HIjackthisFermé

Question

Bonjour,

Mon ordinateur depuis peu est super lent mais juste sur internet, Genre mon débit a baisser de moitié. 
Deplus des page de pub s'ouvre sur firefox quand je navigue sur internet alors qu'avant tous fonctionnait nickel.
J'ai fait un scan avec HijackThis, je met le Copier/Coller si quelqu'un pourrait m'aider ;) merci

ogfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:12:34, on 22/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Dit.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
C:\Program Files\Home Cinema\PowerCinema\PCMService.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\WebCam\M1000\M1000Mnt.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
F:\Soirée pétanque\3.0\Apps\apdproxy.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\SteamKeyFr\SteamKeyFr.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\documents and settings\waelkens\local settings\application data\kmaik.exe
C:\WINDOWS\system32\agrsmsvc.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\interMute\SpySubtract\SpySub.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.aldi.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar	oolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [M1000Mnt] M1000Rmv.exe /StartStillMnt
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "F:\Soirée pétanque\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [SteamKeyFr] "C:\Program Files\SteamKeyFr\SteamKeyFr.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [TrueDownloaderAutoStart] C:\Program Files\TrueDownloader\TrueDownloader.exe /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [Steam] "D:\Program Files\Valve\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [kmaik] "c:\documents and settings\waelkens\local settings\application data\kmaik.exe" kmaik
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: &Download with TrueDownloader! - C:\Program Files\TrueDownloader\TrueDownloader.htm
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTML
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O12 - Plugin for .mu3: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O12 - Plugin for .mus: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O12 - Plugin for .mut: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O12 - Plugin for .myr: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O12 - Plugin for .xmz: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O14 - IERESET.INF: START_PAGE_URL=https://www.aldi.com/
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1106243543703
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {8FEFF364-6A5F-4966-A917-A3AC28411659} - http://phpadsnew.merco6.com/libraries/SOPCORE.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O16 - DPF: {FD40EC41-D860-4579-8BA4-52671A45C71C} (AxHtChat Class) - http://images.goa.com/it/Woo2/fr/chat/nPaxChat.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Lyonnais92 · Answer

Bonjour,

Clique sur ce lien :
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe
pour télécharger navilog1.exe.

Choisis Enregistrer

et enregistre-le sur ton bureau.

Ensuite double clique sur navilog1.exe pour lancer l'installation.
Une fois l'installation terminée, le fix s'exécutera automatiquement.
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau).


Double clique sur le raccourci Navilog1 présent sur le bureau et laisse-toi guider.
    Au menu principal, choisis 4 et valide.

    Le fix va te demander de saisir le nom de fichier.
    Saisis ce qui est en gras ci-dessous et rien d'autre puis valide:

 kmaik

    Le fix va te demander de le resaisir, fais-le et valide.

    Le fix va t'informer qu'il va alors redémarrer ton PC
    Ferme toutes les fenêtres ouvertes et enregistre tes documents personnels ouverts
    Appuie sur une touche comme demandé.
    (si ton Pc ne redémarre pas automatiquement, fais-le toi-même)
    Au redémarrage de ton PC, choisis ta session habituelle si nécessaire.
    Patiente jusqu'au message :
    *** Nettoyage Termine le ..... ***
    Le blocnote va s'ouvrir.
    Sauvegarde le rapport de manière à le retrouver
    Referme le blocnote. Ton bureau va réapparaître


Poste le rapport (cleannavi..txt)

    S:Si ton bureau ne réapparaît pas, fais CTRL+ALT+SUPP pour ouvrir le gestionnaire de tâches.
    Puis rends-toi à l'onglet "processus". Clique en haut à gauche sur fichiers et choisis "exécuter"
    Tape explorer et valide. Cela te fera apparaître ton bureau

================
Télécharge ici :

http://images.malwareremoval.com/random/RSIT.exe

random's system information tool (RSIT) par random/random et sauvegarde-le sur le Bureau.

Double-clique sur RSIT.exe afin de lancer RSIT.

Lis le contenu de l'écran Disclaimer puis clique sur Continue (si tu acceptes les conditions).

Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.

Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).

NB : Les rapports sont sauvegardés dans le dossier C:\rsit

CaptainZack · Answer

WOuha ok Merci je fais sa tout de suite

CaptainZack · Answer

Le contenu de log.txt :







Logfile of random's system information tool 1.04 (written by random/random)
Run by waelkens at 2008-11-22 17:11:20
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 6 GB (8%) free of 76 GB
Total RAM: 1023 MB (21% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:11:26, on 22/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\agrsmsvc.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
C:\Program Files\Home Cinema\PowerCinema\PCMService.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\WebCam\M1000\M1000Mnt.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
F:\Soirée pétanque\3.0\Apps\apdproxy.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\SteamKeyFr\SteamKeyFr.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\interMute\SpySubtract\SpySub.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
D:\ISO\RSIT.exe
D:\Program Files\Trend Micro\HijackThis\waelkens.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.aldi.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar	oolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [M1000Mnt] M1000Rmv.exe /StartStillMnt
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "F:\Soirée pétanque\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [SteamKeyFr] "C:\Program Files\SteamKeyFr\SteamKeyFr.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [TrueDownloaderAutoStart] C:\Program Files\TrueDownloader\TrueDownloader.exe /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [Steam] "D:\Program Files\Valve\Steam\Steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: &Download with TrueDownloader! - C:\Program Files\TrueDownloader\TrueDownloader.htm
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTML
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O12 - Plugin for .mu3: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O12 - Plugin for .mus: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O12 - Plugin for .mut: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O12 - Plugin for .myr: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O12 - Plugin for .xmz: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O14 - IERESET.INF: START_PAGE_URL=https://www.aldi.com/
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1106243543703
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {8FEFF364-6A5F-4966-A917-A3AC28411659} - http://phpadsnew.merco6.com/libraries/SOPCORE.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O16 - DPF: {FD40EC41-D860-4579-8BA4-52671A45C71C} (AxHtChat Class) - http://images.goa.com/it/Woo2/fr/chat/nPaxChat.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Lyonnais92 · Answer

Re,

tu as été infecté par CID. Comment tu l'as éradiqué ?

=========================================

Ouvre ce lien  (merci a S!RI pour ce programme). http://siri.urz.free.fr/Fix/SmitfraudFix.php
et télécharge SmitfraudFix.exe.

Regarde le tuto
Exécute le en choisissant l’option 1, il va générer un rapport
Copie/colle le sur le poste stp.

CaptainZack · Answer

Re !

Alors je ne savais pas que j'ai été infecter par CID.
Je sais que j'ai eu des problème de virus avant, que j'ai régler avec de simple scan anti virus je pense, enfin sa remonte a loin donc je sais pas trop :s ^^

donc voila pour le rapport :



SmitFraudFix v2.376

Rapport fait à 19:33:12,79, 22/11/2008
Executé à partir de C:\Documents and Settings\waelkens\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\agrsmsvc.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
C:\Program Files\Home Cinema\PowerCinema\PCMService.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\WebCam\M1000\M1000Mnt.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
F:\Soirée pétanque\3.0\Apps\apdproxy.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\SteamKeyFr\SteamKeyFr.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\interMute\SpySubtract\SpySub.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

C:\WINDOWS\config.ini PRESENT !
C:\WINDOWS\Tasks\At?.job PRESENT !
C:\WINDOWS\Tasks\At??.job PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32	dssservers.dat détecté, utilisez un scanner de Rootkit
C:\WINDOWS\system32	dssadw.dll détecté, utilisez un scanner de Rootkit
C:\WINDOWS\system32	dssinit.dll détecté, utilisez un scanner de Rootkit
C:\WINDOWS\system32	dssl.dll détecté, utilisez un scanner de Rootkit
C:\WINDOWS\system32	dsslog.dll détecté, utilisez un scanner de Rootkit
C:\WINDOWS\system32	dssmain.dll détecté, utilisez un scanner de Rootkit

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\waelkens


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\waelkens\LOCALS~1\Temp


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\waelkens\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\waelkens\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: VIA Rhine III Fast Ethernet Adapter
DNS Server Search Order: 192.168.1.1

Description: VIA Rhine III Fast Ethernet Adapter
DNS Server Search Order: 192.168.1.1

Description: RT2500 USB Wireless LAN Card
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{5117914C-15EB-4FDF-854E-08858678B038}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{C2132D90-9662-445E-ADDC-1CE46A312C21}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{FB6DEAFC-9202-4679-8981-772AF369289F}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{5117914C-15EB-4FDF-854E-08858678B038}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{FB6DEAFC-9202-4679-8981-772AF369289F}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{5117914C-15EB-4FDF-854E-08858678B038}: DhcpNameServer=192.168.1.1 0.0.0.0
HKLM\SYSTEM\CS2\Services\Tcpip\..\{FB6DEAFC-9202-4679-8981-772AF369289F}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{FB6DEAFC-9202-4679-8981-772AF369289F}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin


Par contre internet n'est plus aussi lent depuis que j'ai utiliser navilog.
merci de ton aide.

merci de ton aide !

Lyonnais92 · Answer

Re,

il y a plus ennuyeux que navipromo.

==================================

    Démarre en mode sans échec :
    Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter.
    Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
    Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
    (Si F8 ne marche pas utilise la touche F5).
    ----------------------------------------------------------------------------
    Relance le programme Smitfraud,
    Cette fois choisit l’option 2, répond oui a tous ;
    Sauvegarde le rapport, Redémarre en mode normal, copie/colle le rapport sauvegardé sur le forum

================================
supprime (si il existe Combofix.exe sur ton Bureau ainsi que le répertoire Qoobox à la racine du disque, en général C:\Qoobox).

télécharge combofix (par sUBs) ici :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

et enregistre le sur le Bureau.

déconnecte toi d'internet et ferme toutes tes applications.

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)


double-clique sur combofix.exe et suis les instructions

en particulier installe la Console de récupération.

à la fin, il va produire un rapport C:\ComboFix.txt

réactive ton parefeu, ton antivirus, la garde de ton antispyware

copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

Tu as un tutoriel complet ici :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

CaptainZack · Answer

OUla, donc apparemment je suis encore infecter par CID ? Rapport de SmitFraud : SmitFraudFix v2.376 Rapport fait à 11:48:58,10, 23/11/2008 Executé à partir de C:\Documents and Settings\waelkens\Bureau\SmitfraudFix OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT Le type du système de fichiers est NTFS Fix executé en mode sans echec »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Arret des processus »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost 127.0.0.1 preymaster.humanhead.com 127.0.0.1 bin.errorprotector.com ## added by CiD 127.0.0.1 br.errorsafe.com ## added by CiD 127.0.0.1 br.winantivirus.com ## added by CiD 127.0.0.1 br.winfixer.com ## added by CiD 127.0.0.1 cdn.drivecleaner.com ## added by CiD 127.0.0.1 cdn.errorsafe.com ## added by CiD 127.0.0.1 cdn.winsoftware.com ## added by CiD 127.0.0.1 de.errorsafe.com ## added by CiD 127.0.0.1 de.winantivirus.com ## added by CiD 127.0.0.1 download.cdn.drivecleaner.com ## added by CiD 127.0.0.1 download.cdn.errorsafe.com ## added by CiD 127.0.0.1 download.cdn.winsoftware.com ## added by CiD 127.0.0.1 download.errorsafe.com ## added by CiD 127.0.0.1 download.systemdoctor.com ## added by CiD 127.0.0.1 download.winantispyware.com ## added by CiD 127.0.0.1 download.windrivecleaner.com ## added by CiD 127.0.0.1 download.winfixer.com ## added by CiD 127.0.0.1 drivecleaner.com ## added by CiD 127.0.0.1 dynamique.drivecleaner.com ## added by CiD 127.0.0.1 errorprotector.com ## added by CiD 127.0.0.1 errorsafe.com ## added by CiD 127.0.0.1 es.winantivirus.com ## added by CiD 127.0.0.1 fr.winantivirus.com ## added by CiD 127.0.0.1 fr.winfixer.com ## added by CiD 127.0.0.1 go.drivecleaner.com ## added by CiD 127.0.0.1 go.errorsafe.com ## added by CiD 127.0.0.1 go.winantispyware.com ## added by CiD 127.0.0.1 go.winantivirus.com ## added by CiD 127.0.0.1 hk.winantivirus.com ## added by CiD 127.0.0.1 instlog.errorsafe.com ## added by CiD 127.0.0.1 instlog.winantivirus.com ## added by CiD 127.0.0.1 instlog.winfixer.com ## added by CiD 127.0.0.1 jsp.drivecleaner.com ## added by CiD 127.0.0.1 kb.errorsafe.com ## added by CiD 127.0.0.1 kb.winantivirus.com ## added by CiD 127.0.0.1 nl.errorsafe.com ## added by CiD 127.0.0.1 se.errorsafe.com ## added by CiD 127.0.0.1 secure.drivecleaner.com ## added by CiD 127.0.0.1 secure.errorsafe.com ## added by CiD 127.0.0.1 secure.winantispam.com ## added by CiD 127.0.0.1 secure.winantispy.com ## added by CiD 127.0.0.1 secure.winantivirus.com ## added by CiD 127.0.0.1 support.winantivirus.com ## added by CiD 127.0.0.1 trial.updates.winsoftware.com ## added by CiD 127.0.0.1 ulog.winantivirus.com ## added by CiD 127.0.0.1 utils.errorsafe.com ## added by CiD 127.0.0.1 utils.winantivirus.com ## added by CiD 127.0.0.1 utils.winfixer.com ## added by CiD 127.0.0.1 winantispyware.com ## added by CiD 127.0.0.1 winantivirus.com ## added by CiD 127.0.0.1 winfixer.com ## added by CiD 127.0.0.1 winfixer2006.com ## added by CiD 127.0.0.1 winsoftware.com ## added by CiD 127.0.0.1 www.drivecleaner.com ## added by CiD 127.0.0.1 www.errorprotector.com ## added by CiD 127.0.0.1 www.errorsafe.com ## added by CiD 127.0.0.1 www.systemdoctor.com ## added by CiD 127.0.0.1 www.utils.winfixer.com ## added by CiD 127.0.0.1 www.win-anti-virus-pro.com ## added by CiD 127.0.0.1 www.win-virus-pro.com ## added by CiD 127.0.0.1 www.winantispam.com ## added by CiD 127.0.0.1 www.winantispy.com ## added by CiD 127.0.0.1 www.winantispyware.com ## added by CiD 127.0.0.1 www.winantivirus.com ## added by CiD 127.0.0.1 www.winantiviruspro.com ## added by CiD 127.0.0.1 www.windrivecleaner.com ## added by CiD 127.0.0.1 www.windrivesafe.com ## added by CiD 127.0.0.1 www.winfixer.com ## added by CiD 127.0.0.1 www.winfixer2006.com ## added by CiD 127.0.0.1 www.winsoftware.com ## added by CiD »»»»»»»»»»»»»»»»»»»»»»»» VACFix VACFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix S!Ri's WS2Fix: LSP not Found. »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés C:\WINDOWS\config.ini supprimé C:\WINDOWS\Tasks\At?.job supprimé »»»»»»»»»»»»»»»»»»»»»»»» IEDFix IEDFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» 404Fix 404Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» RK »»»»»»»»»»»»»»»»»»»»»»»» DNS HKLM\SYSTEM\CCS\Services\Tcpip\..\{C2132D90-9662-445E-ADDC-1CE46A312C21}: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CCS\Services\Tcpip\..\{FB6DEAFC-9202-4679-8981-772AF369289F}: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CS1\Services\Tcpip\..\{5117914C-15EB-4FDF-854E-08858678B038}: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CS1\Services\Tcpip\..\{FB6DEAFC-9202-4679-8981-772AF369289F}: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CS2\Services\Tcpip\..\{5117914C-15EB-4FDF-854E-08858678B038}: DhcpNameServer=192.168.1.1 0.0.0.0 HKLM\SYSTEM\CS2\Services\Tcpip\..\{FB6DEAFC-9202-4679-8981-772AF369289F}: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CS3\Services\Tcpip\..\{FB6DEAFC-9202-4679-8981-772AF369289F}: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0 »»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre Nettoyage terminé. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix !!!Attention, les clés qui suivent ne sont pas forcément infectées!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Fin --------------------------------------------------------------------------------------- Rapport Combofix : omboFix 08-11-22.02 - waelkens 2008-11-23 12:31:46.1 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.587 [GMT 1:00] Lancé depuis: d:\iso\ComboFix.exe * Un nouveau point de restauration a été créé . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\waelkens\Application Data\inst.exe c:\program files\INSTALL.LOG c:\windows\Downloaded Program Files\setup.inf c:\windows\ktd32.atm c:\windows\system32\Bank.dll c:\windows\system32 naph.dll c:\windows\system32 dssadw.dll c:\windows\system32\TDSSerrors.log c:\windows\system32 dssinit.dll c:\windows\system32 dssl.dll c:\windows\system32 dsslog.dll c:\windows\system32 dssmain.dll c:\windows\system32 dssserf.dll c:\windows\system32 dssserf1.dll c:\windows\system32 dssservers.dat . ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-23 au 2008-11-23 )))))))))))))))))))))))))))))))))))) . 2008-11-22 19:33 . 2008-11-23 11:49 3,820 --a------ c:\windows\system32 mp.reg 2008-11-22 19:32 . 2008-11-22 19:34 d-------- c:\documents and settings\waelkens\SmitfraudFix 2008-11-22 19:32 . 2007-09-05 23:22 289,144 --a------ c:\windows\system32\VCCLSID.exe 2008-11-22 19:32 . 2006-04-27 16:49 288,417 --a------ c:\windows\system32\SrchSTS.exe 2008-11-22 19:32 . 2008-10-01 14:51 87,552 --a------ c:\windows\system32\VACFix.exe 2008-11-22 19:32 . 2008-10-10 07:58 82,944 --a------ c:\windows\system32\o4Patch.exe 2008-11-22 19:32 . 2008-05-18 20:40 82,944 --a------ c:\windows\system32\IEDFix.exe 2008-11-22 19:32 . 2008-10-10 07:58 82,944 --a------ c:\windows\system32\IEDFix.C.exe 2008-11-22 19:32 . 2008-08-18 11:19 82,432 --a------ c:\windows\system32\404Fix.exe 2008-11-22 19:32 . 2003-06-05 20:13 53,248 --a------ c:\windows\system32\Process.exe 2008-11-22 19:32 . 2004-07-31 17:50 51,200 --a------ c:\windows\system32\dumphive.exe 2008-11-22 19:32 . 2007-10-03 23:36 25,600 --a------ c:\windows\system32\WS2Fix.exe 2008-11-22 17:11 . 2008-11-22 17:11 d-------- C: sit 2008-11-22 16:56 . 2008-11-22 17:04 d-------- c:\program files\Navilog1 2008-11-22 03:26 . 2008-11-22 03:26 d-------- c:\documents and settings\All Users\Application Data\Blizzard 2008-11-21 17:42 . 2008-11-21 17:42 d-------- C:\Logs 2008-11-20 09:56 . 2008-11-20 09:56 d-------- c:\program files\Lavasoft 2008-11-20 09:56 . 2008-11-20 09:57 d-------- c:\documents and settings\All Users\Application Data\Lavasoft 2008-11-16 20:56 . 2008-11-20 15:41 d-------- c:\program files\adslTV 2008-11-16 20:56 . 2008-11-16 20:56 d-------- c:\documents and settings\waelkens\Application Data\vlc 2008-11-15 18:27 . 2008-11-15 18:27 d-------- c:\documents and settings\All Users\Application Data\2DBoy 2008-11-14 22:24 . 2008-11-14 22:24 118 --a------ c:\windows\system32\MRT.INI 2008-11-13 17:46 . 2008-11-13 17:46 d-------- c:\documents and settings\waelkens\OngameNetwork 2008-11-11 08:36 . 2008-11-11 08:36 d-------- C:\Medion 2008-11-02 08:25 . 2008-11-02 08:25 2,425 --ah----- C:\mxfilerelatedcache.mxc2 2008-11-02 08:25 . 2008-11-02 08:25 1,520 --a------ C:\yannickk_1.avd 2008-10-25 12:55 . 2008-10-25 12:55 86,016 --a------ C:\yannickk.ifo 2008-10-25 12:55 . 2008-10-25 12:55 161 --a------ C:\yannickk.rpk 2008-10-25 12:55 . 2008-10-25 12:55 19 --a------ C:\yannickk.lst 2008-10-25 12:50 . 2008-10-25 12:55 555,194,368 --a------ C:\yannickk_1.vob 2008-10-24 19:03 . 2008-10-24 19:03 0 --a------ c:\windows\DXT108.tmp 2008-10-24 19:03 . 2008-10-24 19:03 0 --a------ c:\windows\DXT107.tmp 2008-10-24 19:03 . 2008-10-24 19:03 0 --a------ c:\windows\DXT106.tmp 2008-10-24 19:03 . 2008-10-24 19:03 0 --a------ c:\windows\DXT105.tmp 2008-10-24 19:03 . 2008-10-24 19:03 0 --a------ c:\windows\DXT104.tmp . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-23 11:31 --------- d-----w c:\program files\Wanadoo 2008-11-23 10:54 --------- d-----w c:\documents and settings\waelkens\Application Data\Skype 2008-11-23 08:15 17,408 ----a-w c:\windows\system32\drivers\USBCRFT.SYS 2008-11-22 18:33 5,632 -csha-w c:\program files\Thumbs.db 2008-11-21 10:39 --------- d-----w c:\program files\Fichiers communs\Blizzard Entertainment 2008-11-21 10:11 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-20 14:18 --------- d-----w c:\documents and settings\waelkens\Application Data\Orbit 2008-11-20 08:56 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard 2008-11-20 08:51 --------- d-----w c:\documents and settings\waelkens\Application Data\Lavasoft 2008-11-17 14:35 46,162 ----a-w c:\documents and settings\waelkens\Application Data\wklnhst.dat 2008-11-14 22:20 --------- d-----w c:\program files\DivX 2008-11-07 21:22 --------- d-----w c:\program files\Mozilla Thunderbird 2008-11-05 18:00 --------- d-----w c:\documents and settings\waelkens\Application Data\uTorrent 2008-11-05 11:23 98,304 ----a-w c:\windows\system32\CmdLineExt.dll 2008-10-29 12:41 --------- d-----w c:\program files\RomStation 2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-21 13:16 --------- d-----w c:\program files\Morgan 2008-10-18 12:22 209,636 ----a-w c:\windows\IPUI_DivXG400.exe 2008-10-18 12:20 --------- d-----w c:\program files\Rippackv3 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll 2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll 2008-10-16 12:51 --------- d-----w c:\documents and settings\waelkens\Application Data\FileZilla 2008-10-16 10:52 --------- d-----w c:\documents and settings\waelkens\Application Data\Apple Computer 2008-10-15 17:08 --------- d-----w c:\program files\DaemonTools_WhenUSave_Installer 2008-10-15 17:07 --------- d-----w c:\program files\Kodak 2008-10-15 16:40 --------- d-----w c:\program files\eRightSoft 2008-10-15 15:49 --------- d-----w c:\program files\BitComet 2008-10-15 09:49 --------- d-----w c:\program files\iTunes 2008-10-15 09:49 --------- d-----w c:\program files\iPod 2008-10-15 09:49 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-10-15 09:48 --------- d-----w c:\program files\Bonjour 2008-10-15 09:47 --------- d-----w c:\program files\QuickTime 2008-10-15 09:46 --------- d-----w c:\program files\Fichiers communs\Apple 2008-10-15 09:44 --------- d-----w c:\program files\Apple Software Update 2008-10-02 14:49 --------- d-----w c:\program files\Warcraft III 2008-10-01 11:01 32,000 ----a-w c:\windows\system32\drivers\usbaapl.sys 2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll 2008-09-30 14:30 98,304 ----a-w c:\windows\DUMPc8fd.tmp 2008-09-30 14:28 98,304 ----a-w c:\windows\DUMP3718.tmp 2008-09-28 06:41 --------- d-----w c:\program files\Combined Community Codec Pack 2008-09-26 13:44 --------- d-----w c:\documents and settings\waelkens\Application Data\Dev-Cpp 2008-09-26 13:02 --------- d-----w c:\documents and settings\waelkens\Application Data\codeblocks 2008-09-26 11:56 --------- d-----w c:\program files\Microsoft Visual Studio 9.0 2008-09-26 11:56 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help 2008-09-24 09:14 --------- d-----w c:\program files\Messenger Plus! Live 2008-09-23 17:56 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Corporation 2008-09-23 17:48 --------- d-----w c:\program files\Guitar Pro 5 2008-09-23 17:48 --------- d-----w c:\program files\Garena 2008-09-23 17:47 --------- d-----w c:\program files\Sports Interactive 2008-09-23 17:46 --------- d-----w c:\program files\eMule 2008-09-23 14:47 --------- d-----w c:\program files\Dofus 2008-09-19 21:55 200,704 -c--a-w c:\windows\system32\ssldivx.dll 2008-09-19 21:55 1,044,480 -c--a-w c:\windows\system32\libdivx.dll 2008-09-15 15:39 1,846,144 ----a-w c:\windows\system32\win32k.sys 2008-09-04 16:45 1,106,944 ----a-w c:\windows\system32\msxml3.dll 2008-08-29 19:06 1,350,664 ----a-w c:\windows\system32\msxml6.dll 2008-08-29 08:18 87,336 ----a-w c:\windows\system32\dns-sd.exe 2008-08-29 07:53 61,440 ----a-w c:\windows\system32\dnssd.dll 2008-06-09 08:26 85,944 -c--a-w c:\documents and settings\waelkens\Application Data\GDIPFONTCACHEV1.DAT 2007-11-18 14:15 47,360 -c--a-w c:\documents and settings\waelkens\Application Data\pcouffin.sys 2007-05-21 11:11 47 -c--a-w c:\documents and settings\waelkens\fixsize.cmd 2007-04-04 20:30 95,232 -c--a-w c:\documents and settings\waelkens\filechop.exe 2007-03-08 23:10 18,690 -c--a-w c:\documents and settings\waelkens\make-multi.exe 2007-02-25 12:00 1 -c--a-w c:\documents and settings\waelkens\SI.bin 2006-07-28 08:30 88,102 -c--a-w c:\program files\Aug2006_xinput_x64.cab 2006-07-28 08:30 47,018 -c--a-w c:\program files\Aug2006_xinput_x86.cab 2006-07-28 08:30 41,995 -c--a-w c:\program files\dxdllreg_x86.cab 2006-07-28 08:30 183,863 -c--a-w c:\program files\Aug2006_XACT_x64.cab 2006-07-28 08:30 138,195 -c--a-w c:\program files\Aug2006_XACT_x86.cab 2006-07-28 07:32 82,338 -c--a-w c:\program files\dxupdate.cab 2006-07-28 07:32 2,248,984 -c--a-w c:\program files\dsetup32.dll 2006-07-28 07:31 484,632 -c--a-w c:\program files\DXSETUP.exe 2006-07-28 07:30 74,520 -c--a-w c:\program files\DSETUP.dll 2006-06-05 23:07 31 -c----w c:\documents and settings\waelkens\getfile.dat 2006-05-31 05:39 181,745 -c----w c:\program files\JUN2006_XACT_x64.cab 2006-05-31 05:39 134,631 -c----w c:\program files\JUN2006_XACT_x86.cab 2006-03-31 11:56 917,318 -c----w c:\program files\Apr2006_MDX1_x86.cab 2006-03-31 11:56 87,989 -c----w c:\program files\Apr2006_xinput_x64.cab 2006-03-31 11:56 46,898 -c----w c:\program files\Apr2006_xinput_x86.cab 2006-03-31 11:56 4,163,518 -c----w c:\program files\Apr2006_MDX1_x86_Archive.cab 2006-03-31 11:56 180,021 -c----w c:\program files\Apr2006_XACT_x64.cab 2006-03-31 11:56 133,991 -c----w c:\program files\Apr2006_XACT_x86.cab 2006-03-31 11:56 1,398,718 -c----w c:\program files\Apr2006_d3dx9_30_x64.cab 2006-03-31 11:56 1,116,109 -c----w c:\program files\Apr2006_d3dx9_30_x86.cab 2006-02-16 13:05 278,528 -c--a-w c:\program files\Fichiers communs\FDEUnInstaller.exe 2006-02-03 08:00 179,247 -c----w c:\program files\Feb2006_XACT_x64.cab 2006-02-03 08:00 133,297 -c----w c:\program files\Feb2006_XACT_x86.cab 2006-02-03 08:00 1,363,684 -c----w c:\program files\Feb2006_d3dx9_29_x64.cab 2006-02-03 08:00 1,085,608 -c----w c:\program files\Feb2006_d3dx9_29_x86.cab 2005-12-05 17:31 86,925 -c----w c:\program files\Oct2005_xinput_x64.cab 2005-12-05 17:31 46,247 -c----w c:\program files\Oct2005_xinput_x86.cab 2005-12-05 17:31 1,358,864 -c----w c:\program files\Dec2005_d3dx9_28_x64.cab 2005-01-25 16:24 8 -csh--r c:\windows\system32\F2A38CDCBF.sys 2006-05-03 09:06 163,328 --sh--r c:\windows\system32\flvDX.dll 2005-01-25 16:24 5,744 -csha-w c:\windows\system32\KGyGaAvL.sys 2007-02-21 10:47 31,232 --sh--r c:\windows\system32\msfDX.dll 2008-03-16 12:30 216,064 --sh--r c:\windows\system32 bDX.dll . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2004-12-09 1937408] "SteamKeyFr"="c:\program files\SteamKeyFr\SteamKeyFr.exe" [2004-01-28 212992] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2007-01-12 25367592] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-25 68856] "WOOKIT"="c:\progra~1\Wanadoo\Shell.exe" [2004-08-23 122880] "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\WCESCOMM.EXE" [2004-02-24 401491] "TrueDownloaderAutoStart"="c:\program files\TrueDownloader\TrueDownloader.exe" [2005-02-20 520258] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360] "LightScribe Control Panel"="c:\program files\Fichiers communs\LightScribe\LightScribeControlPanel.exe" [2007-08-23 455968] "DAEMON Tools Pro Agent"="c:\program files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 136136] "Steam"="d:\program files\Valve\Steam\Steam.exe" [2008-10-15 1410296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "AOLDialer"="c:\program files\Fichiers communs\AOL\ACS\AOLDial.exe" [2004-04-08 496752] "PCMService"="c:\program files\Home Cinema\PowerCinema\PCMService.exe" [2005-02-04 118926] "ISUSPM Startup"="c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-06-16 221184] "ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-08-09 81920] "WOOWATCH"="c:\progra~1\Wanadoo\Watch.exe" [2004-08-23 20480] "WOOTASKBARICON"="c:\progra~1\Wanadoo\GestMaj.exe" [2004-10-14 32768] "Adobe Photo Downloader"="f:\soirée pétanque\3.0\Apps\apdproxy.exe" [2005-06-23 57344] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008] "SMSTray"="c:\program files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-09-20 132624] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440] "AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576] "Dit"="Dit.exe" [2004-07-20 c:\windows\Dit.exe] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-19 c:\windows\system32\bthprops.cpl] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2006-07-16 626176] Logiciel Kodak EasyShare.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2007-06-21 282624] SpySubtract.lnk - c:\program files\interMute\SpySubtract\SpySub.exe [2007-03-18 1187840] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoBandCustomize"= 0 (0x0) "NoMovingBands"= 0 (0x0) "NoCloseDragDropBands"= 0 (0x0) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"= "c:\program files\interMute\SpySubtract\sshook.dll" [2007-03-18 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.I420"= i420vfw.dll "msacm.l3acm"= c:\windows\system32\l3codecp.acm "MSACM.CEGSM"= mobilev.acm "VIDC.FFDS"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll "vidc.DIV3"= DivXc32.dll "vidc.DIV4"= DivXc32f.dll "msacm.divxa32"= DivXa32.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "c:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe"= "c:\Program Files\Microsoft ActiveSync\wcescomm.exe"= "c:\Documents and Settings\waelkens\Bureau\yannicl\programme C C++\eMule0.49b\emule.exe"= "c:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "6112:TCP"= 6112:TCP:Warcraft "4670:TCP"= 4670:TCP:emule port "4671:UDP"= 4671:UDP:emule portudp "3724:TCP"= 3724:TCP:BLIZZARD R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-07-30 78416] R1 cpuidlep;CpuIdle Pro System Driver;c:\windows\system32\drivers\cpuidlep.sys [2008-05-01 4484] R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-07-30 20560] R2 UxTuneUp;Extension de conception TuneUp;c:\windows\System32\svchost.exe -k netsvcs [2005-01-20 14336] R3 3xHybrid;3xHybrid service;c:\windows\system32\DRIVERS\3xHybrid.sys [2005-02-05 802048] R3 cmudax;C-Media High Definition Audio Interface;c:\windows\system32\drivers\cmudax.sys [2005-01-20 1272000] R3 wbscr;Winbond Smartcard Reader for I/O;c:\windows\system32\drivers\wbscr.sys [2005-01-20 19928] S2 FILESpy;FILESpy;\??\c:\program files\Softwin\BitDefender9\filespy.sys [] S3 AIDA32Driver;AIDA32Driver;\??\c:\program files\AIDA32 - Personal System Information\aida32.sys [2004-02-23 3584] S3 CardReaderFilter;Card Reader Filter;\??\c:\windows\system32\Drivers\USBCRFT.SYS [2005-01-20 17408] S3 lac97inf;lac97inf;\??\c:\docume~1\waelkens\LOCALS~1\Temp\lac97inf.sys [] S3 M1000Srv;M5603C USB2.0 Camera Driver;c:\windows\system32\Drivers\M1000KNT.sys [2007-01-10 274567] S3 PPJoyBus;Parallel Port Joystick Bus device driver;c:\windows\system32\drivers\PPJoyBus.sys [2004-01-23 13952] S3 PPortJoystick;Parallel Port Joystick device driver;c:\windows\system32\drivers\PPortJoy.sys [2004-01-23 28800] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2ac68d9a-f886-11da-a67e-001109df929d}] \Shell\AutoRun\command - L:\PreyStub.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5bd32168-dd23-11db-a8d2-001109df929d}] \Shell\AutoRun\command - K:\Autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{925fa382-1aac-11db-a6cd-001109df929d}] \Shell\AutoRun\command - M:\AutoRun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ca5651a3-8e67-11da-a58f-001109df929d}] \Shell\AutoRun\command - livebox.exe *Newly Created Service* - CATCHME *Newly Created Service* - PROCEXP90 [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "c:\program files\Fichiers communs\LightScribe\LSRunOnce.exe" . Contenu du dossier 'Tâches planifiées' 2008-11-23 c:\windows\Tasks\AF65D5EA91324F1E.job - c:\docume~1\waelkens\applic~1\cdromw~1\BLEH LITE BAIT.exe [] 2008-11-18 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2008-11-21 c:\windows\Tasks\Maintenance en 1 clic.job - c:\program files\TuneUp Utilities 2006\SystemOptimizer.exe [2006-10-06 06:27] . - - - - ORPHELINS SUPPRIMES - - - - HKLM-Run-Cmaudio - cmicnfg.cpl HKLM-Run-M1000Mnt - M1000Rmv.exe . ------- Examen supplémentaire ------- . FireFox -: Profile - c:\documents and settings\waelkens\Application Data\Mozilla\Firefox\Profiles\vrvfhw56.default\ FF -: plugin - c:\documents and settings\waelkens\Application Data\Mozilla\Firefox\Profiles\vrvfhw56.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins phardwaredetection.dll FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser ppdf32.dll FF -: plugin - c:\program files\DivX\DivX Content Uploader pUpload.dll FF -: plugin - c:\program files\iTunes\Mozilla Plugins pitunes.dll FF -: plugin - c:\program files\K-Lite Codec Pack\Real\browser\plugins ppl3260.dll FF -: plugin - c:\program files\K-Lite Codec Pack\Real\browser\plugins prpjplug.dll FF -: plugin - c:\program files\ma-config.com phardwaredetection.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\NPMyrMus.dll FF -: plugin - c:\program files\Viewpoint\Viewpoint Experience Technology pViewpoint.dll FF -: plugin - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-23 12:33:29 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... HKCU\Software\Microsoft\Windows\CurrentVersion\Run TrueDownloaderAutoStart = c:\program files\TrueDownloader\TrueDownloader.exe /silent??????????????&?O?p?t?i?o?n?s???i?e?r?????????????????P?a?n?i?e?r???s?i?o?n? ?:???????????????M?o?t? ?d?e? ?p?a?s?s?e?:???????????????h?e?u?r?e?(?s?)?????a?i?s???????????????S?u?p?p?r?.? ?U?R?L???e Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'winlogon.exe'(732) c:\windows\system32\Ati2evxx.dll c:\windows\system32 saenh.dll - - - - - - - > 'lsass.exe'(788) c:\windows\system32\msprivs.dll c:\windows\system32 saenh.dll . Heure de fin: 2008-11-23 12:35:07 ComboFix-quarantined-files.txt 2008-11-23 11:34:36 Avant-CF: 7 907 942 400 octets libres Après-CF: 7,916,593,152 octets libres WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /fastdetect /NoExecute=OptIn 324 --- E O F --- 2008-11-14 21:24:20

Lyonnais92 · Answer

Re,

effectivement, toujours l'infection Cid :


Télécharge Lop S&D ici :

https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2

Double-clique dessus pour lancer l'installation

Puis double-clique [b]sur le raccourci Lop S&D/b présent sur ton bureau

Séléctionne la langue souhaitée , puis choisis [b]l'Option 1/b ( Recherche )

Patiente jusqu'à la fin du scan

Poste le rapport généré ( C:lopR.txt )

CaptainZack · Answer

Re,
Voila le rapport

 --------------------\  Lop S&D 4.2.4-9c   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) 4 CPU 3.20GHz )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : waelkens ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1229 [VPS 081122-0] 4.8.1229 (Activated)
   C:\ (Local Disk) - NTFS - Total:74 Go (Free:7 Go)
   D:\ (Local Disk) - NTFS - Total:68 Go (Free:8 Go)
   E:\ (Local Disk) - FAT32 - Total:5 Go (Free:1 Go)
   F:\ (Local Disk) - NTFS - Total:149 Go (Free:20 Go)
   G:\ (CD or DVD)
   H:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
   I:\ (CD or DVD)
   K:\ (USB)
   L:\ (USB)
   M:\ (USB)
   O:\ (CD or DVD)
   P:\ (CD or DVD)
   S:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
   Option : [1] ( 23/11/2008|14:25 )
 
   --------------------\  Listing des dossiers dans APPLIC~1

   [25/01/2005|17:00] C:\DOCUME~1\ADMINI~1\APPLIC~1\Adobe
   [26/01/2005|13:08] C:\DOCUME~1\ADMINI~1\APPLIC~1\AOL
   [05/02/2005|18:58] C:\DOCUME~1\ADMINI~1\APPLIC~1\CyberLink
   [20/01/2005|14:33] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
   [20/01/2005|18:50] C:\DOCUME~1\ADMINI~1\APPLIC~1\Macromedia
   [26/01/2005|19:30] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
   [30/09/2008|15:08] C:\DOCUME~1\ADMINI~1\APPLIC~1\Mozilla
   [26/01/2005|11:44] C:\DOCUME~1\ADMINI~1\APPLIC~1\Real
   [25/01/2005|16:45] C:\DOCUME~1\ADMINI~1\APPLIC~1\Sun
   [26/01/2005|13:08] C:\DOCUME~1\ADMINI~1\APPLIC~1\You've Got Pictures Screensaver

   [15/10/2008|10:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
   [15/11/2008|18:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\2DBoy
   [24/03/2007|06:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [09/12/2007|05:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
   [26/01/2005|13:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
   [01/12/2007|21:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [01/12/2007|21:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [10/07/2008|11:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ATI
   [22/11/2008|03:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Blizzard
   [29/11/2007|17:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Bluetooth
   [13/03/2007|09:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CakeBowsBrowseBall
   [21/04/2006|18:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Creative
   [06/02/2006|10:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
   [04/11/2007|01:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DAEMON Tools Pro
   [03/11/2007|18:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Droppix
   [27/05/2006|12:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
   [14/06/2007|14:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Elaborate Bytes
   [17/02/2006|21:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ESTsoft
   [12/09/2006|20:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [30/09/2006|15:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
   [27/02/2008|15:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kodak
   [20/11/2008|09:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
   [03/11/2007|17:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\LightScribe
   [22/09/2008|17:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ma-config.com
   [24/01/2006|22:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [02/07/2008|00:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MGS
   [02/07/2008|00:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microgaming
   [20/11/2008|09:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [23/09/2008|18:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Corporation
   [26/09/2008|12:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
   [26/01/2005|19:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\muvee Technologies
   [29/01/2006|12:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
   [02/07/2008|11:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Real
   [20/01/2005|14:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
   [21/01/2007|21:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
   [18/11/2007|09:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony
   [11/02/2006|14:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [03/04/2007|21:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
   [22/07/2006|19:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trojan Remover
   [24/01/2006|20:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TuneUp Software
   [26/01/2005|13:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
   [05/01/2007|22:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [15/03/2008|10:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
   [27/07/2008|19:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
   [28/07/2008|05:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion

   [25/01/2005|17:00] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Adobe
   [26/01/2005|13:08] C:\DOCUME~1\DEFAUL~1\APPLIC~1\AOL
   [05/02/2005|18:58] C:\DOCUME~1\DEFAUL~1\APPLIC~1\CyberLink
   [20/01/2005|14:33] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [20/01/2005|18:50] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Macromedia
   [26/01/2005|19:30] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
   [26/01/2005|11:44] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Real
   [25/01/2005|16:45] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Sun
   [26/01/2005|13:08] C:\DOCUME~1\DEFAUL~1\APPLIC~1\You've Got Pictures Screensaver

   [20/01/2005|14:35] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
   [26/01/2005|19:22] C:\DOCUME~1\LOCALS~1\APPLIC~1\X10 Commander

   [12/07/2007|02:00] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

   [24/04/2006|18:27] C:\DOCUME~1\PROPRI~1\APPLIC~1\Real
   [29/01/2006|12:38] C:\DOCUME~1\PROPRI~1\APPLIC~1\You've Got Pictures Screensaver

   [01/04/2006|13:12] C:\DOCUME~1\waelkens\APPLIC~1\.gaim
   [15/12/2007|12:34] C:\DOCUME~1\waelkens\APPLIC~1\ACAMPREF
   [04/01/2008|22:56] C:\DOCUME~1\waelkens\APPLIC~1\Adobe
   [20/02/2006|10:16] C:\DOCUME~1\waelkens\APPLIC~1\AdobeUM
   [04/11/2006|06:18] C:\DOCUME~1\waelkens\APPLIC~1\Ahead
   [26/01/2005|13:08] C:\DOCUME~1\waelkens\APPLIC~1\AOL
   [16/10/2008|11:52] C:\DOCUME~1\waelkens\APPLIC~1\Apple Computer
   [25/01/2006|06:05] C:\DOCUME~1\waelkens\APPLIC~1\ArcSoft
   [01/05/2008|21:48] C:\DOCUME~1\waelkens\APPLIC~1\ATI
   [26/01/2006|21:47] C:\DOCUME~1\waelkens\APPLIC~1\Azureus
   [12/03/2007|22:43] C:\DOCUME~1\waelkens\APPLIC~1\BitDownload
   [31/05/2008|10:47] C:\DOCUME~1\waelkens\APPLIC~1\BSplayer
   [13/04/2008|22:02] C:\DOCUME~1\waelkens\APPLIC~1\BSplayer Pro
   [12/03/2007|23:01] C:\DOCUME~1\waelkens\APPLIC~1\CdromWait
   [26/09/2008|14:02] C:\DOCUME~1\waelkens\APPLIC~1\codeblocks
   [12/02/2007|13:00] C:\DOCUME~1\waelkens\APPLIC~1\CyberLink
   [04/11/2007|00:05] C:\DOCUME~1\waelkens\APPLIC~1\DAEMON Tools Pro
   [26/12/2007|14:50] C:\DOCUME~1\waelkens\APPLIC~1\DataCast
   [26/09/2008|14:44] C:\DOCUME~1\waelkens\APPLIC~1\Dev-Cpp
   [31/03/2007|07:52] C:\DOCUME~1\waelkens\APPLIC~1\DivX
   [12/03/2006|07:23] C:\DOCUME~1\waelkens\APPLIC~1\DMCache
   [03/11/2007|17:27] C:\DOCUME~1\waelkens\APPLIC~1\Droppix
   [19/09/2008|04:31] C:\DOCUME~1\waelkens\APPLIC~1\EPSON
   [17/02/2006|21:07] C:\DOCUME~1\waelkens\APPLIC~1\ESTsoft
   [16/10/2008|13:51] C:\DOCUME~1\waelkens\APPLIC~1\FileZilla
   [03/05/2007|19:51] C:\DOCUME~1\waelkens\APPLIC~1\GetRightToGo
   [15/09/2006|11:31] C:\DOCUME~1\waelkens\APPLIC~1\Google
   [25/03/2008|18:07] C:\DOCUME~1\waelkens\APPLIC~1\gtk-2.0
   [04/11/2006|23:25] C:\DOCUME~1\waelkens\APPLIC~1\Help
   [20/01/2005|14:33] C:\DOCUME~1\waelkens\APPLIC~1\Identities
   [14/02/2006|23:04] C:\DOCUME~1\waelkens\APPLIC~1\IDM
   [14/06/2007|18:37] C:\DOCUME~1\waelkens\APPLIC~1\ImgBurn
   [28/01/2007|11:57] C:\DOCUME~1\waelkens\APPLIC~1\InstallShield
   [18/03/2007|11:53] C:\DOCUME~1\waelkens\APPLIC~1\InterMute
   [21/04/2006|18:46] C:\DOCUME~1\waelkens\APPLIC~1\InterTrust
   [20/11/2008|09:51] C:\DOCUME~1\waelkens\APPLIC~1\Lavasoft
   [31/03/2007|06:46] C:\DOCUME~1\waelkens\APPLIC~1\Leadertech
   [20/01/2005|18:50] C:\DOCUME~1\waelkens\APPLIC~1\Macromedia
   [15/10/2007|18:21] C:\DOCUME~1\waelkens\APPLIC~1\Magix
   [29/11/2007|13:02] C:\DOCUME~1\waelkens\APPLIC~1\Media Player Classic
   [14/07/2008|11:55] C:\DOCUME~1\waelkens\APPLIC~1\Microsoft
   [26/08/2008|20:56] C:\DOCUME~1\waelkens\APPLIC~1\Mozilla
   [20/11/2008|15:18] C:\DOCUME~1\waelkens\APPLIC~1\Orbit
   [02/07/2008|11:01] C:\DOCUME~1\waelkens\APPLIC~1\Real
   [06/11/2007|20:59] C:\DOCUME~1\waelkens\APPLIC~1\Screenshot Sender
   [28/01/2007|11:39] C:\DOCUME~1\waelkens\APPLIC~1\SecuROM
   [06/06/2007|15:01] C:\DOCUME~1\waelkens\APPLIC~1\Shareaza
   [18/03/2007|11:00] C:\DOCUME~1\waelkens\APPLIC~1\Simply Super Software
   [23/11/2008|11:54] C:\DOCUME~1\waelkens\APPLIC~1\Skype
   [11/11/2007|20:01] C:\DOCUME~1\waelkens\APPLIC~1\Sony
   [31/05/2008|10:47] C:\DOCUME~1\waelkens\APPLIC~1\Sports Interactive
   [25/01/2005|16:45] C:\DOCUME~1\waelkens\APPLIC~1\Sun
   [05/06/2006|20:51] C:\DOCUME~1\waelkens\APPLIC~1\System Requirements Lab
   [24/01/2006|20:41] C:\DOCUME~1\waelkens\APPLIC~1\Talkback
   [19/07/2006|22:06] C:\DOCUME~1\waelkens\APPLIC~1	eamspeak2
   [01/03/2007|18:02] C:\DOCUME~1\waelkens\APPLIC~1\Thunderbird
   [24/01/2006|20:12] C:\DOCUME~1\waelkens\APPLIC~1\TuneUp Software
   [05/11/2008|19:00] C:\DOCUME~1\waelkens\APPLIC~1\uTorrent
   [09/12/2007|14:06] C:\DOCUME~1\waelkens\APPLIC~1\Viewpoint
   [16/11/2008|20:56] C:\DOCUME~1\waelkens\APPLIC~1\vlc
   [18/11/2007|15:15] C:\DOCUME~1\waelkens\APPLIC~1\Vso
   [16/03/2006|20:07] C:\DOCUME~1\waelkens\APPLIC~1\Xfire
   [28/07/2008|05:56] C:\DOCUME~1\waelkens\APPLIC~1\Yahoo!
   [26/01/2005|13:08] C:\DOCUME~1\waelkens\APPLIC~1\You've Got Pictures Screensaver
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [23/11/2008 14:00][--ah-----] C:\WINDOWS	asks\AF65D5EA91324F1E.job
   [18/11/2008 07:13][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [21/11/2008 17:29][--a------] C:\WINDOWS	asks\Maintenance en 1 clic.job
   [23/11/2008 12:35][--ah-----] C:\WINDOWS	asks\SA.DAT
   [05/08/2004 13:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   ( AF65D5EA91324F1E.job )=( c:\docume~1\waelkens\applic~1\cdromw~1\BLEHLITEBAIT.exe )

   --------------------\  Listing des dossiers dans C:\Program Files

   [02/07/2008|10:48] C:\Program Files\7-Zip
   [21/04/2006|18:46] C:\Program Files\Adobe
   [20/11/2008|15:41] C:\Program Files\adslTV
   [31/05/2008|10:47] C:\Program Files\AdVantage
   [07/03/2008|18:49] C:\Program Files\AGEIA Technologies
   [25/01/2005|17:31] C:\Program Files\Ahead
   [26/03/2007|20:19] C:\Program Files\AIDA32 - Personal System Information
   [20/01/2008|16:01] C:\Program Files\AIST
   [03/11/2007|19:57] C:\Program Files\Alcohol Soft
   [31/08/2007|19:55] C:\Program Files\Alwil Software
   [25/01/2006|06:07] C:\Program Files\AOL 9.0
   [26/01/2005|13:08] C:\Program Files\AOL Compagnon
   [03/05/2007|20:02] C:\Program Files\AOL Toolbar
   [15/10/2008|10:44] C:\Program Files\Apple Software Update
   [05/02/2006|20:04] C:\Program Files\ASCII
   [10/07/2008|11:54] C:\Program Files\ATI Technologies
   [27/07/2008|11:47] C:\Program Files\Audacity
   [02/05/2006|15:52] C:\Program Files\AV VCS 3.0
   [07/05/2007|10:36] C:\Program Files\AvantGo Connect
   [11/02/2008|19:18] C:\Program Files\AviSynth 2.5
   [10/01/2007|18:06] C:\Program Files\Beston
   [15/10/2008|16:49] C:\Program Files\BitComet
   [08/09/2007|11:23] C:\Program Files\BitDownload
   [15/10/2008|10:48] C:\Program Files\Bonjour
   [10/02/2006|16:37] C:\Program Files\CA
   [20/01/2005|17:50] C:\Program Files\Cardreader Software
   [28/09/2008|07:41] C:\Program Files\Combined Community Codec Pack
   [01/05/2008|11:29] C:\Program Files\Common Files
   [20/01/2005|14:31] C:\Program Files\ComPlus Applications
   [24/10/2006|22:20] C:\Program Files\Creative
   [05/02/2005|18:40] C:\Program Files\CyberLink
   [14/04/2008|11:25] C:\Program Files\DAEMON Tools Pro
   [15/10/2008|18:08] C:\Program Files\DaemonTools_WhenUSave_Installer
   [17/04/2006|12:40] C:\Program Files\directx
   [14/11/2008|23:20] C:\Program Files\DivX
   [23/09/2008|15:47] C:\Program Files\Dofus
   [28/03/2007|13:15] C:\Program Files\DVD Decrypter
   [10/06/2006|16:01] C:\Program Files\Eidos
   [02/03/2008|13:51] C:\Program Files\Elaborate Bytes
   [07/03/2008|19:04] C:\Program Files\Electronic Arts
   [23/09/2008|18:46] C:\Program Files\eMule
   [26/01/2005|10:23] C:\Program Files\Encarta
   [14/07/2007|08:36] C:\Program Files\EPSON
   [15/10/2008|17:40] C:\Program Files\eRightSoft
   [23/11/2008|12:32] C:\Program Files\Fichiers communs
   [26/04/2007|23:04] C:\Program Files\FLV Player
   [03/11/2006|00:58] C:\Program Files\Futuremark
   [10/07/2006|18:02] C:\Program Files\GameShadow
   [23/09/2008|18:48] C:\Program Files\Garena
   [06/02/2007|19:45] C:\Program Files\Google
   [24/02/2007|11:05] C:\Program Files\Gothic III
   [31/05/2008|10:46] C:\Program Files\Gpotato.eu
   [23/09/2008|18:48] C:\Program Files\Guitar Pro 5
   [25/03/2007|20:50] C:\Program Files\Home Cinema
   [19/11/2007|20:38] C:\Program Files\ImgBurn
   [21/11/2008|11:11] C:\Program Files\InstallShield Installation Information
   [20/01/2005|15:49] C:\Program Files\Intel
   [18/03/2007|11:53] C:\Program Files\interMute
   [12/03/2006|20:30] C:\Program Files\Internet Download Manager
   [18/10/2008|22:23] C:\Program Files\Internet Explorer
   [15/10/2008|10:49] C:\Program Files\iPod
   [25/10/2006|10:50] C:\Program Files\iPod(2)
   [04/11/2007|13:14] C:\Program Files\ISOpen
   [15/10/2008|10:49] C:\Program Files\iTunes
   [25/10/2006|10:50] C:\Program Files\iTunes(2)
   [29/11/2007|17:06] C:\Program Files\IVT Corporation
   [11/07/2008|11:45] C:\Program Files\Java
   [08/03/2007|22:25] C:\Program Files\JeffProd
   [08/09/2007|17:17] C:\Program Files\Jeux classiques
   [02/07/2008|11:03] C:\Program Files\K-Lite Codec Pack
   [15/10/2008|18:07] C:\Program Files\Kodak
   [20/11/2008|09:56] C:\Program Files\Lavasoft
   [26/01/2005|13:08] C:\Program Files\Learn2.com
   [09/06/2007|21:53] C:\Program Files\LeechGet 2007
   [26/07/2007|11:27] C:\Program Files\LitexMedia
   [21/09/2008|12:33] C:\Program Files\Ludiclub
   [22/09/2008|17:21] C:\Program Files\ma-config.com
   [30/11/2007|20:14] C:\Program Files\MagicISO
   [26/12/2007|14:46] C:\Program Files\MarkAny
   [03/06/2007|18:32] C:\Program Files\Maxis
   [26/01/2005|19:10] C:\Program Files\Medion
   [17/08/2008|00:19] C:\Program Files\Messenger
   [24/09/2008|10:14] C:\Program Files\Messenger Plus! Live
   [03/02/2007|22:57] C:\Program Files\MessengerPlus! 3
   [17/04/2006|12:40] C:\Program Files\Microids
   [07/05/2007|10:36] C:\Program Files\Microsoft ActiveSync
   [26/01/2005|10:25] C:\Program Files\Microsoft AutoRoute
   [20/01/2005|14:33] C:\Program Files\microsoft frontpage
   [16/01/2007|20:58] C:\Program Files\Microsoft Games
   [26/01/2005|10:19] C:\Program Files\Microsoft Money 2005
   [10/09/2008|20:13] C:\Program Files\Microsoft Office
   [14/07/2008|00:14] C:\Program Files\Microsoft SDKs
   [11/11/2007|20:01] C:\Program Files\Microsoft SQL Server
   [14/07/2008|00:19] C:\Program Files\Microsoft SQL Server Compact Edition
   [14/07/2008|00:19] C:\Program Files\Microsoft Synchronization Services
   [05/02/2005|17:04] C:\Program Files\Microsoft Visual Studio
   [26/09/2008|12:56] C:\Program Files\Microsoft Visual Studio 9.0
   [03/05/2007|20:02] C:\Program Files\Microsoft Works
   [26/01/2005|10:13] C:\Program Files\Microsoft Works Suite 2005
   [21/10/2008|14:16] C:\Program Files\Morgan
   [11/02/2008|19:36] C:\Program Files\Movie Maker
   [23/11/2008|14:22] C:\Program Files\Mozilla Firefox
   [07/11/2008|22:22] C:\Program Files\Mozilla Thunderbird
   [11/03/2007|15:08] C:\Program Files\MP3 Player Utilities 3.68
   [14/07/2008|00:10] C:\Program Files\MSBuild
   [10/09/2008|20:12] C:\Program Files\MSECache
   [14/03/2006|20:05] C:\Program Files\MSN
   [20/01/2005|14:31] C:\Program Files\MSN Gaming Zone
   [16/11/2006|21:52] C:\Program Files\MSXML 4.0
   [14/07/2008|00:09] C:\Program Files\MSXML 6.0
   [14/04/2007|08:08] C:\Program Files\Multi_Media_France
   [22/12/2007|08:02] C:\Program Files\Musicmatch
   [26/01/2005|19:43] C:\Program Files\muvee Technologies
   [22/11/2008|17:04] C:\Program Files\Navilog1
   [19/08/2007|14:14] C:\Program Files\Navirad_UserTool
   [25/02/2007|01:59] C:\Program Files\NetBattle
   [01/09/2006|16:25] C:\Program Files\NetMeeting
   [21/01/2007|19:37] C:\Program Files\Ocean Technology
   [05/02/2005|17:50] C:\Program Files\OfficeUpdate11
   [13/06/2007|21:05] C:\Program Files\Outlook Express
   [11/11/2007|23:45] C:\Program Files\PaintStar
   [16/06/2008|18:32] C:\Program Files\Picture It! Premium 10
   [07/05/2007|11:17] C:\Program Files\POI-Warner GoPal Edition
   [07/05/2007|11:33] C:\Program Files\POI-Warner POI-Data
   [10/06/2007|19:41] C:\Program Files\PokerStars
   [21/01/2007|22:30] C:\Program Files\PowerPoint Viewer
   [16/01/2007|17:57] C:\Program Files\Project64 1.6
   [15/10/2008|10:47] C:\Program Files\QuickTime
   [26/01/2005|19:29] C:\Program Files\RALINK
   [26/01/2005|11:44] C:\Program Files\Real
   [14/07/2008|00:10] C:\Program Files\Reference Assemblies
   [18/10/2008|13:20] C:\Program Files\Rippackv3
   [11/07/2006|00:15] C:\Program Files\Rockstar Games
   [29/10/2008|13:41] C:\Program Files\RomStation
   [20/10/2006|18:43] C:\Program Files\RPG Maker 2003Projet 1
   [03/11/2006|11:45] C:\Program Files\S2SaTstrat
   [04/04/2007|15:50] C:\Program Files\SAGEM
   [25/02/2007|01:58] C:\Program Files\SAGEM(2)
   [26/12/2007|14:45] C:\Program Files\Samsung
   [12/02/2007|15:04] C:\Program Files\Securitoo
   [14/07/2006|09:16] C:\Program Files\SEIKO EPSON Corp
   [20/01/2005|14:32] C:\Program Files\Services en ligne
   [09/07/2008|18:37] C:\Program Files\Sierra On-Line
   [03/02/2006|13:47] C:\Program Files\Singles
   [21/01/2007|21:47] C:\Program Files\Skype
   [14/06/2007|14:48] C:\Program Files\SlySoft
   [05/10/2006|16:53] C:\Program Files\Smart Projects
   [03/05/2007|20:02] C:\Program Files\Softwin
   [03/01/2008|14:33] C:\Program Files\Soldier of Fortune II - Double Helix
   [22/12/2007|08:05] C:\Program Files\Sony
   [11/11/2007|19:58] C:\Program Files\Sony Setup
   [23/09/2008|18:47] C:\Program Files\Sports Interactive
   [24/08/2006|15:15] C:\Program Files\Spybot - Search & Destroy
   [19/08/2007|14:12] C:\Program Files\Spyware-Secure
   [22/08/2006|15:15] C:\Program Files\SteamKeyFr
   [27/07/2008|11:46] C:\Program Files\Steinberg
   [26/01/2005|13:08] C:\Program Files\TechCity Solutions
   [12/03/2007|23:58] C:\Program Files\The All-Seeing Eye
   [19/10/2006|18:49] C:\Program Files\The Game Creators
   [18/11/2007|10:04] C:\Program Files\The Witcher
   [26/01/2007|18:15] C:\Program Files\THQ
   [09/06/2007|22:10] C:\Program Files\TrueDownloader
   [06/07/2007|16:28] C:\Program Files\TuneUp Utilities 2006
   [11/11/2007|20:01] C:\Program Files\Uninstall Information
   [16/02/2006|22:08] C:\Program Files\UnrealTournament
   [27/04/2007|18:30] C:\Program Files\uTorrent
   [14/07/2008|13:50] C:\Program Files\Valve
   [21/04/2007|11:00] C:\Program Files\VideoLAN
   [25/09/2006|16:04] C:\Program Files\VideoMach-2.7.2
   [21/01/2007|22:30] C:\Program Files\VideoMach-3.3.4
   [26/01/2005|13:08] C:\Program Files\Viewpoint
   [09/05/2008|08:50] C:\Program Files\VirtualDJ
   [03/05/2007|20:02] C:\Program Files\VuPassword
   [23/11/2008|12:37] C:\Program Files\Wanadoo
   [02/10/2008|15:49] C:\Program Files\Warcraft III
   [31/05/2008|10:47] C:\Program Files\Webteh
   [21/10/2006|11:09] C:\Program Files\WinAVI MP4 Converter
   [20/01/2005|17:43] C:\Program Files\Winbond Electronics Corp
   [20/01/2005|14:36] C:\Program Files\Windows Journal Viewer
   [15/03/2008|10:06] C:\Program Files\Windows Live
   [10/01/2007|17:56] C:\Program Files\Windows Media Components
   [05/01/2007|22:23] C:\Program Files\Windows Media Connect
   [02/03/2008|13:53] C:\Program Files\Windows Media Connect 2
   [30/07/2008|14:01] C:\Program Files\Windows Media Player
   [21/03/2007|20:24] C:\Program Files\Windows NT
   [29/04/2006|12:02] C:\Program Files\WindowsUpdate
   [19/08/2007|14:13] C:\Program Files\WinDriver Ghost
   [17/02/2006|20:23] C:\Program Files\WinISO
   [07/06/2007|18:51] C:\Program Files\WinRAR
   [27/02/2007|06:27] C:\Program Files\wmv_vcm
   [05/02/2005|18:14] C:\Program Files\X10 Hardware
   [20/01/2005|14:33] C:\Program Files\xerox
   [21/01/2007|22:30] C:\Program Files\Xfire
   [27/07/2008|19:52] C:\Program Files\Yahoo!
   [31/05/2008|10:45] C:\Program Files\Zero G Registry

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [14/06/2007|16:04] C:\Program Files\Fichiers communs\Adobe
   [25/01/2005|17:30] C:\Program Files\Fichiers communs\Ahead
   [26/01/2005|13:08] C:\Program Files\Fichiers communs\AOL
   [05/02/2005|19:54] C:\Program Files\Fichiers communs\aolshare
   [15/10/2008|10:46] C:\Program Files\Fichiers communs\Apple
   [19/10/2006|18:50] C:\Program Files\Fichiers communs\Bcgsoft
   [21/11/2008|11:39] C:\Program Files\Fichiers communs\Blizzard Entertainment
   [20/01/2005|17:43] C:\Program Files\Fichiers communs\Borland Shared
   [26/01/2005|10:16] C:\Program Files\Fichiers communs\Designer
   [08/02/2006|21:48] C:\Program Files\Fichiers communs\DirectX
   [14/07/2006|08:56] C:\Program Files\Fichiers communs\EPSON
   [30/09/2006|15:36] C:\Program Files\Fichiers communs\InstallShield
   [25/01/2005|16:25] C:\Program Files\Fichiers communs\Java
   [27/02/2008|15:23] C:\Program Files\Fichiers communs\Kodak
   [03/11/2007|17:27] C:\Program Files\Fichiers communs\LightScribe
   [15/10/2007|16:58] C:\Program Files\Fichiers communs\MAGIX Shared
   [18/10/2008|14:48] C:\Program Files\Fichiers communs\Microsoft Shared
   [20/01/2005|14:32] C:\Program Files\Fichiers communs\MSSoap
   [26/01/2005|19:43] C:\Program Files\Fichiers communs\muvee Technologies
   [18/03/2006|18:00] C:\Program Files\Fichiers communs\NSV
   [26/01/2005|13:08] C:\Program Files\Fichiers communs\Nullsoft
   [20/01/2005|15:26] C:\Program Files\Fichiers communs\ODBC
   [14/07/2007|08:39] C:\Program Files\Fichiers communs\Python
   [02/07/2008|11:01] C:\Program Files\Fichiers communs\Real
   [20/01/2005|14:32] C:\Program Files\Fichiers communs\Services
   [21/01/2007|21:47] C:\Program Files\Fichiers communs\Skype
   [06/06/2006|10:02] C:\Program Files\Fichiers communs\Softwin
   [20/01/2005|15:26] C:\Program Files\Fichiers communs\SpeechEngines
   [13/06/2007|21:05] C:\Program Files\Fichiers communs\System
   [05/06/2006|20:51] C:\Program Files\Fichiers communs\SystemRequirementsLab
   [15/03/2008|10:06] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [20/11/2008|09:56] C:\Program Files\Fichiers communs\Wise Installation Wizard

   --------------------\  Process

   ( 70 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   C:\DOCUME~1\waelkens\APPLIC~1\CDROMW~1
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\DOCUME~1\waelkens\APPLIC~1\cdromw~1
   C:\DOCUME~1\waelkens\APPLIC~1\Bitdownload
   C:\DOCUME~1\waelkens\APPLIC~1\BitDownload
   C:\DOCUME~1\waelkens\APPLIC~1\BitDownload\Data
   C:\Program Files\BitDownload
   C:\Program Files\BitDownload\BitDownload.TRC
   C:\Program Files\BitDownload\ZM
   C:\Program Files\Multi_Media_France
   C:\Program Files\Multi_Media_France\INSTALL.LOG
   C:\Program Files\Multi_Media_France
   C:\Program Files\Multi_Media_France\INSTALL.LOG
   C:\WINDOWS\Tasks\AF65D5EA91324F1E.job
 
   --------------------\  Verification du Registre

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Comp Bib Bird]
   "DisplayName"="CiD Help"
   "UninstallString"="C:\DOCUME~1\waelkens\APPLIC~1\CDROMW~1\Camp Mail.exe -uninstall"

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

   --------------------\  Verification du fichier Hosts

   Fichier Hosts MODIFIE

   127.0.0.1 bin.errorprotector.com ## added by CiD
   127.0.0.1 br.errorsafe.com ## added by CiD
   127.0.0.1 br.winantivirus.com ## added by CiD
   127.0.0.1 br.winfixer.com ## added by CiD
   127.0.0.1 cdn.drivecleaner.com ## added by CiD
   127.0.0.1 cdn.errorsafe.com ## added by CiD
   127.0.0.1 cdn.winsoftware.com ## added by CiD
   127.0.0.1 de.errorsafe.com ## added by CiD
   127.0.0.1 de.winantivirus.com ## added by CiD
   127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
   127.0.0.1 download.cdn.errorsafe.com ## added by CiD
   127.0.0.1 download.cdn.winsoftware.com ## added by CiD
   127.0.0.1 download.errorsafe.com ## added by CiD
   127.0.0.1 download.systemdoctor.com ## added by CiD
   127.0.0.1 download.winantispyware.com ## added by CiD
   127.0.0.1 download.windrivecleaner.com ## added by CiD
   127.0.0.1 download.winfixer.com ## added by CiD
   127.0.0.1 drivecleaner.com ## added by CiD
   127.0.0.1 dynamique.drivecleaner.com ## added by CiD
   127.0.0.1 errorprotector.com ## added by CiD
   127.0.0.1 errorsafe.com ## added by CiD
   127.0.0.1 es.winantivirus.com ## added by CiD
   127.0.0.1 fr.winantivirus.com ## added by CiD
   127.0.0.1 fr.winfixer.com ## added by CiD
   127.0.0.1 go.drivecleaner.com ## added by CiD
   127.0.0.1 go.errorsafe.com ## added by CiD
   127.0.0.1 go.winantispyware.com ## added by CiD
   127.0.0.1 go.winantivirus.com ## added by CiD
   127.0.0.1 hk.winantivirus.com ## added by CiD
   127.0.0.1 instlog.errorsafe.com ## added by CiD
   127.0.0.1 instlog.winantivirus.com ## added by CiD
   127.0.0.1 instlog.winfixer.com ## added by CiD
   127.0.0.1 jsp.drivecleaner.com ## added by CiD
   127.0.0.1 kb.errorsafe.com ## added by CiD
   127.0.0.1 kb.winantivirus.com ## added by CiD
   127.0.0.1 nl.errorsafe.com ## added by CiD
   127.0.0.1 se.errorsafe.com ## added by CiD
   127.0.0.1 secure.drivecleaner.com ## added by CiD
   127.0.0.1 secure.errorsafe.com ## added by CiD
   127.0.0.1 secure.winantispam.com ## added by CiD
   127.0.0.1 secure.winantispy.com ## added by CiD
   127.0.0.1 secure.winantivirus.com ## added by CiD
   127.0.0.1 support.winantivirus.com ## added by CiD
   127.0.0.1 trial.updates.winsoftware.com ## added by CiD
   127.0.0.1 ulog.winantivirus.com ## added by CiD
   127.0.0.1 utils.errorsafe.com ## added by CiD
   127.0.0.1 utils.winantivirus.com ## added by CiD
   127.0.0.1 utils.winfixer.com ## added by CiD
   127.0.0.1 winantispyware.com ## added by CiD
   127.0.0.1 winantivirus.com ## added by CiD
   127.0.0.1 winfixer.com ## added by CiD
   127.0.0.1 winfixer2006.com ## added by CiD
   127.0.0.1 winsoftware.com ## added by CiD
   127.0.0.1 [i]ww/iw.drivecleaner.com ## added by CiD
   127.0.0.1 [i]ww/iw.errorprotector.com ## added by CiD
   127.0.0.1 [i]ww/iw.errorsafe.com ## added by CiD
   127.0.0.1 [i]ww/iw.systemdoctor.com ## added by CiD
   127.0.0.1 [i]ww/iw.utils.winfixer.com ## added by CiD
   127.0.0.1 [i]ww/iw.win-anti-virus-pro.com ## added by CiD
   127.0.0.1 [i]ww/iw.win-virus-pro.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantispam.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantispy.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantispyware.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantivirus.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantiviruspro.com ## added by CiD
   127.0.0.1 [i]ww/iw.windrivecleaner.com ## added by CiD
   127.0.0.1 [i]ww/iw.windrivesafe.com ## added by CiD
   127.0.0.1 [i]ww/iw.winfixer.com ## added by CiD
   127.0.0.1 [i]ww/iw.winfixer2006.com ## added by CiD
   127.0.0.1 [i]ww/iw.winsoftware.com ## added by CiD

   -> 73 [ 70 ## added by CiD ]

   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-11-23 14:26:42
   Windows 5.1.2600 Service Pack 2 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 1407
 
   --------------------\  Recherche d'autres infections

   --------------------\  ROOTKIT !!

   Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV]
   Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TDSSserv]

   --------------------\  ROGUES ..

   C:\PROGRA~1\Spyware-Secure

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010425_iPod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010425_iPod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010426_iPod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010426_iPod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010428_iPod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010428_iPod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010429_iPod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010429_iPod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010430_iPod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010430_iPod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123643_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123643_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123644_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123644_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123650_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123650_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123934_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123934_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123935_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123935_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123937_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123937_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123938_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123938_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124330_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124330_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124331_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124331_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124337_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124337_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124344_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124344_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124349_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124349_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124350_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124350_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124356_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124356_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124402_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124402_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124403_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124403_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124427_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124427_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124428_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124428_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124434_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124434_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124435_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124435_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124441_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124441_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131037_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131037_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131038_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131038_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131042_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131042_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131043_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131043_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131354_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131354_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131355_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131355_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131401_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131401_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131402_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131402_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131403_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131403_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131404_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131404_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Mes documents\Mes fichiers reçus\Corona DJ - Move The Sound (Crack Dub Mix).mp3


   [F:7][D:1]-> C:\DOCUME~1\waelkens\LOCALS~1\Temp
   [F:281][D:0]-> C:\DOCUME~1\waelkens\Cookies
   [F:76][D:12]-> C:\DOCUME~1\waelkens\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 23/11/2008|14:29 - Option : [1]

   --------------------\  Fin du rapport a 14:29:04

Lyonnais92 · Answer

RE,


Relance Lop S&D

Choisis cette fois ci l'Option 2 ( Suppression )

Ne ferme pas la fenêtre lors de la suppression !

Poste le rapport généré ( C:\lopR.txt )

( Si le Bureau ne réapparaît pas presse Ctrl + Alt + Suppr, Onglet Fichier,

 Nouvelle tâche, tape explorer.exe et valide )

CaptainZack · Answer

Re,


--------------------\  Lop S&D 4.2.4-9c   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) 4 CPU 3.20GHz )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : waelkens ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1229 [VPS 081122-0] 4.8.1229 (Activated)
   C:\ (Local Disk) - NTFS - Total:74 Go (Free:7 Go)
   D:\ (Local Disk) - NTFS - Total:68 Go (Free:8 Go)
   E:\ (Local Disk) - FAT32 - Total:5 Go (Free:1 Go)
   F:\ (Local Disk) - NTFS - Total:149 Go (Free:40 Go)
   G:\ (CD or DVD)
   H:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
   I:\ (CD or DVD)
   K:\ (USB)
   L:\ (USB)
   M:\ (USB)
   O:\ (CD or DVD)
   P:\ (CD or DVD)
   S:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
   Option : [2] ( 23/11/2008|15:48 )


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\DOCUME~1\waelkens\APPLIC~1\BitDownload\Data
   Supprime! - C:\Program Files\BitDownload\BitDownload.TRC
   Supprime! - C:\Program Files\BitDownload\ZM
   Supprime! - C:\Program Files\Multi_Media_France\INSTALL.LOG
   Supprime! - C:\WINDOWS\Tasks\AF65D5EA91324F1E.job 
   Supprime! - C:\DOCUME~1\waelkens\APPLIC~1\cdromw~1
   Supprime! - C:\DOCUME~1\waelkens\APPLIC~1\Bitdownload
   Supprime! - C:\Program Files\BitDownload
   Supprime! - C:\Program Files\Multi_Media_France
   -
   [ Fichier Hosts ] .. Restaure!
 
   \\\\\\\\\\\\\\\ 

   Supprime! - C:\Program Files\Viewpoint
   Supprime! - C:\DOCUME~1\waelkens\APPLIC~1\Viewpoint
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
 
   \\\\\\\\\\\\\\\

 
   --------------------\  Listing des dossiers dans APPLIC~1

   [25/01/2005|17:00] C:\DOCUME~1\ADMINI~1\APPLIC~1\Adobe
   [26/01/2005|13:08] C:\DOCUME~1\ADMINI~1\APPLIC~1\AOL
   [05/02/2005|18:58] C:\DOCUME~1\ADMINI~1\APPLIC~1\CyberLink
   [20/01/2005|14:33] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
   [20/01/2005|18:50] C:\DOCUME~1\ADMINI~1\APPLIC~1\Macromedia
   [26/01/2005|19:30] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
   [30/09/2008|15:08] C:\DOCUME~1\ADMINI~1\APPLIC~1\Mozilla
   [26/01/2005|11:44] C:\DOCUME~1\ADMINI~1\APPLIC~1\Real
   [25/01/2005|16:45] C:\DOCUME~1\ADMINI~1\APPLIC~1\Sun
   [26/01/2005|13:08] C:\DOCUME~1\ADMINI~1\APPLIC~1\You've Got Pictures Screensaver

   [15/10/2008|10:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
   [15/11/2008|18:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\2DBoy
   [24/03/2007|06:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [09/12/2007|05:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
   [26/01/2005|13:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
   [01/12/2007|21:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [01/12/2007|21:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [10/07/2008|11:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ATI
   [22/11/2008|03:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Blizzard
   [29/11/2007|17:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Bluetooth
   [13/03/2007|09:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CakeBowsBrowseBall
   [21/04/2006|18:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Creative
   [06/02/2006|10:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
   [04/11/2007|01:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DAEMON Tools Pro
   [03/11/2007|18:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Droppix
   [27/05/2006|12:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
   [14/06/2007|14:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Elaborate Bytes
   [17/02/2006|21:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ESTsoft
   [12/09/2006|20:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [30/09/2006|15:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
   [27/02/2008|15:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kodak
   [20/11/2008|09:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
   [03/11/2007|17:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\LightScribe
   [22/09/2008|17:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ma-config.com
   [24/01/2006|22:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [02/07/2008|00:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MGS
   [02/07/2008|00:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microgaming
   [20/11/2008|09:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [23/09/2008|18:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Corporation
   [26/09/2008|12:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
   [26/01/2005|19:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\muvee Technologies
   [29/01/2006|12:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
   [02/07/2008|11:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Real
   [20/01/2005|14:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
   [21/01/2007|21:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
   [18/11/2007|09:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony
   [11/02/2006|14:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [03/04/2007|21:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
   [22/07/2006|19:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trojan Remover
   [24/01/2006|20:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TuneUp Software
   [05/01/2007|22:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [15/03/2008|10:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
   [27/07/2008|19:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
   [28/07/2008|05:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion

   [25/01/2005|17:00] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Adobe
   [26/01/2005|13:08] C:\DOCUME~1\DEFAUL~1\APPLIC~1\AOL
   [05/02/2005|18:58] C:\DOCUME~1\DEFAUL~1\APPLIC~1\CyberLink
   [20/01/2005|14:33] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [20/01/2005|18:50] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Macromedia
   [26/01/2005|19:30] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
   [26/01/2005|11:44] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Real
   [25/01/2005|16:45] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Sun
   [26/01/2005|13:08] C:\DOCUME~1\DEFAUL~1\APPLIC~1\You've Got Pictures Screensaver

   [20/01/2005|14:35] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
   [26/01/2005|19:22] C:\DOCUME~1\LOCALS~1\APPLIC~1\X10 Commander

   [12/07/2007|02:00] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

   [24/04/2006|18:27] C:\DOCUME~1\PROPRI~1\APPLIC~1\Real
   [29/01/2006|12:38] C:\DOCUME~1\PROPRI~1\APPLIC~1\You've Got Pictures Screensaver

   [01/04/2006|13:12] C:\DOCUME~1\waelkens\APPLIC~1\.gaim
   [15/12/2007|12:34] C:\DOCUME~1\waelkens\APPLIC~1\ACAMPREF
   [04/01/2008|22:56] C:\DOCUME~1\waelkens\APPLIC~1\Adobe
   [20/02/2006|10:16] C:\DOCUME~1\waelkens\APPLIC~1\AdobeUM
   [04/11/2006|06:18] C:\DOCUME~1\waelkens\APPLIC~1\Ahead
   [26/01/2005|13:08] C:\DOCUME~1\waelkens\APPLIC~1\AOL
   [16/10/2008|11:52] C:\DOCUME~1\waelkens\APPLIC~1\Apple Computer
   [25/01/2006|06:05] C:\DOCUME~1\waelkens\APPLIC~1\ArcSoft
   [01/05/2008|21:48] C:\DOCUME~1\waelkens\APPLIC~1\ATI
   [26/01/2006|21:47] C:\DOCUME~1\waelkens\APPLIC~1\Azureus
   [31/05/2008|10:47] C:\DOCUME~1\waelkens\APPLIC~1\BSplayer
   [13/04/2008|22:02] C:\DOCUME~1\waelkens\APPLIC~1\BSplayer Pro
   [26/09/2008|14:02] C:\DOCUME~1\waelkens\APPLIC~1\codeblocks
   [12/02/2007|13:00] C:\DOCUME~1\waelkens\APPLIC~1\CyberLink
   [04/11/2007|00:05] C:\DOCUME~1\waelkens\APPLIC~1\DAEMON Tools Pro
   [26/12/2007|14:50] C:\DOCUME~1\waelkens\APPLIC~1\DataCast
   [26/09/2008|14:44] C:\DOCUME~1\waelkens\APPLIC~1\Dev-Cpp
   [31/03/2007|07:52] C:\DOCUME~1\waelkens\APPLIC~1\DivX
   [12/03/2006|07:23] C:\DOCUME~1\waelkens\APPLIC~1\DMCache
   [03/11/2007|17:27] C:\DOCUME~1\waelkens\APPLIC~1\Droppix
   [19/09/2008|04:31] C:\DOCUME~1\waelkens\APPLIC~1\EPSON
   [17/02/2006|21:07] C:\DOCUME~1\waelkens\APPLIC~1\ESTsoft
   [16/10/2008|13:51] C:\DOCUME~1\waelkens\APPLIC~1\FileZilla
   [03/05/2007|19:51] C:\DOCUME~1\waelkens\APPLIC~1\GetRightToGo
   [15/09/2006|11:31] C:\DOCUME~1\waelkens\APPLIC~1\Google
   [25/03/2008|18:07] C:\DOCUME~1\waelkens\APPLIC~1\gtk-2.0
   [04/11/2006|23:25] C:\DOCUME~1\waelkens\APPLIC~1\Help
   [20/01/2005|14:33] C:\DOCUME~1\waelkens\APPLIC~1\Identities
   [14/02/2006|23:04] C:\DOCUME~1\waelkens\APPLIC~1\IDM
   [14/06/2007|18:37] C:\DOCUME~1\waelkens\APPLIC~1\ImgBurn
   [28/01/2007|11:57] C:\DOCUME~1\waelkens\APPLIC~1\InstallShield
   [18/03/2007|11:53] C:\DOCUME~1\waelkens\APPLIC~1\InterMute
   [21/04/2006|18:46] C:\DOCUME~1\waelkens\APPLIC~1\InterTrust
   [20/11/2008|09:51] C:\DOCUME~1\waelkens\APPLIC~1\Lavasoft
   [31/03/2007|06:46] C:\DOCUME~1\waelkens\APPLIC~1\Leadertech
   [20/01/2005|18:50] C:\DOCUME~1\waelkens\APPLIC~1\Macromedia
   [15/10/2007|18:21] C:\DOCUME~1\waelkens\APPLIC~1\Magix
   [29/11/2007|13:02] C:\DOCUME~1\waelkens\APPLIC~1\Media Player Classic
   [14/07/2008|11:55] C:\DOCUME~1\waelkens\APPLIC~1\Microsoft
   [26/08/2008|20:56] C:\DOCUME~1\waelkens\APPLIC~1\Mozilla
   [20/11/2008|15:18] C:\DOCUME~1\waelkens\APPLIC~1\Orbit
   [02/07/2008|11:01] C:\DOCUME~1\waelkens\APPLIC~1\Real
   [06/11/2007|20:59] C:\DOCUME~1\waelkens\APPLIC~1\Screenshot Sender
   [28/01/2007|11:39] C:\DOCUME~1\waelkens\APPLIC~1\SecuROM
   [06/06/2007|15:01] C:\DOCUME~1\waelkens\APPLIC~1\Shareaza
   [18/03/2007|11:00] C:\DOCUME~1\waelkens\APPLIC~1\Simply Super Software
   [23/11/2008|11:54] C:\DOCUME~1\waelkens\APPLIC~1\Skype
   [11/11/2007|20:01] C:\DOCUME~1\waelkens\APPLIC~1\Sony
   [31/05/2008|10:47] C:\DOCUME~1\waelkens\APPLIC~1\Sports Interactive
   [25/01/2005|16:45] C:\DOCUME~1\waelkens\APPLIC~1\Sun
   [05/06/2006|20:51] C:\DOCUME~1\waelkens\APPLIC~1\System Requirements Lab
   [24/01/2006|20:41] C:\DOCUME~1\waelkens\APPLIC~1\Talkback
   [19/07/2006|22:06] C:\DOCUME~1\waelkens\APPLIC~1	eamspeak2
   [01/03/2007|18:02] C:\DOCUME~1\waelkens\APPLIC~1\Thunderbird
   [24/01/2006|20:12] C:\DOCUME~1\waelkens\APPLIC~1\TuneUp Software
   [05/11/2008|19:00] C:\DOCUME~1\waelkens\APPLIC~1\uTorrent
   [16/11/2008|20:56] C:\DOCUME~1\waelkens\APPLIC~1\vlc
   [18/11/2007|15:15] C:\DOCUME~1\waelkens\APPLIC~1\Vso
   [16/03/2006|20:07] C:\DOCUME~1\waelkens\APPLIC~1\Xfire
   [28/07/2008|05:56] C:\DOCUME~1\waelkens\APPLIC~1\Yahoo!
   [26/01/2005|13:08] C:\DOCUME~1\waelkens\APPLIC~1\You've Got Pictures Screensaver
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [18/11/2008 07:13][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [21/11/2008 17:29][--a------] C:\WINDOWS	asks\Maintenance en 1 clic.job
   [23/11/2008 12:35][--ah-----] C:\WINDOWS	asks\SA.DAT
   [05/08/2004 13:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [02/07/2008|10:48] C:\Program Files\7-Zip
   [21/04/2006|18:46] C:\Program Files\Adobe
   [20/11/2008|15:41] C:\Program Files\adslTV
   [31/05/2008|10:47] C:\Program Files\AdVantage
   [07/03/2008|18:49] C:\Program Files\AGEIA Technologies
   [25/01/2005|17:31] C:\Program Files\Ahead
   [26/03/2007|20:19] C:\Program Files\AIDA32 - Personal System Information
   [20/01/2008|16:01] C:\Program Files\AIST
   [03/11/2007|19:57] C:\Program Files\Alcohol Soft
   [31/08/2007|19:55] C:\Program Files\Alwil Software
   [25/01/2006|06:07] C:\Program Files\AOL 9.0
   [26/01/2005|13:08] C:\Program Files\AOL Compagnon
   [03/05/2007|20:02] C:\Program Files\AOL Toolbar
   [15/10/2008|10:44] C:\Program Files\Apple Software Update
   [05/02/2006|20:04] C:\Program Files\ASCII
   [10/07/2008|11:54] C:\Program Files\ATI Technologies
   [27/07/2008|11:47] C:\Program Files\Audacity
   [02/05/2006|15:52] C:\Program Files\AV VCS 3.0
   [07/05/2007|10:36] C:\Program Files\AvantGo Connect
   [11/02/2008|19:18] C:\Program Files\AviSynth 2.5
   [10/01/2007|18:06] C:\Program Files\Beston
   [15/10/2008|16:49] C:\Program Files\BitComet
   [15/10/2008|10:48] C:\Program Files\Bonjour
   [10/02/2006|16:37] C:\Program Files\CA
   [20/01/2005|17:50] C:\Program Files\Cardreader Software
   [28/09/2008|07:41] C:\Program Files\Combined Community Codec Pack
   [01/05/2008|11:29] C:\Program Files\Common Files
   [20/01/2005|14:31] C:\Program Files\ComPlus Applications
   [24/10/2006|22:20] C:\Program Files\Creative
   [05/02/2005|18:40] C:\Program Files\CyberLink
   [14/04/2008|11:25] C:\Program Files\DAEMON Tools Pro
   [15/10/2008|18:08] C:\Program Files\DaemonTools_WhenUSave_Installer
   [17/04/2006|12:40] C:\Program Files\directx
   [14/11/2008|23:20] C:\Program Files\DivX
   [23/09/2008|15:47] C:\Program Files\Dofus
   [28/03/2007|13:15] C:\Program Files\DVD Decrypter
   [10/06/2006|16:01] C:\Program Files\Eidos
   [02/03/2008|13:51] C:\Program Files\Elaborate Bytes
   [07/03/2008|19:04] C:\Program Files\Electronic Arts
   [23/09/2008|18:46] C:\Program Files\eMule
   [26/01/2005|10:23] C:\Program Files\Encarta
   [14/07/2007|08:36] C:\Program Files\EPSON
   [15/10/2008|17:40] C:\Program Files\eRightSoft
   [23/11/2008|12:32] C:\Program Files\Fichiers communs
   [26/04/2007|23:04] C:\Program Files\FLV Player
   [03/11/2006|00:58] C:\Program Files\Futuremark
   [10/07/2006|18:02] C:\Program Files\GameShadow
   [23/09/2008|18:48] C:\Program Files\Garena
   [06/02/2007|19:45] C:\Program Files\Google
   [24/02/2007|11:05] C:\Program Files\Gothic III
   [31/05/2008|10:46] C:\Program Files\Gpotato.eu
   [23/09/2008|18:48] C:\Program Files\Guitar Pro 5
   [25/03/2007|20:50] C:\Program Files\Home Cinema
   [19/11/2007|20:38] C:\Program Files\ImgBurn
   [21/11/2008|11:11] C:\Program Files\InstallShield Installation Information
   [20/01/2005|15:49] C:\Program Files\Intel
   [18/03/2007|11:53] C:\Program Files\interMute
   [12/03/2006|20:30] C:\Program Files\Internet Download Manager
   [18/10/2008|22:23] C:\Program Files\Internet Explorer
   [15/10/2008|10:49] C:\Program Files\iPod
   [25/10/2006|10:50] C:\Program Files\iPod(2)
   [04/11/2007|13:14] C:\Program Files\ISOpen
   [15/10/2008|10:49] C:\Program Files\iTunes
   [25/10/2006|10:50] C:\Program Files\iTunes(2)
   [29/11/2007|17:06] C:\Program Files\IVT Corporation
   [11/07/2008|11:45] C:\Program Files\Java
   [08/03/2007|22:25] C:\Program Files\JeffProd
   [08/09/2007|17:17] C:\Program Files\Jeux classiques
   [02/07/2008|11:03] C:\Program Files\K-Lite Codec Pack
   [15/10/2008|18:07] C:\Program Files\Kodak
   [20/11/2008|09:56] C:\Program Files\Lavasoft
   [26/01/2005|13:08] C:\Program Files\Learn2.com
   [09/06/2007|21:53] C:\Program Files\LeechGet 2007
   [26/07/2007|11:27] C:\Program Files\LitexMedia
   [21/09/2008|12:33] C:\Program Files\Ludiclub
   [22/09/2008|17:21] C:\Program Files\ma-config.com
   [30/11/2007|20:14] C:\Program Files\MagicISO
   [26/12/2007|14:46] C:\Program Files\MarkAny
   [03/06/2007|18:32] C:\Program Files\Maxis
   [26/01/2005|19:10] C:\Program Files\Medion
   [17/08/2008|00:19] C:\Program Files\Messenger
   [24/09/2008|10:14] C:\Program Files\Messenger Plus! Live
   [03/02/2007|22:57] C:\Program Files\MessengerPlus! 3
   [17/04/2006|12:40] C:\Program Files\Microids
   [07/05/2007|10:36] C:\Program Files\Microsoft ActiveSync
   [26/01/2005|10:25] C:\Program Files\Microsoft AutoRoute
   [20/01/2005|14:33] C:\Program Files\microsoft frontpage
   [16/01/2007|20:58] C:\Program Files\Microsoft Games
   [26/01/2005|10:19] C:\Program Files\Microsoft Money 2005
   [10/09/2008|20:13] C:\Program Files\Microsoft Office
   [14/07/2008|00:14] C:\Program Files\Microsoft SDKs
   [11/11/2007|20:01] C:\Program Files\Microsoft SQL Server
   [14/07/2008|00:19] C:\Program Files\Microsoft SQL Server Compact Edition
   [14/07/2008|00:19] C:\Program Files\Microsoft Synchronization Services
   [05/02/2005|17:04] C:\Program Files\Microsoft Visual Studio
   [26/09/2008|12:56] C:\Program Files\Microsoft Visual Studio 9.0
   [03/05/2007|20:02] C:\Program Files\Microsoft Works
   [26/01/2005|10:13] C:\Program Files\Microsoft Works Suite 2005
   [21/10/2008|14:16] C:\Program Files\Morgan
   [11/02/2008|19:36] C:\Program Files\Movie Maker
   [23/11/2008|14:22] C:\Program Files\Mozilla Firefox
   [07/11/2008|22:22] C:\Program Files\Mozilla Thunderbird
   [11/03/2007|15:08] C:\Program Files\MP3 Player Utilities 3.68
   [14/07/2008|00:10] C:\Program Files\MSBuild
   [10/09/2008|20:12] C:\Program Files\MSECache
   [14/03/2006|20:05] C:\Program Files\MSN
   [20/01/2005|14:31] C:\Program Files\MSN Gaming Zone
   [16/11/2006|21:52] C:\Program Files\MSXML 4.0
   [14/07/2008|00:09] C:\Program Files\MSXML 6.0
   [22/12/2007|08:02] C:\Program Files\Musicmatch
   [26/01/2005|19:43] C:\Program Files\muvee Technologies
   [22/11/2008|17:04] C:\Program Files\Navilog1
   [19/08/2007|14:14] C:\Program Files\Navirad_UserTool
   [25/02/2007|01:59] C:\Program Files\NetBattle
   [01/09/2006|16:25] C:\Program Files\NetMeeting
   [21/01/2007|19:37] C:\Program Files\Ocean Technology
   [05/02/2005|17:50] C:\Program Files\OfficeUpdate11
   [13/06/2007|21:05] C:\Program Files\Outlook Express
   [11/11/2007|23:45] C:\Program Files\PaintStar
   [16/06/2008|18:32] C:\Program Files\Picture It! Premium 10
   [07/05/2007|11:17] C:\Program Files\POI-Warner GoPal Edition
   [07/05/2007|11:33] C:\Program Files\POI-Warner POI-Data
   [10/06/2007|19:41] C:\Program Files\PokerStars
   [21/01/2007|22:30] C:\Program Files\PowerPoint Viewer
   [16/01/2007|17:57] C:\Program Files\Project64 1.6
   [15/10/2008|10:47] C:\Program Files\QuickTime
   [26/01/2005|19:29] C:\Program Files\RALINK
   [26/01/2005|11:44] C:\Program Files\Real
   [14/07/2008|00:10] C:\Program Files\Reference Assemblies
   [18/10/2008|13:20] C:\Program Files\Rippackv3
   [11/07/2006|00:15] C:\Program Files\Rockstar Games
   [29/10/2008|13:41] C:\Program Files\RomStation
   [20/10/2006|18:43] C:\Program Files\RPG Maker 2003Projet 1
   [03/11/2006|11:45] C:\Program Files\S2SaTstrat
   [04/04/2007|15:50] C:\Program Files\SAGEM
   [25/02/2007|01:58] C:\Program Files\SAGEM(2)
   [26/12/2007|14:45] C:\Program Files\Samsung
   [12/02/2007|15:04] C:\Program Files\Securitoo
   [14/07/2006|09:16] C:\Program Files\SEIKO EPSON Corp
   [20/01/2005|14:32] C:\Program Files\Services en ligne
   [09/07/2008|18:37] C:\Program Files\Sierra On-Line
   [03/02/2006|13:47] C:\Program Files\Singles
   [21/01/2007|21:47] C:\Program Files\Skype
   [14/06/2007|14:48] C:\Program Files\SlySoft
   [05/10/2006|16:53] C:\Program Files\Smart Projects
   [03/05/2007|20:02] C:\Program Files\Softwin
   [03/01/2008|14:33] C:\Program Files\Soldier of Fortune II - Double Helix
   [22/12/2007|08:05] C:\Program Files\Sony
   [11/11/2007|19:58] C:\Program Files\Sony Setup
   [23/09/2008|18:47] C:\Program Files\Sports Interactive
   [24/08/2006|15:15] C:\Program Files\Spybot - Search & Destroy
   [19/08/2007|14:12] C:\Program Files\Spyware-Secure
   [22/08/2006|15:15] C:\Program Files\SteamKeyFr
   [27/07/2008|11:46] C:\Program Files\Steinberg
   [26/01/2005|13:08] C:\Program Files\TechCity Solutions
   [12/03/2007|23:58] C:\Program Files\The All-Seeing Eye
   [19/10/2006|18:49] C:\Program Files\The Game Creators
   [18/11/2007|10:04] C:\Program Files\The Witcher
   [26/01/2007|18:15] C:\Program Files\THQ
   [09/06/2007|22:10] C:\Program Files\TrueDownloader
   [06/07/2007|16:28] C:\Program Files\TuneUp Utilities 2006
   [11/11/2007|20:01] C:\Program Files\Uninstall Information
   [16/02/2006|22:08] C:\Program Files\UnrealTournament
   [27/04/2007|18:30] C:\Program Files\uTorrent
   [14/07/2008|13:50] C:\Program Files\Valve
   [21/04/2007|11:00] C:\Program Files\VideoLAN
   [25/09/2006|16:04] C:\Program Files\VideoMach-2.7.2
   [21/01/2007|22:30] C:\Program Files\VideoMach-3.3.4
   [09/05/2008|08:50] C:\Program Files\VirtualDJ
   [03/05/2007|20:02] C:\Program Files\VuPassword
   [23/11/2008|12:37] C:\Program Files\Wanadoo
   [02/10/2008|15:49] C:\Program Files\Warcraft III
   [31/05/2008|10:47] C:\Program Files\Webteh
   [21/10/2006|11:09] C:\Program Files\WinAVI MP4 Converter
   [20/01/2005|17:43] C:\Program Files\Winbond Electronics Corp
   [20/01/2005|14:36] C:\Program Files\Windows Journal Viewer
   [15/03/2008|10:06] C:\Program Files\Windows Live
   [10/01/2007|17:56] C:\Program Files\Windows Media Components
   [05/01/2007|22:23] C:\Program Files\Windows Media Connect
   [02/03/2008|13:53] C:\Program Files\Windows Media Connect 2
   [30/07/2008|14:01] C:\Program Files\Windows Media Player
   [21/03/2007|20:24] C:\Program Files\Windows NT
   [29/04/2006|12:02] C:\Program Files\WindowsUpdate
   [19/08/2007|14:13] C:\Program Files\WinDriver Ghost
   [17/02/2006|20:23] C:\Program Files\WinISO
   [07/06/2007|18:51] C:\Program Files\WinRAR
   [27/02/2007|06:27] C:\Program Files\wmv_vcm
   [05/02/2005|18:14] C:\Program Files\X10 Hardware
   [20/01/2005|14:33] C:\Program Files\xerox
   [21/01/2007|22:30] C:\Program Files\Xfire
   [27/07/2008|19:52] C:\Program Files\Yahoo!
   [31/05/2008|10:45] C:\Program Files\Zero G Registry

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [14/06/2007|16:04] C:\Program Files\Fichiers communs\Adobe
   [25/01/2005|17:30] C:\Program Files\Fichiers communs\Ahead
   [26/01/2005|13:08] C:\Program Files\Fichiers communs\AOL
   [05/02/2005|19:54] C:\Program Files\Fichiers communs\aolshare
   [15/10/2008|10:46] C:\Program Files\Fichiers communs\Apple
   [19/10/2006|18:50] C:\Program Files\Fichiers communs\Bcgsoft
   [21/11/2008|11:39] C:\Program Files\Fichiers communs\Blizzard Entertainment
   [20/01/2005|17:43] C:\Program Files\Fichiers communs\Borland Shared
   [26/01/2005|10:16] C:\Program Files\Fichiers communs\Designer
   [08/02/2006|21:48] C:\Program Files\Fichiers communs\DirectX
   [14/07/2006|08:56] C:\Program Files\Fichiers communs\EPSON
   [30/09/2006|15:36] C:\Program Files\Fichiers communs\InstallShield
   [25/01/2005|16:25] C:\Program Files\Fichiers communs\Java
   [27/02/2008|15:23] C:\Program Files\Fichiers communs\Kodak
   [03/11/2007|17:27] C:\Program Files\Fichiers communs\LightScribe
   [15/10/2007|16:58] C:\Program Files\Fichiers communs\MAGIX Shared
   [18/10/2008|14:48] C:\Program Files\Fichiers communs\Microsoft Shared
   [20/01/2005|14:32] C:\Program Files\Fichiers communs\MSSoap
   [26/01/2005|19:43] C:\Program Files\Fichiers communs\muvee Technologies
   [18/03/2006|18:00] C:\Program Files\Fichiers communs\NSV
   [26/01/2005|13:08] C:\Program Files\Fichiers communs\Nullsoft
   [20/01/2005|15:26] C:\Program Files\Fichiers communs\ODBC
   [14/07/2007|08:39] C:\Program Files\Fichiers communs\Python
   [02/07/2008|11:01] C:\Program Files\Fichiers communs\Real
   [20/01/2005|14:32] C:\Program Files\Fichiers communs\Services
   [21/01/2007|21:47] C:\Program Files\Fichiers communs\Skype
   [06/06/2006|10:02] C:\Program Files\Fichiers communs\Softwin
   [20/01/2005|15:26] C:\Program Files\Fichiers communs\SpeechEngines
   [13/06/2007|21:05] C:\Program Files\Fichiers communs\System
   [05/06/2006|20:51] C:\Program Files\Fichiers communs\SystemRequirementsLab
   [15/03/2008|10:06] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [20/11/2008|09:56] C:\Program Files\Fichiers communs\Wise Installation Wizard

   --------------------\  Process

   ( 67 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-11-23 15:49:25
   Windows 5.1.2600 Service Pack 2 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 1413
 
   --------------------\  Recherche d'autres infections

   --------------------\  ROOTKIT !!

   Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV]
   Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TDSSserv]

   --------------------\  ROGUES ..

   C:\PROGRA~1\Spyware-Secure

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010425_iPod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010425_iPod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010426_iPod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010426_iPod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010428_iPod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010428_iPod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010429_iPod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010429_iPod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010430_iPod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010430_iPod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123643_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123643_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123644_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123644_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123650_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123650_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123934_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123934_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123935_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123935_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123937_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123937_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123938_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123938_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124330_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124330_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124331_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124331_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124337_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124337_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124344_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124344_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124349_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124349_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124350_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124350_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124356_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124356_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124402_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124402_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124403_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124403_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124427_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124427_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124428_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124428_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124434_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124434_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124435_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124435_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124441_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124441_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131037_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131037_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131038_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131038_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131042_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131042_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131043_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131043_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131354_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131354_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131355_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131355_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131401_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131401_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131402_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131402_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131403_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131403_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131404_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131404_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Mes documents\Mes fichiers reçus\Corona DJ - Move The Sound (Crack Dub Mix).mp3


   [F:19][D:4]-> C:\DOCUME~1\waelkens\LOCALS~1\Temp
   [F:284][D:0]-> C:\DOCUME~1\waelkens\Cookies
   [F:103][D:12]-> C:\DOCUME~1\waelkens\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 23/11/2008|14:29 - Option : [1]
   2 - "C:\Lop SD\LopR_2.txt" - 23/11/2008|15:51 - Option : [2]

   --------------------\  Fin du rapport a 15:51:26

Lyonnais92 · Answer

Bonsoir,


Télécharge Toolbar-S&D (Team IDN) sur ton Bureau :

https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

    * Lance l'installation du programme en exécutant le fichier téléchargé.
    * Double-clique maintenant sur le raccourci de Toolbar-S&D.
    * Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
    * Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
    * Poste le rapport généré. (C:\TB.txt)

=======================
Rends toi sur ce site :

https://www.virustotal.com/gui/

Clique sur parcourir et cherche ce fichier : C:\yannickk_1.vob

Clique sur Send File.

Un rapport va s'élaborer ligne à ligne.

Attends la fin. Il doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note.

Copie le dans ta réponse. 

Si VirusTotal indique que le fichier a déjà été analysé, cliquer sur le bouton Reanalyse le fichier maintenant

CaptainZack · Answer

Bonjour, 


   -----------\  ToolBar S&D 1.2.5   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) 4 CPU 3.20GHz )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : waelkens ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1229 [VPS 081122-0] 4.8.1229 (Activated)
   C:\ (Local Disk) - NTFS - Total:74 Go (Free:7 Go)
   D:\ (Local Disk) - NTFS - Total:68 Go (Free:8 Go)
   E:\ (Local Disk) - FAT32 - Total:5 Go (Free:1 Go)
   F:\ (Local Disk) - NTFS - Total:149 Go (Free:40 Go)
   G:\ (CD or DVD)
   H:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
   I:\ (CD or DVD)
   K:\ (USB)
   L:\ (USB)
   M:\ (USB)
   O:\ (CD or DVD)
   P:\ (CD or DVD)
   S:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 20-11-2008|20:25 )
   Option : [1] ( 23/11/2008|22:42 )

   -----------\  Recherche de Fichiers / Dossiers ...

   C:\WINDOWS\iun6002.exe

   -----------\  Extensions

   (waelkens) - {DDC359D1-844A-42a7-9AA1-88A850A938A8} => chrome


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\windows\system32\blank.htm"
   "Search Page"="https://www.google.com/?gws_rd=ssl"
   "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
   "First Home Page"="http://www.microsoft.com/isapi/redir.dll?Prd=ie&Pver=5.0&Ar=ie5update&O1=b1"
   "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Search Bar"="http://www.google.com/toolbar/ie8/sidebar.html"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Local Page"="C:\windows\system32\blank.htm"
   "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home"


   --------------------\  Recherche d'autres infections

   --------------------\  ROOTKIT !!

   Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV]
   Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TDSSserv]

   --------------------\  ROGUES ..

   C:\PROGRA~1\Spyware-Secure

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010425_iPod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010425_iPod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010426_iPod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010426_iPod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010428_iPod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010428_iPod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010429_iPod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010429_iPod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010430_iPod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010430_iPod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123643_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123643_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123644_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123644_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123650_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123650_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123934_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123934_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123935_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123935_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123937_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123937_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123938_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123938_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124330_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124330_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124331_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124331_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124337_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124337_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124344_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124344_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124349_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124349_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124350_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124350_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124356_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124356_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124402_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124402_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124403_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124403_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124427_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124427_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124428_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124428_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124434_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124434_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124435_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124435_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124441_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124441_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131037_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131037_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131038_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131038_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131042_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131042_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131043_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131043_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131354_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131354_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131355_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131355_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131401_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131401_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131402_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131402_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131403_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131403_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131404_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131404_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Mes documents\Mes fichiers reçus\Corona DJ - Move The Sound (Crack Dub Mix).mp3



   1 - "C:\ToolBar SD\TB_1.txt" - 23/11/2008|22:44 - Option : [1]

   -----------\  Fin du rapport a 22:44:18,40


-------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------

LE fichier yannickk_1.vob fait 529Mo et est apparement trop gros pour le site, car apres  beaucoup d'attente j'ai eu ça  : Bigger than max permited size / Mayor del tamaño máximo permitido

Lyonnais92 · Answer

Re,

Relance Toolbar-S&D en double-cliquant sur le raccourci. Tape sur "2" puis valide en appuyant sur "Entrée".
! Ne ferme pas la fenêtre lors de la suppression !
Un rapport sera généré, poste son contenu ici.

=========================

fais le scan sur VirusTotal avec :


C:\yannickk.ifo 

=========================

Télécharge sur ton bureau RogueRemover de RubbeR DuckY : https://www.malwarebytes.com/for-home/products/
Choisis un serveur à partir des "Download Locations" pour télécharger RogueRemover

* Créé le dossier C:\RogueRemover pour cela :
-- Ouvre le poste de travail
-- Ouvre le disque C
-- Clic sur le menu Fichier puis Nouveau puis Nouveau Dossier
-- Nomme-le RogueRemover
Décompresse RogueRemover.zip dans C:\RogueRemover
- Rends-toi dans le dossier C:\RogueRemover et double-clic sur le fichier RogueRemover.exe.
* Clic sur le bouton Scan et laisse toi guider.
* Lorsque le scan est terminé.
* Clic sur le bouton Save Log Files en bas, un fichier texte de type RRLogs1236.txt sera créé dans le dossier C:\RogueRemover.
Poste le contenu de ce rapport ici.

===================

J'espère que tu as conscience que ta politique de cracks fait de toi une cible privilégiée des infections.

CaptainZack · Answer

-----------\  ToolBar S&D 1.2.5   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) 4 CPU 3.20GHz )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : waelkens ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1229 [VPS 081123-0] 4.8.1229 (Activated)
   C:\ (Local Disk) - NTFS - Total:74 Go (Free:7 Go)
   D:\ (Local Disk) - NTFS - Total:68 Go (Free:8 Go)
   E:\ (Local Disk) - FAT32 - Total:5 Go (Free:1 Go)
   F:\ (Local Disk) - NTFS - Total:149 Go (Free:40 Go)
   G:\ (CD or DVD)
   H:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
   I:\ (CD or DVD)
   K:\ (USB)
   L:\ (USB)
   M:\ (USB)
   O:\ (CD or DVD)
   P:\ (CD or DVD)
   S:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 20-11-2008|20:25 )
   Option : [2] ( 24/11/2008|12:00 )

   -----------\ SUPPRESSION

   Supprime! - C:\WINDOWS\iun6002.exe

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  Extensions

   (waelkens) - {DDC359D1-844A-42a7-9AA1-88A850A938A8} => chrome


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\windows\system32\blank.htm"
   "Search Page"="https://www.google.com/?gws_rd=ssl"
   "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
   "First Home Page"="http://www.microsoft.com/isapi/redir.dll?Prd=ie&Pver=5.0&Ar=ie5update&O1=b1"
   "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Search Bar"="http://www.google.com/toolbar/ie8/sidebar.html"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Local Page"="C:\windows\system32\blank.htm"
   "Start Page"="https://www.msn.com/fr-fr/"


   --------------------\  Recherche d'autres infections

   --------------------\  ROOTKIT !!

   Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV]
   Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TDSSserv]

   --------------------\  ROGUES ..

   C:\PROGRA~1\Spyware-Secure

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010425_iPod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010425_iPod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010426_iPod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010426_iPod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010428_iPod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010428_iPod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010429_iPod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010429_iPod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010430_iPod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-010430_iPod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123643_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123643_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123644_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123644_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123650_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123650_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123934_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123934_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123935_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123935_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123937_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123937_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123938_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-123938_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124330_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124330_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124331_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124331_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124337_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124337_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124344_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124344_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124349_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124349_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124350_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124350_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124356_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124356_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124402_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124402_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124403_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124403_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124427_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124427_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124428_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124428_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124434_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124434_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124435_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124435_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124441_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-124441_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131037_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131037_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131038_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131038_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131042_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131042_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131043_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131043_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131354_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131354_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131355_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131355_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131401_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131401_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131402_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131402_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131403_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131403_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131404_yannick-s-ipod.crash
   C:\DOCUME~1\waelkens\Application Data\Apple Computer\Logs\CrashReporter\MobileDevice\yannick's ipod\ssh-keygen_2008-10-16-131404_yannick-s-ipod.plist
   C:\DOCUME~1\waelkens\Mes documents\Mes fichiers reçus\Corona DJ - Move The Sound (Crack Dub Mix).mp3



   1 - "C:\ToolBar SD\TB_1.txt" - 23/11/2008|22:44 - Option : [1]
   2 - "C:\ToolBar SD\TB_2.txt" - 24/11/2008|12:03 - Option : [2]

   -----------\  Fin du rapport a 12:03:12,82



----------------------------------------------------------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------------------------------------------------------



Antivirus  	Version  	Dernière mise à jour  	Résultat
AhnLab-V3	2008.11.24.3	2008.11.25	-
AntiVir	7.9.0.35	2008.11.25	-
Authentium	5.1.0.4	2008.11.24	-
Avast	4.8.1281.0	2008.11.24	-
AVG	8.0.0.199	2008.11.24	-
BitDefender	7.2	2008.11.25	-
CAT-QuickHeal	10.00	2008.11.25	-
ClamAV	0.94.1	2008.11.25	-
DrWeb	4.44.0.09170	2008.11.25	-
eSafe	7.0.17.0	2008.11.24	-
eTrust-Vet	31.6.6227	2008.11.25	-
Ewido	4.0	2008.11.24	-
F-Prot	4.4.4.56	2008.11.24	-
F-Secure	8.0.14332.0	2008.11.25	-
Fortinet	3.117.0.0	2008.11.25	-
GData	19	2008.11.25	-
Ikarus	T3.1.1.45.0	2008.11.25	-
K7AntiVirus	7.10.532	2008.11.24	-
Kaspersky	7.0.0.125	2008.11.25	-
McAfee	5444	2008.11.24	-
McAfee+Artemis	5444	2008.11.24	-
Microsoft	1.4104	2008.11.25	-
NOD32	3637	2008.11.24	-
Norman	5.80.02	2008.11.24	-
Panda	9.0.0.4	2008.11.24	-
PCTools	4.4.2.0	2008.11.24	-
Prevx1	V2	2008.11.25	-
Rising	21.05.12.00	2008.11.25	-
SecureWeb-Gateway	6.7.6	2008.11.25	-
Sophos	4.35.0	2008.11.25	-
Sunbelt	3.1.1823.2	2008.11.22	-
Symantec	10	2008.11.25	-
TheHacker	6.3.1.1.162	2008.11.25	-
TrendMicro	8.700.0.1004	2008.11.25	-
VBA32	3.12.8.9	2008.11.24	-
ViRobot	2008.11.25.1484	2008.11.25	-
VirusBuster	4.5.11.0	2008.11.24	-
Information additionnelle
File size: 86016 bytes
MD5...: 1c99056e9bd8807e11ea0f78a787cfdd
SHA1..: 377f6e7b79fb10b152d064bc54e636ff81f72df7
SHA256: f9bb585ee2d0362b84fa66072fb17778f91a5cb61f48778ca7cc4820e4052d4b
SHA512: d6d4c4e6b6540b93472e351c9f12481e24c2c7845cb8f425b1a4961bb604641a
5a7d23c1922fc1857b388eb9ab8694ac59cbfb7dc73a533ccebdf293f21b900f
ssdeep: 1536:VVAD1qM8lrIR5e/ExX/0BB2Jwz486FAeqEpQozaIEb2:VVpUo2Jwzk/XUb
PEiD..: -
TrID..: File type identification
DVD Info file (100.0%)
PEInfo: -





--------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------

L'orsque que je veux télécharger RogueRemver, je vais sur le site que tu m'a donner je clic alors sur un des liens en dessous de :"Main application (English)"

et je ne tombe pas sur un fichier a dézipper mais directement sur un fichier install, (rr-free-setup.exe)
Je l'ai installer et fait un scan mais je n'est pas de "save  logfile".





Ben non je n'en avais pas conscience avant que tu me le disais, c'est a dire; les sites ou je télécharges les carck no-cd sont peu recommandable ?



Merci de ton aide en tout cas .

Lyonnais92 · Answer

Bonjour,

Qu'on voit où on en est après tout ça :

- fais redémarrer l'ordi

- refais tourner RSIT (qui est sur ton Bureau) et poste le rapport.

CaptainZack · Answer

Bonjour, 


JE ne trouve pas de RSIT sur mon bureau :s
Enfin je l'ai peut-être mais pas sous le nom de RSIT sa correspond a quoi ? HijackThis


merci

Lyonnais92 · Answer

Re,

OK, ouvre C:\rsit, cherche rsit.exe et fais un double-clic pour le lancer.

Lyonnais92 · Answer

Re,

alors il est sur ton Bureau comme demandé au post 1 :

================ 
Télécharge ici : 

http://images.malwareremoval.com/random/RSIT.exe 

random's system information tool (RSIT) par random/random et sauvegarde-le sur le Bureau. 

Double-clique sur RSIT.exe afin de lancer RSIT.

Lyonnais92 · Answer

Re,

Copie ou imprime les instructions avant

Déconnecte toi d'internet et ferme toutes tes applications.

Désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)


Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

Driver::
a2tl4gdj
lac97inf

File::
C:\WINDOWS\system32\drivers\a2tl4gdj.sys
C:\DOCUME~1\waelkens\LOCALS~1\Temp\lac97inf.sys 
 
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{91AD9DC2-523A-47E2-A598-6C277F16CC50}]


Enregistre ce fichier sous le nom CFscript


Fait un glisser/déposer de ce fichier CFscript sur le fichier ComboFix.exe

Clique sur le fichier CFscript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFscrïpt vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Réactive ton parefeu, ton antivirus, la garde de ton antispyware

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.


Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

Attention : cette manip a été fait pour cet ordi. Tout réutilisation peut endommager sévèrement le système d'exploitation.

CaptainZack · Answer

Bonsoir, Je n'ai pas eu à taper 1 ou 2, et l'ordinateur s'est redémarrer. Voila le rapport : ComboFix 08-11-22.02 - waelkens 2008-11-26 16:16:38.2 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.367 [GMT 1:00] Lancé depuis: d:\iso\ComboFix.exe Commutateurs utilisés :: d:\iso\CFscript * Un nouveau point de restauration a été créé FILE :: c:\docume~1\waelkens\LOCALS~1\Temp\lac97inf.sys c:\windows\system32\drivers\a2tl4gdj.sys . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_LAC97INF -------\Service_lac97inf ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-26 au 2008-11-26 )))))))))))))))))))))))))))))))))))) . 2008-11-25 10:43 . 2008-11-25 10:44 d-------- c:\program files\RogueRemover FREE 2008-11-25 10:40 . 2008-11-25 10:42 d-------- C:\RogueRemover 2008-11-23 22:41 . 2008-11-24 12:03 d-------- C:\ToolBar SD 2008-11-23 19:14 . 2008-11-23 19:14 d-------- c:\documents and settings\waelkens\Application Data\Grisoft 2008-11-23 19:12 . 2008-11-23 19:12 d-------- c:\documents and settings\All Users\Application Data\Grisoft 2008-11-23 19:12 . 2007-05-30 13:10 10,872 --a------ c:\windows\system32\drivers\AvgAsCln.sys 2008-11-23 14:24 . 2008-11-23 23:06 d-------- C:\Lop SD 2008-11-22 19:33 . 2008-11-23 11:49 3,820 --a------ c:\windows\system32 mp.reg 2008-11-22 19:32 . 2008-11-22 19:34 d-------- c:\documents and settings\waelkens\SmitfraudFix 2008-11-22 19:32 . 2007-09-05 23:22 289,144 --a------ c:\windows\system32\VCCLSID.exe 2008-11-22 19:32 . 2006-04-27 16:49 288,417 --a------ c:\windows\system32\SrchSTS.exe 2008-11-22 19:32 . 2008-10-01 14:51 87,552 --a------ c:\windows\system32\VACFix.exe 2008-11-22 19:32 . 2008-10-10 07:58 82,944 --a------ c:\windows\system32\o4Patch.exe 2008-11-22 19:32 . 2008-05-18 20:40 82,944 --a------ c:\windows\system32\IEDFix.exe 2008-11-22 19:32 . 2008-10-10 07:58 82,944 --a------ c:\windows\system32\IEDFix.C.exe 2008-11-22 19:32 . 2008-08-18 11:19 82,432 --a------ c:\windows\system32\404Fix.exe 2008-11-22 19:32 . 2003-06-05 20:13 53,248 --a------ c:\windows\system32\Process.exe 2008-11-22 19:32 . 2004-07-31 17:50 51,200 --a------ c:\windows\system32\dumphive.exe 2008-11-22 19:32 . 2007-10-03 23:36 25,600 --a------ c:\windows\system32\WS2Fix.exe 2008-11-22 17:11 . 2008-11-22 17:11 d-------- C: sit 2008-11-22 16:56 . 2008-11-22 17:04 d-------- c:\program files\Navilog1 2008-11-22 03:26 . 2008-11-22 03:26 d-------- c:\documents and settings\All Users\Application Data\Blizzard 2008-11-21 17:42 . 2008-11-21 17:42 d-------- C:\Logs 2008-11-20 09:56 . 2008-11-20 09:56 d-------- c:\program files\Lavasoft 2008-11-20 09:56 . 2008-11-20 09:57 d-------- c:\documents and settings\All Users\Application Data\Lavasoft 2008-11-16 20:56 . 2008-11-25 21:35 d-------- c:\program files\adslTV 2008-11-16 20:56 . 2008-11-16 20:56 d-------- c:\documents and settings\waelkens\Application Data\vlc 2008-11-15 18:27 . 2008-11-15 18:27 d-------- c:\documents and settings\All Users\Application Data\2DBoy 2008-11-14 22:24 . 2008-11-14 22:24 118 --a------ c:\windows\system32\MRT.INI 2008-11-13 17:46 . 2008-11-13 17:46 d-------- c:\documents and settings\waelkens\OngameNetwork 2008-11-11 08:36 . 2008-11-11 08:36 d-------- C:\Medion 2008-11-02 08:25 . 2008-11-02 08:25 2,425 --ah----- C:\mxfilerelatedcache.mxc2 2008-11-02 08:25 . 2008-11-02 08:25 1,520 --a------ C:\yannickk_1.avd . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-26 15:26 --------- d-----w c:\program files\Wanadoo 2008-11-26 15:26 --------- d-----w c:\documents and settings\waelkens\Application Data\Skype 2008-11-26 15:25 17,408 ----a-w c:\windows\system32\drivers\USBCRFT.SYS 2008-11-26 15:13 46,366 ----a-w c:\documents and settings\waelkens\Application Data\wklnhst.dat 2008-11-25 09:49 5,632 -csha-w c:\program files\Thumbs.db 2008-11-23 18:14 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard 2008-11-21 10:39 --------- d-----w c:\program files\Fichiers communs\Blizzard Entertainment 2008-11-21 10:11 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-20 14:18 --------- d-----w c:\documents and settings\waelkens\Application Data\Orbit 2008-11-20 08:51 --------- d-----w c:\documents and settings\waelkens\Application Data\Lavasoft 2008-11-14 22:20 --------- d-----w c:\program files\DivX 2008-11-07 21:22 --------- d-----w c:\program files\Mozilla Thunderbird 2008-11-05 18:00 --------- d-----w c:\documents and settings\waelkens\Application Data\uTorrent 2008-10-29 12:41 --------- d-----w c:\program files\RomStation 2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-21 13:16 --------- d-----w c:\program files\Morgan 2008-10-18 12:22 209,636 ----a-w c:\windows\IPUI_DivXG400.exe 2008-10-18 12:20 --------- d-----w c:\program files\Rippackv3 2008-10-16 12:51 --------- d-----w c:\documents and settings\waelkens\Application Data\FileZilla 2008-10-16 10:52 --------- d-----w c:\documents and settings\waelkens\Application Data\Apple Computer 2008-10-15 17:08 --------- d-----w c:\program files\DaemonTools_WhenUSave_Installer 2008-10-15 17:07 --------- d-----w c:\program files\Kodak 2008-10-15 16:40 --------- d-----w c:\program files\eRightSoft 2008-10-15 15:49 --------- d-----w c:\program files\BitComet 2008-10-15 09:49 --------- d-----w c:\program files\iTunes 2008-10-15 09:49 --------- d-----w c:\program files\iPod 2008-10-15 09:49 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-10-15 09:48 --------- d-----w c:\program files\Bonjour 2008-10-15 09:47 --------- d-----w c:\program files\QuickTime 2008-10-15 09:46 --------- d-----w c:\program files\Fichiers communs\Apple 2008-10-15 09:44 --------- d-----w c:\program files\Apple Software Update 2008-10-02 14:49 --------- d-----w c:\program files\Warcraft III 2008-10-01 11:01 32,000 ----a-w c:\windows\system32\drivers\usbaapl.sys 2008-09-30 14:30 98,304 ----a-w c:\windows\DUMPc8fd.tmp 2008-09-30 14:28 98,304 ----a-w c:\windows\DUMP3718.tmp 2008-09-28 06:41 --------- d-----w c:\program files\Combined Community Codec Pack 2008-09-26 13:44 --------- d-----w c:\documents and settings\waelkens\Application Data\Dev-Cpp 2008-09-26 13:02 --------- d-----w c:\documents and settings\waelkens\Application Data\codeblocks 2008-09-26 11:56 --------- d-----w c:\program files\Microsoft Visual Studio 9.0 2008-09-26 11:56 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help 2008-06-09 08:26 85,944 -c--a-w c:\documents and settings\waelkens\Application Data\GDIPFONTCACHEV1.DAT 2007-11-18 14:15 47,360 -c--a-w c:\documents and settings\waelkens\Application Data\pcouffin.sys 2007-05-21 11:11 47 -c--a-w c:\documents and settings\waelkens\fixsize.cmd 2007-04-04 20:30 95,232 -c--a-w c:\documents and settings\waelkens\filechop.exe 2007-03-08 23:10 18,690 -c--a-w c:\documents and settings\waelkens\make-multi.exe 2007-02-25 12:00 1 -c--a-w c:\documents and settings\waelkens\SI.bin 2006-07-28 08:30 88,102 -c--a-w c:\program files\Aug2006_xinput_x64.cab 2006-07-28 08:30 47,018 -c--a-w c:\program files\Aug2006_xinput_x86.cab 2006-07-28 08:30 41,995 -c--a-w c:\program files\dxdllreg_x86.cab 2006-07-28 08:30 183,863 -c--a-w c:\program files\Aug2006_XACT_x64.cab 2006-07-28 08:30 138,195 -c--a-w c:\program files\Aug2006_XACT_x86.cab 2006-07-28 07:32 82,338 -c--a-w c:\program files\dxupdate.cab 2006-07-28 07:32 2,248,984 -c--a-w c:\program files\dsetup32.dll 2006-07-28 07:31 484,632 -c--a-w c:\program files\DXSETUP.exe 2006-07-28 07:30 74,520 -c--a-w c:\program files\DSETUP.dll 2006-06-05 23:07 31 -c----w c:\documents and settings\waelkens\getfile.dat 2006-05-31 05:39 181,745 -c----w c:\program files\JUN2006_XACT_x64.cab 2006-05-31 05:39 134,631 -c----w c:\program files\JUN2006_XACT_x86.cab 2006-03-31 11:56 917,318 -c----w c:\program files\Apr2006_MDX1_x86.cab 2006-03-31 11:56 87,989 -c----w c:\program files\Apr2006_xinput_x64.cab 2006-03-31 11:56 46,898 -c----w c:\program files\Apr2006_xinput_x86.cab 2006-03-31 11:56 4,163,518 -c----w c:\program files\Apr2006_MDX1_x86_Archive.cab 2006-03-31 11:56 180,021 -c----w c:\program files\Apr2006_XACT_x64.cab 2006-03-31 11:56 133,991 -c----w c:\program files\Apr2006_XACT_x86.cab 2006-03-31 11:56 1,398,718 -c----w c:\program files\Apr2006_d3dx9_30_x64.cab 2006-03-31 11:56 1,116,109 -c----w c:\program files\Apr2006_d3dx9_30_x86.cab 2006-02-16 13:05 278,528 -c--a-w c:\program files\Fichiers communs\FDEUnInstaller.exe 2006-02-03 08:00 179,247 -c----w c:\program files\Feb2006_XACT_x64.cab 2006-02-03 08:00 133,297 -c----w c:\program files\Feb2006_XACT_x86.cab 2006-02-03 08:00 1,363,684 -c----w c:\program files\Feb2006_d3dx9_29_x64.cab 2006-02-03 08:00 1,085,608 -c----w c:\program files\Feb2006_d3dx9_29_x86.cab 2005-12-05 17:31 86,925 -c----w c:\program files\Oct2005_xinput_x64.cab 2005-12-05 17:31 46,247 -c----w c:\program files\Oct2005_xinput_x86.cab 2005-12-05 17:31 1,358,864 -c----w c:\program files\Dec2005_d3dx9_28_x64.cab 2005-12-05 17:31 1,080,344 -c----w c:\program files\Dec2005_d3dx9_28_x86.cab 2005-10-26 11:48 40,448 -c--a-w c:\documents and settings\waelkens rial_setup.exe 2005-07-22 18:14 1,351,430 -c----w c:\program files\Aug2005_d3dx9_27_x64.cab 2005-07-22 18:14 1,078,532 -c----w c:\program files\Aug2005_d3dx9_27_x86.cab 2005-05-26 13:49 1,336,890 -c----w c:\program files\Jun2005_d3dx9_26_x64.cab 2005-05-26 13:49 1,065,813 -c----w c:\program files\Jun2005_d3dx9_26_x86.cab 2005-03-18 16:40 1,348,242 -c----w c:\program files\Apr2005_d3dx9_25_x64.cab 2005-03-18 16:40 1,079,850 -c----w c:\program files\Apr2005_d3dx9_25_x86.cab 2005-02-05 19:03 1,248,387 -c----w c:\program files\Feb2005_d3dx9_24_x64.cab 2005-02-05 19:03 1,014,113 -c----w c:\program files\Feb2005_d3dx9_24_x86.cab 2004-09-27 10:29 976,020 -c----w c:\program files\BDAXP.cab 2004-09-27 10:29 703,080 -c----w c:\program files\BDA.cab 2004-09-27 10:29 15,493,481 -c----w c:\program files\DirectX.cab 2004-09-27 10:29 13,265,040 -c----w c:\program files\dxnt.cab 2004-09-27 10:29 1,156,363 -c----w c:\program files\BDANT.cab 1996-12-02 17:44 582,144 -c--a-w c:\program files\Fichiers communs\dao350.dll 2005-01-25 16:24 8 -csh--r c:\windows\system32\F2A38CDCBF.sys 2006-05-03 09:06 163,328 --sh--r c:\windows\system32\flvDX.dll 2005-01-25 16:24 5,744 -csha-w c:\windows\system32\KGyGaAvL.sys 2007-02-21 10:47 31,232 --sh--r c:\windows\system32\msfDX.dll 2008-03-16 12:30 216,064 --sh--r c:\windows\system32 bDX.dll . ((((((((((((((((((((((((((((( snapshot@2008-11-23_12.33.44,79 ))))))))))))))))))))))))))))))))))))))))) . + 2005-10-20 19:02:28 163,328 ----a-w c:\windows\ERDNT\subs\ERDNT.EXE + 2008-11-26 15:24:47 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_660.dat . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2004-12-09 1937408] "SteamKeyFr"="c:\program files\SteamKeyFr\SteamKeyFr.exe" [2004-01-28 212992] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2007-01-12 25367592] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-25 68856] "WOOKIT"="c:\progra~1\Wanadoo\Shell.exe" [2004-08-23 122880] "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\WCESCOMM.EXE" [2004-02-24 401491] "TrueDownloaderAutoStart"="c:\program files\TrueDownloader\TrueDownloader.exe" [2005-02-20 520258] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360] "LightScribe Control Panel"="c:\program files\Fichiers communs\LightScribe\LightScribeControlPanel.exe" [2007-08-23 455968] "DAEMON Tools Pro Agent"="c:\program files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 136136] "Steam"="d:\program files\Valve\Steam\Steam.exe" [2008-10-15 1410296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "AOLDialer"="c:\program files\Fichiers communs\AOL\ACS\AOLDial.exe" [2004-04-08 496752] "PCMService"="c:\program files\Home Cinema\PowerCinema\PCMService.exe" [2005-02-04 118926] "ISUSPM Startup"="c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-06-16 221184] "ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-08-09 81920] "WOOWATCH"="c:\progra~1\Wanadoo\Watch.exe" [2004-08-23 20480] "WOOTASKBARICON"="c:\progra~1\Wanadoo\GestMaj.exe" [2004-10-14 32768] "Adobe Photo Downloader"="f:\soirée pétanque\3.0\Apps\apdproxy.exe" [2005-06-23 57344] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "SMSTray"="c:\program files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-09-20 132624] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440] "AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576] "!AVG Anti-Spyware"="c:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312] "Dit"="Dit.exe" [2004-07-20 c:\windows\Dit.exe] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-19 c:\windows\system32\bthprops.cpl] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2006-07-16 626176] Logiciel Kodak EasyShare.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2007-06-21 282624] SpySubtract.lnk - c:\program files\interMute\SpySubtract\SpySub.exe [2007-03-18 1187840] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoBandCustomize"= 0 (0x0) "NoMovingBands"= 0 (0x0) "NoCloseDragDropBands"= 0 (0x0) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"= "c:\program files\interMute\SpySubtract\sshook.dll" [2007-03-18 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.I420"= i420vfw.dll "msacm.l3acm"= c:\windows\system32\l3codecp.acm "MSACM.CEGSM"= mobilev.acm "VIDC.FFDS"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll "vidc.DIV3"= DivXc32.dll "vidc.DIV4"= DivXc32f.dll "msacm.divxa32"= DivXa32.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "c:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe"= "c:\Program Files\Microsoft ActiveSync\wcescomm.exe"= "c:\Documents and Settings\waelkens\Bureau\yannicl\programme C C++\eMule0.49b\emule.exe"= "c:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe"= "c:\Program Files\adslTV\adsltv.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "6112:TCP"= 6112:TCP:Warcraft "4670:TCP"= 4670:TCP:emule port "4671:UDP"= 4671:UDP:emule portudp "3724:TCP"= 3724:TCP:BLIZZARD R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-07-30 78416] R1 cpuidlep;CpuIdle Pro System Driver;c:\windows\system32\drivers\cpuidlep.sys [2008-05-01 4484] R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-07-30 20560] R2 UxTuneUp;Extension de conception TuneUp;c:\windows\System32\svchost.exe -k netsvcs [2005-01-20 14336] R3 3xHybrid;3xHybrid service;c:\windows\system32\DRIVERS\3xHybrid.sys [2005-02-05 802048] R3 cmudax;C-Media High Definition Audio Interface;c:\windows\system32\drivers\cmudax.sys [2005-01-20 1272000] R3 wbscr;Winbond Smartcard Reader for I/O;c:\windows\system32\drivers\wbscr.sys [2005-01-20 19928] S2 FILESpy;FILESpy;\??\c:\program files\Softwin\BitDefender9\filespy.sys [] S3 AIDA32Driver;AIDA32Driver;\??\c:\program files\AIDA32 - Personal System Information\aida32.sys [2004-02-23 3584] S3 CardReaderFilter;Card Reader Filter;\??\c:\windows\system32\Drivers\USBCRFT.SYS [2005-01-20 17408] S3 M1000Srv;M5603C USB2.0 Camera Driver;c:\windows\system32\Drivers\M1000KNT.sys [2007-01-10 274567] S3 PPJoyBus;Parallel Port Joystick Bus device driver;c:\windows\system32\drivers\PPJoyBus.sys [2004-01-23 13952] S3 PPortJoystick;Parallel Port Joystick device driver;c:\windows\system32\drivers\PPortJoy.sys [2004-01-23 28800] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2ac68d9a-f886-11da-a67e-001109df929d}] \Shell\AutoRun\command - L:\PreyStub.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5bd32168-dd23-11db-a8d2-001109df929d}] \Shell\AutoRun\command - K:\Autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{925fa382-1aac-11db-a6cd-001109df929d}] \Shell\AutoRun\command - M:\AutoRun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ca5651a3-8e67-11da-a58f-001109df929d}] \Shell\AutoRun\command - livebox.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "c:\program files\Fichiers communs\LightScribe\LSRunOnce.exe" . Contenu du dossier 'Tâches planifiées' 2008-11-25 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2008-11-21 c:\windows\Tasks\Maintenance en 1 clic.job - c:\program files\TuneUp Utilities 2006\SystemOptimizer.exe [2006-10-06 06:27] . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-26 16:24:55 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'winlogon.exe'(728) c:\windows\system32\Ati2evxx.dll c:\windows\system32 saenh.dll - - - - - - - > 'lsass.exe'(784) c:\windows\system32\msprivs.dll c:\windows\system32 saenh.dll . ------------------------ Autres processus actifs ------------------------ . c:\windows\system32\ati2evxx.exe c:\windows\system32\ati2evxx.exe c:\program files\Alwil Software\Avast4\aswUpdSv.exe c:\program files\Alwil Software\Avast4\ashServ.exe c:\windows\system32\scardsvr.exe c:\windows\system32\agrsmsvc.exe c:\program files\Fichiers communs\AOL\ACS\AOLacsd.exe c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Grisoft\AVG Anti-Spyware 7.5\guard.exe c:\program files\IVT Corporation\BlueSoleil\BTNtService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe c:\progra~1\Wanadoo\TaskBarIcon.exe c:\windows\system32 undll32.exe c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe c:\program files\Fichiers communs\EPSON\EBAPI\eEBSvc.exe c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe c:\program files\Fichiers communs\EPSON\EBAPI\SAgent2.exe c:\windows\system32\FTRTSVC.exe c:\program files\Fichiers communs\LightScribe\LSSrvc.exe c:\program files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe c:\program files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe c:\program files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe c:\program files\Alwil Software\Avast4\ashMaiSv.exe c:\program files\Alwil Software\Avast4\ashWebSv.exe c:\progra~1\COMMON~1\X10\Common\X10nets.exe c:\windows\system32\wscntfy.exe c:\program files\iPod\bin\iPodService.exe . ************************************************************************** . Heure de fin: 2008-11-26 16:36:11 - La machine a redémarré ComboFix-quarantined-files.txt 2008-11-26 15:36:07 ComboFix2.txt 2008-11-23 11:35:08 Avant-CF: 7 758 241 792 octets libres Après-CF: 7,638,421,504 octets libres 313 --- E O F --- 2008-11-14 21:24:20

Lyonnais92 · Answer

Re,

relance Toolbar S&D sur ton Bureau.

    * Choisis  l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
    * Poste le rapport généré. (C:\TB.txt)

Lyonnais92 · Answer

Re,

Copie ou imprime les instructions avant

Déconnecte toi d'internet et ferme toutes tes applications.

Désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)


Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :
 
folder::
C:\PROGRA~1\Spyware-Secure 
 
Registry::
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TDSSserv] 


Enregistre ce fichier sous le nom CFscript


Fait un glisser/déposer de ce fichier CFscript sur le fichier ComboFix.exe

Clique sur le fichier CFscript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFscrïpt vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Réactive ton parefeu, ton antivirus, la garde de ton antispyware

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Remets aussi un rapport Hijackthis


Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

Attention : cette manip a été fait pour cet ordi. Tout réutilisation peut endommager sévèrement le système d'exploitation.

CaptainZack · Answer

Bonjour, Voici le rapport de Combo fix : ComboFix 08-11-22.02 - waelkens 2008-11-27 11:45:03.3 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.375 [GMT 1:00] Lancé depuis: d:\iso\ComboFix.exe Commutateurs utilisés :: c:\documents and settings\waelkens\Bureau\CFscript * Un nouveau point de restauration a été créé . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\progra~1\Spyware-Secure c:\progra~1\Spyware-Secure\language c:\progra~1\Spyware-Secure\Spyware-Secure.url . ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-27 au 2008-11-27 )))))))))))))))))))))))))))))))))))) . 2008-11-25 10:43 . 2008-11-25 10:44 d-------- c:\program files\RogueRemover FREE 2008-11-25 10:40 . 2008-11-25 10:42 d-------- C:\RogueRemover 2008-11-23 22:41 . 2008-11-26 18:54 d-------- C:\ToolBar SD 2008-11-23 19:14 . 2008-11-23 19:14 d-------- c:\documents and settings\waelkens\Application Data\Grisoft 2008-11-23 19:12 . 2008-11-23 19:12 d-------- c:\documents and settings\All Users\Application Data\Grisoft 2008-11-23 19:12 . 2007-05-30 13:10 10,872 --a------ c:\windows\system32\drivers\AvgAsCln.sys 2008-11-23 14:24 . 2008-11-23 23:06 d-------- C:\Lop SD 2008-11-22 19:33 . 2008-11-23 11:49 3,820 --a------ c:\windows\system32 mp.reg 2008-11-22 19:32 . 2008-11-22 19:34 d-------- c:\documents and settings\waelkens\SmitfraudFix 2008-11-22 19:32 . 2007-09-05 23:22 289,144 --a------ c:\windows\system32\VCCLSID.exe 2008-11-22 19:32 . 2006-04-27 16:49 288,417 --a------ c:\windows\system32\SrchSTS.exe 2008-11-22 19:32 . 2008-10-01 14:51 87,552 --a------ c:\windows\system32\VACFix.exe 2008-11-22 19:32 . 2008-10-10 07:58 82,944 --a------ c:\windows\system32\o4Patch.exe 2008-11-22 19:32 . 2008-05-18 20:40 82,944 --a------ c:\windows\system32\IEDFix.exe 2008-11-22 19:32 . 2008-10-10 07:58 82,944 --a------ c:\windows\system32\IEDFix.C.exe 2008-11-22 19:32 . 2008-08-18 11:19 82,432 --a------ c:\windows\system32\404Fix.exe 2008-11-22 19:32 . 2003-06-05 20:13 53,248 --a------ c:\windows\system32\Process.exe 2008-11-22 19:32 . 2004-07-31 17:50 51,200 --a------ c:\windows\system32\dumphive.exe 2008-11-22 19:32 . 2007-10-03 23:36 25,600 --a------ c:\windows\system32\WS2Fix.exe 2008-11-22 17:11 . 2008-11-22 17:11 d-------- C: sit 2008-11-22 16:56 . 2008-11-22 17:04 d-------- c:\program files\Navilog1 2008-11-22 03:26 . 2008-11-22 03:26 d-------- c:\documents and settings\All Users\Application Data\Blizzard 2008-11-21 17:42 . 2008-11-21 17:42 d-------- C:\Logs 2008-11-20 09:56 . 2008-11-20 09:56 d-------- c:\program files\Lavasoft 2008-11-20 09:56 . 2008-11-20 09:57 d-------- c:\documents and settings\All Users\Application Data\Lavasoft 2008-11-16 20:56 . 2008-11-25 21:35 d-------- c:\program files\adslTV 2008-11-16 20:56 . 2008-11-16 20:56 d-------- c:\documents and settings\waelkens\Application Data\vlc 2008-11-15 18:27 . 2008-11-15 18:27 d-------- c:\documents and settings\All Users\Application Data\2DBoy 2008-11-14 22:24 . 2008-11-14 22:24 118 --a------ c:\windows\system32\MRT.INI 2008-11-13 17:46 . 2008-11-13 17:46 d-------- c:\documents and settings\waelkens\OngameNetwork 2008-11-11 08:36 . 2008-11-11 08:36 d-------- C:\Medion 2008-11-02 08:25 . 2008-11-02 08:25 2,425 --ah----- C:\mxfilerelatedcache.mxc2 2008-11-02 08:25 . 2008-11-02 08:25 1,520 --a------ C:\yannickk_1.avd . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-27 10:43 46,366 ----a-w c:\documents and settings\waelkens\Application Data\wklnhst.dat 2008-11-27 10:39 --------- d-----w c:\program files\Wanadoo 2008-11-27 10:19 --------- d-----w c:\documents and settings\waelkens\Application Data\Skype 2008-11-26 19:36 17,408 ----a-w c:\windows\system32\drivers\USBCRFT.SYS 2008-11-25 09:49 5,632 -csha-w c:\program files\Thumbs.db 2008-11-23 18:14 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard 2008-11-21 10:39 --------- d-----w c:\program files\Fichiers communs\Blizzard Entertainment 2008-11-21 10:11 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-20 14:18 --------- d-----w c:\documents and settings\waelkens\Application Data\Orbit 2008-11-20 08:51 --------- d-----w c:\documents and settings\waelkens\Application Data\Lavasoft 2008-11-14 22:20 --------- d-----w c:\program files\DivX 2008-11-07 21:22 --------- d-----w c:\program files\Mozilla Thunderbird 2008-11-05 18:00 --------- d-----w c:\documents and settings\waelkens\Application Data\uTorrent 2008-11-05 11:23 98,304 ----a-w c:\windows\system32\CmdLineExt.dll 2008-10-29 12:41 --------- d-----w c:\program files\RomStation 2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-21 13:16 --------- d-----w c:\program files\Morgan 2008-10-18 12:22 209,636 ----a-w c:\windows\IPUI_DivXG400.exe 2008-10-18 12:20 --------- d-----w c:\program files\Rippackv3 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll 2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll 2008-10-16 12:51 --------- d-----w c:\documents and settings\waelkens\Application Data\FileZilla 2008-10-16 10:52 --------- d-----w c:\documents and settings\waelkens\Application Data\Apple Computer 2008-10-15 17:08 --------- d-----w c:\program files\DaemonTools_WhenUSave_Installer 2008-10-15 17:07 --------- d-----w c:\program files\Kodak 2008-10-15 16:40 --------- d-----w c:\program files\eRightSoft 2008-10-15 15:49 --------- d-----w c:\program files\BitComet 2008-10-15 09:49 --------- d-----w c:\program files\iTunes 2008-10-15 09:49 --------- d-----w c:\program files\iPod 2008-10-15 09:49 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-10-15 09:48 --------- d-----w c:\program files\Bonjour 2008-10-15 09:47 --------- d-----w c:\program files\QuickTime 2008-10-15 09:46 --------- d-----w c:\program files\Fichiers communs\Apple 2008-10-15 09:44 --------- d-----w c:\program files\Apple Software Update 2008-10-02 14:49 --------- d-----w c:\program files\Warcraft III 2008-10-01 11:01 32,000 ----a-w c:\windows\system32\drivers\usbaapl.sys 2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll 2008-09-30 14:30 98,304 ----a-w c:\windows\DUMPc8fd.tmp 2008-09-30 14:28 98,304 ----a-w c:\windows\DUMP3718.tmp 2008-09-28 06:41 --------- d-----w c:\program files\Combined Community Codec Pack 2008-09-19 21:55 200,704 -c--a-w c:\windows\system32\ssldivx.dll 2008-09-19 21:55 1,044,480 -c--a-w c:\windows\system32\libdivx.dll 2008-09-15 15:39 1,846,144 ----a-w c:\windows\system32\win32k.sys 2008-09-04 16:45 1,106,944 ----a-w c:\windows\system32\msxml3.dll 2008-08-29 19:06 1,350,664 ----a-w c:\windows\system32\msxml6.dll 2008-08-29 08:18 87,336 ----a-w c:\windows\system32\dns-sd.exe 2008-08-29 07:53 61,440 ----a-w c:\windows\system32\dnssd.dll 2008-06-09 08:26 85,944 -c--a-w c:\documents and settings\waelkens\Application Data\GDIPFONTCACHEV1.DAT 2007-11-18 14:15 47,360 -c--a-w c:\documents and settings\waelkens\Application Data\pcouffin.sys 2007-05-21 11:11 47 -c--a-w c:\documents and settings\waelkens\fixsize.cmd 2007-04-04 20:30 95,232 -c--a-w c:\documents and settings\waelkens\filechop.exe 2007-03-08 23:10 18,690 -c--a-w c:\documents and settings\waelkens\make-multi.exe 2007-02-25 12:00 1 -c--a-w c:\documents and settings\waelkens\SI.bin 2006-07-28 08:30 88,102 -c--a-w c:\program files\Aug2006_xinput_x64.cab 2006-07-28 08:30 47,018 -c--a-w c:\program files\Aug2006_xinput_x86.cab 2006-07-28 08:30 41,995 -c--a-w c:\program files\dxdllreg_x86.cab 2006-07-28 08:30 183,863 -c--a-w c:\program files\Aug2006_XACT_x64.cab 2006-07-28 08:30 138,195 -c--a-w c:\program files\Aug2006_XACT_x86.cab 2006-07-28 07:32 82,338 -c--a-w c:\program files\dxupdate.cab 2006-07-28 07:32 2,248,984 -c--a-w c:\program files\dsetup32.dll 2006-07-28 07:31 484,632 -c--a-w c:\program files\DXSETUP.exe 2006-07-28 07:30 74,520 -c--a-w c:\program files\DSETUP.dll 2006-06-05 23:07 31 -c----w c:\documents and settings\waelkens\getfile.dat 2006-05-31 05:39 181,745 -c----w c:\program files\JUN2006_XACT_x64.cab 2006-05-31 05:39 134,631 -c----w c:\program files\JUN2006_XACT_x86.cab 2006-03-31 11:56 917,318 -c----w c:\program files\Apr2006_MDX1_x86.cab 2006-03-31 11:56 87,989 -c----w c:\program files\Apr2006_xinput_x64.cab 2006-03-31 11:56 46,898 -c----w c:\program files\Apr2006_xinput_x86.cab 2006-03-31 11:56 4,163,518 -c----w c:\program files\Apr2006_MDX1_x86_Archive.cab 2006-03-31 11:56 180,021 -c----w c:\program files\Apr2006_XACT_x64.cab 2006-03-31 11:56 133,991 -c----w c:\program files\Apr2006_XACT_x86.cab 2006-03-31 11:56 1,398,718 -c----w c:\program files\Apr2006_d3dx9_30_x64.cab 2006-03-31 11:56 1,116,109 -c----w c:\program files\Apr2006_d3dx9_30_x86.cab 2006-02-16 13:05 278,528 -c--a-w c:\program files\Fichiers communs\FDEUnInstaller.exe 2006-02-03 08:00 179,247 -c----w c:\program files\Feb2006_XACT_x64.cab 2006-02-03 08:00 133,297 -c----w c:\program files\Feb2006_XACT_x86.cab 2006-02-03 08:00 1,363,684 -c----w c:\program files\Feb2006_d3dx9_29_x64.cab 2006-02-03 08:00 1,085,608 -c----w c:\program files\Feb2006_d3dx9_29_x86.cab 2005-12-05 17:31 86,925 -c----w c:\program files\Oct2005_xinput_x64.cab 2005-12-05 17:31 46,247 -c----w c:\program files\Oct2005_xinput_x86.cab 2005-12-05 17:31 1,358,864 -c----w c:\program files\Dec2005_d3dx9_28_x64.cab 2005-12-05 17:31 1,080,344 -c----w c:\program files\Dec2005_d3dx9_28_x86.cab 2005-10-26 11:48 40,448 -c--a-w c:\documents and settings\waelkens rial_setup.exe 2005-07-22 18:14 1,351,430 -c----w c:\program files\Aug2005_d3dx9_27_x64.cab 2005-07-22 18:14 1,078,532 -c----w c:\program files\Aug2005_d3dx9_27_x86.cab 2005-05-26 13:49 1,336,890 -c----w c:\program files\Jun2005_d3dx9_26_x64.cab 2005-05-26 13:49 1,065,813 -c----w c:\program files\Jun2005_d3dx9_26_x86.cab 2005-03-18 16:40 1,348,242 -c----w c:\program files\Apr2005_d3dx9_25_x64.cab 2005-03-18 16:40 1,079,850 -c----w c:\program files\Apr2005_d3dx9_25_x86.cab 2005-02-05 19:03 1,248,387 -c----w c:\program files\Feb2005_d3dx9_24_x64.cab 2005-02-05 19:03 1,014,113 -c----w c:\program files\Feb2005_d3dx9_24_x86.cab 2004-09-27 10:29 976,020 -c----w c:\program files\BDAXP.cab 2005-01-25 16:24 8 -csh--r c:\windows\system32\F2A38CDCBF.sys 2006-05-03 09:06 163,328 --sh--r c:\windows\system32\flvDX.dll 2005-01-25 16:24 5,744 -csha-w c:\windows\system32\KGyGaAvL.sys 2007-02-21 10:47 31,232 --sh--r c:\windows\system32\msfDX.dll 2008-03-16 12:30 216,064 --sh--r c:\windows\system32 bDX.dll . ((((((((((((((((((((((((((((( snapshot@2008-11-23_12.33.44,79 ))))))))))))))))))))))))))))))))))))))))) . + 2005-10-20 19:02:28 163,328 ----a-w c:\windows\ERDNT\subs\ERDNT.EXE - 2008-07-19 14:43:08 1,163,960 ----a-w c:\windows\system32\aswBoot.exe + 2008-11-18 17:41:38 1,233,112 ----a-w c:\windows\system32\aswBoot.exe - 2008-07-19 14:30:53 94,392 ----a-w c:\windows\system32\AVASTSS.scr + 2008-11-18 17:35:22 97,480 ----a-w c:\windows\system32\AvastSS.scr - 2008-07-19 14:32:15 26,944 ----a-w c:\windows\system32\drivers\aavmker4.sys + 2008-11-18 18:00:11 26,944 ----a-w c:\windows\system32\drivers\aavmker4.sys - 2008-07-19 14:37:42 20,560 ----a-w c:\windows\system32\drivers\aswFsBlk.sys + 2008-11-18 18:02:43 20,560 ----a-w c:\windows\system32\drivers\aswFsBlk.sys - 2008-01-17 16:34:01 93,264 ----a-w c:\windows\system32\drivers\aswmon.sys + 2008-11-18 18:04:36 93,296 ----a-w c:\windows\system32\drivers\aswmon.sys - 2008-07-19 14:37:21 94,416 ----a-w c:\windows\system32\drivers\aswmon2.sys + 2008-11-18 18:04:21 94,032 ----a-w c:\windows\system32\drivers\aswmon2.sys - 2008-07-19 14:33:42 23,152 ----a-w c:\windows\system32\drivers\aswRdr.sys + 2008-11-18 18:01:09 23,152 ----a-w c:\windows\system32\drivers\aswRdr.sys - 2008-07-19 14:35:18 78,416 ----a-w c:\windows\system32\drivers\aswSP.sys + 2008-11-18 18:03:33 110,160 ----a-w c:\windows\system32\drivers\aswSP.sys - 2008-07-19 14:32:36 42,912 ----a-w c:\windows\system32\drivers\aswTdi.sys + 2008-11-18 18:01:23 50,864 ----a-w c:\windows\system32\drivers\aswTdi.sys + 2008-11-27 10:18:22 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_670.dat + 2008-11-27 10:19:47 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_e50.dat . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2004-12-09 1937408] "SteamKeyFr"="c:\program files\SteamKeyFr\SteamKeyFr.exe" [2004-01-28 212992] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2007-01-12 25367592] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-25 68856] "WOOKIT"="c:\progra~1\Wanadoo\Shell.exe" [2004-08-23 122880] "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\WCESCOMM.EXE" [2004-02-24 401491] "TrueDownloaderAutoStart"="c:\program files\TrueDownloader\TrueDownloader.exe" [2005-02-20 520258] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360] "LightScribe Control Panel"="c:\program files\Fichiers communs\LightScribe\LightScribeControlPanel.exe" [2007-08-23 455968] "DAEMON Tools Pro Agent"="c:\program files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 136136] "Steam"="d:\program files\Valve\Steam\Steam.exe" [2008-10-15 1410296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "AOLDialer"="c:\program files\Fichiers communs\AOL\ACS\AOLDial.exe" [2004-04-08 496752] "PCMService"="c:\program files\Home Cinema\PowerCinema\PCMService.exe" [2005-02-04 118926] "ISUSPM Startup"="c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-06-16 221184] "ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-08-09 81920] "WOOWATCH"="c:\progra~1\Wanadoo\Watch.exe" [2004-08-23 20480] "WOOTASKBARICON"="c:\progra~1\Wanadoo\GestMaj.exe" [2004-10-14 32768] "Adobe Photo Downloader"="f:\soirée pétanque\3.0\Apps\apdproxy.exe" [2005-06-23 57344] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "SMSTray"="c:\program files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-09-20 132624] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440] "AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576] "!AVG Anti-Spyware"="c:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-18 81000] "Dit"="Dit.exe" [2004-07-20 c:\windows\Dit.exe] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-19 c:\windows\system32\bthprops.cpl] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2006-07-16 626176] Logiciel Kodak EasyShare.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2007-06-21 282624] SpySubtract.lnk - c:\program files\interMute\SpySubtract\SpySub.exe [2007-03-18 1187840] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoBandCustomize"= 0 (0x0) "NoMovingBands"= 0 (0x0) "NoCloseDragDropBands"= 0 (0x0) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"= "c:\program files\interMute\SpySubtract\sshook.dll" [2007-03-18 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.I420"= i420vfw.dll "msacm.l3acm"= c:\windows\system32\l3codecp.acm "MSACM.CEGSM"= mobilev.acm "VIDC.FFDS"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll "vidc.DIV3"= DivXc32.dll "vidc.DIV4"= DivXc32f.dll "msacm.divxa32"= DivXa32.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "c:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe"= "c:\Program Files\Microsoft ActiveSync\wcescomm.exe"= "c:\Documents and Settings\waelkens\Bureau\yannicl\programme C C++\eMule0.49b\emule.exe"= "c:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe"= "c:\Program Files\adslTV\adsltv.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "6112:TCP"= 6112:TCP:Warcraft "4670:TCP"= 4670:TCP:emule port "4671:UDP"= 4671:UDP:emule portudp "3724:TCP"= 3724:TCP:BLIZZARD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2ac68d9a-f886-11da-a67e-001109df929d}] \Shell\AutoRun\command - L:\PreyStub.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5bd32168-dd23-11db-a8d2-001109df929d}] \Shell\AutoRun\command - K:\Autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{925fa382-1aac-11db-a6cd-001109df929d}] \Shell\AutoRun\command - M:\AutoRun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ca5651a3-8e67-11da-a58f-001109df929d}] \Shell\AutoRun\command - livebox.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "c:\program files\Fichiers communs\LightScribe\LSRunOnce.exe" . Contenu du dossier 'Tâches planifiées' 2008-11-25 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2008-11-21 c:\windows\Tasks\Maintenance en 1 clic.job - c:\program files\TuneUp Utilities 2006\SystemOptimizer.exe [2006-10-06 06:27] . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-27 11:49:18 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'winlogon.exe'(728) c:\windows\system32\Ati2evxx.dll c:\windows\system32 saenh.dll - - - - - - - > 'lsass.exe'(784) c:\windows\system32\msprivs.dll c:\windows\system32 saenh.dll . Heure de fin: 2008-11-27 11:51:17 ComboFix-quarantined-files.txt 2008-11-27 10:50:48 ComboFix2.txt 2008-11-26 15:36:12 ComboFix3.txt 2008-11-23 11:35:08 Avant-CF: 7 676 477 440 octets libres Après-CF: 7,653,351,424 octets libres 294 --- E O F --- 2008-11-14 21:24:20 ----------------------------------------------------------------------------------------------------------------------------- Et celui de HijackThis : Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:57:03, on 27/11/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Dit.exe C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe C:\Program Files\Home Cinema\PowerCinema\PCMService.exe C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe C:\PROGRA~1\Wanadoo\TaskBarIcon.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\SteamKeyFr\SteamKeyFr.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe C:\Program Files\DAEMON Tools Pro\DTProAgent.exe C:\WINDOWS\system32\agrsmsvc.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\interMute\SpySubtract\SpySub.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe C:\WINDOWS\System32\FTRTSVC.exe C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32 otepad.exe C:\WINDOWS\explorer.exe D:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar oolbar.dll O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [Dit] Dit.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe" O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "F:\Soirée pétanque\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - HKCU\..\Run: [SteamKeyFr] "C:\Program Files\SteamKeyFr\SteamKeyFr.exe" O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" O4 - HKCU\..\Run: [TrueDownloaderAutoStart] C:\Program Files\TrueDownloader\TrueDownloader.exe /silent O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe -hidden O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" O4 - HKCU\..\Run: [Steam] "D:\Program Files\Valve\Steam\Steam.exe" -silent O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe O8 - Extra context menu item: &Download with TrueDownloader! - C:\Program Files\TrueDownloader\TrueDownloader.htm O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar oolbar.dll/SEARCH.HTML O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU) O12 - Plugin for .mu3: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll O12 - Plugin for .mus: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll O12 - Plugin for .mut: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll O12 - Plugin for .myr: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll O12 - Plugin for .xmz: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll O14 - IERESET.INF: START_PAGE_URL=https://www.aldi.com/ O15 - Trusted Zone: http://www.secuser.com O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1106243543703 O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {8FEFF364-6A5F-4966-A917-A3AC28411659} - http://phpadsnew.merco6.com/libraries/SOPCORE.CAB O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab O16 - DPF: {FD40EC41-D860-4579-8BA4-52671A45C71C} (AxHtChat Class) - http://images.goa.com/it/Woo2/fr/chat/nPaxChat.cab O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Lyonnais92 · Answer

Bonjour,

relance Toolbar S&D avec l'option 1 et regarde si, dans le rapport, tu as encore ces lignes :


--------------------\ ROOTKIT !! 

Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV] 
Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TDSSserv] 


Ne poste pas le rapport.

Donne moi simplement l'information oui ou non.

CaptainZack · Answer

Re, 

Oui, ces deux lignes apparaissent encore sur le rapport.

Lyonnais92 · Answer

Re,

1) Imprime ces instructions car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.

2) Télécharge Malwarebytes' Anti-Malware (MBAM) et enregistre le sur ton Bureau à partir de ce lien :

https://download.cnet.com/Malwarebytes/3000-8022_4-10804572.html

3) A la fin du téléchargement, ferme toutes les fenêtres et programmes, y compris celui-ci.

4) Double-clique sur l'icône Download_mbam-setup.exe sur ton bureau pour démarrer le programme d'installation.

5) Pendant l'installation, suis les indications (en particulier le choix de la langue et l'autorisation d'accession à Internet). N'apporte aucune modification aux réglages par défaut et, en fin d'installation, vérifie que les options Update Malwarebytes' Anti-Malware et Launch Malwarebytes' Anti-Malware sont cochées.

6) MBAM démarrera automatiquement et enverra un message demandant à mettre à jour le programme avant de lancer une analyse. Comme MBAM se met automatiquement à jour en fin d'installation, clique sur OK pour fermer la boîte de dialogue. La fenêtre principale de MBAM s'affiche :

7) Dans l'onglet analyse, vérifie que "Exécuter un examen rapide"  est coché et clique sur le bouton Rechercher pour démarrer l'analyse.

8) MBAM analyse ton ordinateur. L'analyse peut prendre un certain temps. Il suffit de vérifier de temps en temps son avancement.

9) A la fin de l'analyse, un message s'affiche indiquant la fin de l'analyse. Clique sur OK pour poursuivre.

10) Si des malwares ont été détectés, leur liste s'affiche.
En cliquant sur Suppression (?) , MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.

11) MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Ferme le Bloc-notes. (Le rapport peut être retrouvé sous l'onglet Rapports/logs)

12) Ferme MBAM en cliquant sur Quitter.

13) Poste le rapport dans ta réponse

CaptainZack · Answer

Re,

Le scan c'est passer sans probléme voici le rapport :

Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1428
Windows 5.1.2600 Service Pack 2

27/11/2008 13:33:47
mbam-log-2008-11-27 (13-33-47).txt

Type de recherche: Examen rapide
Eléments examinés: 55862
Temps écoulé: 4 minute(s), 28 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 11

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Documents and Settings\Administrateur\results.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\NetworkService\Cookies\MM2048.DAT (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\NetworkService\Cookies\MM256.DAT (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\NetworkService\Cookies\bumo.reg (Fake.Dropped.Malware) -> Delete on reboot.
C:\Documents and Settings\NetworkService\Cookies\jababug.inf (Fake.Dropped.Malware) -> Delete on reboot.
C:\Documents and Settings\NetworkService\Cookies\uwux.exe (Fake.Dropped.Malware) -> Delete on reboot.
C:\Documents and Settings\NetworkService\Cookies\jiceji._sy (Fake.Dropped.Malware) -> Delete on reboot.
C:\Documents and Settings\NetworkService\Cookies\esycire._dl (Fake.Dropped.Malware) -> Delete on reboot.
C:\Documents and Settings\waelkens\results.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\Default User\results.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\NetworkService\Cookies\syssp.exe (Fake.Dropped.Malware) -> Delete on reboot.






Maintenant je reboot le PC, à tout de suite.

Lyonnais92 · Answer

Re,

Télécharge OAD http://sosvirus.changelog.fr/OAD.exe
- Enregistre le sur ton Bureau

Double clique sur le OAD pour le lancer

- nom de fichier à rechercher tape ou fais un copier coller de : TDSSserv
- Type de recherche : sélectionne l'option 6 puis valide [entree]

OAD va maintenant rechercher le fichier. Laisse le travailler jusqu'à ce qu'il en ai terminé.
Le rapport de recherche s'affichera automatiquement à dès qu'il en aura terminé.

- Fais un copier / coller de ce rapport dans ton prochain post.

Note importante : Suivant la taille des disques dur cette recherche peut prendre plusieurs minutes. Sois patient(e)

CaptainZack · Answer

Re,


 27/11/2008 ---- 16:42:14,12  

----------------------------------
§§§§§§ [TDSSserv] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\TDSSserv.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\TDSSserv.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV\0000]
"Service"="TDSSserv"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV\0000]
"DeviceDesc"="TDSSserv"

*******************
     [Fichier] 
*******************



*********************
     [Même date] 
*********************

Aucun fichier créé à la même date détecté


Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------

Lyonnais92 · Answer

Re,

Copie ou imprime les instructions avant

Déconnecte toi d'internet et ferme toutes tes applications.

Désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)


Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

 
 
Registry::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Mi­nimal\TDSSserv.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Ne­twork\TDSSserv.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TD­SSSERV]


Enregistre ce fichier sous le nom CFscript


Fait un glisser/déposer de ce fichier CFscript sur le fichier ComboFix.exe

Clique sur le fichier CFscript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFscrïpt vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Réactive ton parefeu, ton antivirus, la garde de ton antispyware

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Remets aussi un rapport Hijackthis


Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

Attention : cette manip a été fait pour cet ordi. Tout réutilisation peut endommager sévèrement le système d'exploitation.

CaptainZack · Answer

Bonjour, Rapport ComboFix : ComboFix 08-11-22.02 - waelkens 2008-11-28 13:22:01.4 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.562 [GMT 1:00] Lancé depuis: d:\iso\ComboFix.exe Commutateurs utilisés :: c:\documents and settings\waelkens\Bureau\CFscript * Un nouveau point de restauration a été créé . ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-28 au 2008-11-28 )))))))))))))))))))))))))))))))))))) . 2008-11-27 13:27 . 2008-11-27 13:27 d-------- c:\documents and settings\waelkens\Application Data\Malwarebytes 2008-11-27 13:27 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2008-11-27 13:26 . 2008-11-27 13:27 d-------- c:\program files\Malwarebytes' Anti-Malware 2008-11-27 13:26 . 2008-11-27 13:26 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2008-11-27 13:26 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2008-11-25 10:43 . 2008-11-25 10:44 d-------- c:\program files\RogueRemover FREE 2008-11-25 10:40 . 2008-11-25 10:42 d-------- C:\RogueRemover 2008-11-23 22:41 . 2008-11-27 12:57 d-------- C:\ToolBar SD 2008-11-23 19:14 . 2008-11-23 19:14 d-------- c:\documents and settings\waelkens\Application Data\Grisoft 2008-11-23 19:12 . 2008-11-23 19:12 d-------- c:\documents and settings\All Users\Application Data\Grisoft 2008-11-23 19:12 . 2007-05-30 13:10 10,872 --a------ c:\windows\system32\drivers\AvgAsCln.sys 2008-11-23 14:24 . 2008-11-23 23:06 d-------- C:\Lop SD 2008-11-22 19:33 . 2008-11-23 11:49 3,820 --a------ c:\windows\system32 mp.reg 2008-11-22 19:32 . 2008-11-22 19:34 d-------- c:\documents and settings\waelkens\SmitfraudFix 2008-11-22 19:32 . 2007-09-05 23:22 289,144 --a------ c:\windows\system32\VCCLSID.exe 2008-11-22 19:32 . 2006-04-27 16:49 288,417 --a------ c:\windows\system32\SrchSTS.exe 2008-11-22 19:32 . 2008-10-01 14:51 87,552 --a------ c:\windows\system32\VACFix.exe 2008-11-22 19:32 . 2008-10-10 07:58 82,944 --a------ c:\windows\system32\o4Patch.exe 2008-11-22 19:32 . 2008-05-18 20:40 82,944 --a------ c:\windows\system32\IEDFix.exe 2008-11-22 19:32 . 2008-10-10 07:58 82,944 --a------ c:\windows\system32\IEDFix.C.exe 2008-11-22 19:32 . 2008-08-18 11:19 82,432 --a------ c:\windows\system32\404Fix.exe 2008-11-22 19:32 . 2003-06-05 20:13 53,248 --a------ c:\windows\system32\Process.exe 2008-11-22 19:32 . 2004-07-31 17:50 51,200 --a------ c:\windows\system32\dumphive.exe 2008-11-22 19:32 . 2007-10-03 23:36 25,600 --a------ c:\windows\system32\WS2Fix.exe 2008-11-22 17:11 . 2008-11-22 17:11 d-------- C: sit 2008-11-22 16:56 . 2008-11-22 17:04 d-------- c:\program files\Navilog1 2008-11-22 03:26 . 2008-11-22 03:26 d-------- c:\documents and settings\All Users\Application Data\Blizzard 2008-11-21 17:42 . 2008-11-21 17:42 d-------- C:\Logs 2008-11-20 09:56 . 2008-11-20 09:56 d-------- c:\program files\Lavasoft 2008-11-20 09:56 . 2008-11-20 09:57 d-------- c:\documents and settings\All Users\Application Data\Lavasoft 2008-11-16 20:56 . 2008-11-25 21:35 d-------- c:\program files\adslTV 2008-11-16 20:56 . 2008-11-16 20:56 d-------- c:\documents and settings\waelkens\Application Data\vlc 2008-11-15 18:27 . 2008-11-15 18:27 d-------- c:\documents and settings\All Users\Application Data\2DBoy 2008-11-14 22:24 . 2008-11-14 22:24 118 --a------ c:\windows\system32\MRT.INI 2008-11-13 17:46 . 2008-11-13 17:46 d-------- c:\documents and settings\waelkens\OngameNetwork 2008-11-11 08:36 . 2008-11-11 08:36 d-------- C:\Medion 2008-11-02 08:25 . 2008-11-02 08:25 2,425 --ah----- C:\mxfilerelatedcache.mxc2 2008-11-02 08:25 . 2008-11-02 08:25 1,520 --a------ C:\yannickk_1.avd . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-28 12:21 46,312 ----a-w c:\documents and settings\waelkens\Application Data\wklnhst.dat 2008-11-28 12:18 --------- d-----w c:\documents and settings\waelkens\Application Data\Skype 2008-11-28 12:17 --------- d-----w c:\program files\Wanadoo 2008-11-27 22:53 17,408 ----a-w c:\windows\system32\drivers\USBCRFT.SYS 2008-11-27 11:08 5,632 -csha-w c:\program files\Thumbs.db 2008-11-23 18:14 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard 2008-11-21 10:39 --------- d-----w c:\program files\Fichiers communs\Blizzard Entertainment 2008-11-21 10:11 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-20 14:18 --------- d-----w c:\documents and settings\waelkens\Application Data\Orbit 2008-11-20 08:51 --------- d-----w c:\documents and settings\waelkens\Application Data\Lavasoft 2008-11-14 22:20 --------- d-----w c:\program files\DivX 2008-11-07 21:22 --------- d-----w c:\program files\Mozilla Thunderbird 2008-11-05 18:00 --------- d-----w c:\documents and settings\waelkens\Application Data\uTorrent 2008-11-05 11:23 98,304 ----a-w c:\windows\system32\CmdLineExt.dll 2008-10-29 12:41 --------- d-----w c:\program files\RomStation 2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-21 13:16 --------- d-----w c:\program files\Morgan 2008-10-18 12:22 209,636 ----a-w c:\windows\IPUI_DivXG400.exe 2008-10-18 12:20 --------- d-----w c:\program files\Rippackv3 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll 2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll 2008-10-16 12:51 --------- d-----w c:\documents and settings\waelkens\Application Data\FileZilla 2008-10-16 10:52 --------- d-----w c:\documents and settings\waelkens\Application Data\Apple Computer 2008-10-15 17:08 --------- d-----w c:\program files\DaemonTools_WhenUSave_Installer 2008-10-15 17:07 --------- d-----w c:\program files\Kodak 2008-10-15 16:40 --------- d-----w c:\program files\eRightSoft 2008-10-15 15:49 --------- d-----w c:\program files\BitComet 2008-10-15 09:49 --------- d-----w c:\program files\iTunes 2008-10-15 09:49 --------- d-----w c:\program files\iPod 2008-10-15 09:49 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-10-15 09:48 --------- d-----w c:\program files\Bonjour 2008-10-15 09:47 --------- d-----w c:\program files\QuickTime 2008-10-15 09:46 --------- d-----w c:\program files\Fichiers communs\Apple 2008-10-15 09:44 --------- d-----w c:\program files\Apple Software Update 2008-10-02 14:49 --------- d-----w c:\program files\Warcraft III 2008-10-01 11:01 32,000 ----a-w c:\windows\system32\drivers\usbaapl.sys 2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll 2008-09-30 14:30 98,304 ----a-w c:\windows\DUMPc8fd.tmp 2008-09-30 14:28 98,304 ----a-w c:\windows\DUMP3718.tmp 2008-09-28 06:41 --------- d-----w c:\program files\Combined Community Codec Pack 2008-09-19 21:55 200,704 -c--a-w c:\windows\system32\ssldivx.dll 2008-09-19 21:55 1,044,480 -c--a-w c:\windows\system32\libdivx.dll 2008-09-15 15:39 1,846,144 ----a-w c:\windows\system32\win32k.sys 2008-09-04 16:45 1,106,944 ----a-w c:\windows\system32\msxml3.dll 2008-08-29 19:06 1,350,664 ----a-w c:\windows\system32\msxml6.dll 2008-08-29 08:18 87,336 ----a-w c:\windows\system32\dns-sd.exe 2008-08-29 07:53 61,440 ----a-w c:\windows\system32\dnssd.dll 2008-06-09 08:26 85,944 -c--a-w c:\documents and settings\waelkens\Application Data\GDIPFONTCACHEV1.DAT 2007-11-18 14:15 47,360 -c--a-w c:\documents and settings\waelkens\Application Data\pcouffin.sys 2007-05-21 11:11 47 -c--a-w c:\documents and settings\waelkens\fixsize.cmd 2007-04-04 20:30 95,232 -c--a-w c:\documents and settings\waelkens\filechop.exe 2007-03-08 23:10 18,690 -c--a-w c:\documents and settings\waelkens\make-multi.exe 2007-02-25 12:00 1 -c--a-w c:\documents and settings\waelkens\SI.bin 2006-07-28 08:30 88,102 -c--a-w c:\program files\Aug2006_xinput_x64.cab 2006-07-28 08:30 47,018 -c--a-w c:\program files\Aug2006_xinput_x86.cab 2006-07-28 08:30 41,995 -c--a-w c:\program files\dxdllreg_x86.cab 2006-07-28 08:30 183,863 -c--a-w c:\program files\Aug2006_XACT_x64.cab 2006-07-28 08:30 138,195 -c--a-w c:\program files\Aug2006_XACT_x86.cab 2006-07-28 07:32 82,338 -c--a-w c:\program files\dxupdate.cab 2006-07-28 07:32 2,248,984 -c--a-w c:\program files\dsetup32.dll 2006-07-28 07:31 484,632 -c--a-w c:\program files\DXSETUP.exe 2006-07-28 07:30 74,520 -c--a-w c:\program files\DSETUP.dll 2006-06-05 23:07 31 -c----w c:\documents and settings\waelkens\getfile.dat 2006-05-31 05:39 181,745 -c----w c:\program files\JUN2006_XACT_x64.cab 2006-05-31 05:39 134,631 -c----w c:\program files\JUN2006_XACT_x86.cab 2006-03-31 11:56 917,318 -c----w c:\program files\Apr2006_MDX1_x86.cab 2006-03-31 11:56 87,989 -c----w c:\program files\Apr2006_xinput_x64.cab 2006-03-31 11:56 46,898 -c----w c:\program files\Apr2006_xinput_x86.cab 2006-03-31 11:56 4,163,518 -c----w c:\program files\Apr2006_MDX1_x86_Archive.cab 2006-03-31 11:56 180,021 -c----w c:\program files\Apr2006_XACT_x64.cab 2006-03-31 11:56 133,991 -c----w c:\program files\Apr2006_XACT_x86.cab 2006-03-31 11:56 1,398,718 -c----w c:\program files\Apr2006_d3dx9_30_x64.cab 2006-03-31 11:56 1,116,109 -c----w c:\program files\Apr2006_d3dx9_30_x86.cab 2006-02-16 13:05 278,528 -c--a-w c:\program files\Fichiers communs\FDEUnInstaller.exe 2006-02-03 08:00 179,247 -c----w c:\program files\Feb2006_XACT_x64.cab 2006-02-03 08:00 133,297 -c----w c:\program files\Feb2006_XACT_x86.cab 2006-02-03 08:00 1,363,684 -c----w c:\program files\Feb2006_d3dx9_29_x64.cab 2006-02-03 08:00 1,085,608 -c----w c:\program files\Feb2006_d3dx9_29_x86.cab 2005-12-05 17:31 86,925 -c----w c:\program files\Oct2005_xinput_x64.cab 2005-12-05 17:31 46,247 -c----w c:\program files\Oct2005_xinput_x86.cab 2005-12-05 17:31 1,358,864 -c----w c:\program files\Dec2005_d3dx9_28_x64.cab 2005-12-05 17:31 1,080,344 -c----w c:\program files\Dec2005_d3dx9_28_x86.cab 2005-10-26 11:48 40,448 -c--a-w c:\documents and settings\waelkens rial_setup.exe 2005-07-22 18:14 1,351,430 -c----w c:\program files\Aug2005_d3dx9_27_x64.cab 2005-07-22 18:14 1,078,532 -c----w c:\program files\Aug2005_d3dx9_27_x86.cab 2005-05-26 13:49 1,336,890 -c----w c:\program files\Jun2005_d3dx9_26_x64.cab 2005-05-26 13:49 1,065,813 -c----w c:\program files\Jun2005_d3dx9_26_x86.cab 2005-03-18 16:40 1,348,242 -c----w c:\program files\Apr2005_d3dx9_25_x64.cab 2005-03-18 16:40 1,079,850 -c----w c:\program files\Apr2005_d3dx9_25_x86.cab 2005-02-05 19:03 1,248,387 -c----w c:\program files\Feb2005_d3dx9_24_x64.cab 2005-02-05 19:03 1,014,113 -c----w c:\program files\Feb2005_d3dx9_24_x86.cab 2004-09-27 10:29 976,020 -c----w c:\program files\BDAXP.cab 2005-01-25 16:24 8 -csh--r c:\windows\system32\F2A38CDCBF.sys 2006-05-03 09:06 163,328 --sh--r c:\windows\system32\flvDX.dll 2005-01-25 16:24 5,744 -csha-w c:\windows\system32\KGyGaAvL.sys 2007-02-21 10:47 31,232 --sh--r c:\windows\system32\msfDX.dll 2008-03-16 12:30 216,064 --sh--r c:\windows\system32 bDX.dll . ((((((((((((((((((((((((((((( snapshot@2008-11-23_12.33.44,79 ))))))))))))))))))))))))))))))))))))))))) . + 2005-10-20 19:02:28 163,328 ----a-w c:\windows\ERDNT\subs\ERDNT.EXE - 2008-07-19 14:43:08 1,163,960 ----a-w c:\windows\system32\aswBoot.exe + 2008-11-18 17:41:38 1,233,112 ----a-w c:\windows\system32\aswBoot.exe - 2008-07-19 14:30:53 94,392 ----a-w c:\windows\system32\AVASTSS.scr + 2008-11-18 17:35:22 97,480 ----a-w c:\windows\system32\AvastSS.scr - 2008-07-19 14:32:15 26,944 ----a-w c:\windows\system32\drivers\aavmker4.sys + 2008-11-18 18:00:11 26,944 ----a-w c:\windows\system32\drivers\aavmker4.sys - 2008-07-19 14:37:42 20,560 ----a-w c:\windows\system32\drivers\aswFsBlk.sys + 2008-11-18 18:02:43 20,560 ----a-w c:\windows\system32\drivers\aswFsBlk.sys - 2008-01-17 16:34:01 93,264 ----a-w c:\windows\system32\drivers\aswmon.sys + 2008-11-18 18:04:36 93,296 ----a-w c:\windows\system32\drivers\aswmon.sys - 2008-07-19 14:37:21 94,416 ----a-w c:\windows\system32\drivers\aswmon2.sys + 2008-11-18 18:04:21 94,032 ----a-w c:\windows\system32\drivers\aswmon2.sys - 2008-07-19 14:33:42 23,152 ----a-w c:\windows\system32\drivers\aswRdr.sys + 2008-11-18 18:01:09 23,152 ----a-w c:\windows\system32\drivers\aswRdr.sys - 2008-07-19 14:35:18 78,416 ----a-w c:\windows\system32\drivers\aswSP.sys + 2008-11-18 18:03:33 110,160 ----a-w c:\windows\system32\drivers\aswSP.sys - 2008-07-19 14:32:36 42,912 ----a-w c:\windows\system32\drivers\aswTdi.sys + 2008-11-18 18:01:23 50,864 ----a-w c:\windows\system32\drivers\aswTdi.sys + 2008-11-27 12:38:17 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_704.dat + 2008-11-27 12:39:40 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_f20.dat . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2004-12-09 1937408] "SteamKeyFr"="c:\program files\SteamKeyFr\SteamKeyFr.exe" [2004-01-28 212992] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2007-01-12 25367592] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-25 68856] "WOOKIT"="c:\progra~1\Wanadoo\Shell.exe" [2004-08-23 122880] "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\WCESCOMM.EXE" [2004-02-24 401491] "TrueDownloaderAutoStart"="c:\program files\TrueDownloader\TrueDownloader.exe" [2005-02-20 520258] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360] "LightScribe Control Panel"="c:\program files\Fichiers communs\LightScribe\LightScribeControlPanel.exe" [2007-08-23 455968] "DAEMON Tools Pro Agent"="c:\program files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 136136] "Steam"="d:\program files\Valve\Steam\Steam.exe" [2008-10-15 1410296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "AOLDialer"="c:\program files\Fichiers communs\AOL\ACS\AOLDial.exe" [2004-04-08 496752] "PCMService"="c:\program files\Home Cinema\PowerCinema\PCMService.exe" [2005-02-04 118926] "ISUSPM Startup"="c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-06-16 221184] "ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-08-09 81920] "WOOWATCH"="c:\progra~1\Wanadoo\Watch.exe" [2004-08-23 20480] "WOOTASKBARICON"="c:\progra~1\Wanadoo\GestMaj.exe" [2004-10-14 32768] "Adobe Photo Downloader"="f:\soirée pétanque\3.0\Apps\apdproxy.exe" [2005-06-23 57344] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "SMSTray"="c:\program files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-09-20 132624] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440] "AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576] "!AVG Anti-Spyware"="c:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-18 81000] "Dit"="Dit.exe" [2004-07-20 c:\windows\Dit.exe] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-19 c:\windows\system32\bthprops.cpl] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2006-07-16 626176] Logiciel Kodak EasyShare.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2007-06-21 282624] SpySubtract.lnk - c:\program files\interMute\SpySubtract\SpySub.exe [2007-03-18 1187840] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoBandCustomize"= 0 (0x0) "NoMovingBands"= 0 (0x0) "NoCloseDragDropBands"= 0 (0x0) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"= "c:\program files\interMute\SpySubtract\sshook.dll" [2007-03-18 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.I420"= i420vfw.dll "msacm.l3acm"= c:\windows\system32\l3codecp.acm "MSACM.CEGSM"= mobilev.acm "VIDC.FFDS"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll "vidc.DIV3"= DivXc32.dll "vidc.DIV4"= DivXc32f.dll "msacm.divxa32"= DivXa32.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "c:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe"= "c:\Program Files\Microsoft ActiveSync\wcescomm.exe"= "c:\Documents and Settings\waelkens\Bureau\yannicl\programme C C++\eMule0.49b\emule.exe"= "c:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe"= "c:\Program Files\adslTV\adsltv.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "6112:TCP"= 6112:TCP:Warcraft "4670:TCP"= 4670:TCP:emule port "4671:UDP"= 4671:UDP:emule portudp "3724:TCP"= 3724:TCP:BLIZZARD R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-26 110160] R1 cpuidlep;CpuIdle Pro System Driver;c:\windows\system32\drivers\cpuidlep.sys [2008-05-01 4484] R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-26 20560] R2 UxTuneUp;Extension de conception TuneUp;c:\windows\System32\svchost.exe -k netsvcs [2005-01-20 14336] R3 3xHybrid;3xHybrid service;c:\windows\system32\DRIVERS\3xHybrid.sys [2005-02-05 802048] R3 cmudax;C-Media High Definition Audio Interface;c:\windows\system32\drivers\cmudax.sys [2005-01-20 1272000] R3 wbscr;Winbond Smartcard Reader for I/O;c:\windows\system32\drivers\wbscr.sys [2005-01-20 19928] S2 FILESpy;FILESpy;\??\c:\program files\Softwin\BitDefender9\filespy.sys [] S3 AIDA32Driver;AIDA32Driver;\??\c:\program files\AIDA32 - Personal System Information\aida32.sys [2004-02-23 3584] S3 CardReaderFilter;Card Reader Filter;\??\c:\windows\system32\Drivers\USBCRFT.SYS [2005-01-20 17408] S3 M1000Srv;M5603C USB2.0 Camera Driver;c:\windows\system32\Drivers\M1000KNT.sys [2007-01-10 274567] S3 PPJoyBus;Parallel Port Joystick Bus device driver;c:\windows\system32\drivers\PPJoyBus.sys [2004-01-23 13952] S3 PPortJoystick;Parallel Port Joystick device driver;c:\windows\system32\drivers\PPortJoy.sys [2004-01-23 28800] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2ac68d9a-f886-11da-a67e-001109df929d}] \Shell\AutoRun\command - L:\PreyStub.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5bd32168-dd23-11db-a8d2-001109df929d}] \Shell\AutoRun\command - K:\Autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{925fa382-1aac-11db-a6cd-001109df929d}] \Shell\AutoRun\command - M:\AutoRun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ca5651a3-8e67-11da-a58f-001109df929d}] \Shell\AutoRun\command - livebox.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "c:\program files\Fichiers communs\LightScribe\LSRunOnce.exe" . Contenu du dossier 'Tâches planifiées' 2008-11-25 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2008-11-21 c:\windows\Tasks\Maintenance en 1 clic.job - c:\program files\TuneUp Utilities 2006\SystemOptimizer.exe [2006-10-06 06:27] . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-28 13:28:28 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'winlogon.exe'(756) c:\windows\system32\Ati2evxx.dll c:\windows\system32 saenh.dll - - - - - - - > 'lsass.exe'(812) c:\windows\system32\msprivs.dll c:\windows\system32 saenh.dll . Heure de fin: 2008-11-28 13:30:07 ComboFix-quarantined-files.txt 2008-11-28 12:29:33 ComboFix2.txt 2008-11-27 10:51:19 ComboFix3.txt 2008-11-26 15:36:12 ComboFix4.txt 2008-11-23 11:35:08 Avant-CF: 6 770 520 064 octets libres Après-CF: 6,771,019,776 octets libres 307 --- E O F --- 2008-11-28 12:22:07 et l'autre rapport de HijackThis : Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:42:13, on 28/11/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Dit.exe C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe C:\Program Files\Home Cinema\PowerCinema\PCMService.exe C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe C:\PROGRA~1\Wanadoo\TaskBarIcon.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\WINDOWS\system32 undll32.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\iTunes\iTunesHelper.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe C:\WINDOWS\system32\agrsmsvc.exe C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe C:\WINDOWS\System32\FTRTSVC.exe C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\WINDOWS\explorer.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Wanadoo\GestionnaireInternet.exe C:\Program Files\Wanadoo\ComComp.exe C:\PROGRA~1\Wanadoo\Toaster.exe C:\PROGRA~1\Wanadoo\Inactivity.exe C:\PROGRA~1\Wanadoo\PollingModule.exe C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE C:\Program Files\Wanadoo\Watch.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe D:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar oolbar.dll O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [Dit] Dit.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe" O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "F:\Soirée pétanque\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - HKCU\..\Run: [SteamKeyFr] "C:\Program Files\SteamKeyFr\SteamKeyFr.exe" O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" O4 - HKCU\..\Run: [TrueDownloaderAutoStart] C:\Program Files\TrueDownloader\TrueDownloader.exe /silent O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe -hidden O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" O4 - HKCU\..\Run: [Steam] "D:\Program Files\Valve\Steam\Steam.exe" -silent O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe O8 - Extra context menu item: &Download with TrueDownloader! - C:\Program Files\TrueDownloader\TrueDownloader.htm O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar oolbar.dll/SEARCH.HTML O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU) O12 - Plugin for .mu3: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll O12 - Plugin for .mus: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll O12 - Plugin for .mut: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll O12 - Plugin for .myr: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll O12 - Plugin for .xmz: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll O14 - IERESET.INF: START_PAGE_URL=https://www.aldi.com/ O15 - Trusted Zone: http://www.secuser.com O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1106243543703 O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {8FEFF364-6A5F-4966-A917-A3AC28411659} - http://phpadsnew.merco6.com/libraries/SOPCORE.CAB O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab O16 - DPF: {FD40EC41-D860-4579-8BA4-52671A45C71C} (AxHtChat Class) - http://images.goa.com/it/Woo2/fr/chat/nPaxChat.cab O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Lyonnais92 · Answer

Re,

Démarrer, exécuter, tu tapes combofix /u dans la fenêtre et OK.

télécharge combofix (par sUBs) ici :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

et enregistre le sur le Bureau. et pas ailleurs

déconnecte toi d'internet et ferme toutes tes applications.

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)


Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :
 

Registry::
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Mi­nimal\TDSSserv.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Ne­twork\TDSSserv.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TD­SSSERV]

Enregistre ce fichier sous le nom CFscript


Fait un glisser/déposer de ce fichier CFscript sur le fichier ComboFix.exe

Clique sur le fichier CFscript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFscrïpt vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.
 

Réactive ton parefeu, ton antivirus, la garde de ton antispyware

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Remets aussi un rapport Hijackthis


Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

Attention : cette manip a été fait pour cet ordi. Tout réutilisation peut endommager sévèrement le système d'exploitation.

réactive ton parefeu, ton antivirus, la garde de ton antispyware

copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

Tu as un tutoriel complet ici :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

CaptainZack · Answer

Bonjour,

désolée pour le temps de réponse, Voici le scan de HijackThis :


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:50:41, on 30/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Dit.exe
C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
C:\Program Files\Home Cinema\PowerCinema\PCMService.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\SteamKeyFr\SteamKeyFr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\agrsmsvc.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32
otepad.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Wanadoo\GestionnaireInternet.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\Program Files\Wanadoo\Watch.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar	oolbar.dll
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "F:\Soirée pétanque\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [SteamKeyFr] "C:\Program Files\SteamKeyFr\SteamKeyFr.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [TrueDownloaderAutoStart] C:\Program Files\TrueDownloader\TrueDownloader.exe /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [Steam] "D:\Program Files\Valve\Steam\Steam.exe" -silent
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: &Download with TrueDownloader! - C:\Program Files\TrueDownloader\TrueDownloader.htm
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTML
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O12 - Plugin for .mu3: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O12 - Plugin for .mus: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O12 - Plugin for .mut: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O12 - Plugin for .myr: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O12 - Plugin for .xmz: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O14 - IERESET.INF: START_PAGE_URL=https://www.aldi.com/
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1106243543703
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {8FEFF364-6A5F-4966-A917-A3AC28411659} - http://phpadsnew.merco6.com/libraries/SOPCORE.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O16 - DPF: {FD40EC41-D860-4579-8BA4-52671A45C71C} (AxHtChat Class) - http://images.goa.com/it/Woo2/fr/chat/nPaxChat.cab
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Lyonnais92 · Answer

Re,

Double clique sur OAD (sur ton Bureau) pour le lancer

- nom de fichier à rechercher tape ou fais un copier coller de :

TDSSserv


- Type de recherche : sélectionne l'option 6 puis valide [entree]

OAD va maintenant rechercher le fichier. Laisse le travailler jusqu'à ce qu'il en ai terminé.
Le rapport de recherche s'affichera automatiquement à dès qu'il en aura terminé.

- Fais un copier / coller de ce rapport dans ton prochain post.

CaptainZack · Answer

Bonjour,

 01/12/2008 ---- 17:28:10,50  

----------------------------------
§§§§§§ [TDSSserv] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\TDSSserv.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\TDSSserv.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV\0000]
"Service"="TDSSserv"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV\0000]
"DeviceDesc"="TDSSserv"

*******************
     [Fichier] 
*******************



*********************
     [Même date] 
*********************

Aucun fichier créé à la même date détecté


Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------





Encore merci pour ton aide et ta patience .

Lyonnais92 · Answer

Re,

fais ceci :

Démarrer, Exécuter, cope

 combofix /u

dans le cadre puis clique sur OK.

Ensuite :

supprime (si il existe Combofix.exe sur ton Bureau ainsi que le répertoire Qoobox à la racine du disque, en général C:\Qoobox).

télécharge combofix (par sUBs) ici :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

et enregistre le sur le Bureau.

déconnecte toi d'internet et ferme toutes tes applications.

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)


double-clique sur combofix.exe et suis les instructions

en particulier installe la Console de récupération.

à la fin, il va produire un rapport C:\ComboFix.txt

réactive ton parefeu, ton antivirus, la garde de ton antispyware

copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

Tu as un tutoriel complet ici :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

CaptainZack · Answer

Re , VOici le rapport : ComboFix 08-12-01.01 - waelkens 2008-12-02 14:09:42.6 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.575 [GMT 1:00] Lancé depuis: c:\documents and settings\waelkens\Bureau\ComboFix.exe * Un nouveau point de restauration a été créé . ((((((((((((((((((((((((((((( Fichiers créés du 2008-11-02 au 2008-12-02 )))))))))))))))))))))))))))))))))))) . 2008-11-28 16:40 . 2008-11-28 16:50 139,264 --a------ c:\windows\War3Unin.exe 2008-11-28 16:40 . 2008-11-28 17:02 81,377 --a------ c:\windows\War3Unin.dat 2008-11-28 16:40 . 2008-11-28 16:50 2,829 --a------ c:\windows\War3Unin.pif 2008-11-27 13:27 . 2008-11-27 13:27 d-------- c:\documents and settings\waelkens\Application Data\Malwarebytes 2008-11-27 13:27 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2008-11-27 13:26 . 2008-11-27 13:27 d-------- c:\program files\Malwarebytes' Anti-Malware 2008-11-27 13:26 . 2008-11-27 13:26 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2008-11-27 13:26 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2008-11-25 10:43 . 2008-11-25 10:44 d-------- c:\program files\RogueRemover FREE 2008-11-25 10:40 . 2008-11-25 10:42 d-------- C:\RogueRemover 2008-11-23 22:41 . 2008-11-27 12:57 d-------- C:\ToolBar SD 2008-11-23 19:14 . 2008-11-23 19:14 d-------- c:\documents and settings\waelkens\Application Data\Grisoft 2008-11-23 19:12 . 2008-11-23 19:12 d-------- c:\documents and settings\All Users\Application Data\Grisoft 2008-11-23 19:12 . 2007-05-30 13:10 10,872 --a------ c:\windows\system32\drivers\AvgAsCln.sys 2008-11-23 14:24 . 2008-11-23 23:06 d-------- C:\Lop SD 2008-11-22 19:33 . 2008-11-23 11:49 3,820 --a------ c:\windows\system32 mp.reg 2008-11-22 19:32 . 2008-11-22 19:34 d-------- c:\documents and settings\waelkens\SmitfraudFix 2008-11-22 19:32 . 2007-09-05 23:22 289,144 --a------ c:\windows\system32\VCCLSID.exe 2008-11-22 19:32 . 2006-04-27 16:49 288,417 --a------ c:\windows\system32\SrchSTS.exe 2008-11-22 19:32 . 2008-05-18 20:40 82,944 --a------ c:\windows\system32\IEDFix.exe 2008-11-22 19:32 . 2003-06-05 20:13 53,248 --a------ c:\windows\system32\Process.exe 2008-11-22 19:32 . 2004-07-31 17:50 51,200 --a------ c:\windows\system32\dumphive.exe 2008-11-22 19:32 . 2007-10-03 23:36 25,600 --a------ c:\windows\system32\WS2Fix.exe 2008-11-22 17:11 . 2008-11-22 17:11 d-------- C: sit 2008-11-22 16:56 . 2008-11-22 17:04 d-------- c:\program files\Navilog1 2008-11-22 03:26 . 2008-11-22 03:26 d-------- c:\documents and settings\All Users\Application Data\Blizzard 2008-11-21 17:42 . 2008-11-21 17:42 d-------- C:\Logs 2008-11-20 09:56 . 2008-11-20 09:56 d-------- c:\program files\Lavasoft 2008-11-20 09:56 . 2008-11-20 09:57 d-------- c:\documents and settings\All Users\Application Data\Lavasoft 2008-11-16 20:56 . 2008-11-25 21:35 d-------- c:\program files\adslTV 2008-11-16 20:56 . 2008-11-16 20:56 d-------- c:\documents and settings\waelkens\Application Data\vlc 2008-11-15 18:27 . 2008-11-15 18:27 d-------- c:\documents and settings\All Users\Application Data\2DBoy 2008-11-14 22:24 . 2008-11-14 22:24 118 --a------ c:\windows\system32\MRT.INI 2008-11-13 17:46 . 2008-11-13 17:46 d-------- c:\documents and settings\waelkens\OngameNetwork 2008-11-11 08:36 . 2008-11-11 08:36 d-------- C:\Medion 2008-11-02 08:25 . 2008-11-02 08:25 2,425 --ah----- C:\mxfilerelatedcache.mxc2 2008-11-02 08:25 . 2008-11-02 08:25 1,520 --a------ C:\yannickk_1.avd . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-02 13:08 --------- d-----w c:\documents and settings\waelkens\Application Data\Skype 2008-12-02 13:07 --------- d-----w c:\program files\Wanadoo 2008-12-02 13:06 5,632 -csha-w c:\program files\Thumbs.db 2008-12-02 09:49 17,408 ----a-w c:\windows\system32\drivers\USBCRFT.SYS 2008-11-29 13:22 --------- d-----w c:\program files\Mozilla Thunderbird 2008-11-29 06:54 46,012 ----a-w c:\documents and settings\waelkens\Application Data\wklnhst.dat 2008-11-28 15:15 --------- d-----w c:\program files\Warcraft III 2008-11-23 18:14 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard 2008-11-21 10:39 --------- d-----w c:\program files\Fichiers communs\Blizzard Entertainment 2008-11-21 10:11 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-20 14:18 --------- d-----w c:\documents and settings\waelkens\Application Data\Orbit 2008-11-20 08:51 --------- d-----w c:\documents and settings\waelkens\Application Data\Lavasoft 2008-11-14 22:20 --------- d-----w c:\program files\DivX 2008-11-05 18:00 --------- d-----w c:\documents and settings\waelkens\Application Data\uTorrent 2008-11-05 11:23 98,304 ----a-w c:\windows\system32\CmdLineExt.dll 2008-10-29 12:41 --------- d-----w c:\program files\RomStation 2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-21 13:16 --------- d-----w c:\program files\Morgan 2008-10-18 12:22 209,636 ----a-w c:\windows\IPUI_DivXG400.exe 2008-10-18 12:20 --------- d-----w c:\program files\Rippackv3 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll 2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll 2008-10-16 12:51 --------- d-----w c:\documents and settings\waelkens\Application Data\FileZilla 2008-10-16 10:52 --------- d-----w c:\documents and settings\waelkens\Application Data\Apple Computer 2008-10-15 17:08 --------- d-----w c:\program files\DaemonTools_WhenUSave_Installer 2008-10-15 17:07 --------- d-----w c:\program files\Kodak 2008-10-15 16:40 --------- d-----w c:\program files\eRightSoft 2008-10-15 15:49 --------- d-----w c:\program files\BitComet 2008-10-15 09:49 --------- d-----w c:\program files\iTunes 2008-10-15 09:49 --------- d-----w c:\program files\iPod 2008-10-15 09:49 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-10-15 09:48 --------- d-----w c:\program files\Bonjour 2008-10-15 09:47 --------- d-----w c:\program files\QuickTime 2008-10-15 09:46 --------- d-----w c:\program files\Fichiers communs\Apple 2008-10-15 09:44 --------- d-----w c:\program files\Apple Software Update 2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll 2008-09-30 14:30 98,304 ----a-w c:\windows\DUMPc8fd.tmp 2008-09-30 14:28 98,304 ----a-w c:\windows\DUMP3718.tmp 2008-09-19 21:55 200,704 -c--a-w c:\windows\system32\ssldivx.dll 2008-09-19 21:55 1,044,480 -c--a-w c:\windows\system32\libdivx.dll 2008-09-15 15:39 1,846,144 ----a-w c:\windows\system32\win32k.sys 2008-09-04 16:45 1,106,944 ----a-w c:\windows\system32\msxml3.dll 2008-06-09 08:26 85,944 -c--a-w c:\documents and settings\waelkens\Application Data\GDIPFONTCACHEV1.DAT 2007-11-18 14:15 47,360 -c--a-w c:\documents and settings\waelkens\Application Data\pcouffin.sys 2007-05-21 11:11 47 -c--a-w c:\documents and settings\waelkens\fixsize.cmd 2007-04-04 20:30 95,232 -c--a-w c:\documents and settings\waelkens\filechop.exe 2007-03-08 23:10 18,690 -c--a-w c:\documents and settings\waelkens\make-multi.exe 2007-02-25 12:00 1 -c--a-w c:\documents and settings\waelkens\SI.bin 2006-07-28 08:30 88,102 -c--a-w c:\program files\Aug2006_xinput_x64.cab 2006-07-28 08:30 47,018 -c--a-w c:\program files\Aug2006_xinput_x86.cab 2006-07-28 08:30 41,995 -c--a-w c:\program files\dxdllreg_x86.cab 2006-07-28 08:30 183,863 -c--a-w c:\program files\Aug2006_XACT_x64.cab 2006-07-28 08:30 138,195 -c--a-w c:\program files\Aug2006_XACT_x86.cab 2006-07-28 07:32 82,338 -c--a-w c:\program files\dxupdate.cab 2006-07-28 07:32 2,248,984 -c--a-w c:\program files\dsetup32.dll 2006-07-28 07:31 484,632 -c--a-w c:\program files\DXSETUP.exe 2006-07-28 07:30 74,520 -c--a-w c:\program files\DSETUP.dll 2006-06-05 23:07 31 -c----w c:\documents and settings\waelkens\getfile.dat 2006-05-31 05:39 181,745 -c----w c:\program files\JUN2006_XACT_x64.cab 2006-05-31 05:39 134,631 -c----w c:\program files\JUN2006_XACT_x86.cab 2006-03-31 11:56 917,318 -c----w c:\program files\Apr2006_MDX1_x86.cab 2006-03-31 11:56 87,989 -c----w c:\program files\Apr2006_xinput_x64.cab 2006-03-31 11:56 46,898 -c----w c:\program files\Apr2006_xinput_x86.cab 2006-03-31 11:56 4,163,518 -c----w c:\program files\Apr2006_MDX1_x86_Archive.cab 2006-03-31 11:56 180,021 -c----w c:\program files\Apr2006_XACT_x64.cab 2006-03-31 11:56 133,991 -c----w c:\program files\Apr2006_XACT_x86.cab 2006-03-31 11:56 1,398,718 -c----w c:\program files\Apr2006_d3dx9_30_x64.cab 2006-03-31 11:56 1,116,109 -c----w c:\program files\Apr2006_d3dx9_30_x86.cab 2006-02-16 13:05 278,528 -c--a-w c:\program files\Fichiers communs\FDEUnInstaller.exe 2006-02-03 08:00 179,247 -c----w c:\program files\Feb2006_XACT_x64.cab 2006-02-03 08:00 133,297 -c----w c:\program files\Feb2006_XACT_x86.cab 2006-02-03 08:00 1,363,684 -c----w c:\program files\Feb2006_d3dx9_29_x64.cab 2006-02-03 08:00 1,085,608 -c----w c:\program files\Feb2006_d3dx9_29_x86.cab 2005-12-05 17:31 86,925 -c----w c:\program files\Oct2005_xinput_x64.cab 2005-12-05 17:31 46,247 -c----w c:\program files\Oct2005_xinput_x86.cab 2005-12-05 17:31 1,358,864 -c----w c:\program files\Dec2005_d3dx9_28_x64.cab 2005-12-05 17:31 1,080,344 -c----w c:\program files\Dec2005_d3dx9_28_x86.cab 2005-10-26 11:48 40,448 -c--a-w c:\documents and settings\waelkens rial_setup.exe 2005-07-22 18:14 1,351,430 -c----w c:\program files\Aug2005_d3dx9_27_x64.cab 2005-07-22 18:14 1,078,532 -c----w c:\program files\Aug2005_d3dx9_27_x86.cab 2005-05-26 13:49 1,336,890 -c----w c:\program files\Jun2005_d3dx9_26_x64.cab 2005-05-26 13:49 1,065,813 -c----w c:\program files\Jun2005_d3dx9_26_x86.cab 2005-03-18 16:40 1,348,242 -c----w c:\program files\Apr2005_d3dx9_25_x64.cab 2005-03-18 16:40 1,079,850 -c----w c:\program files\Apr2005_d3dx9_25_x86.cab 2005-02-05 19:03 1,248,387 -c----w c:\program files\Feb2005_d3dx9_24_x64.cab 2005-02-05 19:03 1,014,113 -c----w c:\program files\Feb2005_d3dx9_24_x86.cab 2004-09-27 10:29 976,020 -c----w c:\program files\BDAXP.cab 2004-09-27 10:29 703,080 -c----w c:\program files\BDA.cab 2004-09-27 10:29 15,493,481 -c----w c:\program files\DirectX.cab 2004-09-27 10:29 13,265,040 -c----w c:\program files\dxnt.cab 2004-09-27 10:29 1,156,363 -c----w c:\program files\BDANT.cab 1996-12-02 17:44 582,144 -c--a-w c:\program files\Fichiers communs\dao350.dll 2005-01-25 16:24 8 -csh--r c:\windows\system32\F2A38CDCBF.sys 2006-05-03 09:06 163,328 --sh--r c:\windows\system32\flvDX.dll 2005-01-25 16:24 5,744 -csha-w c:\windows\system32\KGyGaAvL.sys 2007-02-21 10:47 31,232 --sh--r c:\windows\system32\msfDX.dll 2008-03-16 12:30 216,064 --sh--r c:\windows\system32 bDX.dll . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2004-12-09 1937408] "SteamKeyFr"="c:\program files\SteamKeyFr\SteamKeyFr.exe" [2004-01-28 212992] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2007-01-12 25367592] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-25 68856] "WOOKIT"="c:\progra~1\Wanadoo\Shell.exe" [2004-08-23 122880] "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\WCESCOMM.EXE" [2004-02-24 401491] "TrueDownloaderAutoStart"="c:\program files\TrueDownloader\TrueDownloader.exe" [2005-02-20 520258] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360] "LightScribe Control Panel"="c:\program files\Fichiers communs\LightScribe\LightScribeControlPanel.exe" [2007-08-23 455968] "DAEMON Tools Pro Agent"="c:\program files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 136136] "Steam"="d:\program files\Valve\Steam\Steam.exe" [2008-10-15 1410296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "AOLDialer"="c:\program files\Fichiers communs\AOL\ACS\AOLDial.exe" [2004-04-08 496752] "PCMService"="c:\program files\Home Cinema\PowerCinema\PCMService.exe" [2005-02-04 118926] "ISUSPM Startup"="c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-06-16 221184] "ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-08-09 81920] "WOOWATCH"="c:\progra~1\Wanadoo\Watch.exe" [2004-08-23 20480] "WOOTASKBARICON"="c:\progra~1\Wanadoo\GestMaj.exe" [2004-10-14 32768] "Adobe Photo Downloader"="f:\soirée pétanque\3.0\Apps\apdproxy.exe" [2005-06-23 57344] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "SMSTray"="c:\program files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-09-20 132624] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440] "AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576] "!AVG Anti-Spyware"="c:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000] "Dit"="Dit.exe" [2004-07-20 c:\windows\Dit.exe] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-19 c:\windows\system32\bthprops.cpl] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2006-07-16 626176] Logiciel Kodak EasyShare.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2007-06-21 282624] SpySubtract.lnk - c:\program files\interMute\SpySubtract\SpySub.exe [2007-03-18 1187840] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"= "c:\program files\interMute\SpySubtract\sshook.dll" [2007-03-18 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.I420"= i420vfw.dll "msacm.l3acm"= c:\windows\system32\l3codecp.acm "MSACM.CEGSM"= mobilev.acm "VIDC.FFDS"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll "vidc.DIV3"= DivXc32.dll "vidc.DIV4"= DivXc32f.dll "msacm.divxa32"= DivXa32.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "c:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe"= "c:\Program Files\Microsoft ActiveSync\wcescomm.exe"= "c:\Documents and Settings\waelkens\Bureau\yannicl\programme C C++\eMule0.49b\emule.exe"= "c:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe"= "c:\Program Files\adslTV\adsltv.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "6112:TCP"= 6112:TCP:Warcraft "4670:TCP"= 4670:TCP:emule port "4671:UDP"= 4671:UDP:emule portudp "3724:TCP"= 3724:TCP:BLIZZARD R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-26 111184] R1 cpuidlep;CpuIdle Pro System Driver;c:\windows\system32\drivers\cpuidlep.sys [2008-05-01 4484] R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-26 20560] R3 3xHybrid;3xHybrid service;c:\windows\system32\DRIVERS\3xHybrid.sys [2005-02-05 802048] R3 cmudax;C-Media High Definition Audio Interface;c:\windows\system32\drivers\cmudax.sys [2005-01-20 1272000] R3 wbscr;Winbond Smartcard Reader for I/O;c:\windows\system32\drivers\wbscr.sys [2005-01-20 19928] S2 FILESpy;FILESpy;\??\c:\program files\Softwin\BitDefender9\filespy.sys [] S3 AIDA32Driver;AIDA32Driver;\??\c:\program files\AIDA32 - Personal System Information\aida32.sys [2004-02-23 3584] S3 CardReaderFilter;Card Reader Filter;\??\c:\windows\system32\Drivers\USBCRFT.SYS [2005-01-20 17408] S3 M1000Srv;M5603C USB2.0 Camera Driver;c:\windows\system32\Drivers\M1000KNT.sys [2007-01-10 274567] S3 PPJoyBus;Parallel Port Joystick Bus device driver;c:\windows\system32\drivers\PPJoyBus.sys [2004-01-23 13952] S3 PPortJoystick;Parallel Port Joystick device driver;c:\windows\system32\drivers\PPortJoy.sys [2004-01-23 28800] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2ac68d9a-f886-11da-a67e-001109df929d}] \Shell\AutoRun\command - L:\PreyStub.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5bd32168-dd23-11db-a8d2-001109df929d}] \Shell\AutoRun\command - K:\Autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{925fa382-1aac-11db-a6cd-001109df929d}] \Shell\AutoRun\command - M:\AutoRun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ca5651a3-8e67-11da-a58f-001109df929d}] \Shell\AutoRun\command - livebox.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "c:\program files\Fichiers communs\LightScribe\LSRunOnce.exe" . Contenu du dossier 'Tâches planifiées' 2008-11-25 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2008-11-28 c:\windows\Tasks\Maintenance en 1 clic.job - c:\program files\TuneUp Utilities 2006\SystemOptimizer.exe [2006-10-06 06:27] . . ------- Examen supplémentaire ------- . FireFox -: Profile - c:\documents and settings\waelkens\Application Data\Mozilla\Firefox\Profiles\vrvfhw56.default\ FF -: plugin - c:\documents and settings\waelkens\Application Data\Mozilla\Firefox\Profiles\vrvfhw56.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins phardwaredetection.dll FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser ppdf32.dll FF -: plugin - c:\program files\DivX\DivX Content Uploader pUpload.dll FF -: plugin - c:\program files\iTunes\Mozilla Plugins pitunes.dll FF -: plugin - c:\program files\K-Lite Codec Pack\Real\browser\plugins ppl3260.dll FF -: plugin - c:\program files\K-Lite Codec Pack\Real\browser\plugins prpjplug.dll FF -: plugin - c:\program files\ma-config.com phardwaredetection.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\NPMyrMus.dll FF -: plugin - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-02 14:13:55 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'winlogon.exe'(744) c:\windows\system32\Ati2evxx.dll . Heure de fin: 2008-12-02 14:15:26 ComboFix-quarantined-files.txt 2008-12-02 13:15:01 ComboFix2.txt 2008-11-30 20:47:32 Avant-CF: 8 406 802 432 octets libres Après-CF: 8,398,376,960 octets libres 284 --- E O F --- 2008-11-28 12:22:07

Lyonnais92 · Answer

Re,

déconnecte toi d'internet et ferme toutes tes applications.

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)


Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :



folder::
c:\program files\DaemonTools_WhenUSave_Installer 

Registry::
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Mi­nimal\TDSSserv.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Ne­twork\TDSSserv.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TD­SSSERV]



Enregistre ce fichier sous le nom CFscript


Fait un glisser/déposer de ce fichier CFscript sur le fichier ComboFix.exe

Clique sur le fichier CFscript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFscrïpt vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.


Réactive ton parefeu, ton antivirus, la garde de ton antispyware

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

CapitainZack · Answer

Salut, deja désolée d'avoir éter si long a répondre mais je n'ai vraiment pas pu avant, J'ai fait ce que tu m'a demander voila le résultat : omboFix 08-12-01.01 - waelkens 2008-12-08 23:32:30.7 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.580 [GMT 1:00] Lancé depuis: c:\documents and settings\waelkens\Bureau\ComboFix.exe Commutateurs utilisés :: c:\documents and settings\waelkens\Bureau\CFscript.txt * Un nouveau point de restauration a été créé . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\DaemonTools_WhenUSave_Installer . ((((((((((((((((((((((((((((( Fichiers créés du 2008-11-08 au 2008-12-08 )))))))))))))))))))))))))))))))))))) . 2008-11-28 16:40 . 2008-11-28 16:50 139,264 --a------ c:\windows\War3Unin.exe 2008-11-28 16:40 . 2008-11-28 17:02 81,377 --a------ c:\windows\War3Unin.dat 2008-11-28 16:40 . 2008-11-28 16:50 2,829 --a------ c:\windows\War3Unin.pif 2008-11-27 13:27 . 2008-11-27 13:27 d-------- c:\documents and settings\waelkens\Application Data\Malwarebytes 2008-11-27 13:27 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2008-11-27 13:26 . 2008-11-27 13:27 d-------- c:\program files\Malwarebytes' Anti-Malware 2008-11-27 13:26 . 2008-11-27 13:26 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2008-11-27 13:26 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2008-11-25 10:43 . 2008-11-25 10:44 d-------- c:\program files\RogueRemover FREE 2008-11-25 10:40 . 2008-11-25 10:42 d-------- C:\RogueRemover 2008-11-23 22:41 . 2008-11-27 12:57 d-------- C:\ToolBar SD 2008-11-23 19:14 . 2008-11-23 19:14 d-------- c:\documents and settings\waelkens\Application Data\Grisoft 2008-11-23 19:12 . 2008-11-23 19:12 d-------- c:\documents and settings\All Users\Application Data\Grisoft 2008-11-23 19:12 . 2007-05-30 13:10 10,872 --a------ c:\windows\system32\drivers\AvgAsCln.sys 2008-11-23 14:24 . 2008-11-23 23:06 d-------- C:\Lop SD 2008-11-22 19:33 . 2008-11-23 11:49 3,820 --a------ c:\windows\system32 mp.reg 2008-11-22 19:32 . 2008-11-22 19:34 d-------- c:\documents and settings\waelkens\SmitfraudFix 2008-11-22 19:32 . 2007-09-05 23:22 289,144 --a------ c:\windows\system32\VCCLSID.exe 2008-11-22 19:32 . 2006-04-27 16:49 288,417 --a------ c:\windows\system32\SrchSTS.exe 2008-11-22 19:32 . 2008-05-18 20:40 82,944 --a------ c:\windows\system32\IEDFix.exe 2008-11-22 19:32 . 2003-06-05 20:13 53,248 --a------ c:\windows\system32\Process.exe 2008-11-22 19:32 . 2004-07-31 17:50 51,200 --a------ c:\windows\system32\dumphive.exe 2008-11-22 19:32 . 2007-10-03 23:36 25,600 --a------ c:\windows\system32\WS2Fix.exe 2008-11-22 17:11 . 2008-11-22 17:11 d-------- C: sit 2008-11-22 16:56 . 2008-11-22 17:04 d-------- c:\program files\Navilog1 2008-11-22 03:26 . 2008-11-22 03:26 d-------- c:\documents and settings\All Users\Application Data\Blizzard 2008-11-21 17:42 . 2008-11-21 17:42 d-------- C:\Logs 2008-11-20 09:56 . 2008-11-20 09:56 d-------- c:\program files\Lavasoft 2008-11-20 09:56 . 2008-11-20 09:57 d-------- c:\documents and settings\All Users\Application Data\Lavasoft 2008-11-16 20:56 . 2008-11-25 21:35 d-------- c:\program files\adslTV 2008-11-16 20:56 . 2008-11-16 20:56 d-------- c:\documents and settings\waelkens\Application Data\vlc 2008-11-15 18:27 . 2008-11-15 18:27 d-------- c:\documents and settings\All Users\Application Data\2DBoy 2008-11-14 22:24 . 2008-11-14 22:24 118 --a------ c:\windows\system32\MRT.INI 2008-11-13 17:46 . 2008-11-13 17:46 d-------- c:\documents and settings\waelkens\OngameNetwork 2008-11-11 08:36 . 2008-11-11 08:36 d-------- C:\Medion . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-08 22:30 --------- d-----w c:\program files\Wanadoo 2008-12-08 06:38 --------- d-----w c:\documents and settings\waelkens\Application Data\Skype 2008-12-03 09:41 17,408 ----a-w c:\windows\system32\drivers\USBCRFT.SYS 2008-12-02 17:21 --------- d-----w c:\program files\Mozilla Thunderbird 2008-12-02 17:09 46,012 ----a-w c:\documents and settings\waelkens\Application Data\wklnhst.dat 2008-12-02 13:06 5,632 -csha-w c:\program files\Thumbs.db 2008-11-28 15:15 --------- d-----w c:\program files\Warcraft III 2008-11-23 18:14 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard 2008-11-21 10:39 --------- d-----w c:\program files\Fichiers communs\Blizzard Entertainment 2008-11-21 10:11 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-20 14:18 --------- d-----w c:\documents and settings\waelkens\Application Data\Orbit 2008-11-20 08:51 --------- d-----w c:\documents and settings\waelkens\Application Data\Lavasoft 2008-11-14 22:20 --------- d-----w c:\program files\DivX 2008-11-05 18:00 --------- d-----w c:\documents and settings\waelkens\Application Data\uTorrent 2008-11-05 11:23 98,304 ----a-w c:\windows\system32\CmdLineExt.dll 2008-10-29 12:41 --------- d-----w c:\program files\RomStation 2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-21 13:16 --------- d-----w c:\program files\Morgan 2008-10-18 12:22 209,636 ----a-w c:\windows\IPUI_DivXG400.exe 2008-10-18 12:20 --------- d-----w c:\program files\Rippackv3 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll 2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll 2008-10-16 12:51 --------- d-----w c:\documents and settings\waelkens\Application Data\FileZilla 2008-10-16 10:52 --------- d-----w c:\documents and settings\waelkens\Application Data\Apple Computer 2008-10-15 17:07 --------- d-----w c:\program files\Kodak 2008-10-15 16:40 --------- d-----w c:\program files\eRightSoft 2008-10-15 15:49 --------- d-----w c:\program files\BitComet 2008-10-15 09:49 --------- d-----w c:\program files\iTunes 2008-10-15 09:49 --------- d-----w c:\program files\iPod 2008-10-15 09:49 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-10-15 09:48 --------- d-----w c:\program files\Bonjour 2008-10-15 09:47 --------- d-----w c:\program files\QuickTime 2008-10-15 09:46 --------- d-----w c:\program files\Fichiers communs\Apple 2008-10-15 09:44 --------- d-----w c:\program files\Apple Software Update 2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll 2008-09-30 14:30 98,304 ----a-w c:\windows\DUMPc8fd.tmp 2008-09-30 14:28 98,304 ----a-w c:\windows\DUMP3718.tmp 2008-09-19 21:55 200,704 -c--a-w c:\windows\system32\ssldivx.dll 2008-09-19 21:55 1,044,480 -c--a-w c:\windows\system32\libdivx.dll 2008-09-15 15:39 1,846,144 ----a-w c:\windows\system32\win32k.sys 2008-06-09 08:26 85,944 -c--a-w c:\documents and settings\waelkens\Application Data\GDIPFONTCACHEV1.DAT 2007-11-18 14:15 47,360 -c--a-w c:\documents and settings\waelkens\Application Data\pcouffin.sys 2007-05-21 11:11 47 -c--a-w c:\documents and settings\waelkens\fixsize.cmd 2007-04-04 20:30 95,232 -c--a-w c:\documents and settings\waelkens\filechop.exe 2007-03-08 23:10 18,690 -c--a-w c:\documents and settings\waelkens\make-multi.exe 2007-02-25 12:00 1 -c--a-w c:\documents and settings\waelkens\SI.bin 2006-07-28 08:30 88,102 -c--a-w c:\program files\Aug2006_xinput_x64.cab 2006-07-28 08:30 47,018 -c--a-w c:\program files\Aug2006_xinput_x86.cab 2006-07-28 08:30 41,995 -c--a-w c:\program files\dxdllreg_x86.cab 2006-07-28 08:30 183,863 -c--a-w c:\program files\Aug2006_XACT_x64.cab 2006-07-28 08:30 138,195 -c--a-w c:\program files\Aug2006_XACT_x86.cab 2006-07-28 07:32 82,338 -c--a-w c:\program files\dxupdate.cab 2006-07-28 07:32 2,248,984 -c--a-w c:\program files\dsetup32.dll 2006-07-28 07:31 484,632 -c--a-w c:\program files\DXSETUP.exe 2006-07-28 07:30 74,520 -c--a-w c:\program files\DSETUP.dll 2006-06-05 23:07 31 -c----w c:\documents and settings\waelkens\getfile.dat 2006-05-31 05:39 181,745 -c----w c:\program files\JUN2006_XACT_x64.cab 2006-05-31 05:39 134,631 -c----w c:\program files\JUN2006_XACT_x86.cab 2006-03-31 11:56 917,318 -c----w c:\program files\Apr2006_MDX1_x86.cab 2006-03-31 11:56 87,989 -c----w c:\program files\Apr2006_xinput_x64.cab 2006-03-31 11:56 46,898 -c----w c:\program files\Apr2006_xinput_x86.cab 2006-03-31 11:56 4,163,518 -c----w c:\program files\Apr2006_MDX1_x86_Archive.cab 2006-03-31 11:56 180,021 -c----w c:\program files\Apr2006_XACT_x64.cab 2006-03-31 11:56 133,991 -c----w c:\program files\Apr2006_XACT_x86.cab 2006-03-31 11:56 1,398,718 -c----w c:\program files\Apr2006_d3dx9_30_x64.cab 2006-03-31 11:56 1,116,109 -c----w c:\program files\Apr2006_d3dx9_30_x86.cab 2006-02-16 13:05 278,528 -c--a-w c:\program files\Fichiers communs\FDEUnInstaller.exe 2006-02-03 08:00 179,247 -c----w c:\program files\Feb2006_XACT_x64.cab 2006-02-03 08:00 133,297 -c----w c:\program files\Feb2006_XACT_x86.cab 2006-02-03 08:00 1,363,684 -c----w c:\program files\Feb2006_d3dx9_29_x64.cab 2006-02-03 08:00 1,085,608 -c----w c:\program files\Feb2006_d3dx9_29_x86.cab 2005-12-05 17:31 86,925 -c----w c:\program files\Oct2005_xinput_x64.cab 2005-12-05 17:31 46,247 -c----w c:\program files\Oct2005_xinput_x86.cab 2005-12-05 17:31 1,358,864 -c----w c:\program files\Dec2005_d3dx9_28_x64.cab 2005-12-05 17:31 1,080,344 -c----w c:\program files\Dec2005_d3dx9_28_x86.cab 2005-10-26 11:48 40,448 -c--a-w c:\documents and settings\waelkens rial_setup.exe 2005-07-22 18:14 1,351,430 -c----w c:\program files\Aug2005_d3dx9_27_x64.cab 2005-07-22 18:14 1,078,532 -c----w c:\program files\Aug2005_d3dx9_27_x86.cab 2005-05-26 13:49 1,336,890 -c----w c:\program files\Jun2005_d3dx9_26_x64.cab 2005-05-26 13:49 1,065,813 -c----w c:\program files\Jun2005_d3dx9_26_x86.cab 2005-03-18 16:40 1,348,242 -c----w c:\program files\Apr2005_d3dx9_25_x64.cab 2005-03-18 16:40 1,079,850 -c----w c:\program files\Apr2005_d3dx9_25_x86.cab 2005-02-05 19:03 1,248,387 -c----w c:\program files\Feb2005_d3dx9_24_x64.cab 2005-02-05 19:03 1,014,113 -c----w c:\program files\Feb2005_d3dx9_24_x86.cab 2004-09-27 10:29 976,020 -c----w c:\program files\BDAXP.cab 2004-09-27 10:29 703,080 -c----w c:\program files\BDA.cab 2004-09-27 10:29 15,493,481 -c----w c:\program files\DirectX.cab 2004-09-27 10:29 13,265,040 -c----w c:\program files\dxnt.cab 2004-09-27 10:29 1,156,363 -c----w c:\program files\BDANT.cab 1996-12-02 17:44 582,144 -c--a-w c:\program files\Fichiers communs\dao350.dll 2005-01-25 16:24 8 -csh--r c:\windows\system32\F2A38CDCBF.sys 2006-05-03 09:06 163,328 --sh--r c:\windows\system32\flvDX.dll 2005-01-25 16:24 5,744 -csha-w c:\windows\system32\KGyGaAvL.sys 2007-02-21 10:47 31,232 --sh--r c:\windows\system32\msfDX.dll 2008-03-16 12:30 216,064 --sh--r c:\windows\system32 bDX.dll . ((((((((((((((((((((((((((((( snapshot@2008-12-02_14.14.14,00 ))))))))))))))))))))))))))))))))))))))))) . + 2008-12-08 06:38:30 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_664.dat + 2008-12-08 06:39:57 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_f0c.dat . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2004-12-09 1937408] "SteamKeyFr"="c:\program files\SteamKeyFr\SteamKeyFr.exe" [2004-01-28 212992] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2007-01-12 25367592] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-25 68856] "WOOKIT"="c:\progra~1\Wanadoo\Shell.exe" [2004-08-23 122880] "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\WCESCOMM.EXE" [2004-02-24 401491] "TrueDownloaderAutoStart"="c:\program files\TrueDownloader\TrueDownloader.exe" [2005-02-20 520258] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360] "LightScribe Control Panel"="c:\program files\Fichiers communs\LightScribe\LightScribeControlPanel.exe" [2007-08-23 455968] "DAEMON Tools Pro Agent"="c:\program files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 136136] "Steam"="d:\program files\Valve\Steam\Steam.exe" [2008-10-15 1410296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "AOLDialer"="c:\program files\Fichiers communs\AOL\ACS\AOLDial.exe" [2004-04-08 496752] "PCMService"="c:\program files\Home Cinema\PowerCinema\PCMService.exe" [2005-02-04 118926] "ISUSPM Startup"="c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-06-16 221184] "ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-08-09 81920] "WOOWATCH"="c:\progra~1\Wanadoo\Watch.exe" [2004-08-23 20480] "WOOTASKBARICON"="c:\progra~1\Wanadoo\GestMaj.exe" [2004-10-14 32768] "Adobe Photo Downloader"="f:\soirée pétanque\3.0\Apps\apdproxy.exe" [2005-06-23 57344] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "SMSTray"="c:\program files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-09-20 132624] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440] "AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576] "!AVG Anti-Spyware"="c:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000] "Dit"="Dit.exe" [2004-07-20 c:\windows\Dit.exe] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-19 c:\windows\system32\bthprops.cpl] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2006-07-16 626176] Logiciel Kodak EasyShare.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2007-06-21 282624] SpySubtract.lnk - c:\program files\interMute\SpySubtract\SpySub.exe [2007-03-18 1187840] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"= "c:\program files\interMute\SpySubtract\sshook.dll" [2007-03-18 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.I420"= i420vfw.dll "msacm.l3acm"= c:\windows\system32\l3codecp.acm "MSACM.CEGSM"= mobilev.acm "VIDC.FFDS"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll "vidc.DIV3"= DivXc32.dll "vidc.DIV4"= DivXc32f.dll "msacm.divxa32"= DivXa32.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "c:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe"= "c:\Program Files\Microsoft ActiveSync\wcescomm.exe"= "c:\Documents and Settings\waelkens\Bureau\yannicl\programme C C++\eMule0.49b\emule.exe"= "c:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe"= "c:\Program Files\adslTV\adsltv.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "6112:TCP"= 6112:TCP:Warcraft "4670:TCP"= 4670:TCP:emule port "4671:UDP"= 4671:UDP:emule portudp "3724:TCP"= 3724:TCP:BLIZZARD R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-26 111184] R1 cpuidlep;CpuIdle Pro System Driver;c:\windows\system32\drivers\cpuidlep.sys [2008-05-01 4484] R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-26 20560] R3 3xHybrid;3xHybrid service;c:\windows\system32\DRIVERS\3xHybrid.sys [2005-02-05 802048] R3 cmudax;C-Media High Definition Audio Interface;c:\windows\system32\drivers\cmudax.sys [2005-01-20 1272000] R3 wbscr;Winbond Smartcard Reader for I/O;c:\windows\system32\drivers\wbscr.sys [2005-01-20 19928] S2 FILESpy;FILESpy;\??\c:\program files\Softwin\BitDefender9\filespy.sys [] S3 AIDA32Driver;AIDA32Driver;\??\c:\program files\AIDA32 - Personal System Information\aida32.sys [2004-02-23 3584] S3 CardReaderFilter;Card Reader Filter;\??\c:\windows\system32\Drivers\USBCRFT.SYS [2005-01-20 17408] S3 M1000Srv;M5603C USB2.0 Camera Driver;c:\windows\system32\Drivers\M1000KNT.sys [2007-01-10 274567] S3 PPJoyBus;Parallel Port Joystick Bus device driver;c:\windows\system32\drivers\PPJoyBus.sys [2004-01-23 13952] S3 PPortJoystick;Parallel Port Joystick device driver;c:\windows\system32\drivers\PPortJoy.sys [2004-01-23 28800] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2ac68d9a-f886-11da-a67e-001109df929d}] \Shell\AutoRun\command - L:\PreyStub.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5bd32168-dd23-11db-a8d2-001109df929d}] \Shell\AutoRun\command - K:\Autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{925fa382-1aac-11db-a6cd-001109df929d}] \Shell\AutoRun\command - M:\AutoRun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ca5651a3-8e67-11da-a58f-001109df929d}] \Shell\AutoRun\command - livebox.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "c:\program files\Fichiers communs\LightScribe\LSRunOnce.exe" . Contenu du dossier 'Tâches planifiées' 2008-11-25 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2008-12-05 c:\windows\Tasks\Maintenance en 1 clic.job - c:\program files\TuneUp Utilities 2006\SystemOptimizer.exe [2006-10-06 06:27] . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-08 23:37:12 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'winlogon.exe'(728) c:\windows\system32\Ati2evxx.dll . Heure de fin: 2008-12-08 23:38:55 ComboFix-quarantined-files.txt 2008-12-08 22:38:21 ComboFix2.txt 2008-12-02 13:15:27 ComboFix3.txt 2008-11-30 20:47:32 Avant-CF: 7 955 668 992 octets libres Après-CF: 7,969,505,280 octets libres 277 --- E O F --- 2008-11-28 12:22:07

Lyonnais92 · Answer

Re,

pas de souci pour le délai.

Lis bien et exécute cette manip dans l’ordre.

#Télécharge et installe ces logiciels (si tu ne les as pas) pour les 3 premiers
mets les à jour, comme indiqué dans les démos ou tutos.

Ne les utilise pas tout de suite.


Antispywares et autres :
 
Télécharge Malwarebytes' Anti-Malware (MBAM) et enregistre le sur ton bureau à partir de ce lien :

https://www.malwarebytes.com/

A la fin du téléchargement, ferme toutes les fenêtres et programmes, y compris celui-ci.

Double-clique sur l'icône Download_mbam-setup.exe sur ton bureau pour démarrer le programme d'installation.

Pendant l'installation, suis les indications (en particulier le choix de la langue et l'autorisation d'accession à Internet). N'apporte aucune modification aux réglages par défaut et, en fin d'installation, vérifie que les options Update Malwarebytes' Anti-Malware et Launch Malwarebytes' Anti-Malware sont cochées.

MBAM démarrera automatiquement et enverra un message demandant à mettre à jour le programme avant de lancer une analyse. Comme MBAM se met automatiquement à jour en fin d'installation, clique sur OK pour fermer la boîte de dialogue.


Nettoyeurs (de fichiers inutiles) et autres :

*Ccleaner (gratuit)
Téléchargement :
https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html
Tuto :
https://www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.php

Lors de l’installation, [décoche] l’option qui t’installerait la barre Yahoo !

========================================
->Affiche tous les fichiers et dossiers :
clique sur démarrer/panneau de configuration (en affichage classique)/option des dossiers/affichage

[Coche] « afficher les dossiers et fichiers cachés »

[Décoche] la case « Masquer les fichiers protégés du système d'exploitation (recommandé) »

[Décoche] « masquer les extensions dont le type est connu »

Puis fais [appliquer] pour valider les changements.

Et [Ok]
.

=======================================

->Démarre en mode sans échec :
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec
puis tape « entrée ».
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
(Si F8 ne marche pas utilise la touche F5).

========================================
->Lance CCleaner.

Suppression des fichiers temporaires

Va dans la section "Options" situé dans la marge gauche.
Décoche "Avancé"
Retourne ensuite dans la section "Nettoyeur"
Fais bien attention de cocher toutes ces cases dans la marge gauche (Internet Explorer/Windows Explorer/Système)
• Clique sur [Analyse]
• Patiente le temps du scan, qui peut prendre un peu de temps si c'est la première fois.
• Une fois le scan terminé, clique sur [Lancer le Nettoyage]



========================================
Lance Malwarebytes AntiMalware

Dans l'onglet analyse, vérifie que "Exécuter un scan rapide" est coché et clique sur le bouton Rechercher pour démarrer l'analyse.

MBAM analyse ton ordinateur. L'analyse peut prendre un certain temps. Il suffit de vérifier de temps en temps son avancement.

A la fin de l'analyse, un message s'affiche indiquant la fin de l'analyse. Clique sur OK pour poursuivre.

Si des malwares ont été détectés, leur liste s'affiche.
En cliquant sur Suppression (?) , MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.

MBAM va ouvrir le bloc-notes et y copier le rapport d'analyse. Ferme le bloc-note. (Le rapport peut être retrouvé sous l'onglet Rapports/logs)

Ferme MBAM en cliquant sur Quitter. 

Poste le rapport dans ta réponse.
========================================

->Relance CCleaner.
Suppression des incohérences du registre

• Clique sur l'icône [Registre] situés dans la marge à gauche
• Puis clique sur [Analyser les erreurs]
• Patiente pendant que CCleaner scan ton registre.
• Une fois le scan terminé, coche toutes les entrèes qu'il t'aura trouvée.
• Tu peux cliquer ensuite sur [Corriger les erreurs].

Si tu n'est pas sur de ce que tu fais, tu peux choisir de sauvegarder les entrées cochées pour les restaurer ultérieurement.
========================================
->Vide ta Corbeille.
========================================
->Redémarre en mode normal,


- > Ouvre ce lien pour scanner ton PC avec un BitDefender en ligne (uniquement sous Internet Explorer) :

http://www.bitdefender.fr/scan_fr/scan8/ie.html

Utilisation :
Cliquer sur "J'accepte" puis accepter également l'ActiveX bloqué par la barre anti-popup du SP2 qui clignotera en haut et l'installer.
Ensuite, cliquer sur "Cliquez ici pour scanner".
Patienter jusqu'à la fin du scan qui peut durer assez longtemps...

Copier/coller le rapport entier sur le forum.

Tutoriel en images ici : http://pageperso.aol.fr/rginformatique/mapage/defender.htm (merci à Balltrap34 pour cette réalisation)
[Recoche] la case « Masquer les fichiers protégés du système d'exploitation (recommandé) »

CapitainZack · Answer

Bonjour, 

Voici le rapport de malwareByte :
alwarebytes' Anti-Malware 1.31
Version de la base de données: 1478
Windows 5.1.2600 Service Pack 2

09/12/2008 23:57:11
mbam-log-2008-12-09 (23-57-11).txt

Type de recherche: Examen rapide
Eléments examinés: 53956
Temps écoulé: 9 minute(s), 34 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Documents and Settings\waelkens	rial_setup.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.



Celui de bitdefender :


BitDefender Online Scanner
	

 
	

 

Rapport d'analyse généré à: Wed, Dec 10, 2008 - 00:52:47

 
	

 
	

 

Voie d'analyse: C:\;D:\;E:\;F:\;G:\;H:\;I:\;K:\;L:\;M:\;O:\;P:\;S:\;
	

 
	

 

 
	

 
	

 

Statistiques

Temps
	

00:36:07

Fichiers
	

93305

Directoires
	

16051

Secteurs de boot
	

0

Archives
	

2517

Paquets programmes
	

5117
	

 
	

 

Résultats

Virus identifiés
	

2

Fichiers infectés
	

3

Fichiers suspects
	

0

Avertissements
	

0

Désinfectés
	

0

Fichiers effacés
	

3
	

 
	

 

Info sur les moteurs

Définition virus
	

2339266

Version des moteurs
	

AVCORE v1.7 (build 8314.19) (i386) (Sep 29 2008 17:19:14)

Analyse des plugins
	

17

Archive des plugins
	

44

Unpack des plugins
	

7

E-mail plugins
	

6

Système plugins
	

4
	

 
	

 

Paramètres d'analyse

Première action
	

Désinfecté

Seconde Action
	

Supprimé

Heuristique
	

Oui

Acceptez les avertissements
	

Oui

Extensions analysées
	

exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;

Excludez les extensions
	

 

Analyse d'emails
	

Oui

Analyse des Archives
	

Oui

Analyser paquets programmes
	

Oui

Analyse des fichiers
	

Oui

Analyse de boot
	

Oui
	

 
	

 
 

Fichier analysé
	

 Statut

C:\Program Files\Rippackv3\Logiciels\codec\DivX5.02\DivXPro502GAINBundle.exe=>(VISE Installer o)=>Gain_Trickler.exe
	

Détecté avec: Adware.Gator.C

C:\Program Files\Rippackv3\Logiciels\codec\DivX5.02\DivXPro502GAINBundle.exe=>(VISE Installer o)=>Gain_Trickler.exe
	

Supprimé

C:\Program Files\Rippackv3\Logiciels\codec\DivX5.02\DivXPro502GAINBundle.exe=>(VISE Installer o)
	

Echec de la mise à jour

C:\Program Files\TuneUp Utilities 2006\SDShelEx.dll
	

Infecté par: Trojan.Generic.93952

C:\Program Files\TuneUp Utilities 2006\SDShelEx.dll
	

Supprimé

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP930\A0244506.dll
	

Infecté par: Trojan.Generic.93952

C:\System Volume Information\_restore{1D57A905-D4FE-4B9B-83D6-90B578A2376C}\RP930\A0244506.dll
	

Supprimé
	

 

 Je n'ai pas eu a vider la corbeille, elle était déjà vide.

Lorsque j'ai décocher la case "Masquer les fichiers protégés du système d'exploitation plusieurs fichier transparant sont apparut sur mon bureau.


Merci

CapitainZack · Answer

En ayant recocher la case les fichier sont toujours présent :/

Lyonnais92 · Answer

Bonjour,

1) démarre en mode sans échec et supprime :

C:\Program Files\Rippackv3\Logiciels\codec\DivX5.02\DivXPro502GAINBundle.exe

2) Donne moi le nom de quelques uns de ces fichiers apparus.

CapitainZack · Answer

Bonjour ;

Il ya plusieurs fichier transparent qui sont apapru (a peu prés 30).

du genre :
alien1.BMP
alien_bomb.wav
bigexplo1.bmp
bigexplo.wav
blueplanet.bmp
bomb.bmp
mario2.mid
nintendoVScompetition.bas
VTK1631W.DLL
VOFLR31W.SLL



j'ai supprimer le dossier.

Lyonnais92 · Answer

Bonjour,

tu as le jeu Space War ?

Lyonnais92 · Answer

Re,

il n'y a que toi à avoir accès à l'ordi ?


pour : alien_bomb.wav 

http://216.239.59.132/search?q=cache:tHcdYX9C27UJ:www.commentcamarche.net/forum/affich 4407812 jeux cree par moi probleme+alien_bomb.wav&hl=fr&ct=clnk&cd=1&gl=fr&client=firefox a


et ça aussi : nintendoVScompetition.bas

CapitainZack · Answer

Bonjour

Fiiou, Oui n fait j'ai du installer un jeux amateur comme sa il y a bien longtemps en tout cas c'est possible


Non il n'y a pas que moi qui ait accés a mon ordi mais les autres utilisateurs ce limite a surfer sur le web ou les mails.

Merci

Lyonnais92 · Answer

Re,

une seule méthode, les lister tous et détruire les inutiles.


Télécharge DirLook de jpshortstuff ici :

http://jpshortstuff.247fixes.com/DirLook.exe

[*]Double-clique sur DirLook.exe pour le lancer.
[*]Assure-toi que Show Hidden Files et BBCode Ouput soient tous les deux cochés.
[*]Copie le contenu de la boîte ci-dessous dans le champ texte principal :

c:\documents and settings\waelkens\Bureau
 

[*]Clique sur le bouton DirLook pour lancer l'examen.
[*]Quand il est terminé, une fenêtre du Bloc-notes s'ouvre avec le résultat du scan. Merci de poster ce rapport dans ta prochaine réponse.

Note : Le rapport peut aussi être trouvé dans C:dl_log.txt

Tu élimines tout ce qui semble "normal" pour ne garder que les "transparents". Il suffit de supprimer les lignes dans le Bloc-Notes avant de copier dans la réponse.

CapitainZack · Answer

Salut, 
Donc voici le rapport ou il ne reste que les fichier transparent :

DirLook.exe v2.0 by jpshortstuff
Log created at 20:16 on 11/12/2008
==================================[b]
Contents of "c:\documents and settings\waelkens\Bureau"
[/b]
[b][color=blue]---FOLDERS---[/b][/color]


[b][color=blue]---FILES---[/b][/color]

[b]alien1.BMP[/b] (10038 bytes - created on 01/05/2006 at 16:43, modified on 09/01/2006 at 19:43) --ah-c
[b]alien2.BMP[/b] (10038 bytes - created on 01/05/2006 at 16:43, modified on 09/01/2006 at 19:43) --ah-c
[b]alien3.BMP[/b] (10038 bytes - created on 01/05/2006 at 16:43, modified on 09/01/2006 at 19:43) --ah-c
[b]alien_bomb.wav[/b] (6828 bytes - created on 01/05/2006 at 16:43, modified on 12/05/2004 at 08:36) --ah-c
[b]Areohvee_-_Defiant_Discipe.wmv[/b] (0 bytes - created on 08/12/2008 at 19:31, modified on 08/12/2008 at 19:31) --a---
[b]Areohvee_-_Defiant_Discipe.wmv.part[/b] (125431020 bytes - created on 08/12/2008 at 19:31, modified on 08/12/2008 at 19:51) --a---
[b]bigexplo.wav[/b] (23164 bytes - created on 01/05/2006 at 16:43, modified on 25/02/2004 at 13:43) --ah-c
[b]bigexplo1.bmp[/b] (20066 bytes - created on 01/05/2006 at 16:43, modified on 25/02/2004 at 16:45) --ah-c
[b]bigexplo2.bmp[/b] (20066 bytes - created on 01/05/2006 at 16:43, modified on 25/02/2004 at 16:45) --ah-c
[b]bigexplo3.bmp[/b] (20066 bytes - created on 01/05/2006 at 16:43, modified on 25/02/2004 at 16:45) --ah-c
[b]bigexplo4.bmp[/b] (20066 bytes - created on 01/05/2006 at 16:43, modified on 25/02/2004 at 16:45) --ah-c
[b]bigexplo5.bmp[/b] (20066 bytes - created on 01/05/2006 at 16:43, modified on 25/02/2004 at 16:46) --ah-c
[b]blueplanet1.BMP[/b] (12534 bytes - created on 01/05/2006 at 16:43, modified on 09/01/2006 at 21:14) --ah-c
[b]blueplanet3.BMP[/b] (12534 bytes - created on 01/05/2006 at 16:43, modified on 09/01/2006 at 21:13) --ah-c
[b]blueplanet5.BMP[/b] (12534 bytes - created on 01/05/2006 at 16:43, modified on 09/01/2006 at 21:12) --ah-c
[b]blueplanet7.BMP[/b] (12534 bytes - created on 01/05/2006 at 16:43, modified on 09/01/2006 at 21:13) --ah-c
[b]bomb.BMP[/b] (2454 bytes - created on 01/05/2006 at 16:43, modified on 09/01/2006 at 19:27) --ah-
[b]explo1.bmp[/b] (7266 bytes - created on 01/05/2006 at 16:43, modified on 26/04/2004 at 08:04) --ah-c
[b]explo2.bmp[/b] (7266 bytes - created on 01/05/2006 at 16:43, modified on 13/04/2006 at 11:12) --ah-c
[b]explo3.bmp[/b] (7266 bytes - created on 01/05/2006 at 16:43, modified on 26/04/2004 at 08:07) --ah-c
[b]explo4.bmp[/b] (7266 bytes - created on 01/05/2006 at 16:43, modified on 21/04/2004 at 16:53) --ah-c
[b]explo5.bmp[/b] (7266 bytes - created on 01/05/2006 at 16:43, modified on 13/04/2006 at 11:13) --ah-c
[b]images.jpg[/b] (3953 bytes - created on 06/11/2008 at 20:23, modified on 06/11/2008 at 20:23) --a---
[b]laser.wav[/b] (17372 bytes - created on 01/05/2006 at 16:43, modified on 13/10/2000 at 12:50) --ah-c
[b]mario2.mid[/b] (22439 bytes - created on 01/05/2006 at 16:43, modified on 13/02/2005 at 10:03) --ah-c
[b]meteroite.BMP[/b] (9654 bytes - created on 01/05/2006 at 16:43, modified on 09/01/2006 at 21:26) --ah-c
[b]NintendoVScompetition.bas[/b] (14939 bytes - created on 01/05/2006 at 16:43, modified on 12/01/2006 at 14:04) --ah-c
[b]space.bmp[/b] (504054 bytes - created on 01/05/2006 at 16:43, modified on 09/01/2006 at 20:33) --ah-c
[b]spider1.bmp[/b] (4854 bytes - created on 01/05/2006 at 16:43, modified on 09/01/2006 at 21:07) --ah-c
[b]spider2.bmp[/b] (4854 bytes - created on 01/05/2006 at 16:43, modified on 09/01/2006 at 21:07) --ah-c
[b]VBAS31W.SLL[/b] (560386 bytes - created on 01/05/2006 at 16:43, modified on 11/12/1995 at 06:10) --ah-c
[b]VGUI31W.SLL[/b] (756129 bytes - created on 01/05/2006 at 16:43, modified on 11/12/1995 at 06:10) --ah-c
[b]VOFLR31W.SLL[/b] (35608 bytes - created on 01/05/2006 at 16:43, modified on 11/12/1995 at 06:10) --ah-c
[b]VTHK31W.DLL[/b] (11776 bytes - created on 01/05/2006 at 16:43, modified on 11/12/1995 at 06:10) --ah-c
[b]VTK1631W.DLL[/b] (11776 bytes - created on 01/05/2006 at 16:43, modified on 11/12/1995 at 06:10) --ah-c
[b]VTK3231W.DLL[/b] (4608 bytes - created on 01/05/2006 at 16:43, modified on 11/12/1995 at 06:10) --ah-c
[b]VVM31W.DLL[/b] (200704 bytes - created on 01/05/2006 at 16:43, modified on 03/03/1999 at 06:13) --ah-c
[b]VVMT31W.DLL[/b] (65536 bytes - created on 01/05/2006 at 16:43, modified on 08/07/2003 at 02:04) --ah-c


==================================
[b][color=blue]=EOF=[/b][/color]


une seule méthode, les lister tous et détruire les inutiles.

C's a dire ? j'envoie vers la corbeille ?

Lyonnais92 · Answer

Re,

oui, direction la Corbeille.

Tu vides la Corbeille

Tu supprimes les fichiers (clic droit et supprimer)

Tu attends quelques jour pour vider la Corbeille.

CapitainZack · Answer

Re ,

Ok merci c'est fait esce que mon PC est clean maintenant >?

Lyonnais92 · Answer

Re,

tu as bien supprimé :

C:\Program Files\Rippackv3\Logiciels\codec\DivX5.02\DivXPro502GAINBundle.exe

Si oui, l'ordi est propre.

nettoyage des outils :

* Télécharge ToolsCleaner par A.Rothstein & dj QUIOU sur ton Bureau.

http://pc-system.fr/
hxxp://a-rothstein.changelog.fr/TC/ToolsCleaner2.exe
hxxp://pagesperso-orange.fr/AceRothstein/ToolsCleaner2.exe

* Clique sur Recherche et laisse le scan se terminer.

* Clique, sur Suppression pour finaliser.

* Tu peux, si tu le souhaites, te servir des Options facultatives.

* Clique sur Quitter, pour que le rapport puisse se créer.

* Poste moi le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur( C:\).

CapitainZack · Answer

Re, 

Ouais, j'ai bien supprimer le dossier, dans le fichier DivX5.02 il rest un fichier : divx5spy.reg
ce n'est rien ?



sinon voila le rapport  :
[ Rapport ToolsCleaner version 2.2.7 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

C:\Combofix.txt: trouvé !
C:\cleannavi.txt: trouvé !
C:\lopR.txt: trouvé !
C:\TB.txt: trouvé !
C:\Lop SD: trouvé !
C:\Qoobox: trouvé !
C:\Toolbar SD: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\All Users\Bureau\Navilog1.lnk: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: trouvé !
C:\Documents and Settings\waelkens\SmitFraudfix: trouvé !
C:\Documents and Settings\waelkens\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\waelkens\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\waelkens\Bureau\SmitFraudFix.exe: trouvé !
C:\Documents and Settings\waelkens\Bureau\OAD.exe: trouvé !
C:\Documents and Settings\waelkens\Bureau\SmitFraudfix: trouvé !
C:\Documents and Settings\waelkens\Bureau\yannicl\cleannavi.txt: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files\Navilog1\Navilog1.bat: trouvé !
C:\WINDOWS\NIRCMD.exe: trouvé !

---------------------------------
-->- Suppression: 

C:\Documents and Settings\All Users\Bureau\Navilog1.lnk: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: supprimé !
C:\Documents and Settings\waelkens\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\waelkens\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Documents and Settings\waelkens\Bureau\SmitFraudFix.exe: supprimé !
C:\Program Files\Navilog1\Navilog1.bat: supprimé !
C:\Combofix.txt: supprimé !
C:\cleannavi.txt: supprimé !
C:\lopR.txt: supprimé !
C:\TB.txt: supprimé !
C:\Documents and Settings\waelkens\Bureau\OAD.exe: supprimé !
C:\Documents and Settings\waelkens\Bureau\yannicl\cleannavi.txt: supprimé !
C:\WINDOWS\NIRCMD.exe: supprimé !
C:\Lop SD: supprimé !
C:\Qoobox: supprimé !
C:\Toolbar SD: supprimé !
C:\Rsit: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: supprimé !
C:\Documents and Settings\waelkens\SmitFraudfix: supprimé !
C:\Documents and Settings\waelkens\Bureau\SmitFraudfix: supprimé !
C:\Program Files\Navilog1: supprimé

Lyonnais92 · Answer

Re,

la suppression de Combofix ne s'est pas faite.

Fais ceci :

Démarrer, Exécuter, tape combofix /u dans la zone de saisie puis OK (un espace avant /u)

Supprime Toolscleaner qui est sur ton bureau et C:\TCleaner.txt.

================

Fais un clic droit sur divx5spy.reg  et Modifier.

Poste le contenu du fichier qui s'ouvre.

Ne l'exécute évidemment pas !

CapitainZack · Answer

Lut,

J'ai fait ce que tu m'a dit et Voici le contenu du fichier qui s'ouvre :

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Trickler"=-



Merci

Lyonnais92 · Answer

Bonjour,

amusant divx5spy.reg !

On te lvre un trojan et le fichier qui le neutralise.

Tu peux supprimer le fichier divx5spy.reg.

Derniers conseils :

Voici quelques conseils pour mieux protéger ton ordi des malwares : 
 
1) Mets à jour Windows en consultant régulièrement le site de mise à jour :
http://www.update.microsoft.com/windowsupdate/v6/default.aspx
2) pour réduire les risques de réinfection, je te recommande fortement d'installer ces programmes gratuits :

- SpywareBlaster protège des ActiveX malicieux  : http://www.commentcamarche.net/telecharger/telecharger 226 spyware blaster

- SpywareGuard offre une protection en temps réel contre les tentatives d'installation des spywares. Prends garde à n'avoir qu'un seul anti-spyware en garde active pour éviter les risques de conflit : http://www.commentcamarche.net/telecharger/telecharger 34055277 spywareguard .

- Sécurise Internet Explorer
         * Clique sur Démarrer puis Exécuter
         * Tape Inetcpl.cpl dans la zone de saisie puis OK
         * Clique sur l'onglet Sécurité
         * Clique sur "Rétablir toutes les zones au niveau par défaut"
         * Sélectionne Zone Internet et clique sur "Personaliser le niveau"
         * Dans la section sur les ActiveX, règle sur "Demander" les téléchargements des ActiveX sognés et non sognés et règle sur "Désactivé" "Contrôles d'initialisation et de script ActiveX non marqués comme sécurisés" 

- ATF Cleaner nettoye les fichiers temporaires d'Internet Explorer et Windows (et Firefox), vide la corbeille et effectue quelques autres actions de nettoyage. Il améliore la vitesse et élimine les fichiers malveillants logés dans les fichiers temporaires : https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html

- Noscript est un "Addon" pour Firefox qui empêche l'exécution de scripts en provenance des sites Web. il stoppe l'installation de logiciels infectieux via flash, java, javascript et d'autres points d'entrée : http://www.geekstogo.com/forum/redirect.php?url=http%3A%2F%2Fwww.noscript.net

- Conserve une sauvegarde des fichiers importants. Ceco devient de plus en plus important. Cet article, en anglais, est rempli d'informations sur les solutions possibles : http://www.geekstogo.com/559/options-for-home-computer-data-backup-part-1/

- MVPS Hosts replace le fichier Hosts par un fichier contenantles sites de pub et autres sites dangereux. Fondamentalement, cela empêche l'ordi de se connecter à ces sites en redirigeant l'appel vers 127.0.0.1 qui correspond à ton ordi. Ceci rend plus difficile d'infecter l'ordi.

- Il vaut mieux utiliser un navigateur alternatif à Internet Explorer. Je recommande celui de Mozilla, Firefox, très agréable, mieux sécurisé et doté d'un très bon bloqueur de pop-ups. lien de téléchargement : http://www.commentcamarche.net/telecharger/telecharger 111 firefox

3) Si tu lis l'anglais, cet article de Tony Klein comporte d'excellentes suggestions : http://www.geekstogo.com/how-did-i-get-infected-in-the-first-place

4)ERUNT (Emergency Recovery Utility NT) permet de prendre une sauvegarde de la base de registre et de la restaurer en cas de besoin. La copie de sauvegarde du registre effectuée par Windows n'est pas complète : http://www.commentcamarche.net/telecharger/telecharger 34055395 erunt

5)Console de récupération Face aux nouvelles menaces (attaque du secteur de boot par exemple), la Console de récupération peut être la seule solution. Un tutoriel ici : https://www.pcastuces.com/pratique/windows/xp/console_recuperation/page1.htm . N'hésite pas à poser des questions si nécessaire
==============

Bon surf.

CapitainZack · Answer

Salut,

Je te remercie beaucoup pour ce que tu as fait, ta patience et la clarté des informations donné. 

Vous faites du super boulot en aidant toute ces personnes.

Je vas suivre te conseil.
Merci 
Bye

Lyonnais92 · Answer

Bonsoir,

de rien pour l'aide,

surtout si tu suis les conseils.

HIjackthis

59 réponses

Discussions similaires

Newsletters