOWS\system32\adssite-remove.exe
C:\WINDOWS\system32\adssite_sidebar_uninstall.exe
C:\WINDOWS\System32\Dcads-remove.exe
C:\WINDOWS\system32\dcads_sidebar_uninstall.exe
C:\WINDOWS\system32\rightonadz-uninst.exe
C:\WINDOWS\system32\superiorads-uninst.exe

-----------\\ SUPPRESSION

Supprime! - C:\DOCUME~1\Ludo\Cookies\ludo@www.bananalotto[2].txt
Supprime! - C:\Program Files\Dcads Games Collection\BattlesOfHelicopters.exe
Supprime! - C:\Program Files\Dcads Games Collection\BobAndBill.exe
Supprime! - C:\Program Files\Dcads Games Collection\CrazyBlocks.exe
Supprime! - C:\Program Files\Dcads Games Collection\Lines.exe
Supprime! - C:\Program Files\Dcads Games Collection\uninstall.exe
Supprime! - C:\Program Files\Dcads Games Collection\VideoPool.exe
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\---Yahoo.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\01net.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\a.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\amazon.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\an.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\arrowB.gif
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\arrowT.gif
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\arrow_down.gif
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\arrow_up.gif
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\autofill.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\avstate.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\b.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\bg_pub.gif
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\bg_ttl.gif
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\bn.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\bottom.png
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\bottom_left.png
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\bottom_right.png
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\c.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\canalblog.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\cn.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\COMBOSEARCH.acs
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\d.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\dictionary2.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\dn.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\downfile
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\DownloadCOM.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\dropdown.css
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\ErrorLog.txt
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\ErrorPageTemplate.css
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\f.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\flag_argentine.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\flag_australia.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\flag_brazil.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\flag_canada.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\flag_china.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\flag_france.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\flag_germany.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\flag_greece.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\flag_hongkong.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\flag_india.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\flag_indonesia.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\flag_italy.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\flag_japan.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\flag_korea.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\flag_mexico.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\flag_netherlands.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\flag_spain.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\flag_sweeden.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\flag_taiwan.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\flag_uk.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\flag_usa.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\fn.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\g.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\gaming.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\gn.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\gograph.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\graphred0.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\graphred0_5.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\graphred1.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\graphred1_5.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\graphred2.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\graphred2_5.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\graphred3.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\graphred3_5.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\graphred4.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\graphred4_5.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\graphred5.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\h.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\help.gif
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\hideremove.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\highlight.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\hn.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\hororank.xml
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\h_aquarius.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\h_aries.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\h_cancer.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\h_capricorn.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\h_gemini.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\h_leo.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\h_libra.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\h_pisces.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\h_sagittarius.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\h_scorpio.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\h_taurus.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\h_virgo.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\i.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\IEtab1_7d.zip
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\in.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\ipsearch.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\j.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\jn.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\k.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\kn.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\l.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\left.png
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\ln.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\loading.gif
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\login.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\logo.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\n.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\New York_NY_weather.txt
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\New York_NY_weather.txt129959000
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\New York_NY_weather.txt13077140
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\New York_NY_weather.txt20809031
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\New York_NY_weather.txt37869015
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\new02.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\NewCfg
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\news.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\news.html
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\nn.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\o.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\on.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\p.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\pestscanimg.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\pixsy.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\pn.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\popup_off.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\popup_on.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\popup_ona.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\p_yahoo.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\p_yahoo_fr.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\q.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\qn.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\r.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\relatedlinks.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\report.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\right.png
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\rn.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\rss.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\rss.xsl
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\rss1.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\rsslib.js
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\rssmenu1_7a.zip
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\s.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\search.gif
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\search_fr.gif
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\security.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\sinfo.txt
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\sinfo.txt20969609
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\siteinfo.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\slider.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\sn.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\spacer.gif
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\stars-red1.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\stars-red2.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\stars-red3.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\stars-red4.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\stars-red5.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\storage.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\t.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\tabdataV3.js
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\tablib.js
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\tabwelcome_en.html
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\tabwelcome_fr.html
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\tab_icon.png
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\technorati.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\thes_search.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\tn.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\tools.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\top.png
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\top_left.png
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\top_right.png
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\translate.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\u.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\un.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\utf8.js
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\v.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\vmlib.js
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\vmntoolbartb0501.cfg
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\vn.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\w.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\web_en.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\wikipedia.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\wn.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\x.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\xp_close_small.gif
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\Yahoo.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\yahoo_search.gif
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\YouTube.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\z.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\zn.bmp
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar\zoom.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\---Yahoo.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\01net.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\1px_dark.gif
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\1px_green.gif
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\1px_white.gif
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\a.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\amazon.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\an.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\arrowB.gif
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\arrowT.gif
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\arrow_down.gif
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\arrow_red.gif
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\arrow_red2.gif
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\arrow_up.gif
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\autofill.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\avstate.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\b.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\background2.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\bgmeteo_results.gif
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\bg_pub.gif
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\bg_ttl.gif
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\bn.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\bottom.png
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\bottom_left.png
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\bottom_right.png
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\btn_close.gif
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\btn_minus.gif
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\btn_moreforecast.gif
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\c.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\canalblog.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\cn.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\COMBOSEARCH.acs
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\d.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\dictionary2.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\dn.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\downfile
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\DownloadCOM.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\dropdown.css
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\ErrorPageTemplate.css
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\f.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\flag_argentine.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\flag_australia.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\flag_brazil.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\flag_canada.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\flag_china.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\flag_france.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\flag_germany.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\flag_greece.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\flag_hongkong.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\flag_india.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\flag_indonesia.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\flag_italy.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\flag_japan.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\flag_korea.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\flag_mexico.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\flag_netherlands.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\flag_spain.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\flag_sweeden.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\flag_taiwan.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\flag_uk.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\flag_usa.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\fn.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\g.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\gaming.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\gn.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\gograph.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\graphred0.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\graphred0_5.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\graphred1.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\graphred1_5.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\graphred2.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\graphred2_5.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\graphred3.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\graphred3_5.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\graphred4.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\graphred4_5.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\graphred5.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\h.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\help.gif
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\hideremove.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\highlight.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\hn.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\h_aquarius.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\h_aries.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\h_cancer.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\h_capricorn.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\h_gemini.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\h_leo.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\h_libra.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\h_pisces.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\h_sagittarius.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\h_scorpio.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\h_taurus.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\h_virgo.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\i.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\icotemp_placeholder.gif
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\IEtab1_7d.zip
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\in.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\ipsearch.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\j.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\jn.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\k.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\kn.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\l.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\left.png
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\ln.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\loading.gif
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\login.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\logo.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\n.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\New York_NY_weather.txt
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\new02.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\NewCfg
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\news.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\news.html
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\nn.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\o.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\on.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\p.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\pestscanimg.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\pixsy.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\pn.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\popup_off.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\popup_on.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\popup_ona.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\p_yahoo.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\p_yahoo_fr.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\q.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\qn.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\r.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\relatedlinks.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\report.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\right.png
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\rn.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\rss.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\rss.xsl
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\rss1.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\rsslib.js
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\rssmenu1_7a.zip
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\s.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\search.gif
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\search_fr.gif
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\security.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\sinfo.txt
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\siteinfo.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\slider.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\sn.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\spacer.gif
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\stars-red1.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\stars-red2.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\stars-red3.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\stars-red4.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\stars-red5.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\storage.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\t.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\tabdataV3.js
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\tablib.js
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\tabwelcome_en.html
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\tabwelcome_fr.html
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\tab_icon.png
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\technorati.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\thes_search.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\tn.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\tools.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\top.png
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\top_left.png
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\top_right.png
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\translate.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\u.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\un.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\utf8.js
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\v.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\vmlib.js
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\vmntoolbartb1501.cfg
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\vn.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\w.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\web.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\web_fr.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\wikipedia.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\wn.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\x.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\xp_close_small.gif
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\yahoo.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\yahoo_search.gif
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\YouTube.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\z.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\zn.bmp
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar\zoom.bmp
Supprime! - C:\Program Files\VMNToolbar\install.ico
Supprime! - C:\Program Files\VMNToolbar\tbuninstall.exe
Supprime! - C:\Program Files\VMNToolbar\toolbar.ini
Supprime! - C:\Program Files\VMNToolbar\uninstall.exe
Supprime! - C:\WINDOWS\system32\adssite-remove.exe
Supprime! - C:\WINDOWS\system32\adssite_sidebar_uninstall.exe
Supprime! - C:\WINDOWS\System32\Dcads-remove.exe
Supprime! - C:\WINDOWS\system32\dcads_sidebar_uninstall.exe
Supprime! - C:\WINDOWS\system32\rightonadz-uninst.exe
Supprime! - C:\WINDOWS\system32\superiorads-uninst.exe
Supprime! - C:\Program Files\Dcads Games Collection
Supprime! - C:\DOCUME~1\Ludo\APPLIC~1\VMNToolbar
Supprime! - C:\DOCUME~1\Seb\APPLIC~1\VMNToolbar
Supprime! - C:\Program Files\VMNToolbar

-----------\\ Recherche de Fichiers / Dossiers ...


-----------\\ Extensions

(All Users) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar

(Ludo) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar

(Seb) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar


-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="http://home.neuf.fr/"
"SearchMigratedDefaultURL"="https://www.google.com/webhp?gws_rd=ssl{searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8"
"Search Bar"="http://www.google.com/toolbar/ie8/sidebar.html"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.01net.com/telecharger/"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Start Page"="https://www.msn.com/fr-fr/"
"Home_Page"="https://www.dell.com/fr-fr?c=fr&l=fr&s=gen&redirect=1"
"Help_Page"="http://support.euro.dell.com/segment.asp?country=FR&language=FR"


--------------------\\ Recherche d'autres infections


Aucune autre infection trouvée !


1 - "C:\ToolBar SD\TB_1.txt" - 25/11/2008|21:05 - Option : [2]

-----------\\ Fin du rapport a 21:05:51,65
0
BuTHora > BuTHora
 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:10:57, on 25/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
C:\Program Files\Pack Securite\Common\FSMA32.EXE
C:\Program Files\Pack Securite\Anti-Virus\FSGK32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Pack Securite\Common\FSMB32.EXE
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Pack Securite\Common\FCH32.EXE
C:\Program Files\Pack Securite\Common\FAMEH32.EXE
C:\Program Files\Pack Securite\Anti-Virus\fsqh.exe
C:\Program Files\Pack Securite\FSPC\fspc.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Pack Securite\Anti-Virus\fssm32.exe
C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Pack Securite\FSAUA\program\fsus.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Pack Securite\Common\FSM32.EXE
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NetWaiting\netWaiting.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Pack Securite\FSGUI\fsguidll.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Fichiers communs\AOL\1169114695\ee\aolsoftware.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Pack Securite\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=5061010
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {FC6F74C0-145D-4815-B9AD-CE29318696B3} - C:\WINDOWS\system32\c_g1803.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Pack Securite\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Pack Securite\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [AOL Dialer] C:\Program Files\Fichiers communs\AOL\ACS\AOlDial.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [Saxo] C:\Program Files\Saxo\Saxo.exe regstart
O4 - HKCU\..\Run: [Pando] "C:\Program Files\Pando Networks\Pando\Pando.exe" /Minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Parental... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Parental... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {87AF076E-D86D-4E87-ADDD-F05804E1F150} - https://www.virginmega.fr/DownloadManager/Release/Prod/DownMan.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Pack Securite\Common\FSMA32.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
0
jfkpresident Messages postés 13877 Statut Contributeur sécurité 1 175
 
Télécharge OTMoveIt3 de OldTimer sur ton Bureau en cliquant sur ce lien :

http://oldtimer.geekstogo.com/OTMoveIt3.exe

Double-clique sur OTMoveIt3.exe pour le lancer.

Vérifie que la case devant "Unregister Dll's and Ocx's est bien cochée.

Copie la liste qui se trouve en gras ci-dessous,

et colle-la dans le cadre de gauche de OTMoveIt : "Paste instructions for item to be moved".


:processes
explorer.exe

:Reg

:files
C:\Program Files\Saxo\Saxo.exe regstart
C:\WINDOWS\system32\c_g1803.dll

:services

:commands
[purity]
[emptytemp]
[start explorer]
[reboot]


Clique sur "MoveIt!" pour lancer la suppression.

Le résultat apparaitra dans le cadre "Results".

Clique sur "Exit" pour fermer.

Poste le rapport situé dans C:\_OTMoveIt\MovedFiles sous le nom xxxxxx_xxxxxxxxxx.log .

Il te sera peut-être demander de redémarrer le pc pour achever la suppression. Si c'est le cas accepte par Yes.

Ensuite dis moi comment se comporte ton pc ?

0
BuTHora
 
========== PROCESSES ==========
Process explorer.exe killed successfully.
========== REGISTRY ==========
========== FILES ==========
File/Folder C:\Program Files\Saxo\Saxo.exe regstart not found.
LoadLibrary failed for C:\WINDOWS\system32\c_g1803.dll
C:\WINDOWS\system32\c_g1803.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\c_g1803.dll scheduled to be moved on reboot.
========== SERVICES/DRIVERS ==========
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\Ludo\LOCALS~1\Temp\yslhrqav.dat scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\nvcbin.def.CA456A2F.TMP scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_a10.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\Ludo\Local Settings\Application Data\Mozilla\Firefox\Profiles\twcs701z.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Ludo\Local Settings\Application Data\Mozilla\Firefox\Profiles\twcs701z.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Ludo\Local Settings\Application Data\Mozilla\Firefox\Profiles\twcs701z.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Ludo\Local Settings\Application Data\Mozilla\Firefox\Profiles\twcs701z.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Ludo\Local Settings\Application Data\Mozilla\Firefox\Profiles\twcs701z.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.1 log created on 11252008_224012
0
BuTHora > BuTHora
 
Et bien quand j'ai redémarrer, il m'a mis le même message (code dangereux virus podnuha)
mais c'est vrai qu'il rame moins.
0
jfkpresident Messages postés 13877 Statut Contributeur sécurité 1 175
 
Ok ,on va sortir l'artillerie lourde afin de déceler ce rootkit :

Télécharges ComboFix à partir d'un de ces liens :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
https://forospyware.com
http://www.geekstogo.com/forum/files/file/197-combofix-by-subs/

Et important, enregistre le sur le bureau.

Avant d'utiliser ComboFix :

? Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.

? Désactive provisoirement et seulement le temps de l'utilisation de ComboFix,
la protection en temps réel de ton Antivirus et de tes Antispywares,
qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.

Une fois fait, sur ton bureau double-clic sur Combofix.exe.

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.

- En fin de scan il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt,.
est automatiquement sauvegardé et rangé à C:\Combofix.txt)

? Réactive la protection en temps réel de ton Antivirus et de tes Antispywares,
avant de te reconnecter à internet.

? Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

0