L'invasion des pubs Fermé

Question

Bonjour,
voila mon problème, depuis un certain moment quand je surf sur mozilla il y a des pubs qui n'arrete pas de venir, et ce n'est pas tout, malgré que je suis sur mozilla il y a aussi des pubs qui viennent d'internet explorer. Voila un rapport qu'a fait HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:20:05, on 23/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32undll32.exe
C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Prayer\Prayer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEMonitor.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Djouher\Mes documents\Downloads\Programs\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fwww.msn.fr%2fimg%2ffr%2ffr-fr%2fdivertissement%2fcelebrites%2fgalery%2fwentworth02.jpg%3f
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fr.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/ymj/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/ymj/*https://fr.yahoo.com/?p=us
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/?p=us
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - (no file)
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMIECC.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2fc742d1-59f8-4524-aa4f-cd9c51d98747} - C:\WINDOWS\system32\zeyepome.dll (file missing)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealOne Playerpbrowserrecordplugin.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - (no file)
O2 - BHO: Windows Live Toolbar Beta - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: islamuslim Toolbar - {fcd5ee58-54d8-4d33-aa8d-54ae85597966} - C:\Program Files\islamuslim	bisl0.dll
O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: islamuslim Toolbar - {fcd5ee58-54d8-4d33-aa8d-54ae85597966} - C:\Program Files\islamuslim	bisl0.dll
O3 - Toolbar: &Windows Live Toolbar Beta - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [EEventManager] C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
O4 - HKLM\..\Run: [AXIS TONS THE MP3] C:\Documents and Settings\All Users\Application Data\Readme Live Axis Tons\Amok team.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [fuyamawewu] Rundll32.exe "C:\WINDOWS\system32\meburaro.dll",s
O4 - HKLM\..\Run: [ecd85eae] rundll32.exe "C:\WINDOWS\system32\misiruvu.dll",b
O4 - HKLM\..\Run: [CPMefeb6d32] Rundll32.exe "c:\windows\system32	uhuduta.dll",a
O4 - HKCU\..\Run: [IDMan] C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe /onboot
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\PROGRA~1\WI1F86~1\MESSEN~1\msnmsgr.exe" /background
O4 - HKCU\..\Run: [zweitgeist Assistant] "C:\Program Files\weblin\weblinAssistant.exe"
O4 - HKCU\..\Run: [Heartbags] C:\DOCUME~1\Djouher\APPLIC~1\ITCHSE~1\DASH BLEH.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [fuyamawewu] Rundll32.exe "C:\WINDOWS\system32\meburaro.dll",s (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bilal.lnk = C:\Program Files\Prayer\Prayer.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: Download all links with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEExt.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O20 - AppInit_DLLs: C:\WINDOWS\system32\wehojavi.dll c:\windows\system32\jojayuza.dll c:\windows\system32	uhuduta.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32	uhuduta.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32	uhuduta.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
O23 - Service: Localisateur d'appels de procédure distante (RPC) (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe
O23 - Service: QoS RSVP (RSVP) - Unknown owner - C:\WINDOWS\system32svp.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe

Utilisateur anonyme · Answer

Salut,

Télécharge Navilog1 depuis-ce lien :
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe

Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau.
Ensuite double clique sur navilog1.exe pour lancer l'installation.

Une fois l'installation terminée, le fix s'exécutera automatiquement.
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau).


Au menu principal, Fais le choix 1 >> Recherche
Laisse toi guider et patiente.
Patiente jusqu'au message :
*** Analyse Termine le ..... *** >>>>> Le fix peut durer une dizaine de minutes ;)
Appuie sur une touche le bloc note va s'ouvrir.
Copie-colle le rapport ici.

A toute.
++

Utilisateur anonyme · Answer

Relance Navilog, Sur le menu principal, choisis 2.
Suis les instructions et patiente.

L'outil va t'informer qu'il redémarrera ton ordinateur.
Sauvegarde les documents ouverts, s'il y en a, puis ferme toutes les fenêtres.
Appuie sur une touche ainsi que demandé.

Si ton ordinateur ne redémarre pas automatiquement, fais le manuellement.
Choisis ta session habituelle si nécessaire.
Patiente jusqu'au message *** Nettoyage terminé le ….*** (il se peut que ça prenne un certain temps).
Un document du Bloc-notes est créé. Sauvegarde le rapport de manière à le retrouver.
* Copie/colle le contenu de ce compte-rendu dans ta prochaine réponse.
Referme le Bloc-notes.
Ton Bureau va réapparaître.


Note : Si ton Bureau ne réapparaît pas, presse Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches.
Onglet "Processus" > Fichier (menu) > Nouvelle tâche (Exécuter...) > tape explorer et clique sur OK.

karimosouli · Answer

tien:

Clean Navipromo version 3.6.9 commencé le 23/11/2008 à 13:18:44,00

Outil exécuté depuis C:\Program Files
avilog1
Session actuelle : "Djouher" 

Mise à jour le 05.11.2008 à 21h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 6.0.2900.2180
Système de fichiers : NTFS

Mode suppression automatique 
avec prise en charge résultats Catchme et GNS


Nettoyage exécuté au redémarrage de l'ordinateur

 
*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)
 

*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\WINDOWS\System32" *


* Suppression dans "C:\Documents and Settings\Djouher\locals~1\applic~1" * 


* Suppression dans "C:\DOCUME~1\MOHAME~1\locals~1\applic~1" * 


*** Suppression dossiers dans "C:\WINDOWS" ***


*** Suppression dossiers dans "C:\Program Files" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\Djouher\applic~1" *** 


*** Suppression dossiers dans "C:\DOCUME~1\MOHAME~1\applic~1" *** 


*** Suppression dossiers dans "C:\DOCUME~1\PROPRI~1\applic~1" *** 


*** Suppression dossiers dans "C:\Documents and Settings\Djouher\locals~1\applic~1" *** 


*** Suppression dossiers dans "C:\DOCUME~1\MOHAME~1\locals~1\applic~1" *** 


*** Suppression dossiers dans "C:\Documents and Settings\Djouher\menudm~1\progra~1" *** 


*** Suppression dossiers dans "C:\DOCUME~1\MOHAME~1\menudm~1\progra~1" *** 



*** Suppression fichiers ***


*** Suppression fichiers temporaires ***

Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\Djouher\locals~1\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\WINDOWS\system32" *


* Dans "C:\Documents and Settings\Djouher\locals~1\applic~1" * 


ymagg.dat trouvé ! 
Copie ymagg.dat réalisée avec succès !
ymagg.dat supprimé !

ymagg_nav.dat trouvé ! 
Copie ymagg_nav.dat réalisée avec succès !
ymagg_nav.dat supprimé !

ymagg_navps.dat trouvé ! 
Copie ymagg_navps.dat réalisée avec succès !
ymagg_navps.dat supprimé !


* Dans "C:\DOCUME~1\MOHAME~1\locals~1\applic~1" * 


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup supprimé !
Certificat Electronic-Group supprimé !
Certificat Montorgueil absent !
Certificat OOO-Favorit supprimé !
Certificat Sunny-Day-Design-Ltdt absent !

*** Nettoyage terminé le 23/11/2008 à 13:23:49,56 ***


Et encore merci.

Utilisateur anonyme · Answer

Télécharges ToolBar S&D ( de Eric_71 ) :
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2
( Tuto : https://sites.google.com/site/toolbarsd/aideenimages )

!! Déconnectes toi et fermes toute tes applications en cours le temps de la manipulation !!
* double-cliques sur l'.exe pour lancer l'installe et laisses toi guider ...
* Une fois fait, cliques sur le raccourci créé sur ton bureau pour lancer l'outil .
* Choisis l'option 1 ( « recherche ») et tapes « entrée » .
* Une fois le scan finit, un rapport va apparaître, copie/colles l'intégralité de son contenu dans ta prochaine réponse ...
(Le rapport est en outre sauvegardé ici -> C:\TB.txt )

karimosouli · Answer

voici le rapport:


   -----------\  ToolBar S&D 1.2.5   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) 4 CPU 3.00GHz )
   BIOS : Award Medallion BIOS v6.00PG
   USER : Djouher ( Administrator )
   BOOT : Normal boot
   Antivirus : ESET NOD32 Antivirus 3.0 3.0 (Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:149 Go (Free:91 Go)
   D:\ (CD or DVD)
   E:\ (CD or DVD)
   F:\ (USB)
   G:\ (USB)
   H:\ (USB)
   I:\ (USB)

   "C:\ToolBar SD" ( MAJ : 20-11-2008|20:25 )
   Option : [1] ( 23/11/2008|13:38 )

   -----------\  Recherche de Fichiers / Dossiers ...

   C:\Program Files\AskTBar
   C:\Program Files\AskTBar\bar
   C:\Program Files\AskTBar\SrchAstt
   C:\Program Files\AskTBar\bar\1.bin
   C:\Program Files\AskTBar\bar\Cache
   C:\Program Files\AskTBar\bar\History
   C:\Program Files\AskTBar\bar\Settings
   C:\Program Files\AskTBar\bar\Cache\00085404
   C:\Program Files\AskTBar\bar\Cache\000BE857
   C:\Program Files\AskTBar\bar\Cache\00DAECAD.bin
   C:\Program Files\AskTBar\bar\Cache\00DAEEEF.bin
   C:\Program Files\AskTBar\bar\Cache\00DAF037.bin
   C:\Program Files\AskTBar\bar\Cache\files.ini
   C:\Program Files\AskTBar\bar\History\search2
   C:\Program Files\AskTBar\bar\Settings\prevcfg2.htm
   C:\Program Files\AskTBar\SrchAstt\1.bin
   C:\WINDOWS\iun6002.exe

   -----------\  Extensions

   (Djouher) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar
   (Djouher) - {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} => adblockplus

   (HADJAB) - {2ba521ac-b9b9-4433-ba45-dba2f02cba5a} => speed-bit
   (HADJAB) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar
   (HADJAB) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fwww.msn.fr%2fimg%2ffr%2ffr-fr%2fdivertissement%2fcelebrites%2fgalery%2fwentworth02.jpg%3f"
   "Search Page"="https://www.google.com/?gws_rd=ssl"
   "Search Bar"="http://www.google.com/toolbar/ie8/sidebar.html"
   "First Home Page"="http://www.microsoft.com/isapi/redir.dll?Prd=ie&Pver=5.0&Ar=ie5update&O1=b1"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Search_URL"="http://www.google.com/toolbar/ie8/sidebar.html"
   "Search Page"="http://us.rd.yahoo.com/customize/ie/defaults/sp/ymj/*https://fr.yahoo.com/?p=us"
   "Start Page"="https://fr.yahoo.com/?p=us"
   "Search Bar"="http://us.rd.yahoo.com/customize/ie/defaults/sb/ymj/*http://www.yahoo.com/ext/search/search.html"


   --------------------\  Recherche d'autres infections

   C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\MessengerSkinner
   C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\MessengerSkinner\Conditions g‚n‚rales.url
   C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\MessengerSkinner\Confidentialit‚.url
   C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\MessengerSkinner\Website.url
   [b]==> EGDACCESS <==/b




   1 - "C:\ToolBar SD\TB_1.txt" - 23/11/2008|13:41 - Option : [1]

   -----------\  Fin du rapport a 13:41:18,14

Et encore merci

Utilisateur anonyme · Answer

Relance ToolbarSD option 2 et montre le rapport

Ensuite, refait Navilog option 1 et montre le rapport

karimosouli · Answer

sa c'est pour ToolbarSD:

 -----------\  ToolBar S&D 1.2.5   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) 4 CPU 3.00GHz )
   BIOS : Award Medallion BIOS v6.00PG
   USER : Djouher ( Administrator )
   BOOT : Normal boot
   Antivirus : ESET NOD32 Antivirus 3.0 3.0 (Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:149 Go (Free:92 Go)
   D:\ (CD or DVD)
   E:\ (CD or DVD)
   F:\ (USB)
   G:\ (USB)
   H:\ (USB)
   I:\ (USB)

   "C:\ToolBar SD" ( MAJ : 20-11-2008|20:25 )
   Option : [2] ( 23/11/2008|14:12 )

   -----------\ SUPPRESSION

   Supprime! - C:\Program Files\AskTBar\bar
   Supprime! - C:\Program Files\AskTBar\SrchAstt
   Supprime! - C:\WINDOWS\iun6002.exe
   Supprime! - C:\Program Files\AskTBar

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  Extensions

   (Djouher) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar
   (Djouher) - {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} => adblockplus

   (HADJAB) - {2ba521ac-b9b9-4433-ba45-dba2f02cba5a} => speed-bit
   (HADJAB) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar
   (HADJAB) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fwww.msn.fr%2fimg%2ffr%2ffr-fr%2fdivertissement%2fcelebrites%2fgalery%2fwentworth02.jpg%3f"
   "Search Page"="https://www.google.com/?gws_rd=ssl"
   "Search Bar"="http://www.google.com/toolbar/ie8/sidebar.html"
   "First Home Page"="http://www.microsoft.com/isapi/redir.dll?Prd=ie&Pver=5.0&Ar=ie5update&O1=b1"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Search_URL"="http://www.google.com/toolbar/ie8/sidebar.html"
   "Search Page"="http://us.rd.yahoo.com/customize/ie/defaults/sp/ymj/*https://fr.yahoo.com/?p=us"
   "Start Page"="https://www.msn.com/fr-fr/"
   "Search Bar"="http://us.rd.yahoo.com/customize/ie/defaults/sb/ymj/*http://www.yahoo.com/ext/search/search.html"


   --------------------\  Recherche d'autres infections

   C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\MessengerSkinner
   C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\MessengerSkinner\Conditions g‚n‚rales.url
   C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\MessengerSkinner\Confidentialit‚.url
   C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\MessengerSkinner\Website.url
   [b]==> EGDACCESS <==/b




   1 - "C:\ToolBar SD\TB_1.txt" - 23/11/2008|13:41 - Option : [1]
   2 - "C:\ToolBar SD\TB_2.txt" - 23/11/2008|14:17 - Option : [2]

   -----------\  Fin du rapport a 14:17:41,23

karimosouli · Answer

Et sa c'est pour Navilog


Search Navipromo version 3.6.9 commencé le 23/11/2008 à 14:24:32,42

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1
Session actuelle : "Djouher" 

Mise à jour le 05.11.2008 à 21h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 6.0.2900.2180 
Système de fichiers : NTFS

Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "C:\WINDOWS" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Djouher\applic~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\MOHAME~1\applic~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\PROPRI~1\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\Djouher\locals~1\applic~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\MOHAME~1\locals~1\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\Djouher\menudm~1\progra~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\MOHAME~1\menudm~1\progra~1" *** 


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings\Djouher\locals~1\applic~1" * 

* Recherche dans "C:\DOCUME~1\MOHAME~1\locals~1\applic~1" * 



*** Recherche fichiers *** 



*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :


* Dans "C:\Documents and Settings\Djouher\locals~1\applic~1" : 


* Dans "C:\DOCUME~1\MOHAME~1\locals~1\applic~1" : 


3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :



*** Analyse terminée le 23/11/2008 à 14:32:50,70 ***


Et encore merci

Utilisateur anonyme · Answer

télécharge OTMoveIt https://www.luanagames.com/index.fr.html (de Old_Timer) sur ton Bureau.
double-clique sur OTMoveIt.exe pour le lancer.
Assure toi que la case Unregister Dll's and Ocx's soit bien cochée
copie la liste qui se trouve en gras ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved. 
C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\MessengerSkinner
C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\MessengerSkinner\Conditions g‚n‚rales.url
C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\MessengerSkinner\Confidentialit‚.url
C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\MessengerSkinner\Website.url

Utilisateur anonyme · Answer

Et fait MoveIt!

karimosouli · Answer

Quand que je clique sur movelt! Une autre fenetre  apparait et me dit Cannot create file C:\_OTMoveIt\MovedFiles\1123208_145646.log. Et dans la case results il y a File/Folder C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\MessengerSkinner not found.
File/Folder C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\MessengerSkinner\Conditions g‚n‚rales.url not found.
File/Folder C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\MessengerSkinner\Confidentialit‚.url not found.
File/Folder C:\DOCUME~1\ALLUSE~1\MENUD~1\PROGRA~1\MessengerSkinner\Website.url not found.
 
Created on 11/23/2008 14:56:46


C'est grave doctor

Utilisateur anonyme · Answer

Lance Navilog option 4
Ecrit ça : MessengerSkinner et fait entrer, montre le rapport ensuite

karimosouli · Answer

voici le rapport demandé:

Clean Navipromo version 3.6.9 commencé le 23/11/2008 à 15:19:26,92

Outil exécuté depuis C:\Program Files
avilog1
Session actuelle : "Djouher" 

Mise à jour le 05.11.2008 à 21h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 6.0.2900.2180
Système de fichiers : NTFS


Mode suppression par méthode manuelle

Nom du fichier saisi : MessengerSkinner

Nettoyage exécuté au redémarrage de l'ordinateur

*** Recherche, création sauvegardes et suppression ***

* Suppression dans "C:\WINDOWS\system32" *


* Suppression dans "C:\Documents and Settings\Djouher\locals~1\applic~1" * 


* Suppression dans "C:\DOCUME~1\MOHAME~1\locals~1\applic~1" * 



*** Suppression dossiers dans "C:\WINDOWS" ***


*** Suppression dossiers dans "C:\Program Files" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\Djouher\applic~1" *** 


*** Suppression dossiers dans "C:\DOCUME~1\MOHAME~1\applic~1" *** 


*** Suppression dossiers dans "C:\DOCUME~1\PROPRI~1\applic~1" *** 


*** Suppression dossiers dans "C:\Documents and Settings\Djouher\locals~1\applic~1" *** 


*** Suppression dossiers dans "C:\DOCUME~1\MOHAME~1\locals~1\applic~1" *** 


*** Suppression dossiers dans "C:\Documents and Settings\Djouher\menudm~1\progra~1" *** 


*** Suppression dossiers dans "C:\DOCUME~1\MOHAME~1\menudm~1\progra~1" *** 



*** Suppression fichiers ***


*** Suppression fichiers temporaires ***

Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\Djouher\locals~1\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\WINDOWS\system32" *


* Dans "C:\Documents and Settings\Djouher\locals~1\applic~1" * 


* Dans "C:\DOCUME~1\MOHAME~1\locals~1\applic~1" * 


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltdt absent !

*** Nettoyage terminé le 23/11/2008 à 15:24:38,04 ***

Utilisateur anonyme · Answer

Refait un hijack

karimosouli · Answer

tiens et excuse pour le temp de reponse:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:30:43, on 23/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32undll32.exe
C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Prayer\Prayer.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEMonitor.exe
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\Documents and Settings\Djouher\Mes documents\Downloads\Programs\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fwww.msn.fr%2fimg%2ffr%2ffr-fr%2fdivertissement%2fcelebrites%2fgalery%2fwentworth02.jpg%3f
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fr.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/ymj/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/ymj/*https://fr.yahoo.com/?p=us
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMIECC.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2fc742d1-59f8-4524-aa4f-cd9c51d98747} - C:\WINDOWS\system32\zeyepome.dll (file missing)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealOne Playerpbrowserrecordplugin.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Windows Live Toolbar Beta - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: islamuslim Toolbar - {fcd5ee58-54d8-4d33-aa8d-54ae85597966} - C:\Program Files\islamuslim	bisl0.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: islamuslim Toolbar - {fcd5ee58-54d8-4d33-aa8d-54ae85597966} - C:\Program Files\islamuslim	bisl0.dll
O3 - Toolbar: &Windows Live Toolbar Beta - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [EEventManager] C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
O4 - HKLM\..\Run: [AXIS TONS THE MP3] C:\Documents and Settings\All Users\Application Data\Readme Live Axis Tons\Amok team.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [fuyamawewu] Rundll32.exe "C:\WINDOWS\system32\meburaro.dll",s
O4 - HKLM\..\Run: [ecd85eae] rundll32.exe "C:\WINDOWS\system32\misiruvu.dll",b
O4 - HKLM\..\Run: [CPMefeb6d32] Rundll32.exe "c:\windows\system32	uhuduta.dll",a
O4 - HKCU\..\Run: [IDMan] C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe /onboot
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [zweitgeist Assistant] "C:\Program Files\weblin\weblinAssistant.exe"
O4 - HKCU\..\Run: [Heartbags] C:\DOCUME~1\Djouher\APPLIC~1\ITCHSE~1\DASH BLEH.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [fuyamawewu] Rundll32.exe "C:\WINDOWS\system32\meburaro.dll",s (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bilal.lnk = C:\Program Files\Prayer\Prayer.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: Download all links with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEExt.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O20 - AppInit_DLLs: C:\WINDOWS\system32\wehojavi.dll c:\windows\system32\jojayuza.dll c:\windows\system32	uhuduta.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32	uhuduta.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32	uhuduta.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
O23 - Service: Localisateur d'appels de procédure distante (RPC) (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe
O23 - Service: QoS RSVP (RSVP) - Unknown owner - C:\WINDOWS\system32svp.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe

Utilisateur anonyme · Answer

télécharge OTMoveIt https://www.luanagames.com/index.fr.html (de Old_Timer) sur ton Bureau.
double-clique sur OTMoveIt.exe pour le lancer.
Assure toi que la case Unregister Dll's and Ocx's soit bien cochée
copie la liste qui se trouve en gras ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved. 
C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe 
Et fait MoveIt!

Montre ensuite le rapport

karimosouli · Answer

tien:

C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe moved successfully.
 
Created on 11/23/2008 16:42:03

Utilisateur anonyme · Answer

--------------------------------------------- [ ! ATTENTION ! ] ----------------------------------------------------------
!! déconnecte toi, ferme toutes tes applications en cours et DÉSACTIVE TOUTES TES DÉFENSES (anti-virus, antispyware, pare-feu) le temps de la manipulation : en effet , activés, ils pourraient gêner fortement la procédure de recherche et de nettoyage de l'outil ( voir planter le PC )...Tu les réactiveras donc après !!

---> Surtout, si tu rencontres des difficultés à ce niveau là, dis le moi avant de poursuivre...

Tuto ici : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
---------------------------------------------------------------------------------------------------------------------------------

Ensuite :

Double-clique sur C-Fix.exe (= combofix.exe ) .

Appuie sur une touche pour démarrer le scan .

Attention : n'utilise pas ta souris ni ton clavier pendant que le programme tourne. Cela pourrait figer l'ordi ---> si un message d'erreur windows apparait à un moment : clique sur la croix rouge en haut à droite de la fenêtre pour la fermer

Le rapport sera crée dans: C:\Combofix.txt , poste le ici stp

karimosouli · Answer

tien: ComboFix 08-11-22.02 - Djouher 2008-11-23 17:15:26.1 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.266 [GMT 1:00] Lancé depuis: c:\documents and settings\Djouher\Bureau\ComboFix.exe Commutateurs utilisés :: c:\documents and settings\Djouher\Bureau\WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe * Un nouveau point de restauration a été créé . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Menu Démarrer\Programmes\MessengerSkinner c:\documents and settings\All Users\Menu Démarrer\Programmes\MessengerSkinner\Conditions générales.url c:\documents and settings\All Users\Menu Démarrer\Programmes\MessengerSkinner\Confidentialité.url c:\documents and settings\All Users\Menu Démarrer\Programmes\MessengerSkinner\Website.url c:\program files\INSTALL.LOG c:\windows\system32\_000000_.tmp.dll c:\windows\system32\_000001_.tmp.dll c:\windows\system32\~.exe c:\windows\system32\boserote.dll c:\windows\system32\etoresob.ini c:\windows\system32\hewurogo.dll c:\windows\system32\jojayuza.dll c:\windows\system32\misiruvu.dll c:\windows\system32\ogoruweh.ini c:\windows\system32\ohigedis.ini c:\windows\system32\sidegiho.dll c:\windows\system32 orayiya.dll c:\windows\system32 uhuduta.dll c:\windows\system32\uvurisim.ini c:\windows\system32\votojoye.dll . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_BOONTY_GAMES -------\Service_Boonty Games ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-23 au 2008-11-23 )))))))))))))))))))))))))))))))))))) . 2008-11-23 16:42 . 2008-11-23 16:42 d-------- C:\_OTMoveIt 2008-11-23 13:34 . 2008-11-23 14:17 d-------- C:\ToolBar SD 2008-11-23 12:40 . 2008-11-23 15:24 d-------- c:\program files\Navilog1 2008-11-22 13:03 . 2008-11-22 13:03 d-------- c:\documents and settings\Djouher\Application Data\Phoenix 2008-11-21 09:52 . 2008-11-21 09:54 d-------- c:\documents and settings\All Users\Application Data\Lavasoft 2008-11-19 15:58 . 2008-11-19 15:58 d-------- c:\program files\Itch seek 2008-11-19 15:51 . 2008-11-19 15:59 d-------- c:\documents and settings\All Users\Application Data\Readme Live Axis Tons 2008-11-19 15:50 . 2008-11-22 12:27 d-------- c:\documents and settings\Djouher\Application Data\Itch seek 2008-11-19 13:33 . 2008-11-21 19:58 d-------- c:\program files\weblin 2008-11-19 13:32 . 2008-11-21 19:58 d-------- c:\documents and settings\Djouher\Application Data\zweitgeist 2008-11-15 22:48 . 2008-11-15 22:48 0 --ah----- c:\windows\SwSys2.bmp 2008-11-15 22:48 . 2008-11-15 22:48 0 --ah----- c:\windows\SwSys1.bmp 2008-11-15 22:44 . 2008-11-21 19:56 d-------- c:\program files\Legacy Interactive 2008-11-09 11:12 . 2008-11-09 11:12 d-------- c:\program files\VideoLAN 2008-11-09 10:20 . 2002-07-09 18:07 724,992 --------- c:\windows\NuNinst.exe 2008-11-09 10:19 . 2002-03-13 14:13 610,304 --------- c:\windows\UNNMP.exe 2008-11-09 10:19 . 2002-03-13 14:44 39,936 --------- c:\windows\UNNMP.cfg 2008-11-09 10:18 . 2008-11-21 09:40 d-------- c:\program files\Ahead 2008-11-03 20:43 . 2008-11-03 20:43 d-------- c:\windows\system32\Midnight Club Los Angeles dir 2008-11-03 20:43 . 2008-11-03 20:43 520,192 --a------ c:\windows\system32\Midnight Club Los Angeles.scr 2008-11-02 21:25 . 2008-11-02 21:25 d-------- c:\documents and settings\Djouher\Application Data\OpenOffice.org2 2008-11-02 11:23 . 2008-11-03 10:39 d-------- c:\documents and settings\Djouher\Application Data\Epson 2008-11-01 20:20 . 2008-11-01 20:20 0 --a------ c:\windows\EEventManager.INI 2008-11-01 19:21 . 2007-12-07 03:08 86,528 --a------ c:\windows\system32\E_FLBEME.DLL 2008-11-01 19:21 . 2007-12-07 03:01 78,848 --a------ c:\windows\system32\E_FD4BEME.DLL 2008-11-01 19:21 . 2007-04-10 02:06 8,192 --a------ c:\windows\system32\E_DCINST.DLL 2008-11-01 19:19 . 2008-11-01 19:19 d-------- c:\documents and settings\All Users\Application Data\UDL 2008-11-01 19:17 . 2008-11-01 19:18 d-------- c:\program files\Epson Software 2008-11-01 19:15 . 2008-11-01 19:22 d-------- c:\documents and settings\All Users\Application Data\EPSON 2008-10-27 20:16 . 2003-07-02 17:54 475,136 --a------ c:\windows\system32\SLLights.dll 2008-10-27 20:16 . 2003-07-02 17:23 401,408 --a------ c:\windows\system32\slcpappl.cpl 2008-10-27 20:16 . 2003-07-02 17:12 376,832 --a------ c:\windows\system32\slmh.exe 2008-10-27 20:16 . 2003-07-02 17:12 351,388 --a------ c:\windows\system32\slmh.cab 2008-10-27 20:16 . 2003-07-02 16:39 167,936 --a------ c:\windows\system32\minirec.exe 2008-10-27 20:16 . 2003-07-02 16:41 155,648 --a------ c:\windows\system32\amr_cpl.dll 2008-10-27 20:16 . 2003-05-15 15:31 138,560 --a------ c:\windows\system32\slcpappl.chm 2008-10-27 20:16 . 2003-07-16 12:40 135,168 --a------ c:\windows\system32\SLMOHServ.dll 2008-10-27 20:16 . 2003-06-09 10:25 130,190 --a------ c:\windows\sl.lng 2008-10-27 20:16 . 2003-07-02 17:44 61,440 --a------ c:\windows\SmCfg.exe 2008-10-27 20:16 . 2003-07-02 18:38 14,976 --a------ c:\windows\system32\drivers\winddx.sys 2008-10-23 16:22 . 2008-11-21 20:11 d-------- c:\program files\Mes Vacances en Photo . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-23 16:14 --------- d-----w c:\documents and settings\Djouher\Application Data\DMCache 2008-11-23 16:13 --------- d-----w c:\program files\Prayer 2008-11-22 12:07 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP 2008-11-21 17:19 --------- d-----w c:\program files\iTunes 2008-11-21 17:16 --------- d-----w c:\program files\LogProtect 2008-11-21 17:00 --------- d-----w c:\program files\speed-bit 2008-11-21 16:58 --------- d-----w c:\program files\Time4Worker 2008-11-21 16:47 --------- d-----w c:\program files\Google 2008-11-21 16:39 --------- d-----w c:\program files\Java 2008-11-21 16:31 --------- d-----w c:\program files\Lavasoft 2008-11-21 16:31 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard 2008-11-21 09:43 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-21 09:09 --------- d-----w c:\program files\Transparent 2008-11-21 09:08 --------- d-----w c:\program files\Axialis 2008-11-21 09:07 --------- d-----w c:\program files\AVS4YOU 2008-11-01 18:18 --------- d-----w c:\program files\Fichiers communs\InstallShield 2008-11-01 18:18 --------- d-----w c:\program files\EPSON 2008-10-27 19:14 --------- d-----w c:\program files\Microsoft Silverlight 2008-10-27 18:38 --------- d-----w c:\documents and settings\All Users\Application Data\Skype 2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-20 07:04 --------- d-----w c:\program files\Picasa2 2008-10-16 19:46 --------- d-----w c:\program files\DivX 2008-10-16 12:48 --------- d-----w c:\program files\Windows Live 2008-10-16 12:48 --------- d-----w c:\program files\Microsoft Office Outlook Connector 2008-10-16 12:41 --------- d-----w c:\program files\Windows Live Toolbar 2008-10-16 12:38 --------- d-----w c:\program files\Microsoft 2008-10-16 12:26 --------- d-----w c:\program files\Fichiers communs\Windows Live 2008-10-15 18:19 --------- d-----w c:\program files\QuickTime 2008-10-15 18:18 --------- d-----w c:\program files\Fichiers communs\Apple 2008-10-15 17:43 --------- d-----w c:\program files\Safari 2008-10-15 17:35 --------- d-----w c:\program files\Bonjour 2008-09-25 17:02 --------- d-----w c:\documents and settings\Djouher\Application Data\e frontier 2008-09-05 13:56 287,744 ----a-w c:\windows\WLXPGSS.SCR . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9421DD08-935F-4701-A9CA-22DF90AC4EA6}] 2008-04-02 13:24 266240 --a------ c:\program files\Epson Software\Easy Photo Print\EPTBL.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fcd5ee58-54d8-4d33-aa8d-54ae85597966}] 2008-11-22 22:27 1784856 --a------ c:\program files\islamuslim bisl0.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{fcd5ee58-54d8-4d33-aa8d-54ae85597966}"= "c:\program files\islamuslim bisl0.dll" [2008-11-22 1784856] "{9421DD08-935F-4701-A9CA-22DF90AC4EA6}"= "c:\program files\Epson Software\Easy Photo Print\EPTBL.dll" [2008-04-02 266240] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{FCD5EE58-54D8-4D33-AA8D-54AE85597966}"= "c:\program files\islamuslim bisl0.dll" [2008-11-22 1784856] [HKEY_CLASSES_ROOT\clsid\{fcd5ee58-54d8-4d33-aa8d-54ae85597966}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IDMan"="c:\documents and settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe" [2007-12-21 2573744] "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000] "MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2008-09-08 3513344] "Heartbags"="c:\docume~1\Djouher\APPLIC~1\ITCHSE~1\DASH BLEH.exe" [2008-11-19 594432] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB ealsched.exe" [2008-01-29 185896] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696] "AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936] "EEventManager"="c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe" [2008-05-07 591696] "AXIS TONS THE MP3"="c:\documents and settings\All Users\Application Data\Readme Live Axis Tons\Amok team.exe" [2008-11-23 14515200] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2007-12-21 1443072] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Bilal.lnk - c:\program files\Prayer\Prayer.exe [2006-02-03 1447424] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{88485281-8b4b-4f8d-9ede-82e29a064277}"= "c:\progra~1\MarkAny\CONTEN~1\MACSMA~1.DLL" [2004-11-23 192512] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "UIHost"="c:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe" [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%ProgramFiles%\AOL 9.0\aol.exe"= "%windir%\system32\sessmgr.exe"= "c:\APPS\Inventime\my.exe"= "c:\WINDOWS\system32\muzapp.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "c:\Program Files\sixteen tons entertainment\Emergency 4\Em4.exe"= "c:\program files\Microsoft ActiveSync apimgr.exe"= c:\program files\Microsoft ActiveSync apimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "c:\Program Files\Real\RealOne Player\realplay.exe"= "c:\Program Files\Bonjour\mDNSResponder.exe"= "c:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"= "c:\Program Files\Windows Live\Messenger\msnmsgr.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service R1 epfwtdir;epfwtdir;c:\windows\system32\DRIVERS\epfwtdir.sys [2007-12-21 33800] R2 fssfltr;FssFltr;c:\windows\system32\DRIVERS\fssfltr.sys [2008-10-16 56344] S3 fsssvc;Windows Live Family Safety;"c:\program files\Windows Live\Family Safety\fsssvc.exe" [2008-09-04 512536] . Contenu du dossier 'Tâches planifiées' 2008-11-23 c:\windows\Tasks\1-Click Maintenance.job - c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [] 2008-11-23 c:\windows\Tasks\8B841DC78F879383.job - c:\docume~1\djouher\applic~1\itchse~1\DELETE MEMO TONS.exe [2008-11-19 15:59] 2008-11-23 c:\windows\Tasks\MP Scheduled Scan.job - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20] 2007-08-30 c:\windows\Tasks\Rappel d'enregistrement 2.job - c:\windows\system32\OOBE\oobebaln.exe [2004-08-05 13:00] . - - - - ORPHELINS SUPPRIMES - - - - BHO-{2fc742d1-59f8-4524-aa4f-cd9c51d98747} - c:\windows\system32\zeyepome.dll WebBrowser-{2BA521AC-B9B9-4433-BA45-DBA2F02CBA5A} - (no file) HKCU-Run-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe HKCU-Run-zweitgeist Assistant - c:\program files\weblin\weblinAssistant.exe HKLM-Run-fuyamawewu - c:\windows\system32\meburaro.dll . ------- Examen supplémentaire ------- . FireFox -: Profile - c:\documents and settings\Djouher\Application Data\Mozilla\Firefox\Profiles\xy7y4dxb.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.fr FF -: plugin - c:\program files\DivX\DivX Content Uploader pUpload.dll FF -: plugin - c:\program files\Microsoft Silverlight\2.0.30523.8 pctrl.dll FF -: plugin - c:\program files\Microsoft Silverlight\2.0.31005.0 pctrl.1.0.30401.0.dll FF -: plugin - c:\program files\Microsoft Silverlight\2.0.31005.0 pctrl.dll FF -: plugin - c:\program files\Picasa2 pPicasa2.dll FF -: plugin - c:\program files\Real\RealOne Player\Netscape6 ppl3260.dll FF -: plugin - c:\program files\Real\RealOne Player\Netscape6 prjplug.dll FF -: plugin - c:\program files\Real\RealOne Player\Netscape6 prpjplug.dll FF -: plugin - c:\program files\Real\RhapsodyPlayerEngine prhapengine.dll FF -: plugin - c:\program files\Viewpoint\Viewpoint Experience Technology pViewpoint.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-23 17:21:04 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... c:\windows\TEMP\TMP0000002774A0FE6FC8E51562 524288 bytes Scan terminé avec succès Fichiers cachés: 1 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MysqlInventime] "ImagePath"="c:\mysql\bin\mysqld-nt MysqlInventime" . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'winlogon.exe'(580) c:\windows\system32 saenh.dll c:\windows\system32\WgaLogon.dll - - - - - - - > 'lsass.exe'(636) c:\windows\system32\msprivs.dll c:\windows\system32 saenh.dll . ------------------------ Autres processus actifs ------------------------ . c:\windows\system32\ati2evxx.exe c:\program files\Windows Defender\MsMpEng.exe c:\progra~1\FICHIE~1\AOL\ACS\AOLacsd.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe c:\apps\Powercinema\Kernel\TV\CLCapSvc.exe c:\apps\Powercinema\Kernel\TV\CLSched.exe c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe c:\apps\HIDSERVICE\HidService.exe c:\program files\Internet Explorer\IEXPLORE.EXE c:\program files\Internet Explorer\IEXPLORE.EXE c:\progra~1\MI3AA1~1 apimgr.exe c:\documents and settings\Default User\Local Settings\Temp\bsasee3y5d\IEMonitor.exe c:\program files\Windows Live\Contacts\wlcomm.exe . ************************************************************************** . Heure de fin: 2008-11-23 17:29:15 - La machine a redémarré [Djouher] ComboFix-quarantined-files.txt 2008-11-23 16:29:10 Avant-CF: 98 947 493 888 octets libres Après-CF: 99,030,700,032 octets libres 255 --- E O F --- 2008-11-23 16:24:18

Utilisateur anonyme · Answer

Télécharge Spyware Terminator ici : https://filehippo.com/download_spyware_terminator/?ex=CORE-116.0
Installe le (n'accepte pas la toolbar !!!!)
Ensuite sur le menu, fait scan et scan complet, patiente, supprime tout ce qui trouve et montre le rapport

karimosouli · Answer

tien:

Logfile of Spyware Terminator v2.5.0.567 (db:2.011.021.000)
Scan Time: 23/11/2008 17:59:07  length: 1704 s
Platform: WXP (5.1.0.2600)
User: Admin
Boot Mode: Normal
Scan type: Full_Spyware_Scan
Scanned Objects: 54656 (Critical:0)
Filter: No System items, No Safe items, No Invalid items

Running Processes
Ati2evxx.exe [ATI Technologies Inc.] : C:\WINDOWS\system32\Ati2evxx.exe
AOLacsd.exe [America Online, Inc.] : C:\Program Files\Fichiers communs\AOL\ACS\AOLacsd.exe
btwdins.exe [WIDCOMM, Inc.] : C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
CLCapSvc.exe : C:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
CLSched.exe : C:\APPS\Powercinema\Kernel\TV\CLSched.exe
CLMLServer.exe [Cyberlink] : C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
CLMLService.exe [Cyberlink] : C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
ekrn.exe [ESET] : C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
HIDSERVICE.exe : C:\APPS\HIDSERVICE\HIDSERVICE.exe
EEventManager.exe [SEIKO EPSON CORPORATION] : C:\Program Files\Epson Software\Event Manager\EEventManager.exe
egui.exe [ESET] : C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
IDMan.exe [Tonec Inc.] : C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe
rapimgr.exe [Microsoft Corporation] : C:\Program Files\Microsoft ActiveSyncapimgr.exe
Prayer.exe [Bilal Team] : C:\Program Files\Prayer\Prayer.exe
IEMonitor.exe [Tonec Inc.] : C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEMonitor.exe
wlcomm.exe [Microsoft Corporation] : C:\Program Files\Windows Live\Contacts\wlcomm.exe
wlmail.exe [Microsoft Corporation] : C:\Program Files\Windows Live\Mail\wlmail.exe

Internet Settings
R - HKLM\Software\Microsoft\Internet Explorer\Main, Start Page = https://www.msn.com/fr-fr/
R - HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant = https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm
R - HKLM\Software\Microsoft\Internet Explorer\Search, CustomizeSearch = https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm
R - HKLM\System\CurrentControlSet\Services\Tcpip\Parameters, Domain = 
R - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Telephony, DomainName = 

BHO
02 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} -  [Tonec Inc.] : C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMIECC.dll
02 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} -  [Yahoo! Inc.] : C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
02 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} -  [RealPlayer] : C:\Program Files\Real\RealOne Playerpbrowserrecordplugin.dll
02 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -  [Microsoft Corp.] : C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
02 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -  [SEIKO EPSON CORPORATION / CyCom Technology Corp.] : C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
02 - BHO: Windows Live Toolbar Beta - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} -  [Microsoft Corporation] : C:\Program Files\Windows Live\Toolbar\wltcore.dll
02 - BHO: islamuslim Toolbar - {fcd5ee58-54d8-4d33-aa8d-54ae85597966} -  [Conduit Ltd.] : C:\Program Files\islamuslim	bisl0.dll

Toolbars
03 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} -  [Yahoo! Inc.] : C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
03 - Toolbar: islamuslim Toolbar - {fcd5ee58-54d8-4d33-aa8d-54ae85597966} -  [Conduit Ltd.] : C:\Program Files\islamuslim	bisl0.dll
03 - Toolbar: &Windows Live Toolbar Beta - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  [Microsoft Corporation] : C:\Program Files\Windows Live\Toolbar\wltcore.dll
03 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -  [SEIKO EPSON CORPORATION / CyCom Technology Corp.] : C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll

StartUps
04 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, IDMan :  [Tonec Inc.] : C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe
04 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, MsnMsgr :  [Microsoft Corporation] : C:\Program Files\WINDOWS LIVE\MESSENGER\MSNMSGR.EXE
04 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, Heartbags :  [O] : C:\Documents and Settings\Djouher\Application Data\Itch seek\DASH BLEH.exe
04 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, AppleSyncNotifier :  [Apple Inc.] : C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
04 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, EEventManager :  [SEIKO EPSON CORPORATION] : C:\Program Files\Epson Software\Event Manager\EEventManager.exe
04 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, AXIS TONS THE MP3 :  : C:\Documents and Settings\All Users\Application Data\Readme Live Axis Tons\Amok team.exe
04 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, egui :  [ESET] : C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
04 - Startup: %STARTUPALL%\Bilal.lnk [Bilal Team] : C:\Program Files\Prayer\Prayer.exe

Shell Extensions
RecordNow! SendToExt - {DEE12703-6333-4D4E-8F34-738C4DCC2E04} -  : C:\Apps\RecordNow\shlext.dll
RealOne Player Context Menu Class - {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} -  [RealNetworks, Inc.] : C:\Program Files\Real\RealOne Playerpshell.dll
CLSID_WLMCMimeFilter - {0563DB41-F538-4B37-A92D-4659049B7766} -  [Microsoft Corporation] : C:\Program Files\Windows Live\Mail\mailcomm.dll
7-Zip Shell Extension - {23170F69-40C1-278A-1000-000100020000} -  [Igor Pavlov] : C:\Program Files\7-Zip\7-zip.dll
WinRAR - {B41DB860-8EE4-11D2-9906-E49FADC173CA} -  : C:\Program Files\WinRARarext.dll
My Bluetooth Places - {6af09ec9-b429-11d4-a1fb-0090960218cb} -  [WIDCOMM, Inc.] : C:\WINDOWS\system32\btneighborhood.dll
Microsoft Office Outlook - {00020D75-0000-0000-C000-000000000046} -  [Microsoft Corporation] : C:\Program Files\Microsoft Office\OFFICE11\MLSHEXT.DLL
Outlook File Icon Extension - {0006F045-0000-0000-C000-000000000046} -  [Microsoft Corporation] : C:\Program Files\Microsoft Office\OFFICE11\OLKFSTUB.DLL
Appareil mobile - {49BF5420-FA7F-11cf-8011-00A0C90A8F78} -  [Microsoft Corporation] : C:\Program Files\Microsoft ActiveSync\Wcesview.dll
 - {06A2568A-CED6-4187-BB20-400B8C02BE5A} -  [Microsoft Corporation] : C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe
Windows Live Photo Gallery Viewer Autoplay Shim - {00F33137-EE26-412F-8D71-F84E4C2C6625} -  [Microsoft Corporation] : C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
Windows Live Photo Gallery Autoplay Drop Target - {2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} -  [Microsoft Corporation] : C:\Program Files\WINDOWS LIVE\PHOTO GALLERY\WLXPHOTOGALLERY.EXE
Windows Live Photo Gallery Editor Drop Target - {00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} -  [Microsoft Corporation] : C:\Program Files\WINDOWS LIVE\PHOTO GALLERY\WLXPHOTOGALLERY.EXE
Windows Live Photo Gallery Viewer Drop Target - {00F374B7-B390-4884-B372-2FC349F2172B} -  [Microsoft Corporation] : C:\Program Files\WINDOWS LIVE\PHOTO GALLERY\WLXPHOTOGALLERY.EXE
Windows Live Photo Gallery Viewer Shim - {00F346CB-35A4-465B-8B8F-65A29DBAB1F6} -  [Microsoft Corporation] : C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
Windows Live Photo Gallery Editor Shim - {00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} -  [Microsoft Corporation] : C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
Windows Live Photo Gallery Viewer Autoplay Shim - {00F30F90-3E96-453B-AFCD-D71989ECC2C7} -  [Microsoft Corporation] : C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
Eset Smart Security - Context Menu Shell Extension - {B089FE88-FB52-11D3-BDF1-0050DA34150D} -  [ESET] : C:\Program Files\ESET\ESET NOD32 Antivirus\shellExt.dll

Shell Extecute Hooks
ShellHook Class - {{88485281-8b4b-4f8d-9ede-82e29a064277}} -  [MarkAny Cooperation.] : C:\Program Files\MarkAny\ContentSafer\MACSMANAGER.dll

Protocol Handler
 - {828030A1-22C1-4009-854F-8E305202313F} -  [Microsoft Corporation] : C:\Program Files\Windows Live\Messenger\msgrapp.14.0.5027.0908.dll
 - {828030A1-22C1-4009-854F-8E305202313F} -  [Microsoft Corporation] : C:\Program Files\Windows Live\Messenger\msgrapp.14.0.5027.0908.dll
Data Page Pluggable Protocol mso-offdap Handler - {3D9F03FA-7A94-11D3-BE81-0050048385D1} -  [Microsoft Corporation] : C:\Program Files\Fichiers communs\Microsoft Shared\Web Components\10\OWC10.DLL
Windows Live Mail HTML Asynchronous Pluggable Protocol Handler - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} -  [Microsoft Corporation] : C:\Program Files\Windows Live\Mail\mailcomm.dll

Services
23 - [Microsoft Corporation] : C:\WINDOWS\system32\DRIVERS\adpu160m.sys
23 - [Acer Laboratories Inc.] : C:\WINDOWS\system32\DRIVERS\aliide.sys
23 - [America Online, Inc.] : C:\Program Files\Fichiers communs\AOL\ACS\AOLacsd.exe
23 - [ATI Technologies Inc.] : C:\WINDOWS\system32\Ati2evxx.exe
23 - [WIDCOMM, Inc.] : C:\WINDOWS\system32\drivers\btkrnl.sys
23 - : C:\WINDOWS\system32\drivers\btserial.sys
23 - [WIDCOMM, Inc.] : C:\WINDOWS\system32\drivers\btslbcsp.sys
23 - [WIDCOMM, Inc.] : C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
23 - : C:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
23 - : C:\APPS\Powercinema\Kernel\TV\CLSched.exe
23 - [CMD Technology, Inc.] : C:\WINDOWS\system32\DRIVERS\cmdide.sys
23 - [Cyberlink] : C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
23 - [ESET] : C:\WINDOWS\system32\DRIVERS\eamon.sys
23 - [ESET] : C:\WINDOWS\system32\DRIVERS\easdrv.sys
23 - [ESET] : C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
23 - : C:\WINDOWS\system32\DRIVERS\epfwtdir.sys
23 - [Microsoft Corporation] : C:\WINDOWS\system32\DRIVERS\fssfltr.sys
23 - [GEAR Software Inc.] : C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
23 - : C:\APPS\HIDSERVICE\HIDSERVICE.exe
23 - [Realtek Semiconductor Corp.] : C:\WINDOWS\system32\drivers\RtkHDAud.sys
23 - [American Megatrends Inc.] : C:\WINDOWS\system32\DRIVERS\mraid35x.sys
23 - [AntiCracking] : C:\WINDOWS\system32\STEC3.sys
23 - [LSI Logic] : C:\WINDOWS\system32\DRIVERS\symc8xx.sys
23 - [LSI Logic] : C:\WINDOWS\system32\DRIVERS\sym_hi.sys
23 - [LSI Logic] : C:\WINDOWS\system32\DRIVERS\sym_u3.sys
23 - [Promise Technology, Inc.] : C:\WINDOWS\system32\DRIVERS\ultra.sys
23 - [America Online, Inc.] : C:\WINDOWS\system32\DRIVERS\wanatw4.sys

IE URL Search Hooks
Yahoo! Toolbar - {{EF99BD32-C1FB-11D2-892F-0090271D4F88}} -  [Yahoo! Inc.] : C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

Advanced Files Report
%SYSDIR%\Ati2evxx.exe [ATI Technologies Inc.] [ATI External Event Utility for WindowsNT and Windows9X] MD5=DF7CE16CFF3217E71742E3D700844C07 SIZE=389120
%SYSDIR%\bthcrp.dll [WIDCOMM, Inc.] [Bluetooth Software 1.4.2 Build 10] MD5=916AA8A6FCE7A297A2387C0411E73036 SIZE=98304
%SYSDIR%\WidcommSdk.dll [WIDCOMM, Inc.] [Bluetooth Software 1.4.2 Build 10] MD5=8CFBD9A9B55CC7798A28FB753AB0E08C SIZE=503808
%SYSDIR%\wbtapi.dll [WIDCOMM, Inc.] [Bluetooth Software 1.4.2 Build 10] MD5=A33297E6E7D60225439CBEE72D528433 SIZE=536637
%SYSDIR%\E_FLBEME.DLL [SEIKO EPSON CORPORATION] [EPSON Bi-directional Printer] MD5=6D59EC87391A45019D95841AF590D890 SIZE=86528
%SYSDIR%\E_SL2340.DLL [SEIKO EPSON CORPORATION] [EPSON Bidirectional Printer] MD5=5B9D556A93A49CE03E3B905F5FDFC680 SIZE=61598
%COMMONFILES%\AOL\ACS\AOLacsd.exe [America Online, Inc.] [AOL Connectivity Service] MD5=BB1DA35335D88DB1CE1FEE8BD35F2248 SIZE=1123440
%PROGRAMFILES%\WIDCOMM\Bluetooth Software\bin\btwdins.exe [WIDCOMM, Inc.] [Bluetooth Software 1.4.2 Build 10] MD5=09EAE9824FBBB881E7B4D9F5CAFD24F0 SIZE=135168
%SystemDiskRoot%\APPS\Powercinema\Kernel\TV\CLCapSvc.exe [CLCapSvc Module] MD5=0326B36B8331569F25DB4A06412261F9 SIZE=176220
%SystemDiskRoot%\APPS\Powercinema\Kernel\TV\CLSched.exe [CLSched Module] MD5=F905E8799D4EBF0597DFEEE659ECBA36 SIZE=110682
%PROGRAMFILES%\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe [Cyberlink] [Cyberlink Media Library Server] MD5=2BB11CD367D49098D57A8638ADB5BCF6 SIZE=24576
%PROGRAMFILES%\CyberLink\Shared Files\CLML_NTService\CLMLService.exe [Cyberlink] [Cyberlink MediaLibrary NT Service] MD5=0B591A91E838A1C6D11920491C42199E SIZE=737379
%SystemDiskRoot%\Apps\Powercinema\Kernel\HomeNetWorking\CLNetMedia.dll [CLNetMedia Module] MD5=DEA8CA9F4B7355F765E883BF3002D06C SIZE=229458
%PROGRAMFILES%\ESET\ESET NOD32 Antivirus\ekrn.exe [ESET] [ESET Smart Security] MD5=D5D4124827086BA54F6BFE75CE330531 SIZE=468224
%PROGRAMFILES%\ESET\ESET NOD32 Antivirus\ekrnScan.dll [ESET] [ESET Smart Security] MD5=748C898B132D37187AACE7C19849FC67 SIZE=156928
%PROGRAMFILES%\ESET\ESET NOD32 Antivirus\ekrnAmon.dll [ESET] [ESET Smart Security] MD5=B61CF090F99137C761EE81EC07A7086B SIZE=120064
%PROGRAMFILES%\ESET\ESET NOD32 Antivirus\ekrnEmon.dll [ESET] [ESET Smart Security] MD5=7F29B4CD000376CCC226F1180BDC1826 SIZE=99584
%PROGRAMFILES%\ESET\ESET NOD32 Antivirus\ekrnEpfw.dll [ESET] [ESET Smart Security] MD5=BBBAB58F30F6634674856085265A4E32 SIZE=251136
%PROGRAMFILES%\ESET\ESET NOD32 Antivirus\ekrnUpdate.dll [ESET] [ESET Smart Security] MD5=591C12301D2A14A7077F5B2BF774949A SIZE=132352
%PROGRAMFILES%\ESET\ESET NOD32 Antivirus\updater.dll [ESET] [ESET Smart Security] MD5=5748F6E9A70F8D0740E82AAFFC756E7E SIZE=177408
%PROGRAMFILES%\ESET\ESET NOD32 Antivirus\ekrnMailPlugins.dll [ESET] [ESET Smart Security] MD5=76D9DA47CFCB8F27BA1F37816B24088A SIZE=99584
%SystemDiskRoot%\APPS\HIDSERVICE\HIDSERVICE.exe MD5=69202C049779AE09470370F163363F13 SIZE=49152
%PROGRAMFILES%\ESET\ESET NOD32 Antivirus\eguiScan.dll [ESET] [ESET Smart Security] MD5=1F34681C9142A14074DE8D652D4DCA61 SIZE=279808
%PROGRAMFILES%\ESET\ESET NOD32 Antivirus\eguiAmon.dll [ESET] [ESET Smart Security] MD5=BD502632EC4614DFEBD897975BA7B651 SIZE=99584
%PROGRAMFILES%\ESET\ESET NOD32 Antivirus\eguiEmon.dll [ESET] [ESET Smart Security] MD5=268DFF9F4482F1EE30F9FFABC77AFF4E SIZE=107776
%PROGRAMFILES%\ESET\ESET NOD32 Antivirus\eguiEpfw.dll [ESET] [ESET Smart Security] MD5=778F84F111C21BAF767CB72AA6934026 SIZE=771328
%PROGRAMFILES%\ESET\ESET NOD32 Antivirus\eguiUpdate.dll [ESET] [ESET Smart Security] MD5=CA7098EF64BC885530DEAEA533D662A1 SIZE=230656
%PROGRAMFILES%\ESET\ESET NOD32 Antivirus\eguiMailPlugins.dll [ESET] [ESET Smart Security] MD5=E0B1E342631450BFD1E5860919A9F78C SIZE=87296
%SystemDiskRoot%\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\idmmkb.dll [Tonec Inc.] [Internet Download Manager] MD5=2DAD6798DFEF87D21E58CF58F0EAE807 SIZE=34488
%PROGRAMFILES%\Microsoft ActiveSyncapimgr.exe [Microsoft Corporation] [Microsoft ActiveSync] MD5=DCFC84480C76D862D9BFD386EA6E8DE7 SIZE=199464
%PROGRAMFILES%\Prayer\Prayer.exe [Bilal Team] [Prayer] MD5=E43C677E919644AF317F29D15B7A9A55 SIZE=1447424
%SYSDIR%\DartWeb.dll [Dart Communications] [PowerTCP© Tools] MD5=8475C7148889C759E15FCEEF9DF521B8 SIZE=118784
%SYSDIR%\DartSock.dll [Dart Communications] [PowerTCP© Tools] MD5=BF3853899FDCABF4510568ECB95D661B SIZE=221184
%SYSDIR%\DartMail.dll [Dart Communications] [PowerTCP© Tools] MD5=6414EA8173ECB95BCC76A2740BE44DE2 SIZE=438272
%SYSDIR%\DartUtil.dll [Dart Communications] [PowerTCP© Tools] MD5=F4316FF9FD5AE038F4387799B478AF1C SIZE=114688
%SYSDIR%\bsrmdec.ax [Gabest] [RealMedia Splitter] MD5=05B85D191C4331CD959A226574BED1F1 SIZE=356352
%SystemDiskRoot%\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEMonitor.exe [Tonec Inc.] [IEMonitor Application] MD5=E732348FE3A96496D1215A215173577A SIZE=251576
%SystemDiskRoot%\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMIECC.dll [Tonec Inc.] [Internet Download Manager Module] MD5=B2C439F5FD7E6F278463F9C0DCB672CB SIZE=95664
%PROGRAMFILES%\Adobe\Reader 8.0\Reader\AcroRdIF.dll [Adobe Systems, Inc.] [Adobe PDF IFilter] MD5=2DC8C8C2DFB9173C2E940A01A50BDA02 SIZE=108144
%PROGRAMFILES%\Adobe\Reader 8.0\Reader\AcroRd32.dll [Adobe Systems Incorporated] [Adobe Reader] MD5=E0F3EB94943FAF9EECFCEC29F3E51147 SIZE=13215088
%PROGRAMFILES%\Adobe\Reader 8.0\Reader\AGM.dll [Adobe Systems Incorporated] [AGM] MD5=50206267E4701629C8387480B3A2EEF4 SIZE=4905984
%PROGRAMFILES%\Adobe\Reader 8.0\Reader\CoolType.dll [Adobe Systems Incorporated] [CoolType] MD5=FECC04A2AA659868A3E47E6A06237DD1 SIZE=2281472
%PROGRAMFILES%\Adobe\Reader 8.0\Reader\BIB.dll [Adobe Systems Incorporated] [BIB] MD5=329701BA5C5FE54619F38CB88D92702E SIZE=98816
%PROGRAMFILES%\Adobe\Reader 8.0\Reader\ACE.dll [Adobe Systems Incorporated] [ACE] MD5=980918B5A4E21CD3D9313A9FE8DCC697 SIZE=674816
%PROGRAMFILES%\Adobe\Reader 8.0\Reader\bibutils.dll [Adobe Systems Incorporated] [BIBUtils] MD5=2111BDF986BB250582AE194541673F34 SIZE=152064
%PROGRAMFILES%\Adobe\Reader 8.0\Reader\jp2klib.dll [Adobe Systems Incorporated] [JP2KLib] MD5=64082F2382062CF8656E683107F1C1BF SIZE=443904
%PROGRAMFILES%\Adobe\Reader 8.0\Reader\adobexmp.dll [Adobe XMP Core] MD5=0AA227CFE391F056E985E448085FD858 SIZE=389120
%PROGRAMFILES%\Windows Live\Contacts\wlcomm.exe [Microsoft Corporation] [Messenger] MD5=5BE8F3FEB0BB58D915EA5A6B61549A84 SIZE=30752
%PROGRAMFILES%\Windows Live\Mail\wlmail.exe [Microsoft Corporation] [Windows Live Mail] MD5=3D70E0F600117B780CFC2E60B61D8BFF SIZE=160256
%PROGRAMFILES%\Windows Live\Messenger\msgsc.14.0.5027.0908.dll MD5=A2A9A23492EA052358CF6735C7B3DD45 SIZE=224256
%PROGRAMFILES%\Yahoo!\Companion\Installs\cpn\yt.dll [Yahoo! Inc.] [Yahoo! Toolbar] MD5=2785037CE05B63D5607C9D5DFB2FEEE4 SIZE=440384
deskpan.dll
%SystemDiskRoot%\Apps\RecordNow\shlext.dll [RecordNow!] MD5=449FAEFE093CEEF36FDCC3D920AE437A SIZE=73728
%PROGRAMFILES%\Real\RealOne Playerpshell.dll [RealNetworks, Inc.] [RealPlayer] MD5=D3EA9C1687A12608BF4D505EDAC585D6 SIZE=63040
%PROGRAMFILES%\Windows Live\Mail\mailcomm.dll [Microsoft Corporation] [Windows Live Mail] MD5=79DB4384FAC86529506F52DFE6EE497D SIZE=823808
%PROGRAMFILES%\7-Zip\7-zip.dll [Igor Pavlov] [7-Zip] MD5=0275B6E956756CB03C5C8F2080E26150 SIZE=69632
%PROGRAMFILES%\WinRARarext.dll MD5=3B42317C8A22B82B04BF8C4E13B27CF0 SIZE=125440
%SYSDIR%\btneighborhood.dll [WIDCOMM, Inc.] [Bluetooth Software 1.4.2 Build 10] MD5=809233888E88C6FF7F818C9D76DD6529 SIZE=790605
%PROGRAMFILES%\Microsoft Office\OFFICE11\MLSHEXT.DLL [Microsoft Corporation] [Microsoft Office Outlook] MD5=E79956F4AEC40921F1766C76F015C7AD SIZE=33152
%PROGRAMFILES%\Microsoft Office\OFFICE11\OLKFSTUB.DLL [Microsoft Corporation] [Microsoft Office Outlook] MD5=C027689A05E6B67018DF7614A27C6894 SIZE=236416
%PROGRAMFILES%\Microsoft ActiveSync\Wcesview.dll [Microsoft Corporation] [Microsoft ActiveSync] MD5=0301328A45EF0E42EB3602157A93B8A9 SIZE=260904
%PROGRAMFILES%\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe [Microsoft Corporation] [Windows Live® Photo Gallery] MD5=8490C7D7D104F84D4CD5CF3F0BCC8806 SIZE=234528
%PROGRAMFILES%\Windows Live\Photo Gallery\PhotoViewerShim.dll [Microsoft Corporation] [Windows Live® Photo Gallery] MD5=10DFC43C8B22DDFE1E002776BF04331E SIZE=46112
%PROGRAMFILES%\WINDOWS LIVE\PHOTO GALLERY\WLXPHOTOGALLERY.EXE [Microsoft Corporation] [Windows Live® Photo Gallery] MD5=6A72C40E5DB59770D5815583D641A2D9 SIZE=119296
%PROGRAMFILES%\ESET\ESET NOD32 Antivirus\shellExt.dll [ESET] [ESET Smart Security] MD5=4B6EBD84217FCA70A0356964C614CA4A SIZE=169216
%PROGRAMFILES%\MarkAny\ContentSafer\MACSMANAGER.dll [MarkAny Cooperation.] [MACSMGR Module] MD5=4B6708F7D8152508A6DD870CB2896483 SIZE=192512
%SYSDIR%\DRIVERS\adpu160m.sys [Microsoft Corporation] [Microsoft® Windows® Operating System] MD5=9A11864873DA202C996558B2106B0BBC SIZE=101888
%SYSDIR%\DRIVERS\aliide.sys [Acer Laboratories Inc.] [ALi mini IDE Driver] MD5=1140AB9938809700B46BB88E46D72A96 SIZE=5248
%SYSDIR%\svchost.exe -k netsvcs
%SYSDIR%\svchost.exe -k bthsvcs
%SYSDIR%\drivers\btkrnl.sys [WIDCOMM, Inc.] [Bluetooth Software 1.4.2 Build 10] MD5=58A9FCBB9D3307C27BAE4F39009FFB87 SIZE=1257418
%SYSDIR%\drivers\btserial.sys MD5=CBF5A79F3D2177E80CA79C2BC20119DB SIZE=22183
%SYSDIR%\drivers\btslbcsp.sys [WIDCOMM, Inc.] [Bluetooth Software 1.4.2 Build 10] MD5=26FA6F56CE3152505D8A44CDEABE002F SIZE=222876
%SYSDIR%\DRIVERS\cmdide.sys [CMD Technology, Inc.] [Système d'exploitation Microsoft® Windows®] MD5=E3726AD522D0BDAE090671048C991AB3 SIZE=6656
%SYSDIR%\svchost -k DcomLaunch
%SYSDIR%\svchost.exe -k NetworkService
%SYSDIR%\DRIVERS\eamon.sys [ESET] [ESET Smart Security] MD5=7A25AD652A3003B8854E873A3324E672 SIZE=39944
%SYSDIR%\DRIVERS\easdrv.sys [ESET] [ESET Smart Security] MD5=C7C17BC80B7264322207ABC31F20EA84 SIZE=30216
%SYSDIR%\DRIVERS\epfwtdir.sys MD5=74051DA749E5E89A14DDAB5BA4A03A7F SIZE=33800
%SYSDIR%\DRIVERS\fssfltr.sys [Microsoft Corporation] [Family Safety Filter Driver (TDI)] MD5=EE2241501D513352C1A704C48D9A149D SIZE=56344
%SYSDIR%\Drivers\GEARAspiWDM.sys [GEAR Software Inc.] [CD DVD Filter] MD5=AB8A6A87D9D7255C3884D5B9541A6E80 SIZE=15464
%SYSDIR%\drivers\RtkHDAud.sys [Realtek Semiconductor Corp.] [Realtek(r) High Definition Audio Function Driver (HRTF data Copyright 1994 by MIT Media Lab)] MD5=5F2657F8781376892035976CF8122A2D SIZE=3173888
%SYSDIR%\svchost.exe -k LocalService
%SYSDIR%\DRIVERS\mraid35x.sys [American Megatrends Inc.] [MegaRAID Miniport Driver for Windows Whistler 32] MD5=3F4BB95E5A44F3BE34824E8E7CAF0737 SIZE=17280
%SYSDIR%\svchost -k rpcss
%SYSDIR%\STEC3.sys [AntiCracking] [SVKP driver for NT] MD5=E4EBF293D1F612BDA19B646C36715B20 SIZE=2368
%SYSDIR%\svchost.exe -k imgsvc
%SYSDIR%\DRIVERS\symc8xx.sys [LSI Logic] [Microsoft(R) Windows (R) 2000 Operating System] MD5=070E001D95CF725186EF8B20335F933C SIZE=32640
%SYSDIR%\DRIVERS\sym_hi.sys [LSI Logic] [Microsoft® Windows® Operating System] MD5=80AC1C4ABBE2DF3B738BF15517A51F2C SIZE=28384
%SYSDIR%\DRIVERS\sym_u3.sys [LSI Logic] [Microsoft® Windows® Operating System] MD5=BF4FAB949A382A8E105F46EBB4937058 SIZE=30688
%SYSDIR%\DRIVERS\ultra.sys [Promise Technology, Inc.] [Gestionnaire de miniport ULTRA66 de Promise pour Windows NT] MD5=1B698A51CD528D8DA4FFAED66DFC51B9 SIZE=36736
%SYSDIR%\DRIVERS\wanatw4.sys [America Online, Inc.] [Wan Miniport (ATW)] MD5=0A716C08CB13C3A8F4F51E882DBF7416 SIZE=33588
%SYSDIR%\svchost.exe -k WudfServiceGroup
%PROGRAMFILES%\Windows Live\Messenger\msgrapp.14.0.5027.0908.dll [Microsoft Corporation] [Windows Live Messenger Protocol Handler Module] MD5=8F52BDC9B2ADFF3A99E1CBE60D86042A SIZE=64000
%COMMONFILES%\Microsoft Shared\Web Components\10\OWC10.DLL [Microsoft Corporation] [Microsoft Office XP] MD5=AA2204BD7F9FBFAA09EF15C212A67D69 SIZE=7255384
%SYSDIR%\MACROMED\SHOCKWAVE 10\GTAPI.DLL MD5=AE5CDA196A69F583DD356E7487AF3B49 SIZE=52288
%SYSDIR%\px.dll [Sonic Solutions] [Px] MD5=7E5994B7DC6FC39DD684EACE6351477C SIZE=551672
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll [Microsoft Corporation] [Microsoft® Visual Studio® 2005] MD5=CB23B162AC655F24C6711A5F5DF348C6 SIZE=61440
%WINDIR%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll [Microsoft Corporation] [Microsoft® Visual Studio® 2005] MD5=1B7524806D0270B81360C63A2FA047CB SIZE=1101824
%COMMONFILES%\Microsoft Shared\Smart Tag\FPERSON.DLL [Microsoft Corporation] [Microsoft Office 2003] MD5=DD55EF4AE8244FAED88AC71F69B2ECEC SIZE=186208
%SYSDIR%\mfc70.dll [Microsoft Corporation] [Microsoft® Visual Studio .NET] MD5=09AEF167EB1531E965053D0DCF6CC573 SIZE=974848

End of Report

Utilisateur anonyme · Answer

Fait un hijack stp

karimosouli · Answer

tiens:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:43:05, on 23/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Program Files\Prayer\Prayer.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEMonitor.exe
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\DOCUME~1\Djouher\LOCALS~1\Temp\Rar$EX01.609\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fwww.msn.fr%2fimg%2ffr%2ffr-fr%2fdivertissement%2fcelebrites%2fgalery%2fwentworth02.jpg%3f
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/ymj/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMIECC.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealOne Playerpbrowserrecordplugin.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Windows Live Toolbar Beta - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (file missing)
O2 - BHO: islamuslim Toolbar - {fcd5ee58-54d8-4d33-aa8d-54ae85597966} - C:\Program Files\islamuslim	bisl0.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: islamuslim Toolbar - {fcd5ee58-54d8-4d33-aa8d-54ae85597966} - C:\Program Files\islamuslim	bisl0.dll
O3 - Toolbar: &Windows Live Toolbar Beta - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (file missing)
O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [EEventManager] C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
O4 - HKLM\..\Run: [AXIS TONS THE MP3] C:\Documents and Settings\All Users\Application Data\Readme Live Axis Tons\Amok team.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [IDMan] C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe /onboot
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Heartbags] C:\DOCUME~1\Djouher\APPLIC~1\ITCHSE~1\DASH BLEH.exe
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1008\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Mohamed-Amine')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1008\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime (User 'Mohamed-Amine')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1008\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Mohamed-Amine')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1008\..\Run: [EPSON PX800FW Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIEME.EXE /FU "C:\DOCUME~1\MOHAME~1\LOCALS~1\Temp\E_S253.tmp" /EF "HKCU" (User 'Mohamed-Amine')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1008\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart (User 'Mohamed-Amine')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1008\..\Run: [ecd85eae] rundll32.exe "C:\WINDOWS\system32\hewurogo.dll",b (User 'Mohamed-Amine')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1008\..\Run: [fuyamawewu] Rundll32.exe "C:\WINDOWS\system32\meburaro.dll",s (User 'Mohamed-Amine')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1008\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Mohamed-Amine')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1008\..\Run: [CPMefeb6d32] Rundll32.exe "c:\windows\system32\jojayuza.dll",a (User 'Mohamed-Amine')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bilal.lnk = C:\Program Files\Prayer\Prayer.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: Download all links with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEExt.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
O23 - Service: Localisateur d'appels de procédure distante (RPC) (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe
O23 - Service: QoS RSVP (RSVP) - Unknown owner - C:\WINDOWS\system32svp.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

Utilisateur anonyme · Answer

---> Télécharge AD-Remover (de Cyrildu17 / C_XX) sur ton bureau :
http://sd-1.archive-host.com/membres/up/197122637410686155/AD-R.exe

! Déconnecte-toi du net et ferme toutes les applications en cours !

* Double-clique sur le programme d'installation et installe-le dans son emplacement par défaut (le bureau).
* Ouvre le dossier AD-Remover présent sur ton bureau et double-clique sur AD-Remover.bat.
* Au menu principal, choisis l'option "A"

--> Poste le rapport qui apparaît à la fin.

(Le rapport est sauvegardé aussi sous C:\Ad-report.log)

(CTRL+A pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller )

karimosouli · Answer

quand je clique sur lien il me dise objet non trouvé c'est normal

Utilisateur anonyme · Answer

Ici : http://sd-1.archive-host.com/membres/up/16506160323759868/AD-R.exe

karimosouli · Answer

tener:

F --------- Logfile of AD-Remover 1.0.4.4 by C_XX ---------    

START at: 18:54:36 | 23/11/2008 
ON: Microsoft Windows XP [version 5.1.2600] ( Windows XP ) 
Internet Explorer: 6.0.2900.2180
OPTION: Scan
EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat
USER: Djouher | PC: SN104681400316
BOOT MODE: Normal  
DRIVE(S): A:\ 
~> Systemdrive: C:\
 
--------- [ PROCESSES ] ---------

\SystemRoot\System32\smss.exe [504]   
\??\C:\WINDOWS\system32\csrss.exe [552]   
\??\C:\WINDOWS\system32\winlogon.exe [580]   
C:\WINDOWS\system32\services.exe [624]   
C:\WINDOWS\system32\lsass.exe [636]   
C:\WINDOWS\system32\Ati2evxx.exe [776]   
C:\WINDOWS\system32\svchost.exe [808]   
C:\WINDOWS\system32\svchost.exe [888]   
C:\Program Files\Windows Defender\MsMpEng.exe [960]   
C:\WINDOWS\System32\svchost.exe [1000]   
C:\WINDOWS\system32\svchost.exe [1052]   
C:\WINDOWS\system32\svchost.exe [1160]   
C:\WINDOWS\system32\svchost.exe [1240]   
C:\WINDOWS\system32\spoolsv.exe [1372]   
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe [1504]   
C:\Program Files\Bonjour\mDNSResponder.exe [1560]   
C:\WINDOWS\system32\svchost.exe [1580]   
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe [1668]   
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe [1684]   
c:\APPS\Powercinema\Kernel\TV\CLSched.exe [1704]   
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe [1732]   
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe [1756]   
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [1768]   
c:\APPS\HIDSERVICE\HIDSERVICE.exe [1788]   
C:\WINDOWS\system32\svchost.exe [1856]   
C:\WINDOWS\System32\alg.exe [524]   
C:\Program Files\Spyware Terminator\sp_rsser.exe [2704]   
C:\WINDOWS\Explorer.EXE [972]   
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [152]   
C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe [2744]   
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [276]   
C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe [792]   
C:\Program Files\Microsoft ActiveSync\wcescomm.exe [3952]   
C:\Program Files\Internet Explorer\iexplore.exe [2608]   
C:\Program Files\Internet Explorer\iexplore.exe [3568]   
C:\PROGRA~1\MI3AA1~1\rapimgr.exe [2024]   
C:\Program Files\Prayer\Prayer.exe [3984]   
C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEMonitor.exe [3344]   
C:\Program Files\Windows Live\Mail\wlmail.exe [3296]   
C:\Program Files\Windows Live\Contacts\wlcomm.exe [2344]   

---------------------------- [~> 40]


+---------------------------------------------------------------------------+
+-------------------------------  SERVICES FOUND
+---------------------------------------------------------------------------+ 


+---------------------------------------------------------------------------+
+-------------------------------  REGISTRY ELEMENTS FOUND
+---------------------------------------------------------------------------+ 

"HKEY_CURRENT_USER\SOFTWARE\Boonty" 
"HKEY_LOCAL_MACHINE\Software\Boonty" 
"HKEY_CURRENT_USER\SOFTWARE\MessengerSkinner" 
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F1B496B301445D115AA4000972A8B18B" 

+---------------------------------------------------------------------------+
+-------------------------------  FILES\FOLDERS FOUND 
+---------------------------------------------------------------------------+ 

[21/04/2008 16:30|d--------] C:\Program Files\Boonty 
[21/04/2008 16:30|d--------] C:\Program Files\BoontyGames 
[21/04/2008 16:31|d--------] C:\Program Files\Fichiers communs\BOONTY Shared 
[21/04/2008 16:31|d--------] C:\Documents and Settings\All Users\Application Data\BOONTY 
[21/04/2008 16:31|--a------] C:\Documents and Settings\Djouher\Cookies\djouher@shell.boonty[2].txt 
 
 
+---------- Scanning prefs.js ... ( # Mozilla User Preferences ) 
 
...\xy7y4dxb.default\prefs.js : 
 
~~~~ Mozilla FireFox version 3.0.4 ~~~~ 
  
Start Page :  "https://www.google.fr/?gws_rd=ssl"   
 
+----------+ 
 
 
+---------------------------------------------------------------------------+ 
 
 
+---------- Added scan ... 

+-----[HKLM\...\Run] 
 
TkBellExe	REG_SZ	"C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot 
QuickTime Task	REG_SZ	"C:\Program Files\QuickTime\QTTask.exe" -atboottime 
AppleSyncNotifier	REG_SZ	C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe 
EEventManager	REG_SZ	C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe 
AXIS TONS THE MP3	REG_SZ	C:\Documents and Settings\All Users\Application Data\Readme Live Axis Tons\Amok team.exe 
egui	REG_SZ	"C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice 
 
+-----[HKCU\...\Run] 

IDMan	REG_SZ	C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe /onboot 
H/PC Connection Agent	REG_SZ	"C:\Program Files\Microsoft ActiveSync\wcescomm.exe" 
MsnMsgr	REG_SZ	"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background 
Heartbags	REG_SZ	C:\DOCUME~1\Djouher\APPLIC~1\ITCHSE~1\DASH BLEH.exe 
 
+-----[HKLM\...\Internet Explorer\MAIN] 

Start Page : hxxp://www.msn.com/ 
 
+-----[HKCU\...\Internet Explorer\MAIN] 

Start Page : hxxp://www.msn.fr/ 

+---------------------------------------------------------------------------+
+-------------------------------  [ EOF - 109 lines ]
+---------------------------------------------------------------------------+

[ END at: 18:55:11 | 23/11/2008 ] - [ Time elapsed: 34.8 seconds ]

Utilisateur anonyme · Answer

! Déconnecte-toi et ferme toutes les applications en cours !

* Relance "AD-Remover" : au menu principal, choisis l'option "B".

--> le programme va travailler...

* Poste le rapport qui apparait à la fin

(Le rapport est sauvegardé aussi sous C:\Ad-report.log)

/!\ Si le Bureau ne réapparait pas, presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tapes explorer.exe et valide /!\

Utilisateur anonyme · Answer

Besoin d'aide ???

karimosouli · Answer

voila:

F --------- Logfile of AD-Remover 1.0.4.4 by C_XX ---------    

START at: 19:29:57 | 23/11/2008 
ON: Microsoft Windows XP [version 5.1.2600] ( Windows XP )
Internet Explorer: 6.0.2900.2180
OPTION: Clean

*** Limited to ***

Boonty/BoontyGames  
Eorezo  
Everest Poker  
Funwebproduct/MyWay/MyWebsearch  
Messenger Skinner  
Sweetim  

******************

EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat
USER: Djouher | PC: SN104681400316
BOOT MODE: Normal  
DRIVE(S): A:\ 
~> Systemdrive: C:\
 
--------- [ PROCESSES ] ---------

\SystemRoot\System32\smss.exe [504]   
\??\C:\WINDOWS\system32\csrss.exe [552]   
\??\C:\WINDOWS\system32\winlogon.exe [580]   
C:\WINDOWS\system32\services.exe [624]   
C:\WINDOWS\system32\lsass.exe [636]   
C:\WINDOWS\system32\Ati2evxx.exe [776]   
C:\WINDOWS\system32\svchost.exe [808]   
C:\WINDOWS\system32\svchost.exe [888]   
C:\Program Files\Windows Defender\MsMpEng.exe [960]   
C:\WINDOWS\System32\svchost.exe [1000]   
C:\WINDOWS\system32\svchost.exe [1052]   
C:\WINDOWS\system32\svchost.exe [1160]   
C:\WINDOWS\system32\svchost.exe [1240]   
C:\WINDOWS\system32\spoolsv.exe [1372]   
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe [1504]   
C:\Program Files\Bonjour\mDNSResponder.exe [1560]   
C:\WINDOWS\system32\svchost.exe [1580]   
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe [1668]   
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe [1684]   
c:\APPS\Powercinema\Kernel\TV\CLSched.exe [1704]   
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe [1732]   
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe [1756]   
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [1768]   
c:\APPS\HIDSERVICE\HIDSERVICE.exe [1788]   
C:\WINDOWS\system32\svchost.exe [1856]   
C:\WINDOWS\System32\alg.exe [524]   
C:\Program Files\Spyware Terminator\sp_rsser.exe [2704]   
C:\WINDOWS\Explorer.EXE [972]   
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [152]   
C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe [2744]   
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [276]   
C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe [792]   
C:\Program Files\Microsoft ActiveSync\wcescomm.exe [3952]   
C:\Program Files\Internet Explorer\iexplore.exe [2608]   
C:\Program Files\Internet Explorer\iexplore.exe [3568]   
C:\PROGRA~1\MI3AA1~1\rapimgr.exe [2024]   
C:\Program Files\Prayer\Prayer.exe [3984]   
C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEMonitor.exe [3344]   
C:\Program Files\Windows Live\Mail\wlmail.exe [4052]   
C:\Program Files\Windows Live\Contacts\wlcomm.exe [1212]   

---------------------------- [~> 40]

(!) ---- IE start pages reset 

+---------------------------------------------------------------------------+
+-------------------------------  SERVICES DELETED
+---------------------------------------------------------------------------+ 


+---------------------------------------------------------------------------+
+-------------------------------  REGISTRY ELEMENTS DELETED 
+---------------------------------------------------------------------------+ 

"HKEY_CURRENT_USER\SOFTWARE\Boonty"
"HKEY_LOCAL_MACHINE\Software\Boonty"
"HKEY_CURRENT_USER\SOFTWARE\MessengerSkinner"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F1B496B301445D115AA4000972A8B18B"

+---------------------------------------------------------------------------+
+-------------------------------  FILES\FOLDERS DELETED 
+---------------------------------------------------------------------------+ 

[21/04/2008 16:30|d--------] C:\Program Files\Boonty  
[21/04/2008 16:30|d--------] C:\Program Files\BoontyGames  
[21/04/2008 16:31|d--------] C:\Program Files\Fichiers communs\BOONTY Shared  
[21/04/2008 16:31|d--------] C:\Documents and Settings\All Users\Application Data\BOONTY  
[21/04/2008 16:31|--a------] C:\Documents and Settings\Djouher\Cookies\djouher@shell.boonty[2].txt  
 
 
+---------- Scanning prefs.js ... ( # Mozilla User Preferences ) 
 
...\xy7y4dxb.default\prefs.js : 
 
~~~~ Mozilla FireFox version 3.0.4 ~~~~ 
  
Start Page :  "https://www.google.fr/?gws_rd=ssl"   
 
+----------+ 
 

(!) ---- Temp files deleted.
(!) ---- Recycle bin emptied in all drives. 
  
 
 
+---------- Added scan ... 

+-----[HKLM\...\Run] 
 
TkBellExe	REG_SZ	"C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot 
QuickTime Task	REG_SZ	"C:\Program Files\QuickTime\QTTask.exe" -atboottime 
AppleSyncNotifier	REG_SZ	C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe 
EEventManager	REG_SZ	C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe 
AXIS TONS THE MP3	REG_SZ	C:\Documents and Settings\All Users\Application Data\Readme Live Axis Tons\Amok team.exe 
egui	REG_SZ	"C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice 
 
+-----[HKCU\...\Run] 

IDMan	REG_SZ	C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe /onboot 
H/PC Connection Agent	REG_SZ	"C:\Program Files\Microsoft ActiveSync\wcescomm.exe" 
MsnMsgr	REG_SZ	"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background 
Heartbags	REG_SZ	C:\DOCUME~1\Djouher\APPLIC~1\ITCHSE~1\DASH BLEH.exe 
 
+-----[HKLM\...\Internet Explorer\MAIN] 

Start Page : hxxp://fr.msn.com/ 
 
+-----[HKCU\...\Internet Explorer\MAIN] 

Start Page : hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome 

+---------------------------------------------------------------------------+
+-------------------------------  [ EOF - 118 lines ]
+---------------------------------------------------------------------------+

[ END at: 19:35:21 | 23/11/2008 ] - [ Time elapsed: 5 minutes, 23 seconds ]

karimosouli · Answer

C'est fini??

karimosouli · Answer

Si oui ba merci beaucoup si non on continue quand??

Utilisateur anonyme · Answer

Refait un hijack stp

karimosouli · Answer

voila:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:54:14, on 24/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Prayer\Prayer.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEMonitor.exe
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\Documents and Settings\Djouher\Mes documents\Downloads\Programs\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/ymj/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMIECC.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealOne Playerpbrowserrecordplugin.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Windows Live Toolbar Beta - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: islamuslim Toolbar - {fcd5ee58-54d8-4d33-aa8d-54ae85597966} - C:\Program Files\islamuslim	bisl0.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: islamuslim Toolbar - {fcd5ee58-54d8-4d33-aa8d-54ae85597966} - C:\Program Files\islamuslim	bisl0.dll
O3 - Toolbar: &Windows Live Toolbar Beta - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [EEventManager] C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
O4 - HKLM\..\Run: [AXIS TONS THE MP3] C:\Documents and Settings\All Users\Application Data\Readme Live Axis Tons\Amok team.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [IDMan] C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe /onboot
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Heartbags] C:\DOCUME~1\Djouher\APPLIC~1\ITCHSE~1\DASH BLEH.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bilal.lnk = C:\Program Files\Prayer\Prayer.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: Download all links with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEExt.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
O23 - Service: Localisateur d'appels de procédure distante (RPC) (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe
O23 - Service: QoS RSVP (RSVP) - Unknown owner - C:\WINDOWS\system32svp.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

Utilisateur anonyme · Answer

Télécharge AusLogics Disk Defrag ici : http://sd-1.archive-host.com/membres/up/57571633934563785/disk-defrag-setup.exe

Intalle le et défragmente ton disque C:\, a la fin, clic sur le bouton pour afficher le rapport.

Copie-colle le et montre le rapport

@+

karimosouli · Answer

voila le rapport:

Last Time Defragmentation: 24/11/2008 22:04:03
Disk: HDD (C:), NTFS
Defragmentation Summary
  	 
Auslogics Disk Defrag Version : 	1.5.19.330 (DiskDefrag.exe)
Disk Size : 	149,04 GB
Free Size : 	92,14 GB
Clusters : 	39070072
Sectors per cluster : 	8
Bytes per sector : 	512
Started defragmentation at : 	24/11/2008 22:04:03
Completed defragmentation at : 	24/11/2008 22:35:55
Elapsed time : 	00:31:52
Total Files : 	215496
Total Directories : 	21183
Fragmented File Count : 	5698
Defragmented File Count : 	5698
Skipped File Count : 	0
Fragmentation Before : 	5,97%   .................................................. :
Fragmentation After : 	0,00%    :

Defragmentation Details
Fragments 	Clusters 	Size 	Result 	File Name
2 	9694 / 9696 	5,76 KB 	OK 	C:\AD-report-23.11.2008.log
3 	12955 / 12960 	16,63 KB 	OK 	C:\ComboFix.txt
2 	53538 / 53556 	71,83 KB 	OK 	C:\Documents and Settings\All Users\Application Data\Adobe\Photoshop Album\3.2\upsellCache\graphic_create.jpg
2 	30040 / 30045 	19,96 KB 	OK 	C:\Documents and Settings\All Users\Application Data\Adobe\Photoshop Album\3.2\upsellCache\graphic_date.jpg
3 	136114 / 136168 	213,00 KB 	OK 	C:\Documents and Settings\All Users\Application Data\EPSON\EPSON PX800FW Series\Language\040c.E_DI0EME.DLL
3 	58373 / 58398 	98,88 KB 	OK 	C:\Documents and Settings\All Users\Application Data\EPSON\EPSON PX800FW Series\Language\040c.E_QI141E.CHM
21 	86632 / 86653 	80,27 KB 	OK 	C:\Documents and Settings\All Users\Application Data\EPSON\Setup\epstplog.txt
2 	9696 / 9698 	6,31 KB 	OK 	C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Charon\CACHE.NDB
4 	52174 / 52190 	61,00 KB 	OK 	C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Charon\FND0.NFI
4 	58398 / 58414 	61,00 KB 	OK 	C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Charon\FND1.NFI
2 	240825 / 240870 	179,41 KB 	OK 	C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Logs\eScan\ndl18529.dat
2 	30045 / 30049 	12,09 KB 	OK 	C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\continuous\nod42A0.nup
3 	30049 / 30054 	16,22 KB 	OK 	C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\continuous\nod641A.nup
2 	31476 / 31480 	15,73 KB 	OK 	C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\em003_32_l2.nup
2 	34389 / 34397 	28,76 KB 	OK 	C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\em005_32_l0.nup
4 	40642 / 40655 	48,75 KB 	OK 	C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\nod0294.nup
3 	31480 / 31485 	17,66 KB 	OK 	C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\nod0A3E.nup
10 	364720 / 364827 	427,29 KB 	OK 	C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\nod10AD.nup
4 	35686 / 35695 	35,95 KB 	OK 	C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\nod10E1.nup
4 	49531 / 49544 	48,64 KB 	OK 	C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\nod22CD.nup
7 	287987 / 288040 	211,50 KB 	OK 	C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\nod2667.nup
20 	382806 / 383064 	1,00 MB 	OK 	C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\nod27BC.nup
35 	383064 / 383569 	1,97 MB 	OK 	C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\nod2B13.nup
3 	53475 / 53483 	31,38 KB 	OK 	C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\nod354A.nup
2 	9015 / 9018 	9,44 KB 	OK 	C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\nod3B8D.nup
3 	53556 / 53563 	26,52 KB 	OK 	C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\nod4452.nup
170 	1203086 / 1205751 	10,41 MB 	OK 	C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\nod5D03.nup
9 	383569 / 383650 	321,24 KB 	OK 	C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\nod748A.nup
2 	34830 / 34833 	10,38 KB 	OK 	C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\nod76BD.nup
2 	12146 / 12148 	0 bytes 	OK 	C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Updfiles\
15 	383650 / 384175 	2,05 MB 	OK 	C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\update\backup\Help\Ad-Awaremanual-EN.chm.old
3 	262273 / 262292 	74,79 KB 	OK 	C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\update\backup\Lang\EN.lslang.old
36 	1205751 / 1206276 	2,05 MB 	OK 	C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\update\new\Help\Ad-Awaremanual-EN.chm.new
5 	262292 / 262311 	75,08 KB 	OK 	C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\update\new\Lang\EN.lslang.new
54 	4377420 / 4393388 	62,37 MB 	OK 	C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\drwtsn32.log
2 	12205 / 12207 	5,43 KB 	OK 	C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Scans\History\Results\Quick\{073693F9-EFE9-4D4D-AE2A-F93F19AF844E}
2 	17130 / 17132 	5,43 KB 	OK 	C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Scans\History\Results\Quick\{222C455C-2ABB-40A8-8BB8-1450E6766B1A}
2 	20682 / 20684 	5,43 KB 	OK 	C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Scans\History\Results\Quick\{2B123F20-115B-42C6-94F4-643B8E6CCCF5}
2 	29717 / 29719 	5,43 KB 	OK 	C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Scans\History\Results\Quick\{32234F6E-5FC3-48B7-A2F0-40E9D20E9C65}
2 	30054 / 30056 	5,43 KB 	OK 	C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Scans\History\Results\Quick\{3B4BD1DD-D95B-4B3D-9263-F64B8894ADC5}
2 	30481 / 30483 	5,43 KB 	OK 	C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Scans\History\Results\Quick\{44439C38-4066-420C-8143-124C90C0FDF4}
2 	31875 / 31877 	5,43 KB 	OK 	C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Scans\History\Results\Quick\{4F50BD8C-C1B3-4D75-B44A-249F5C04F771}
2 	34397 / 34399 	5,43 KB 	OK 	C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Scans\History\Results\Quick\{4FDA0036-2098-414F-9071-8335D1F6FFD9}
2 	34864 / 34866 	5,43 KB 	OK 	C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Scans\History\Results\Quick\{509448A8-E97E-4223-B015-A08D23AC2D86}
2 	35775 / 35777 	5,43 KB 	OK 	C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Scans\History\Results\Quick\{7099EA69-7AE6-4D8D-BD55-F6EB01FBA856}
2 	36236 / 36238 	5,43 KB 	OK 	C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Scans\History\Results\Quick\{A09B1257-48D5-467A-AEDD-2BD507364DF4}
4 	53483 / 53489 	20,76 KB 	OK 	C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Scans\History\Results\Quick\{A4F42BA0-4333-4AD0-9B2D-A1527231FD0F}
2 	36238 / 36240 	5,43 KB 	OK 	C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Scans\History\Results\Quick\{B645C106-92E8-4E9E-96CF-C1DC809B93D1}
2 	36435 / 36437 	5,43 KB 	OK 	C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Scans\History\Results\Quick\{B6A14C46-384F-4977-994F-CD9E4AD92F3C}
2 	36437 / 36439 	5,43 KB 	OK 	C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Scans\History\Results\Quick\{B908ACEC-6F7F-43EF-845F-714C459CAD39}
2 	36549 / 36551 	5,43 KB 	OK 	C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Scans\History\Results\Quick\{E2C08BA8-613F-47AF-9BC5-27637656418B}
2 	36763 / 36765 	5,43 KB 	OK 	C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Scans\History\Results\Quick\{F9A29993-42C7-4BC7-A90A-189164FDECA8}
2 	36773 / 36775 	5,90 KB 	OK 	C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Scans\History\Results\Resource\{895AD6A5-D51D-4769-9E89-EDEFEBE8658C}
2 	36855 / 36857 	5,90 KB 	OK 	C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Scans\History\Results\Resource\{896E12C9-2611-4566-9915-A80811471B3B}
2 	38301 / 38303 	5,90 KB 	OK 	C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Scans\History\Results\Resource\{B5E3A6F1-D2E7-4174-8541-9540011539C4}
26 	1206276 / 1206804 	2,05 MB 	OK 	C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-08302007-225805.log
3 	1400099 / 1403839 	14,61 MB 	OK 	C:\Documents and Settings\All Users\Application Data\Readme Live Axis Tons\Amok team.exe
8 	288344 / 288385 	0 bytes 	OK 	C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Local Cache\
12 	1403839 / 1404692 	3,33 MB 	OK 	C:\Documents and Settings\All Users\Documents\Mes vid&#1081;os\emg4.wmv
518 	6465497 / 6533937 	267,34 MB 	OK 	C:\Documents and Settings\All Users\Documents\Mes vid&#1081;os\video.mp4
158 	4393388 / 4412233 	73,61 MB 	OK 	C:\Documents and Settings\All Users\Documents\Mes vid&#1081;os\[DB]_Naruto_Shippuuden_049_Sub_French_[9A99442B].mp4
157 	5143207 / 5162276 	74,49 MB 	OK 	C:\Documents and Settings\All Users\Documents\Mes vid&#1081;os\[DB]_Naruto_Shippuuden_050_Sub_French_[B084A853].mp4
296 	6533937 / 6570685 	143,54 MB 	OK 	C:\Documents and Settings\All Users\Documents\Mes vid&#1081;os\[DB]_Naruto_Shippuuden_051-052_Sub_French_[EEE9BB43].mp4
246 	1404692 / 1408626 	15,36 MB 	OK 	C:\Documents and Settings\All Users\Documents\Mes vid&#1081;os\_com_wipido_videos_Q3TG5PhK8vjY_mq.mp4
220 	1408626 / 1412258 	14,19 MB 	OK 	C:\Documents and Settings\All Users\Documents\Mes vid&#1081;os\_com_wipido_videos_Qpw5NgVMx5Ph_mq.mp4
2 	1801 / 1803 	6,95 KB 	OK 	C:\Documents and Settings\All Users\Documents\Softwrap\LEGACYINTERPP1GMC4\PetPals.sw2
3 	1803 / 1815 	33,76 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Auslogics\Disk Defrag\Reports\C_Disk_Defrag_Report.html
2 	1206804 / 1206952 	590,50 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Itch seek\veujjiow.exe
3 	55601 / 55608 	0 bytes 	OK 	C:\Documents and Settings\Djouher\Application Data\Macromedia\Flash Player\#SharedObjects\LJ2UENFK\
4 	55608 / 55616 	0 bytes 	OK 	C:\Documents and Settings\Djouher\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\
2 	31639 / 31644 	17,35 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Microsoft\Excel\Excel11.xlb
4 	4909 / 4913 	15,07 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Microsoft\Forms\RefEdit.exd
6 	56100 / 56108 	30,50 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Microsoft\Mod&#1080;les\Normal.dot
6 	244965 / 245001 	141,02 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Microsoft\Office\fbc2802.tmp
2 	196586 / 196608 	84,55 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Microsoft\Services Windows Live\Raccourci Galerie de Photos Windows Live.exe
2 	242785 / 242818 	129,56 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Microsoft\Services Windows Live\Raccourci Windows Live Messenger.exe
3 	39088 / 39091 	8,31 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Microsoft\Windows\Themes\Custom.theme
2 	39431 / 39435 	12,85 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Microsoft\Windows Live\Toolbar\Feeds\rss2771.tmp
2 	52731 / 52736 	17,24 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Microsoft\Windows Live\Toolbar\Feeds\rss2775.tmp
2 	40850 / 40854 	13,92 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Microsoft\Windows Live\Toolbar\Feeds\rss2777.tmp
3 	56118 / 56124 	21,94 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Microsoft\Windows Live\Toolbar\Feeds\rss2779.tmp
2 	53940 / 53944 	14,36 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Microsoft\Windows Live\Toolbar\Feeds\rss277C.tmp
3 	56453 / 56460 	24,16 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Microsoft\Windows Live\Toolbar\Feeds\rss277E.tmp
3 	56460 / 56465 	17,67 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Microsoft\Windows Live\Toolbar\Feeds\rss2780.tmp
2 	55564 / 55568 	13,66 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Microsoft\Windows Live\Toolbar\Feeds\rss2787.tmp
5 	56854 / 56863 	32,37 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Mozilla\Firefox\Profiles\xy7y4dxb.default\bookmarkbackups\bookmarks-2008-11-15.json
4 	65065 / 65074 	32,20 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Mozilla\Firefox\Profiles\xy7y4dxb.default\bookmarkbackups\bookmarks-2008-11-17.json
5 	72940 / 72949 	32,20 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Mozilla\Firefox\Profiles\xy7y4dxb.default\bookmarkbackups\bookmarks-2008-11-19.json
4 	77293 / 77302 	32,20 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Mozilla\Firefox\Profiles\xy7y4dxb.default\bookmarkbackups\bookmarks-2008-11-21.json
5 	83521 / 83530 	32,20 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Mozilla\Firefox\Profiles\xy7y4dxb.default\bookmarkbackups\bookmarks-2008-11-23.json
5 	87555 / 87564 	32,56 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Mozilla\Firefox\Profiles\xy7y4dxb.default\bookmarkbackups\bookmarks-2008-11-24.json
2 	56124 / 56128 	15,13 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Mozilla\Firefox\Profiles\xy7y4dxb.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}\components\nsAdblockPlus.js
2 	9293 / 9295 	4,95 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Mozilla\Firefox\Profiles\xy7y4dxb.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}\install.js
2 	38325 / 38327 	7,45 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Mozilla\Firefox\Profiles\xy7y4dxb.default\extensions.rdf.bak
2 	50559 / 50562 	10,13 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Mozilla\Firefox\Profiles\xy7y4dxb.default\GoogleToolbarData\searchhistory.xml
2 	56511 / 56515 	12,47 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Mozilla\Firefox\Profiles\xy7y4dxb.default\localstore.rdf
2 	60443 / 60447 	14,41 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Mozilla\Firefox\Profiles\xy7y4dxb.default\pluginreg.dat
2 	51215 / 51218 	11,94 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Mozilla\Firefox\Profiles\xy7y4dxb.default\prefs.js
2 	40655 / 40657 	5,70 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Phoenix\pluginreg.dat
2 	41491 / 41493 	7,04 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Phoenix\Profiles\default\5ukmyxc5.slt\bookmarks.html
2 	72949 / 72954 	16,34 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Phoenix\Profiles\default\5ukmyxc5.slt\Cache\683D3929d01
2 	77302 / 77307 	16,52 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Phoenix\Profiles\default\5ukmyxc5.slt\Cache\F81756EDd01
3 	91058 / 91065 	26,75 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Phoenix\Profiles\default\5ukmyxc5.slt\Cache\_CACHE_001_
3 	87564 / 87570 	23,00 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Phoenix\Profiles\default\5ukmyxc5.slt\Cache\_CACHE_002_
3 	91383 / 91392 	36,00 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Phoenix\Profiles\default\5ukmyxc5.slt\Cache\_CACHE_003_
2 	287950 / 287983 	132,00 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Phoenix\Profiles\default\5ukmyxc5.slt\Cache\_CACHE_MAP_
4 	1206952 / 1207068 	462,25 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Phoenix\Profiles\default\5ukmyxc5.slt\XUL.mfl
5 	1213789 / 1214063 	1,07 MB 	OK 	C:\Documents and Settings\Djouher\Application Data\Real\RealPlayer\skins\data\normal\imgcache.dat
3 	300760 / 300794 	134,62 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\Spyware Terminator\LanguageAct\language.ini
9 	91670 / 91679 	0 bytes 	OK 	C:\Documents and Settings\Djouher\Application Data\Spyware Terminator\LanguageAct\
2 	12485 / 12487 	5,85 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\TuneUp Software\TuneUp Utilities\Backups\00000028.rcb
2 	12487 / 12489 	5,00 KB 	OK 	C:\Documents and Settings\Djouher\Application Data\zweitgeist\location.db
5 	91876 / 91882 	21,00 KB 	OK 	C:\Documents and Settings\Djouher\Bureau\Conseil.xls
9 	1207068 / 1207226 	631,21 KB 	OK 	C:\Documents and Settings\Djouher\Bureau\SpywareTerminatorSetup.exe
2 	29989 / 29991 	6,03 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Adobe\Acrobat\8.0\Updater\updater.log
2 	30304 / 30307 	8,61 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Adobe\Color\ACECache6.lst
2 	51214 / 51217 	8,67 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Adobe\Updater5\aumLib.log
310 	4412233 / 4421601 	36,59 MB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Adobe\Updater5\Install\reader8rdr-fr_FR\AdbeRdr813_fr_FR.msi
2 	41684 / 41686 	0 bytes 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Apple Computer\SyncNotifier\SyncNotifier\Logs\
38 	239100 / 239162 	246,32 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Messenger\ContactsLog.txt
3 	58227 / 58242 	0 bytes 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Messenger\karimsouli12@hotmail.com\ObjectStore\CustomEmoticons\
2 	45037 / 45039 	0 bytes 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Messenger\karimsouli12@hotmail.com\ObjectStore\Scenes\
4 	58242 / 58248 	0 bytes 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Messenger\karimsouli12@hotmail.com\ObjectStore\Winks3\
3 	106176 / 106190 	55,80 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Messenger\karimsouli12@hotmail.com\SocialNews\WNResponse.xml
2 	7658 / 7660 	0 bytes 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Messenger\mohamedsouli11@live.fr\ObjectStore\Scenes\
2 	58248 / 58251 	0 bytes 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Messenger\mohamedsouli11@live.fr\ObjectStore\UserTile\
2 	58251 / 58255 	0 bytes 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Messenger\mohamedsouli11@live.fr\ObjectStore\Winks3\
3 	91882 / 91891 	34,61 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Messenger\mohamedsouli11@live.fr\SocialNews\WNResponse.xml
3 	1412258 / 1413162 	3,53 MB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Messenger\MsnMsgr.txt
2 	7660 / 7662 	0 bytes 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Messenger\soulikarim@hotmail.fr\ObjectStore\Scenes\
3 	60443 / 60446 	0 bytes 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Messenger\soulikarim@hotmail.fr\ObjectStore\UserTile\
2 	48784 / 48786 	1,00 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
2 	1413162 / 1413678 	2,02 MB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Contacts\{03ef8726-b955-437e-b373-62f3171ceda9}\DBStore\contacts.edb
2 	60446 / 60450 	16,00 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Contacts\{03ef8726-b955-437e-b373-62f3171ceda9}\DBStore\contacts.pat
2 	1413678 / 1414194 	2,02 MB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Contacts\{2d411e3c-3345-4d37-82bb-3bb9280cae18}\DBStore\contacts.edb
2 	1414194 / 1415736 	6,02 MB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Contacts\{31d78d79-a7cd-4b4b-8c3f-cc6f6782d75d}\DBStore\Backup\new\contacts.edb
2 	61716 / 61720 	16,00 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Contacts\{31d78d79-a7cd-4b4b-8c3f-cc6f6782d75d}\DBStore\contacts.pat
3 	328767 / 328831 	256,00 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Contacts\{31d78d79-a7cd-4b4b-8c3f-cc6f6782d75d}\DBStore\tempedb.edb
2 	1505714 / 1506230 	2,02 MB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Contacts\{45f69a03-b099-4063-8736-bfc1fae04ce2}\DBStore\contacts.edb
2 	61979 / 61983 	16,00 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Contacts\{45f69a03-b099-4063-8736-bfc1fae04ce2}\DBStore\contacts.pat
2 	1506230 / 1507772 	6,02 MB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Contacts\{4f81347b-a0ad-4f32-aacc-e26e5ffbb8dd}\DBStore\Backup\new\contacts.edb
3 	2474654 / 2476194 	6,02 MB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Contacts\{4f81347b-a0ad-4f32-aacc-e26e5ffbb8dd}\DBStore\contacts.edb
2 	65074 / 65078 	16,00 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Contacts\{4f81347b-a0ad-4f32-aacc-e26e5ffbb8dd}\DBStore\contacts.pat
2 	49558 / 49560 	0 bytes 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Contacts\{4f81347b-a0ad-4f32-aacc-e26e5ffbb8dd}\DBStore\LogFiles\
3 	2476194 / 2479784 	14,02 MB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Contacts\{858c1d3d-c4ff-4916-a5e1-e880037f48ee}\DBStore\Backup\new\contacts.edb
2 	67050 / 67054 	16,00 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Contacts\{858c1d3d-c4ff-4916-a5e1-e880037f48ee}\DBStore\contacts.pat
3 	384175 / 384239 	256,00 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Contacts\{858c1d3d-c4ff-4916-a5e1-e880037f48ee}\DBStore\tempedb.edb
2 	1507772 / 1508802 	4,02 MB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Contacts\{86885aea-e6b6-4e65-9f35-caa08fe75952}\DBStore\Backup\new\contacts.edb
2 	51633 / 51637 	16,00 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Contacts\{86885aea-e6b6-4e65-9f35-caa08fe75952}\DBStore\contacts.pat
2 	1516036 / 1516552 	2,02 MB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Contacts\{ac735001-c238-4605-9caf-348a5da60fdd}\DBStore\contacts.edb
2 	1851868 / 1852898 	4,02 MB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Mail\Backup\new\Mail.MSMessageStore
2 	106190 / 106222 	128,00 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Mail\Calendars\karimsouli12@hotmail.com\DBStore\tempedb.edb
2 	51637 / 51641 	16,00 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Mail\Calendars\karimsouli12@hotmail.com\DBStore\WLCalendarStore.pat
2 	1516552 / 1517064 	2,00 MB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Mail\edb.log
2 	16912 / 16914 	4,32 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Mail\Hotmail (ka 489\Bo&#1086;te de r&#1081; 29\082E3B6F-00000190.eml
2 	16916 / 16918 	4,11 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Mail\Hotmail (ka 489\Bo&#1086;te de r&#1081; 29\0A112D0E-0000019C.eml
2 	41545 / 41547 	4,04 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Mail\Hotmail (ka 489\Bo&#1086;te de r&#1081; 29\1AD5767C-00000195.eml
2 	47119 / 47121 	4,20 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Mail\Hotmail (ka 489\Bo&#1086;te de r&#1081; 29\2DB1532C-0000018F.eml
2 	51641 / 51643 	5,59 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Mail\Hotmail (ka 489\Bo&#1086;te de r&#1081; 29\34447D0F-000001A0.eml
2 	51643 / 51645 	4,69 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Mail\Hotmail (ka 489\Bo&#1086;te de r&#1081; 29\558D7514-00000199.eml
2 	51645 / 51647 	4,20 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Mail\Hotmail (ka 489\Bo&#1086;te de r&#1081; 29\7A9357F3-00000191.eml
11 	51647 / 51658 	0 bytes 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Mail\Hotmail (ka 489\Bo&#1086;te de r&#1081; 29\
2 	53576 / 53579 	11,40 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Mail\karimsouli12@hotmail.com\oeconfig.xml
2 	73286 / 73290 	16,00 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Mail\Mail.pat
5 	1214063 / 1214198 	538,31 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Mail\Proof\prf000C\1\MSSp3fr.dll
23 	1880678 / 1881395 	2,80 MB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Mail\Proof\prf000C\1\MSSp3fr.lex
2 	14727 / 14729 	6,53 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Mail\Storage Folders\Recovered items\10-21-2008 bd0\23081C39-00000001.eml
2 	239162 / 239194 	128,00 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Mail\tmp.edb
3 	1121442 / 1121552 	429,34 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Microsoft\Windows Live Mail\WindowsLiveMail.log
2 	75154 / 75161 	24,75 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Mozilla\Firefox\Profiles\xy7y4dxb.default\Cache\50AA7025d01
2 	14729 / 14734 	18,49 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Mozilla\Firefox\Profiles\xy7y4dxb.default\Cache\AC873238d01
2 	83849 / 83854 	18,44 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Mozilla\Firefox\Profiles\xy7y4dxb.default\Cache\C35AA1A5d01
4 	284011 / 284057 	181,92 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Mozilla\Firefox\Profiles\xy7y4dxb.default\Cache\E2DB59E1d01
3 	239194 / 239216 	84,15 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Mozilla\Firefox\Profiles\xy7y4dxb.default\Cache\FBA2F5EFd01
7 	384239 / 384287 	125,42 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Mozilla\Firefox\Profiles\xy7y4dxb.default\Cache\_CACHE_001_
6 	382342 / 382374 	71,08 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Mozilla\Firefox\Profiles\xy7y4dxb.default\Cache\_CACHE_002_
6 	1189111 / 1189207 	164,98 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Mozilla\Firefox\Profiles\xy7y4dxb.default\Cache\_CACHE_003_
2 	53093 / 53096 	8,27 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Mozilla\Firefox\Profiles\xy7y4dxb.default\Cache\_CACHE_MAP_
20 	1518976 / 1519407 	1,68 MB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\Mozilla\Firefox\Profiles\xy7y4dxb.default\XUL.mfl
3 	72831 / 72842 	40,87 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Application Data\speed-bit\rss\http___www_fileratings_com_rss_aspx.xml
2 	93527 / 93535 	32,00 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Historique\History.IE5\MSHist012008110320081110\index.dat
2 	96054 / 96062 	32,00 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Historique\History.IE5\MSHist012008111020081117\index.dat
2 	96741 / 96749 	32,00 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Historique\History.IE5\MSHist012008111720081124\index.dat
2 	97033 / 97041 	32,00 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Historique\History.IE5\MSHist012008112120081122\index.dat
2 	98770 / 98778 	32,00 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Historique\History.IE5\MSHist012008112420081125\index.dat
2 	56883 / 56886 	10,10 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\9HS10206\8ED3DC823E4E693449E38F36CADE90[1].jpg
2 	51658 / 51660 	4,45 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\9HS10206\D3D69B1D87CB43F5C0403FDDA264A[1].jpg
4 	99265 / 99274 	32,15 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\9HS10206\magteen_01[1].jpg
4 	106280 / 106289 	34,42 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\9HS10206\magteen_02[1].jpg
2 	51854 / 51856 	0 bytes 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\9HS10206\
4 	107831 / 107841 	36,41 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\K76T4HOU\9ACA98731FCA9AFC6F28EC549219A6[1].jpg
3 	100772 / 100778 	22,52 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\K76T4HOU\CAMFMJAD.png
5 	124726 / 124735 	33,91 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\K76T4HOU\MsgrConfig[1].xml
2 	58414 / 58417 	11,40 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\K76T4HOU\msgrconfig[2].xml
2 	72842 / 72847 	17,83 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\K76T4HOU\s_code[2].js
3 	104874 / 104880 	23,91 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\K76T4HOU\wbk10A4.tmp
4 	124758 / 124767 	32,85 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\K76T4HOU\wbk10A6.tmp
3 	105078 / 105084 	23,91 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\K76T4HOU\wbk10AE.tmp
4 	163856 / 163865 	32,85 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\K76T4HOU\wbk10B0.tmp
2 	75714 / 75718 	13,18 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\K76T4HOU\wbk12FF.tmp
4 	165803 / 165812 	34,61 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\K76T4HOU\whatsnewservice[1].xml
4 	79116 / 79120 	0 bytes 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\K76T4HOU\
2 	60465 / 60468 	10,76 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\UEU9QZ31\5EC0467C030EB45560ED1768B6B[1].jpg
3 	136168 / 136176 	31,37 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\UEU9QZ31\FF717F51A3C3791CFF4551ECBF3060[1].jpg
4 	230693 / 230710 	66,97 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\UEU9QZ31\fr-fr[2].js
2 	52778 / 52780 	7,16 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\UEU9QZ31\fr_180x150_rihanna_001[1].jpg
2 	64504 / 64507 	8,07 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\UEU9QZ31\fr_234x60_gregoire_V2[1].gif
3 	106289 / 106295 	20,56 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\UEU9QZ31\magteen_05[1].jpg
2 	52835 / 52837 	4,46 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\ULH0623M\52F8A495A19BF26E6C744401A3C88[1].jpg
2 	81789 / 81793 	12,94 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\ULH0623M\dap[1].js
2 	251404 / 251422 	68,44 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\ULH0623M\gtl_sitegeneric[2].css
4 	167439 / 167448 	32,47 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\ULH0623M\magteen_03[1].jpg
4 	177618 / 177628 	37,04 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\ULH0623M\magteen_04[1].jpg
2 	41457 / 41460 	9,17 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\ULH0623M\y1aVqBbB3vZ16_HtulIbF2fd_H5Qr_U9JAAAe2u349UJ0ymtx9GrLZ6Ce4KLoIU9uO5jE9Zhy89LOg[1].gif
2 	109550 / 109557 	25,56 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\ULH0623M\zz-zz[2].css
2 	37773 / 37775 	0 bytes 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\Temporary Internet Files\Content.IE5\ULH0623M\
28 	411956 / 411992 	143,83 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\VBE\MSForms.exd
4 	41460 / 41464 	14,69 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\VBE\RefEdit.exd
9 	424227 / 424259 	128,00 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temp\~DF20BF.tmp
4 	185974 / 185988 	52,94 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temporary Internet Files\Content.IE5\3J4H3O04\460x278_mobile6[1].jpg
4 	190887 / 190896 	34,26 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temporary Internet Files\Content.IE5\3J4H3O04\490x278_mobile5[1].jpg
4 	231466 / 231479 	51,36 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temporary Internet Files\Content.IE5\3J4H3O04\950x164_mobile7[1].jpg
4 	196457 / 196467 	39,29 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temporary Internet Files\Content.IE5\3J4H3O04\CAWHE53W.swf
3 	163186 / 163194 	29,95 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temporary Internet Files\Content.IE5\3J4H3O04\o[1].css
2 	49525 / 49529 	13,92 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temporary Internet Files\Content.IE5\3J4H3O04\rss[1].xml
3 	162567 / 162574 	24,16 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temporary Internet Files\Content.IE5\3J4H3O04\rss[2].xml
2 	86653 / 86657 	13,66 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temporary Internet Files\Content.IE5\3J4H3O04\rss[3].xml
4 	239360 / 239372 	47,79 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temporary Internet Files\Content.IE5\AXBSTF4P\460x308_mobile4[1].jpg
5 	288614 / 288632 	68,17 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temporary Internet Files\Content.IE5\AXBSTF4P\490x308_mobile3[1].jpg
2 	66698 / 66701 	11,40 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temporary Internet Files\Content.IE5\AXBSTF4P\msgrconfig[1].xml
2 	87449 / 87453 	12,85 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temporary Internet Files\Content.IE5\AXBSTF4P\rss[1].xml
3 	107371 / 107377 	21,94 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temporary Internet Files\Content.IE5\AXBSTF4P\rss[2].xml
3 	91077 / 91082 	17,67 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temporary Internet Files\Content.IE5\AXBSTF4P\rss[3].xml
2 	37775 / 37777 	7,87 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temporary Internet Files\Content.IE5\AXBSTF4P\su-home-shop-noel[1].htm
2 	90589 / 90593 	13,18 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temporary Internet Files\Content.IE5\AXBSTF4P\wbk265D.tmp
2 	91679 / 91683 	13,18 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temporary Internet Files\Content.IE5\AXBSTF4P\wbk266A.tmp
3 	93535 / 93540 	16,30 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temporary Internet Files\Content.IE5\AXBSTF4P\wtbase[1].js
2 	40638 / 40640 	0 bytes 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temporary Internet Files\Content.IE5\AXBSTF4P\
4 	240870 / 240883 	49,25 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temporary Internet Files\Content.IE5\BTGTUA4H\460x244_mobile2[1].jpg
3 	163865 / 163872 	27,11 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temporary Internet Files\Content.IE5\BTGTUA4H\common[1].js
5 	333034 / 333064 	118,59 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temporary Internet Files\Content.IE5\BTGTUA4H\msoffice11[1].xml
4 	242429 / 242442 	51,17 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temporary Internet Files\Content.IE5\GNYPB117\490x244_mobile1[1].jpg
3 	94985 / 94990 	17,24 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temporary Internet Files\Content.IE5\GNYPB117\rss[1].xml
2 	92870 / 92874 	14,36 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temporary Internet Files\Content.IE5\GNYPB117\rss[2].xml
4 	244853 / 244866 	51,15 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temporary Internet Files\Content.IE5\GNYPB117\style_V2[1].css
3 	250585 / 250597 	48,00 KB 	OK 	C:\Documents and Settings\Djouher\Local Settings\Temporary Internet Files\Content.IE5\index.dat
8 	603178 / 603225 	185,00 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\akatsuki\akatsuki.doc
13 	1508802 / 1508992 	757,50 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\akatsuki\La vie.doc
2 	2686 / 2689 	10,51 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Compressed\HiJackThis.zip
11 	1881395 / 1881881 	1,90 MB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Compressed\mcla_screensaver.zip
20 	2479784 / 2481490 	6,66 MB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Compressed\MozillaFirebird-0.6-win32.zip
18 	1517064 / 1517375 	1,21 MB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Compressed\rs_calc_fr.zip
12 	74750 / 74762 	45,27 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\-5BDB-5D_Naruto_Shippuuden_049_225\log_225.log
12 	164322 / 164335 	48,60 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\-5BDB-5D_Naruto_Shippuuden_050_226\log_226.log
12 	168834 / 168847 	51,73 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\-5BDB-5D_Naruto_Shippuuden_051_227\log_227.log
33 	2481490 / 2481996 	1,97 MB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\-5BDB-5D_Naruto_Shippuuden_056_267\-5BDB-5D_Naruto_Shippuuden_056
1488 	6570685 / 6598114 	107,14 MB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\-5BDB-5D_Naruto_Shippuuden_057_269\-5BDB-5D_Naruto_Shippuuden_057
22 	48842 / 48864 	84,88 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\-5BDB-5D_Naruto_Shippuuden_057_269\log_269.log
31 	2492260 / 2492711 	1,76 MB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\-5BSK-TeaM-5DNaruto.Original_245\-5BSK-TeaM-5DNaruto.Original.S
1170 	9569570 / 9592148 	88,19 MB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\-5BSK-TeaM-5DNaruto.Original_246\-5BSK-TeaM-5DNaruto.Original.S
9 	16274 / 16283 	32,44 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\-5BSK-TeaM-5DNaruto.Original_246\-5BSK-TeaM-5DNaruto_246.log
3 	16283 / 16286 	11,34 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\07_-_toshiro_masuda_-_the_rais_244\log_244.log
3 	16286 / 16289 	9,52 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\AD-R_284\AD-R_284.log
3 	16289 / 16292 	9,95 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\ComboFix_280\ComboFix_280.log
4 	16292 / 16296 	13,50 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\cops_237\cops_237.log
3 	16296 / 16299 	10,47 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\disk-defrag-setup_285\disk-defrag-setup_285.log
3 	16299 / 16302 	9,72 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\emg4_224\emg4_224.log
3 	16302 / 16305 	10,70 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\EmoticonesGrandesGueules_249\EmoticonesGrandesGueules_249.log
13 	32212 / 32225 	48,40 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\FyC-mm7_gfayPnS0kiP9fc3RdO0_228\log_228.log
3 	16305 / 16308 	10,48 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\HiJackThis_272\HiJackThis_272.log
3 	16308 / 16311 	11,82 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\mcla_screensaver_241\mcla_screensaver_241.log
4 	21058 / 21062 	14,84 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\MozillaFirebird-0.6-win32_266\MozillaFirebird-0_266.log
4 	30253 / 30257 	14,81 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\msn_plus_264\msn_plus_264.log
4 	35695 / 35708 	50,98 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\Naruto-20shippuuden-20e01-20fr_259\Naruto-20shippuuden-20e01-20fr
3 	16625 / 16628 	9,67 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\Navilog1_275\Navilog1_275.log
15 	35708 / 35723 	56,06 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\PetPals_250\PetPals_250.log
2 	29991 / 29993 	7,13 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\Q3TG5PhK8vjY_mq_243\Q3TG5PhK8vjY_mq_243.log
2 	30257 / 30259 	6,73 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\Qpw5NgVMx5Ph_mq_242\Qpw5NgVMx5Ph_mq_242.log
3 	30259 / 30262 	9,85 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\ResHack_257\ResHack_257.log
4 	35723 / 35727 	12,46 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\rs_calc_fr_219\rs_calc_fr_219.log
3 	42333 / 42336 	10,54 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\ToolBarSD_276\ToolBarSD_276.log
3 	42336 / 42339 	11,42 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\ToolBarSD_277\ToolBarSD_277.log
3 	42339 / 42342 	10,89 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\weblinInstall_258\weblinInstall_258.log
155 	2518930 / 2521453 	9,85 MB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\xpsp3_5512_265\xpsp3_5512.080413-2113_fr_x86f
149 	2521453 / 2523964 	9,80 MB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\xpsp3_5512_265\xpsp3_5512.080413-2113_fr_x86f1
156 	2523964 / 2526483 	9,84 MB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\xpsp3_5512_265\xpsp3_5512.080413-2113_fr_x86f2
154 	3834777 / 3837280 	9,78 MB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\xpsp3_5512_265\xpsp3_5512.080413-2113_fr_x86f3
154 	3837280 / 3839778 	9,76 MB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\xpsp3_5512_265\xpsp3_5512.080413-2113_fr_x86f4
151 	4095491 / 4097995 	9,78 MB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\xpsp3_5512_265\xpsp3_5512.080413-2113_fr_x86f5
151 	4097995 / 4100480 	9,70 MB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\xpsp3_5512_265\xpsp3_5512.080413-2113_fr_x86f6
152 	5162276 / 5164751 	9,67 MB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\xpsp3_5512_265\xpsp3_5512.080413-2113_fr_x86f7
5 	42342 / 42347 	17,33 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\xpsp3_5512_265\xpsp3_5512_265.log
4 	45005 / 45013 	0 bytes 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Documents\DwnlData\Djouher\
11 	2507851 / 2508418 	2,21 MB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Music\07_-_toshiro_masuda_-_the_raising_fighting_spirit_2.mp3
2 	45013 / 45018 	18,11 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Music\COLLECTABLE_01_LEFT.mp3
2 	45243 / 45277 	135,83 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Music\doowop.mp3
2 	4100480 / 4101438 	3,74 MB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Music\oxk1ybok.mp3
2 	48996 / 49027 	121,37 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Music\SNY-M-779591.mp3
2 	28852 / 28854 	6,86 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Music\UI_MENU_SELECT_L.mp3
9 	1100456 / 1100603 	586,54 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Programs\AD-R.exe
9 	2526483 / 2526902 	1,64 MB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Programs\disk-defrag-setup.exe
2 	41300 / 41303 	11,19 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Programs\hijackthis.log
657 	14211663 / 14294479 	323,50 MB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Downloads\Programs\PetPals.exe
2 	4191519 / 4193663 	8,37 MB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Mes fichiers re&#1079;us\tape1.mp3
2 	5164751 / 5166835 	8,14 MB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Mes fichiers re&#1079;us\tape2.mp3
2 	45018 / 45022 	13,50 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Mes Historiques de Conversation\octobre 2008\Images\Thumbs.db
2 	63015 / 63035 	78,80 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Mes images\0dyf91ki.jpg
2 	60952 / 60967 	56,36 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Mes images\1153665307ao5.jpg
2 	45022 / 45031 	35,37 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Mes images\187116_42CWVUPO28CURNMLURCCBO5H81UC1R_88854_411689400_naruto_haku0143_h011503_l_H183021_L.jpg
3 	364640 / 364691 	200,98 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Mes images\29.gif
2 	61766 / 61778 	45,68 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Mes images\e005.gif
2 	77307 / 77320 	51,36 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Mes images\gifs_itachi1.gif
2 	92968 / 92989 	81,99 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Mes images\hws5chme.gif
3 	97541 / 97568 	104,23 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Mes images\lecon_kunai.jpg
3 	255517 / 255563 	180,15 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Mes images\matrix_naruto.jpg
2 	97568 / 97580 	45,29 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Mes images\N4.jpg
2 	114600 / 114620 	77,67 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Mes images\naruto15.jpg
5 	1513800 / 1513924 	495,33 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Mes images\naruto_shippuden_65.jpg
3 	883369 / 883414 	178,07 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Mes images\naruto_volleyball.jpg
3 	114749 / 114776 	106,56 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Mes images\sasuke_coupe.jpg
3 	920150 / 920194 	173,45 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Mes images\sasuke_supersaiyan.jpg
2 	48864 / 48875 	40,04 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Mes images\sharinganeye.jpg
3 	114983 / 115011 	109,16 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Mes images\spider-naruto.jpg
3 	933625 / 933676 	203,17 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Mes images\technique_kakashi.jpg
21 	936602 / 936656 	216,00 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Mes images\Thumbs.db
4 	1519407 / 1519513 	422,67 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Mes images\vay95xnt.gif
9 	124065 / 124101 	143,50 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Prosper M&#1081;rim&#1081;e.doc
5 	45031 / 45036 	20,00 KB 	OK 	C:\Documents and Settings\Djouher\Mes documents\Synth&#1080;se.doc
2 	5166835 / 5168499 	6,50 MB 	OK 	C:\Documents and Settings\Djouher\NTUSER.DAT
90 	2362303 / 2362646 	1,00 KB 	OK 	C:\Documents and Settings\Djouher\ntuser.dat.LOG
3 	47121 / 47128 	24,51 KB 	OK 	C:\Documents and Settings\HADJAB\Application Data\Microsoft\Windows Live\Toolbar\Feeds\rss19A5.tmp
3 	49027 / 49035 	28,41 KB 	OK 	C:\Documents and Settings\HADJAB\Application Data\Microsoft\Windows Live\Toolbar\Feeds\rss19A7.tmp
2 	45277 / 45280 	11,62 KB 	OK 	C:\Documents and Settings\HADJAB\Application Data\Microsoft\Windows Live\Toolbar\Feeds\rss1D0D.tmp
2 	47546 / 47550 	12,34 KB 	OK 	C:\Documents and Settings\HADJAB\Application Data\Microsoft\Windows Live\Toolbar\Feeds\rss1D11.tmp
4 	77320 / 77329 	34,71 KB 	OK 	C:\Documents and Settings\HADJAB\Application Data\Microsoft\Windows Live\Toolbar\Feeds\rss1D13.tmp
6 	131621 / 131658 	146,01 KB 	OK 	C:\Documents and Settings\HADJAB\Application Data\Mozilla\Firefox\Profiles\ktnbof9s.default\bookmarkbackups\bookmarks-2008-11-17.json
6 	167842 / 167879 	146,01 KB 	OK 	C:\Documents and Settings\HADJAB\Application Data\Mozilla\Firefox\Profiles\ktnbof9s.default\bookmarkbackups\bookmarks-2008-11-19.json
6 	893316 / 893353 	146,41 KB 	OK 	C:\Documents and Settings\HADJAB\Application Data\Mozilla\Firefox\Profiles\ktnbof9s.default\bookmarkbackups\bookmarks-2008-11-21.json
6 	906103 / 906140 	146,72 KB 	OK 	C:\Documents and Settings\HADJAB\Application Data\Mozilla\Firefox\Profiles\ktnbof9s.default\bookmarkbackups\bookmarks-2008-11-22.json
6 	936692 / 936729 	146,72 KB 	OK 	C:\Documents and Settings\HADJAB\Application Data\Mozilla\Firefox\Profiles\ktnbof9s.default\bookmarkbackups\bookmarks-2008-11-24.json
3 	48565 / 48571 	23,87 KB 	OK 	C:\Documents and Settings\HADJAB\Application Data\Mozilla\Firefox\Profiles\ktnbof9s.default\GoogleToolbarData\searchhistory.xml
3 	53301 / 53306 	18,33 KB 	OK 	C:\Documents and Settings\HADJAB\Application Data\Mozilla\Firefox\Profiles\ktnbof9s.default\localstore.rdf
2 	57222 / 57226 	14,41 KB 	OK 	C:\Documents and Settings\HADJAB\Application Data\Mozilla\Firefox\Profiles\ktnbof9s.default\pluginreg.dat
3 	68032 / 68037 	16,83 KB 	OK 	C:\Documents and Settings\HADJAB\Application Data\Mozilla\Firefox\Profiles\ktnbof9s.default\prefs.js
2 	20626 / 20628 	4,52 KB 	OK 	C:\Documents and Settings\HADJAB\Application Data\OpenOffice.org2\user\registry\data\org\openoffice\Office\Common.xcu
3 	63035 / 63039 	13,65 KB 	OK 	C:\Documents and Settings\HADJAB\Application Data\Real\RealOne Player\ErrorLogs\GenDevices.log
2 	30262 / 30264 	4,39 KB 	OK 	C:\Documents and Settings\HADJAB\Application Data\Real\RealOne Player\ErrorLogs\pdgenwmdm.log
3 	2359839 / 2360144 	1,19 MB 	OK 	C:\Documents and Settings\HADJAB\Application Data\Real\RealOne Player\skins\data\normal\imgcache.dat
2 	82001 / 82005 	0 bytes 	OK 	C:\Documents and Settings\HADJAB\Application Data\Real\RealPlayer\db\Backup\000\
8 	97633 / 97650 	64,81 KB 	OK 	C:\Documents and Settings\HADJAB\Application Data\Real\RealPlayer\db\CD.DBF
4 	101043 / 101058 	58,36 KB 	OK 	C:\Documents and Settings\HADJAB\Application Data\Real\RealPlayer\db\CDTRAX.DBF
5 	936778 / 936821 	170,03 KB 	OK 	C:\Documents and Settings\HADJAB\Application Data\Real\RealPlayer\db\TRACKS.DBF
10 	1564987 / 1565158 	680,51 KB 	OK 	C:\Documents and Settings\HADJAB\Application Data\Real\RealPlayer\db\TRACKS.FPT
19 	114889 / 114908 	75,63 KB 	OK 	C:\Documents and Settings\HADJAB\Application Data\skypePM\2008-10-25-0.ezlog
2 	36847 / 36849 	6,67 KB 	OK 	C:\Documents and Settings\HADJAB\Application Data\skypePM\2008-10-26-1.ezlog
4 	114941 / 114959 	71,05 KB 	OK 	C:\Documents and Settings\HADJAB\Application Data\Sun\Java\Deployment\cache\6.0\62\577e907e-5c2f7e38
8 	976123 / 976201 	310,97 KB 	OK 	C:\Documents and Settings\HADJAB\Application Data\vlc\cache\plugins-04041e.dat
4 	114633 / 114646 	49,41 KB 	OK 	C:\Documents and Settings\HADJAB\Application Data\vlc\vlcrc
4 	975957 / 976014 	225,24 KB 	OK 	C:\Documents and Settings\HADJAB\Bureau\C1_L1\cours_1\C1_L1.pdf.zip
151 	7174371 / 7179248 	19,05 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\C1_L1\cour_1_audio\L1_C1.zip
133 	7108613 / 7112965 	17 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\C1_L2\L2_C1.zip
47 	7157138 / 7161679 	17,74 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\C1_L3\exo3_C1.zip
56 	8104066 / 8109592 	21,58 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\C1_L3\L3_C1.zip
2 	255357 / 255410 	209,45 KB 	OK 	C:\Documents and Settings\HADJAB\Bureau\C1_L3\Nouveau dossier\C1_L3.pdf
3 	255410 / 255461 	200,38 KB 	OK 	C:\Documents and Settings\HADJAB\Bureau\C1_L3\Nouveau dossier\C1_L3.pdf.zip
6 	54170 / 54176 	23,50 KB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Cours du dimanche 09 nov\All&#1074;humma inn&#1086; a.doc
326 	8136539 / 8142422 	22,98 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le bonheur\confiance-en-soi.mp3(2)\confiance-en-soi.mp3
155 	8323831 / 8329668 	22,80 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le bonheur\confiance-en-soi.mp3(2)\confiance-en-soi.mp3(2).zip
53 	5168499 / 5170818 	9,06 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le bonheur\connaissance.mp3\connaissance.mp3.zip
10 	2481996 / 2482329 	1,30 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le bonheur\connaissance.mp3\la_connaissance_de_soi_extrait.mp3\la_connaissance_de_soi_extrait.mp3.zip
9 	6598114 / 6600410 	8,97 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le bonheur\maitrise-de-soi.mp3(2)\maitrise-de-soi.mp3(2).zip
102 	8470778 / 8477133 	24,82 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le bonheur\MIPD\MIPD.zip
115 	9164002 / 9172783 	34,30 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le bonheur\MIPD2\MIPD2.zip
29 	7461596 / 7463394 	7,02 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le bonheur\S'affirmer\saffirmer.zip
11 	8165166 / 8170144 	19,44 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le bonheur\victorieux.mp3(2)\victorieux.mp3(2).zip
2 	2622958 / 2623357 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome I\Scan10006.BMP
2 	2659949 / 2660348 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome I\Scan10007.BMP
2 	2660348 / 2660747 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome I\Scan10008.BMP
2 	3731714 / 3732113 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome I\Scan10009.BMP
2 	3839778 / 3840177 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome I\Scan10010.BMP
2 	4101438 / 4101837 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome I\Scan10011.BMP
2 	4102833 / 4103232 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome I\Scan10012.BMP
2 	4421601 / 4422000 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome I\Scan10013.BMP
2 	4422000 / 4422399 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome I\Scan10014.BMP
2 	4422399 / 4422798 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome I\Scan10015.BMP
2 	5170818 / 5171217 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome I\Scan10016.BMP
2 	5171217 / 5171616 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome I\Scan10017.BMP
2 	5171616 / 5172015 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome I\Scan10018.BMP
2 	5172015 / 5172414 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome I\Scan10019.BMP
2 	5357813 / 5358212 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome I\Scan10020.BMP
5 	54176 / 54185 	34,00 KB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome I\Thumbs.db
2 	9189 / 9191 	0 bytes 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome I\
2 	6600410 / 6600809 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome II\Scan10001.BMP
2 	6600809 / 6601208 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome II\Scan10002.BMP
2 	6860861 / 6861260 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome II\Scan10003.BMP
2 	6861260 / 6861659 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome II\Scan10004.BMP
2 	6862579 / 6862978 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome II\Scan10005.BMP
2 	6862978 / 6863377 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome II\Scan10006.BMP
2 	6960282 / 6960681 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome II\Scan10007.BMP
2 	7096034 / 7096433 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome II\Scan10008.BMP
2 	2360640 / 2361039 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome II\Scan10009.BMP
2 	7179248 / 7179647 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome II\Scan10010.BMP
2 	7179647 / 7180046 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome II\Scan10011.BMP
2 	7433129 / 7433528 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome II\Scan10012.BMP
2 	7463394 / 7463793 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome II\Scan10013.BMP
2 	7463793 / 7464192 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome II\Scan10014.BMP
2 	7464192 / 7464591 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome II\Scan10015.BMP
2 	7464591 / 7464990 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome II\Scan10016.BMP
2 	7464990 / 7465389 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome II\Scan10017.BMP
3 	54185 / 54191 	24,00 KB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome II\Thumbs.db
2 	7465389 / 7465788 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome III\Scan1.BMP
2 	7466834 / 7467233 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome III\Scan10001.BMP
2 	7467233 / 7467632 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome III\Scan10002.BMP
2 	7467632 / 7468031 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome III\Scan10003.BMP
2 	7468031 / 7468430 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome III\Scan10004.BMP
2 	7468430 / 7468829 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome III\Scan10005.BMP
2 	7468829 / 7469228 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome III\Scan10006.BMP
2 	7469228 / 7469627 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome III\Scan10007.BMP
2 	7469627 / 7470026 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome III\Scan10008.BMP
2 	7470026 / 7470425 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome III\Scan10009.BMP
2 	7470425 / 7470824 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome III\Scan10010.BMP
2 	7470824 / 7471223 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome III\Scan10011.BMP
2 	7474017 / 7474416 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome III\Scan10012.BMP
2 	7474416 / 7474815 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome III\Scan10013.BMP
2 	7474815 / 7475214 	1,56 MB 	OK 	C:\Documents and Settings\HADJAB\Bureau\Le Sahih d'al-Bukh&#1074;ry\Tome III\Scan10014.BMP
2 	7475214 / 7475613 	1,56 MB 	OK 	C:\Documents and Settings\HADJ

Utilisateur anonyme · Answer

Refait un hijackthis stp

karimosouli · Answer

tien:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:37:50, on 25/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Prayer\Prayer.exe
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEMonitor.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Documents and Settings\Djouher\Mes documents\Downloads\Programs\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/ymj/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMIECC.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealOne Playerpbrowserrecordplugin.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Windows Live Toolbar Beta - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: islamuslim Toolbar - {fcd5ee58-54d8-4d33-aa8d-54ae85597966} - C:\Program Files\islamuslim	bisl0.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: islamuslim Toolbar - {fcd5ee58-54d8-4d33-aa8d-54ae85597966} - C:\Program Files\islamuslim	bisl0.dll
O3 - Toolbar: &Windows Live Toolbar Beta - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [EEventManager] C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
O4 - HKLM\..\Run: [AXIS TONS THE MP3] C:\Documents and Settings\All Users\Application Data\Readme Live Axis Tons\Amok team.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [IDMan] C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe /onboot
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Heartbags] C:\DOCUME~1\Djouher\APPLIC~1\ITCHSE~1\DASH BLEH.exe
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'HADJAB')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S (User 'HADJAB')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'HADJAB')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" (User 'HADJAB')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'HADJAB')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [EPSON PX800FW Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIEME.EXE /FU "C:\WINDOWS\TEMP\E_S5D7.tmp" /EF "HKCU" (User 'HADJAB')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [Netlog Music Tool] "C:\Program Files\Netlog Music Tool\NetlogMusicTool.exe" (User 'HADJAB')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [Heartbags] C:\DOCUME~1\HADJAB\APPLIC~1\ITCHSE~1\DASH BLEH.exe (User 'HADJAB')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-21-2227724090-2535785734-815230075-1006 Startup: OpenOffice.org 2.4.lnk (User 'HADJAB')
O4 - S-1-5-21-2227724090-2535785734-815230075-1006 User Startup: OpenOffice.org 2.4.lnk (User 'HADJAB')
O4 - Global Startup: Bilal.lnk = C:\Program Files\Prayer\Prayer.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: Download all links with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEExt.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
O23 - Service: Localisateur d'appels de procédure distante (RPC) (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe
O23 - Service: QoS RSVP (RSVP) - Unknown owner - C:\WINDOWS\system32svp.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

Utilisateur anonyme · Answer

Bon aller, pour vérifier, le scan peut durer plus d'une heure !!!!!
1) Télécharge et installe Malwarebyte's Anti-Malware:

http://www.malwarebytes.org/mbam/program/mbam-setup.exe

A la fin de l'installation, veille à ce que l'option « mettre a jour Malwarebyte's Anti-Malware » soit cochée. >>> clique sur OK
Lance Malwarebyte's Anti-Malware en double-cliquant sur l'icône sur ton Bureau.

Au premier lancement, une fenêtre t'annonce que la version est Free >>> clique sur OK

Laisse les Mises à jour se télécharger
*** Referme le programme ***

2) Redémarre en "Mode sans échec"

Au redémarrage de l'ordinateur, une fois le chargement du BIOS terminé, il y a un écran noir qui apparaît rapidement, appuie sur la touche [F8] (ou [F5] sur certains pc) jusqu'à l'affichage du menu des options avancées de Windows.
Sélectionner "Mode sans échec" et appuie sur [Entrée]
Il faudra choisir ta session habituelle, pas le compte "Administrateur" ou une autre.
Regarde ici si besoin : https://www.malekal.com/demarrer-windows-mode-sans-echec/

Ouvre le fichier texte sauvegardé sur le Bureau afin de suivre les instructions comme il faut.

3) Scan avec Malwarebyte's Anti-Malware

Lance Malwarebyte's Anti-Malware
Onglet "Recherche" >>> coche Executer un exame complet >>> Rechercher sélectionne tes disques durs puis clique sur Lancer l’examen
A la fin du scan >>> clique sur Afficher les résultats puis sur Enregistrer le rapport
Suppression des éléments détectés >>>>
supprime ce qu'il a trouvé vide également les éléments de la quarantaine
S'il t'es demandé de redémarrer >>> clique sur "Yes"

--> Un rapport de scan s'ouvre, enregistre sur ton Bureau et poste ce rapport en réponse.

karimosouli · Answer

tien:

Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1423
Windows 5.1.2600 Service Pack 2

25/11/2008 23:09:56
mbam-log-2008-11-25 (23-09-56).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 259084
Temps écoulé: 2 hour(s), 43 minute(s), 10 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 26

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055c089-8582-441b-a0bf-17b458c2a3a8} (Trojan.BHO.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0055c089-8582-441b-a0bf-17b458c2a3a8} (Trojan.BHO.H) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AXIS TONS THE MP3 (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Program Files\ScanSpyware v3.8.0.2 (Rogue.ScanSpyware) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMIECC.dll (Trojan.BHO.H) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\boserote.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\hewurogo.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\jojayuza.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\misiruvu.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\sidegiho.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32	orayiya.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32	uhuduta.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\votojoye.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\~.exe.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP107\A0011459.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP107\A0011463.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP107\A0011467.dll (Adware.Shopper) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP107\A0011501.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP109\A0011634.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP109\A0011635.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP109\A0011637.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP109\A0011638.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP109\A0011639.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP109\A0011642.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP109\A0011643.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP109\A0011644.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP109\A0011646.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP110\A0011754.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Readme Live Axis Tons\Amok team.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\~.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

Utilisateur anonyme · Answer

Bon, désactive et réactive la restauration du système : http://service1.symantec.com/support/inter/tsgeninfointl.Nsf/fr_docid/20020830101856924

Refait un hijack ensuite !

karimosouli · Answer

voila:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:58:52, on 26/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Prayer\Prayer.exe
C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEMonitor.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Djouher\Mes documents\Downloads\Programs\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/ymj/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMIECC.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealOne Playerpbrowserrecordplugin.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Windows Live Toolbar Beta - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: islamuslim Toolbar - {fcd5ee58-54d8-4d33-aa8d-54ae85597966} - C:\Program Files\islamuslim	bisl0.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: islamuslim Toolbar - {fcd5ee58-54d8-4d33-aa8d-54ae85597966} - C:\Program Files\islamuslim	bisl0.dll
O3 - Toolbar: &Windows Live Toolbar Beta - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [EEventManager] C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [IDMan] C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe /onboot
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Heartbags] C:\DOCUME~1\Djouher\APPLIC~1\ITCHSE~1\DASH BLEH.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bilal.lnk = C:\Program Files\Prayer\Prayer.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: Download all links with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEExt.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
O23 - Service: Localisateur d'appels de procédure distante (RPC) (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe
O23 - Service: QoS RSVP (RSVP) - Unknown owner - C:\WINDOWS\system32svp.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

Utilisateur anonyme · Answer

Pour vérifier,
    * Télécharger Lopxp : (by Moe) : http://sosvirus.changelog.fr/Green_day/Lopxpsetup
    * Double-cliquer sur Lopxpsetup.exe pour lancer l'installation
    * Au menu, choisir l'option 1
    * Patienter jusqu'à que l'on demande d'appuyer sur une touche, appuyer !
    * Le contenu du rapport est situé dans : C:\Programfiles\Lopxp\cid.txt

Poste le rapport

karimosouli · Answer

voila voila:

# Rapport Lopxp fait le 26/11/2008 à 13:48:06
# Exécuté dans : C:\Program Files\Lopxp
# Version 3.10 - Maj du 11/04/2008

  Killing 'iexplore.exe'
"C:\Program Files\Internet Explorer\iexplore.exe" (3868)

========== Listing des dossiers Application Data

+- C:\Documents and Settings\All Users\Application Data

 2008-05-18 à 19:02:42 - Adobe 
 2007-08-30 à 19:44:41 - AOL 
 2007-12-29 à 12:57:34 - Apple 
 2008-01-15 à 19:19:21 - Apple Computer
 2008-04-08 à 07:26:32 - AVS4YOU 
 2008-04-29 à 18:15:06 - BVRP Software
 2007-08-31 à 09:17:39 - CyberLink 
 2008-06-20 à 11:55:17 - Downloaded Installations
 2008-11-01 à 18:22:06 - EPSON 
 2008-03-22 à 17:02:07 - ESET 
 2008-11-21 à 16:47:40 - Google 
 2008-11-21 à 08:54:48 - Lavasoft 
 2008-11-25 à 18:59:58 - Malwarebytes 
 2008-10-16 à 12:41:47 - Microsoft 
 2007-09-08 à 19:04:18 - QuickTime 
 2008-11-19 à 14:59:13 - Readme Live Axis Tons
 2004-08-16 à 16:28:48 - SBSI 
 2008-10-27 à 18:38:55 - Skype 
 2008-06-14 à 18:01:17 - Spybot - Search & Destroy
 2008-11-23 à 16:57:52 - Spyware Terminator
 2008-11-22 à 12:07:38 - TEMP 
 2008-05-11 à 14:13:19 - Transparent 
 2008-04-22 à 15:30:30 - TuneUp Software
 2008-11-01 à 18:19:32 - UDL 
 2008-04-06 à 16:36:08 - Ulead Systems
 2007-11-14 à 21:51:35 - ViceVersa PRO 2
 2007-08-30 à 19:45:03 - Viewpoint 
 2007-08-30 à 20:55:16 - Windows Genuine Advantage
 2008-05-09 à 21:53:01 - WLInstaller 
 2008-05-09 à 19:09:56 - YAHOO 
 2007-09-17 à 14:22:37 - Yahoo! 
 2007-09-17 à 14:40:38 - Yahoo! Companion

+- C:\Documents and Settings\Djouher\Application Data

 2008-05-21 à 17:12:34 - Adobe 
 2007-12-30 à 19:41:55 - AquaNox 
 2008-11-24 à 21:03:57 - Auslogics 
 2008-09-06 à 14:44:41 - Axialis 
 2008-01-04 à 12:46:37 - Babylon 
 2007-11-03 à 19:22:30 - CyberLink 
 2008-05-03 à 11:35:14 - DivX 
 2008-11-26 à 11:54:36 - DMCache 
 2008-09-25 à 17:02:36 - e frontier
 2008-11-03 à 09:39:59 - Epson 
 2008-04-19 à 19:16:02 - Google 
 2008-04-22 à 15:47:12 - Help 
 2004-08-16 à 16:19:22 - Identities 
 2008-09-21 à 17:49:53 - IDM 
 2007-09-25 à 15:21:14 - InstallShield 
 2007-09-25 à 15:21:22 - InstallShield Installation Information
 2008-11-22 à 11:27:48 - Itch seek
 2008-05-21 à 17:12:43 - Leadertech 
 2007-11-02 à 16:40:02 - LogProtect 
 2007-10-07 à 15:03:44 - Macromedia 
 2008-11-25 à 19:00:12 - Malwarebytes 
 2008-11-24 à 19:10:40 - Microsoft 
 2008-06-19 à 17:17:57 - Mozilla 
 2007-10-08 à 16:36:53 - MusicNet 
 2008-05-05 à 18:34:43 - OmniPokedex 
 2008-11-02 à 20:25:14 - OpenOffice.org2 
 2008-11-22 à 12:03:57 - Phoenix 
 2007-11-05 à 13:05:54 - Real 
 2007-09-25 à 15:21:22 - sixteen tons entertainment
 2007-12-02 à 17:35:05 - Sonic 
 2008-06-14 à 14:49:37 - SPAMfighter 
 2008-11-23 à 16:58:57 - Spyware Terminator
 2008-05-17 à 17:42:42 - Styler 
 2007-08-30 à 19:40:22 - Sun 
 2007-08-30 à 19:47:12 - Symantec 
 2008-04-23 à 13:04:07 - Thinstall 
 2008-04-22 à 15:30:43 - TuneUp Software
 2008-03-22 à 16:43:38 - URSoft 
 2008-09-10 à 17:29:17 - Viewpoint 
 2008-03-22 à 17:47:33 - vlc 
 2008-04-09 à 15:13:22 - WinRAR 
 2007-08-30 à 19:45:04 - You've Got Pictures Screensaver
 2008-11-21 à 18:58:07 - zweitgeist 

+- C:\Documents and Settings\Djouher\Local Settings\Application Data

 2008-11-23 à 16:39:58 - Adobe 
 2007-12-29 à 12:57:38 - Apple 
 2008-08-27 à 16:09:12 - Apple Computer
 2007-08-30 à 19:03:28 - ApplicationHistory 
 2008-09-07 à 17:23:19 - Axialis 
 2008-01-04 à 12:26:03 - Babylon 
 2008-03-22 à 17:36:44 - ESET 
 2008-05-16 à 16:57:13 - Google 
 2008-04-22 à 15:47:12 - Help 
 2007-11-06 à 17:32:54 - Identities 
 2008-11-23 à 11:10:53 - islamuslim 
 2008-11-16 à 17:05:57 - Microsoft 
 2007-09-22 à 16:32:59 - Mozilla 
 2007-11-03 à 19:21:44 - PowerCinema 
 2008-07-11 à 17:54:15 - speed-bit 
 2007-10-20 à 09:27:35 - Winamp Toolbar
 2008-05-08 à 17:28:21 - Yahoo 
 2007-08-30 à 19:40:12 - {7148F0A6-6813-11D6-A77B-00B0D0142050} 

+- C:\Documents and Settings\Mohamed-Amine\Application Data

 2008-09-24 à 18:44:50 - Adobe 
 2008-06-14 à 15:25:01 - Apple Computer
 2008-11-01 à 19:53:53 - Epson 
 2008-03-10 à 20:24:38 - Google 
 2004-08-16 à 16:19:22 - Identities 
 2007-12-03 à 17:49:01 - InstallShield 
 2007-11-03 à 18:50:04 - LogProtect 
 2007-11-04 à 09:46:12 - Macromedia 
 2008-11-20 à 08:13:06 - Microsoft 
 2008-06-19 à 15:25:50 - Mozilla 
 2007-12-04 à 09:28:36 - MusicNet 
 2008-05-08 à 14:27:17 - Real 
 2008-06-14 à 13:39:33 - SPAMfighter 
 2007-08-30 à 19:40:22 - Sun 
 2007-08-30 à 19:47:12 - Symantec 
 2008-09-10 à 18:18:14 - Viewpoint 
 2007-08-30 à 19:45:04 - You've Got Pictures Screensaver

+- C:\Documents and Settings\Mohamed-Amine\Local Settings\Application Data

 2008-09-24 à 18:45:13 - Adobe 
 2008-10-18 à 08:28:17 - Apple Computer
 2007-08-30 à 19:03:28 - ApplicationHistory 
 2008-03-10 à 17:10:23 - Google 
 2007-11-11 à 09:58:26 - Identities 
 2008-11-23 à 10:04:30 - islamuslim 
 2008-11-20 à 08:13:02 - Microsoft 
 2007-11-04 à 09:44:18 - Mozilla 
 2007-08-30 à 19:49:38 - PowerCinema 
 2008-07-13 à 15:15:01 - speed-bit 
 2007-08-30 à 19:40:12 - {7148F0A6-6813-11D6-A77B-00B0D0142050} 

+- C:\Documents and Settings\Propri‚taire\Application Data

 2007-10-15 à 18:57:53 - You've Got Pictures Screensaver

========== Listing du dossier Program Files

+- C:\Program Files

 2008-03-04 à 05:20:42 - 7-Zip 
 2008-11-23 à 18:35:21 - Ad-remover 
 2008-06-27 à 05:55:12 - Adobe 
 2008-11-21 à 08:40:10 - Ahead 
 2007-09-17 à 12:36:51 - Alwil Software
 2008-01-17 à 18:20:38 - aod 
 2007-08-30 à 19:45:05 - AOL 9.0
 2007-08-30 à 19:45:04 - AOL Compagnon
 2007-10-10 à 19:10:42 - ArcSoft 
 2008-07-13 à 13:20:23 - Athan 
 2008-11-24 à 21:03:50 - Auslogics 
 2008-11-21 à 09:07:06 - AVS4YOU 
 2008-11-21 à 09:08:12 - Axialis 
 2008-01-05 à 10:43:48 - Babylon 
 2008-10-15 à 17:35:00 - Bonjour 
 2007-10-10 à 19:11:10 - Caere 
 2008-04-09 à 15:13:44 - Common Files
 2004-08-16 à 16:05:16 - ComPlus Applications
 2008-03-22 à 17:38:52 - Conjugaison 
 2007-08-30 à 19:49:15 - CyberLink 
 2008-02-10 à 10:49:21 - DAP 
 2007-12-24 à 15:00:11 - DicoRime 
 2007-11-20 à 22:51:27 - Dictionnaire 
 2008-10-16 à 19:46:56 - DivX 
 2007-09-22 à 10:49:34 - DK 
 2008-03-22 à 17:44:59 - DMV 
 2007-10-20 à 15:18:43 - EA Games
 2008-09-22 à 16:42:32 - Empire Interactive
 2008-11-01 à 18:18:44 - EPSON 
 2008-11-01 à 18:18:59 - Epson Software
 2008-04-04 à 18:22:43 - ESET 
 2008-11-23 à 18:32:17 - Fichiers communs
 2007-11-16 à 12:50:07 - Foreignword 
 2007-08-30 à 20:56:56 - Foxit Software
 2008-03-28 à 22:08:50 - Generalia Multimedia
 2008-05-17 à 10:27:25 - GOA 
 2008-11-21 à 16:47:43 - Google 
 2008-05-11 à 13:38:44 - Harf 
 2008-11-21 à 09:43:00 - InstallShield Installation Information
 2007-08-30 à 20:34:28 - Intel 
 2008-10-16 à 19:49:41 - Internet Explorer
 2007-12-31 à 11:21:01 - islamuslim 
 2008-11-19 à 14:58:19 - Itch seek
 2008-11-21 à 17:19:34 - iTunes 
 2008-11-21 à 16:39:35 - Java 
 2007-09-27 à 11:32:06 - Lame MP3 Codec
 2008-11-21 à 16:31:33 - Lavasoft 
 2007-08-30 à 19:45:04 - Learn2.com 
 2007-11-12 à 23:29:54 - LeConjugueur 
 2008-11-21 à 18:56:48 - Legacy Interactive
 2008-01-10 à 19:48:58 - Ligos 
 2008-11-21 à 17:16:45 - LogProtect 
 2008-11-26 à 12:48:16 - Lopxp 
 2008-11-25 à 19:00:10 - Malwarebytes' Anti-Malware
 2007-09-27 à 11:30:37 - MarkAny 
 2008-11-21 à 19:11:26 - Mes Vacances en Photo
 2008-08-16 à 09:18:04 - Messenger 
 2008-01-10 à 19:51:50 - metagenia 
 2008-10-16 à 12:38:35 - Microsoft 
 2008-09-21 à 12:17:54 - Microsoft ActiveSync
 2004-08-16 à 16:11:16 - microsoft frontpage
 2007-11-17 à 15:54:32 - Microsoft Games
 2008-05-05 à 11:15:03 - Microsoft Office
 2008-10-16 à 12:48:20 - Microsoft Office Outlook Connector
 2008-10-27 à 19:14:27 - Microsoft Silverlight
 2008-01-15 à 17:50:48 - Microsoft SQL Server Compact Edition
 2008-05-05 à 11:14:24 - Microsoft.NET 
 2008-04-29 à 18:09:58 - mobile PhoneTools
 2004-08-16 à 16:06:24 - Movie Maker
 2008-11-26 à 12:41:18 - Mozilla Firefox
 2004-08-16 à 16:03:08 - MSN 
 2004-08-16 à 16:03:38 - MSN Gaming Zone
 2007-08-31 à 11:20:55 - MSXML 4.0
 2008-04-04 à 11:16:12 - MUSICMATCH 
 2007-09-27 à 11:40:36 - MyFree Codec
 2008-11-23 à 14:24:38 - Navilog1 
 2004-08-16 à 16:06:14 - NetMeeting 
 2007-11-17 à 16:46:23 - Nobilis 
 2007-11-01 à 10:07:10 - nouf.org 
 2008-04-23 à 13:15:43 - Omni Pokedex
 2004-08-16 à 16:03:54 - Online Services
 2008-05-01 à 21:49:38 - OpenOffice.org 2.4
 2007-08-31 à 11:18:22 - Outlook Express
 2008-10-20 à 07:04:34 - Picasa2 
 2008-06-29 à 13:17:56 - PopUp Destroy
 2008-11-26 à 11:54:48 - Prayer 
 2008-04-22 à 16:27:29 - Proxomitron Naoko v4.5
 2008-10-15 à 18:19:26 - QuickTime 
 2008-06-01 à 17:57:38 - QuickZip4 
 2008-05-31 à 13:45:50 - Quran_AR 
 2007-11-02 à 18:27:19 - RaimaRadio 
 2007-11-12 à 16:57:44 - Real 
 2008-11-21 à 09:59:21 - Registry Mechanic
 2008-09-21 à 12:17:39 - Ressources Windows Mobile
 2007-11-01 à 09:27:04 - RM to MP3 Converter
 2008-10-15 à 17:43:58 - Safari 
 2007-09-27 à 11:30:30 - Samsung 
 2004-08-16 à 16:07:34 - Services en ligne
 2008-07-12 à 10:26:58 - sixteen tons entertainment
 2008-04-05 à 14:39:34 - Small Rockets
 2007-08-30 à 19:51:26 - Sonic 
 2008-11-21 à 17:00:25 - speed-bit 
 2008-11-23 à 16:58:30 - Spyware Terminator
 2007-09-12 à 13:43:01 - Strategy First
 2008-11-21 à 16:58:24 - Time4Worker 
 2008-11-21 à 09:09:39 - Transparent 
 2007-11-17 à 15:40:08 - Ubi Soft
 2004-08-16 à 16:19:06 - Uninstall Information
 2008-06-16 à 18:09:22 - UNYK 
 2007-11-14 à 21:56:55 - ViceVersa Pro 2
 2008-11-09 à 10:12:08 - VideoLAN 
 2007-08-30 à 19:45:03 - Viewpoint 
 2008-05-17 à 09:02:54 - Vstep 
 2008-11-21 à 18:58:06 - weblin 
 2008-04-29 à 16:55:04 - WIDCOMM 
 2007-08-30 à 20:58:01 - Windows Defender
 2008-10-16 à 12:48:00 - Windows Live
 2008-01-15 à 17:52:51 - Windows Live Favorites
 2008-10-16 à 12:41:59 - Windows Live Toolbar
 2007-09-08 à 16:50:21 - Windows Media Connect 2
 2008-11-13 à 07:34:15 - Windows Media Player
 2004-08-16 à 16:03:06 - Windows NT
 2004-08-16 à 16:07:42 - WindowsUpdate 
 2008-04-22 à 15:47:30 - WinRAR 
 2008-06-13 à 18:45:28 - WorkTime 
 2004-08-16 à 16:11:16 - xerox 
 2007-09-27 à 11:31:57 - XviD 
 2008-05-09 à 19:09:53 - Yahoo! 
 2007-11-16 à 12:38:26 - ZikiTranslator 

========== Tâches planifiées

1-Click Maintenance.job: C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe /schedulestart
8B841DC78F879383.job: c:\docume~1\djouher\applic~1\itchse~1\DELETE MEMO TONS.exe 
MP Scheduled Scan.job: C:\Program Files\Windows Defender\MpCmdRun.exe Scan -RestrictPrivileges
Rappel d'enregistrement 2.job: C:\WINDOWS\system32\OOBE\oobebaln.exe /sys /r /n:2

========== Clés registre

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Heartbags"="C:\DOCUME~1\Djouher\APPLIC~1\ITCHSE~1\DASH BLEH.exe"


========== Bloqueur popups Internet Explorer


==========    Suggestion ( /!\ Nécessite une interprétation.)    ==========

C:\Documents and Settings\All Users\Application Data\Readme Live Axis Tons
C:\Documents and Settings\Djouher\Application Data\Itch seek
C:\Program Files\Itch seek
C:\WINDOWS	asks\8B841DC78F879383.job

+- Registre:

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Heartbags"=-




- Fin du rapport -

Utilisateur anonyme · Answer

J'en étais sur...
Télécharge LopSD : https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2
Installe le, lance le et tape 1 et valide, attend........ le bloc-note s'ouvrira, copie colle le contenue et poste le ici

Tutoriel si problème : http://forum.telecharger.01net.com/microhebdo/6/tuto-securite/lopsd-eliminez-les-pubs-cid-353105/messages-1.html

karimosouli · Answer

tien:

   --------------------\  Lop S&D 4.2.4-9c   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) 4 CPU 3.00GHz )
   BIOS : Award Medallion BIOS v6.00PG
   USER : Djouher ( Administrator )
   BOOT : Normal boot
   Antivirus : ESET NOD32 Antivirus 3.0 3.0 (Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:149 Go (Free:97 Go)
   D:\ (CD or DVD)
   E:\ (CD or DVD)
   F:\ (USB)
   G:\ (USB)
   H:\ (USB)
   I:\ (USB)

   "C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
   Option : [1] ( 26/11/2008|14:33 )
 
   --------------------\  Listing des dossiers dans APPLIC~1

   [18/05/2008|20:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [30/08/2007|20:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
   [29/12/2007|13:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [15/01/2008|20:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [08/04/2008|08:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AVS4YOU
   [29/04/2008|19:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BVRP Software
   [31/08/2007|10:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
   [20/06/2008|12:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Downloaded Installations
   [01/11/2008|19:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\EPSON
   [22/03/2008|18:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ESET
   [21/11/2008|17:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [21/11/2008|09:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
   [25/11/2008|19:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
   [16/10/2008|13:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [08/09/2007|20:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
   [25/11/2008|23:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Readme Live Axis Tons
   [16/08/2004|17:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
   [27/10/2008|19:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
   [14/06/2008|19:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [23/11/2008|17:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spyware Terminator
   [26/11/2008|13:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
   [11/05/2008|15:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Transparent
   [22/04/2008|16:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TuneUp Software
   [01/11/2008|19:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\UDL
   [06/04/2008|17:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ulead Systems
   [14/11/2007|22:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ViceVersa PRO 2
   [30/08/2007|20:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
   [30/08/2007|21:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [09/05/2008|22:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
   [09/05/2008|20:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\YAHOO
   [17/09/2007|15:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
   [17/09/2007|15:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion

   [16/08/2004|17:19] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [16/08/2004|16:54] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
   [30/08/2007|20:50] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Real
   [30/08/2007|20:40] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Sun
   [30/08/2007|20:47] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec
   [30/08/2007|20:45] C:\DOCUME~1\DEFAUL~1\APPLIC~1\You've Got Pictures Screensaver

   [21/05/2008|18:12] C:\DOCUME~1\Djouher\APPLIC~1\Adobe
   [30/12/2007|20:41] C:\DOCUME~1\Djouher\APPLIC~1\AquaNox
   [24/11/2008|22:03] C:\DOCUME~1\Djouher\APPLIC~1\Auslogics
   [06/09/2008|15:44] C:\DOCUME~1\Djouher\APPLIC~1\Axialis
   [04/01/2008|13:46] C:\DOCUME~1\Djouher\APPLIC~1\Babylon
   [03/11/2007|20:22] C:\DOCUME~1\Djouher\APPLIC~1\CyberLink
   [03/05/2008|12:35] C:\DOCUME~1\Djouher\APPLIC~1\DivX
   [26/11/2008|12:58] C:\DOCUME~1\Djouher\APPLIC~1\DMCache
   [25/09/2008|18:02] C:\DOCUME~1\Djouher\APPLIC~1\e frontier
   [03/11/2008|10:39] C:\DOCUME~1\Djouher\APPLIC~1\Epson
   [19/04/2008|20:16] C:\DOCUME~1\Djouher\APPLIC~1\Google
   [22/04/2008|16:47] C:\DOCUME~1\Djouher\APPLIC~1\Help
   [16/08/2004|17:19] C:\DOCUME~1\Djouher\APPLIC~1\Identities
   [21/09/2008|18:49] C:\DOCUME~1\Djouher\APPLIC~1\IDM
   [25/09/2007|16:21] C:\DOCUME~1\Djouher\APPLIC~1\InstallShield
   [25/09/2007|16:21] C:\DOCUME~1\Djouher\APPLIC~1\InstallShield Installation Information
   [22/11/2008|12:27] C:\DOCUME~1\Djouher\APPLIC~1\Itch seek
   [21/05/2008|18:12] C:\DOCUME~1\Djouher\APPLIC~1\Leadertech
   [02/11/2007|17:40] C:\DOCUME~1\Djouher\APPLIC~1\LogProtect
   [07/10/2007|16:03] C:\DOCUME~1\Djouher\APPLIC~1\Macromedia
   [25/11/2008|20:00] C:\DOCUME~1\Djouher\APPLIC~1\Malwarebytes
   [24/11/2008|20:10] C:\DOCUME~1\Djouher\APPLIC~1\Microsoft
   [19/06/2008|18:17] C:\DOCUME~1\Djouher\APPLIC~1\Mozilla
   [08/10/2007|17:36] C:\DOCUME~1\Djouher\APPLIC~1\MusicNet
   [05/05/2008|19:34] C:\DOCUME~1\Djouher\APPLIC~1\OmniPokedex
   [02/11/2008|21:25] C:\DOCUME~1\Djouher\APPLIC~1\OpenOffice.org2
   [22/11/2008|13:03] C:\DOCUME~1\Djouher\APPLIC~1\Phoenix
   [05/11/2007|14:05] C:\DOCUME~1\Djouher\APPLIC~1\Real
   [25/09/2007|16:21] C:\DOCUME~1\Djouher\APPLIC~1\sixteen tons entertainment
   [02/12/2007|18:35] C:\DOCUME~1\Djouher\APPLIC~1\Sonic
   [14/06/2008|15:49] C:\DOCUME~1\Djouher\APPLIC~1\SPAMfighter
   [23/11/2008|17:58] C:\DOCUME~1\Djouher\APPLIC~1\Spyware Terminator
   [17/05/2008|18:42] C:\DOCUME~1\Djouher\APPLIC~1\Styler
   [30/08/2007|20:40] C:\DOCUME~1\Djouher\APPLIC~1\Sun
   [30/08/2007|20:47] C:\DOCUME~1\Djouher\APPLIC~1\Symantec
   [23/04/2008|14:04] C:\DOCUME~1\Djouher\APPLIC~1\Thinstall
   [22/04/2008|16:30] C:\DOCUME~1\Djouher\APPLIC~1\TuneUp Software
   [22/03/2008|17:43] C:\DOCUME~1\Djouher\APPLIC~1\URSoft
   [10/09/2008|18:29] C:\DOCUME~1\Djouher\APPLIC~1\Viewpoint
   [22/03/2008|18:47] C:\DOCUME~1\Djouher\APPLIC~1\vlc
   [09/04/2008|16:13] C:\DOCUME~1\Djouher\APPLIC~1\WinRAR
   [30/08/2007|20:45] C:\DOCUME~1\Djouher\APPLIC~1\You've Got Pictures Screensaver
   [21/11/2008|19:58] C:\DOCUME~1\Djouher\APPLIC~1\zweitgeist


   [08/09/2007|17:54] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [24/09/2008|19:44] C:\DOCUME~1\MOHAME~1\APPLIC~1\Adobe
   [14/06/2008|16:25] C:\DOCUME~1\MOHAME~1\APPLIC~1\Apple Computer
   [01/11/2008|20:53] C:\DOCUME~1\MOHAME~1\APPLIC~1\Epson
   [10/03/2008|21:24] C:\DOCUME~1\MOHAME~1\APPLIC~1\Google
   [16/08/2004|17:19] C:\DOCUME~1\MOHAME~1\APPLIC~1\Identities
   [03/12/2007|18:49] C:\DOCUME~1\MOHAME~1\APPLIC~1\InstallShield
   [03/11/2007|19:50] C:\DOCUME~1\MOHAME~1\APPLIC~1\LogProtect
   [04/11/2007|10:46] C:\DOCUME~1\MOHAME~1\APPLIC~1\Macromedia
   [20/11/2008|09:13] C:\DOCUME~1\MOHAME~1\APPLIC~1\Microsoft
   [19/06/2008|16:25] C:\DOCUME~1\MOHAME~1\APPLIC~1\Mozilla
   [04/12/2007|10:28] C:\DOCUME~1\MOHAME~1\APPLIC~1\MusicNet
   [08/05/2008|15:27] C:\DOCUME~1\MOHAME~1\APPLIC~1\Real
   [14/06/2008|14:39] C:\DOCUME~1\MOHAME~1\APPLIC~1\SPAMfighter
   [30/08/2007|20:40] C:\DOCUME~1\MOHAME~1\APPLIC~1\Sun
   [30/08/2007|20:47] C:\DOCUME~1\MOHAME~1\APPLIC~1\Symantec
   [10/09/2008|19:18] C:\DOCUME~1\MOHAME~1\APPLIC~1\Viewpoint
   [30/08/2007|20:45] C:\DOCUME~1\MOHAME~1\APPLIC~1\You've Got Pictures Screensaver

   [08/09/2007|17:38] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

   [15/10/2007|19:57] C:\DOCUME~1\PROPRI~1\APPLIC~1\You've Got Pictures Screensaver
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [26/11/2008 14:00][--a------] C:\WINDOWS	asks\GoogleUpdateTaskUser.job
   [26/11/2008 14:00][--ah-----] C:\WINDOWS	asks\8B841DC78F879383.job
   [26/11/2008 14:00][--a------] C:\WINDOWS	asks\1-Click Maintenance.job
   [26/11/2008 09:29][--ah-----] C:\WINDOWS	asks\MP Scheduled Scan.job
   [30/08/2007 20:58][--a------] C:\WINDOWS	asks\Rappel d'enregistrement 2.job
   [26/11/2008 09:26][--ah-----] C:\WINDOWS	asks\SA.DAT
   [05/08/2004 13:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   ( 8B841DC78F879383.job )=( c:\docume~1\djouher\applic~1\itchse~1\DELETEMEMOTONS.exe )

   --------------------\  Listing des dossiers dans C:\Program Files

   [04/03/2008|06:20] C:\Program Files\7-Zip
   [27/06/2008|06:55] C:\Program Files\Adobe
   [23/11/2008|19:35] C:\Program Files\Ad-remover
   [21/11/2008|09:40] C:\Program Files\Ahead
   [17/09/2007|13:36] C:\Program Files\Alwil Software
   [17/01/2008|19:20] C:\Program Files\aod
   [30/08/2007|20:45] C:\Program Files\AOL 9.0
   [30/08/2007|20:45] C:\Program Files\AOL Compagnon
   [10/10/2007|20:10] C:\Program Files\ArcSoft
   [13/07/2008|14:20] C:\Program Files\Athan
   [24/11/2008|22:03] C:\Program Files\Auslogics
   [21/11/2008|10:07] C:\Program Files\AVS4YOU
   [21/11/2008|10:08] C:\Program Files\Axialis
   [05/01/2008|11:43] C:\Program Files\Babylon
   [15/10/2008|18:35] C:\Program Files\Bonjour
   [10/10/2007|20:11] C:\Program Files\Caere
   [09/04/2008|16:13] C:\Program Files\Common Files
   [16/08/2004|17:05] C:\Program Files\ComPlus Applications
   [22/03/2008|18:38] C:\Program Files\Conjugaison
   [30/08/2007|20:49] C:\Program Files\CyberLink
   [10/02/2008|11:49] C:\Program Files\DAP
   [24/12/2007|16:00] C:\Program Files\DicoRime
   [20/11/2007|23:51] C:\Program Files\Dictionnaire
   [16/10/2008|20:46] C:\Program Files\DivX
   [22/09/2007|11:49] C:\Program Files\DK
   [22/03/2008|18:44] C:\Program Files\DMV
   [20/10/2007|16:18] C:\Program Files\EA Games
   [22/09/2008|17:42] C:\Program Files\Empire Interactive
   [01/11/2008|19:18] C:\Program Files\EPSON
   [01/11/2008|19:18] C:\Program Files\Epson Software
   [04/04/2008|19:22] C:\Program Files\ESET
   [23/11/2008|19:32] C:\Program Files\Fichiers communs
   [16/11/2007|13:50] C:\Program Files\Foreignword
   [30/08/2007|21:56] C:\Program Files\Foxit Software
   [28/03/2008|23:08] C:\Program Files\Generalia Multimedia
   [17/05/2008|11:27] C:\Program Files\GOA
   [21/11/2008|17:47] C:\Program Files\Google
   [11/05/2008|14:38] C:\Program Files\Harf
   [21/11/2008|10:43] C:\Program Files\InstallShield Installation Information
   [30/08/2007|21:34] C:\Program Files\Intel
   [16/10/2008|20:49] C:\Program Files\Internet Explorer
   [31/12/2007|12:21] C:\Program Files\islamuslim
   [19/11/2008|15:58] C:\Program Files\Itch seek
   [21/11/2008|18:19] C:\Program Files\iTunes
   [21/11/2008|17:39] C:\Program Files\Java
   [27/09/2007|12:32] C:\Program Files\Lame MP3 Codec
   [21/11/2008|17:31] C:\Program Files\Lavasoft
   [30/08/2007|20:45] C:\Program Files\Learn2.com
   [13/11/2007|00:29] C:\Program Files\LeConjugueur
   [21/11/2008|19:56] C:\Program Files\Legacy Interactive
   [10/01/2008|20:48] C:\Program Files\Ligos
   [21/11/2008|18:16] C:\Program Files\LogProtect
   [26/11/2008|13:48] C:\Program Files\Lopxp
   [25/11/2008|20:00] C:\Program Files\Malwarebytes' Anti-Malware
   [27/09/2007|12:30] C:\Program Files\MarkAny
   [21/11/2008|20:11] C:\Program Files\Mes Vacances en Photo
   [16/08/2008|10:18] C:\Program Files\Messenger
   [10/01/2008|20:51] C:\Program Files\metagenia
   [16/10/2008|13:38] C:\Program Files\Microsoft
   [21/09/2008|13:17] C:\Program Files\Microsoft ActiveSync
   [16/08/2004|17:11] C:\Program Files\microsoft frontpage
   [17/11/2007|16:54] C:\Program Files\Microsoft Games
   [05/05/2008|12:15] C:\Program Files\Microsoft Office
   [16/10/2008|13:48] C:\Program Files\Microsoft Office Outlook Connector
   [27/10/2008|20:14] C:\Program Files\Microsoft Silverlight
   [15/01/2008|18:50] C:\Program Files\Microsoft SQL Server Compact Edition
   [05/05/2008|12:14] C:\Program Files\Microsoft.NET
   [29/04/2008|19:09] C:\Program Files\mobile PhoneTools
   [16/08/2004|17:06] C:\Program Files\Movie Maker
   [26/11/2008|14:21] C:\Program Files\Mozilla Firefox
   [16/08/2004|17:03] C:\Program Files\MSN
   [16/08/2004|17:03] C:\Program Files\MSN Gaming Zone
   [31/08/2007|12:20] C:\Program Files\MSXML 4.0
   [04/04/2008|12:16] C:\Program Files\MUSICMATCH
   [27/09/2007|12:40] C:\Program Files\MyFree Codec
   [23/11/2008|15:24] C:\Program Files\Navilog1
   [16/08/2004|17:06] C:\Program Files\NetMeeting
   [17/11/2007|17:46] C:\Program Files\Nobilis
   [01/11/2007|11:07] C:\Program Files
ouf.org
   [23/04/2008|14:15] C:\Program Files\Omni Pokedex
   [16/08/2004|17:03] C:\Program Files\Online Services
   [01/05/2008|22:49] C:\Program Files\OpenOffice.org 2.4
   [31/08/2007|12:18] C:\Program Files\Outlook Express
   [20/10/2008|08:04] C:\Program Files\Picasa2
   [29/06/2008|14:17] C:\Program Files\PopUp Destroy
   [26/11/2008|12:54] C:\Program Files\Prayer
   [22/04/2008|17:27] C:\Program Files\Proxomitron Naoko v4.5
   [15/10/2008|19:19] C:\Program Files\QuickTime
   [01/06/2008|18:57] C:\Program Files\QuickZip4
   [31/05/2008|14:45] C:\Program Files\Quran_AR
   [02/11/2007|19:27] C:\Program Files\RaimaRadio
   [12/11/2007|17:57] C:\Program Files\Real
   [21/11/2008|10:59] C:\Program Files\Registry Mechanic
   [21/09/2008|13:17] C:\Program Files\Ressources Windows Mobile
   [01/11/2007|10:27] C:\Program Files\RM to MP3 Converter
   [15/10/2008|18:43] C:\Program Files\Safari
   [27/09/2007|12:30] C:\Program Files\Samsung
   [16/08/2004|17:07] C:\Program Files\Services en ligne
   [12/07/2008|11:26] C:\Program Files\sixteen tons entertainment
   [05/04/2008|15:39] C:\Program Files\Small Rockets
   [30/08/2007|20:51] C:\Program Files\Sonic
   [21/11/2008|18:00] C:\Program Files\speed-bit
   [23/11/2008|17:58] C:\Program Files\Spyware Terminator
   [12/09/2007|14:43] C:\Program Files\Strategy First
   [21/11/2008|17:58] C:\Program Files\Time4Worker
   [21/11/2008|10:09] C:\Program Files\Transparent
   [17/11/2007|16:40] C:\Program Files\Ubi Soft
   [16/08/2004|17:19] C:\Program Files\Uninstall Information
   [16/06/2008|19:09] C:\Program Files\UNYK
   [14/11/2007|22:56] C:\Program Files\ViceVersa Pro 2
   [09/11/2008|11:12] C:\Program Files\VideoLAN
   [30/08/2007|20:45] C:\Program Files\Viewpoint
   [17/05/2008|10:02] C:\Program Files\Vstep
   [21/11/2008|19:58] C:\Program Files\weblin
   [29/04/2008|17:55] C:\Program Files\WIDCOMM
   [30/08/2007|21:58] C:\Program Files\Windows Defender
   [16/10/2008|13:48] C:\Program Files\Windows Live
   [15/01/2008|18:52] C:\Program Files\Windows Live Favorites
   [16/10/2008|13:41] C:\Program Files\Windows Live Toolbar
   [08/09/2007|17:50] C:\Program Files\Windows Media Connect 2
   [13/11/2008|08:34] C:\Program Files\Windows Media Player
   [16/08/2004|17:03] C:\Program Files\Windows NT
   [16/08/2004|17:07] C:\Program Files\WindowsUpdate
   [22/04/2008|16:47] C:\Program Files\WinRAR
   [13/06/2008|19:45] C:\Program Files\WorkTime
   [16/08/2004|17:11] C:\Program Files\xerox
   [27/09/2007|12:31] C:\Program Files\XviD
   [09/05/2008|20:09] C:\Program Files\Yahoo!
   [16/11/2007|13:38] C:\Program Files\ZikiTranslator

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [18/05/2008|19:49] C:\Program Files\Fichiers communs\Adobe
   [30/08/2007|20:45] C:\Program Files\Fichiers communs\AOL
   [30/08/2007|20:45] C:\Program Files\Fichiers communs\aolshare
   [15/10/2008|19:18] C:\Program Files\Fichiers communs\Apple
   [01/10/2007|22:56] C:\Program Files\Fichiers communs\AVSMedia
   [10/10/2007|20:11] C:\Program Files\Fichiers communs\Caere
   [05/05/2008|12:15] C:\Program Files\Fichiers communs\DESIGNER
   [09/09/2007|17:13] C:\Program Files\Fichiers communs\DirectX
   [01/11/2008|19:18] C:\Program Files\Fichiers communs\InstallShield
   [16/10/2008|13:38] C:\Program Files\Fichiers communs\Microsoft Shared
   [16/08/2004|17:06] C:\Program Files\Fichiers communs\MSSoap
   [30/08/2007|20:44] C:\Program Files\Fichiers communs\Nullsoft
   [16/08/2004|16:57] C:\Program Files\Fichiers communs\ODBC
   [29/01/2008|23:12] C:\Program Files\Fichiers communs\Real
   [16/08/2004|17:06] C:\Program Files\Fichiers communs\Services
   [30/08/2007|20:51] C:\Program Files\Fichiers communs\Sonic Shared
   [16/08/2004|16:56] C:\Program Files\Fichiers communs\SpeechEngines
   [09/05/2008|20:09] C:\Program Files\Fichiers communs\SureThing Shared
   [17/09/2007|20:17] C:\Program Files\Fichiers communs\Symantec Shared
   [16/10/2008|13:48] C:\Program Files\Fichiers communs\System
   [16/10/2008|13:26] C:\Program Files\Fichiers communs\Windows Live
   [15/01/2008|18:47] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [21/11/2008|17:31] C:\Program Files\Fichiers communs\Wise Installation Wizard
   [29/01/2008|23:13] C:\Program Files\Fichiers communs\xing shared

   --------------------\  Process

   ( 49 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Readme Live Axis Tons
   C:\DOCUME~1\Djouher\APPLIC~1\itchse~1
   C:\DOCUME~1\Djouher\APPLIC~1\itchse~1\acesafemixfast.exe
   C:\DOCUME~1\Djouher\APPLIC~1\itchse~1\DASH BLEH.exe
   C:\DOCUME~1\Djouher\APPLIC~1\itchse~1\DELETE MEMO TONS.exe
   C:\DOCUME~1\Djouher\APPLIC~1\itchse~1\veujjiow.exe
   C:\DOCUME~1\Djouher\APPLIC~1\itchse~1\xxxwdmis.exe
   C:\Program Files\itchse~1
   C:\DOCUME~1\Djouher\Cookies\djouher@advertising[2].txt
   C:\DOCUME~1\Djouher\Cookies\djouher@adin.bigpoint[2].txt
   C:\DOCUME~1\Djouher\Cookies\djouher@bigpoint[2].txt
   C:\DOCUME~1\Djouher\Cookies\djouher@fr1.seafight.bigpoint[2].txt
   C:\DOCUME~1\Djouher\Cookies\djouher@adopt.euroclick[1].txt
   C:\DOCUME~1\Djouher\Cookies\djouher@fr1.seafight.bigpoint[2].txt
   C:\WINDOWS\Tasks\8B841DC78F879383.job
 
   --------------------\  Verification du Registre

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
   "Heartbags"="C:\DOCUME~1\Djouher\APPLIC~1\ITCHSE~1\DASH BLEH.exe"

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-11-26 14:34:52
   Windows 5.1.2600 Service Pack 2 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 12
 
   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [F:118][D:26]-> C:\DOCUME~1\Djouher\LOCALS~1\Temp
   [F:141][D:0]-> C:\DOCUME~1\Djouher\Cookies
   [F:282][D:4]-> C:\DOCUME~1\Djouher\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 26/11/2008|14:35 - Option : [1]

   --------------------\  Fin du rapport a 14:35:56

Utilisateur anonyme · Answer

Relance LopS&D option 2 et montre le rapport

karimosouli · Answer

tien:

   --------------------\  Lop S&D 4.2.4-9c   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) 4 CPU 3.00GHz )
   BIOS : Award Medallion BIOS v6.00PG
   USER : Djouher ( Administrator )
   BOOT : Normal boot
   Antivirus : ESET NOD32 Antivirus 3.0 3.0 (Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:149 Go (Free:97 Go)
   D:\ (CD or DVD)
   E:\ (CD or DVD)
   F:\ (USB)
   G:\ (USB)
   H:\ (USB)
   I:\ (USB)

   "C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
   Option : [2] ( 26/11/2008|15:17 )


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\DOCUME~1\Djouher\APPLIC~1\itchse~1\acesafemixfast.exe
   Supprime! - C:\DOCUME~1\Djouher\APPLIC~1\itchse~1\DASH BLEH.exe
   Supprime! - C:\DOCUME~1\Djouher\APPLIC~1\itchse~1\DELETE MEMO TONS.exe
   Supprime! - C:\DOCUME~1\Djouher\APPLIC~1\itchse~1\veujjiow.exe
   Supprime! - C:\DOCUME~1\Djouher\APPLIC~1\itchse~1\xxxwdmis.exe
   Supprime! - C:\DOCUME~1\Djouher\Cookies\djouher@advertising[2].txt
   Supprime! - C:\DOCUME~1\Djouher\Cookies\djouher@adin.bigpoint[2].txt
   Supprime! - C:\DOCUME~1\Djouher\Cookies\djouher@bigpoint[2].txt
   Supprime! - C:\DOCUME~1\Djouher\Cookies\djouher@fr1.seafight.bigpoint[2].txt
   Supprime! - C:\DOCUME~1\Djouher\Cookies\djouher@adopt.euroclick[1].txt
   Supprime! - C:\WINDOWS\Tasks\8B841DC78F879383.job 
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Readme Live Axis Tons
   Supprime! - C:\DOCUME~1\Djouher\APPLIC~1\itchse~1
   Supprime! - C:\Program Files\itchse~1
 
   \\\\\\\\\\\\\\\ 

   Supprime! - C:\Program Files\Viewpoint
   Supprime! - C:\DOCUME~1\Djouher\APPLIC~1\Viewpoint
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
 
   \\\\\\\\\\\\\\\

 
   --------------------\  Listing des dossiers dans APPLIC~1

   [18/05/2008|20:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [30/08/2007|20:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
   [29/12/2007|13:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [15/01/2008|20:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [08/04/2008|08:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AVS4YOU
   [29/04/2008|19:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BVRP Software
   [31/08/2007|10:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
   [20/06/2008|12:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Downloaded Installations
   [01/11/2008|19:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\EPSON
   [22/03/2008|18:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ESET
   [21/11/2008|17:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [21/11/2008|09:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
   [25/11/2008|19:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
   [16/10/2008|13:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [08/09/2007|20:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
   [16/08/2004|17:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
   [27/10/2008|19:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
   [14/06/2008|19:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [23/11/2008|17:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spyware Terminator
   [26/11/2008|13:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
   [11/05/2008|15:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Transparent
   [22/04/2008|16:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TuneUp Software
   [01/11/2008|19:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\UDL
   [06/04/2008|17:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ulead Systems
   [14/11/2007|22:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ViceVersa PRO 2
   [30/08/2007|21:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [09/05/2008|22:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
   [09/05/2008|20:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\YAHOO
   [17/09/2007|15:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
   [17/09/2007|15:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion

   [16/08/2004|17:19] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [16/08/2004|16:54] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
   [30/08/2007|20:50] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Real
   [30/08/2007|20:40] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Sun
   [30/08/2007|20:47] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec
   [30/08/2007|20:45] C:\DOCUME~1\DEFAUL~1\APPLIC~1\You've Got Pictures Screensaver

   [21/05/2008|18:12] C:\DOCUME~1\Djouher\APPLIC~1\Adobe
   [30/12/2007|20:41] C:\DOCUME~1\Djouher\APPLIC~1\AquaNox
   [24/11/2008|22:03] C:\DOCUME~1\Djouher\APPLIC~1\Auslogics
   [06/09/2008|15:44] C:\DOCUME~1\Djouher\APPLIC~1\Axialis
   [04/01/2008|13:46] C:\DOCUME~1\Djouher\APPLIC~1\Babylon
   [03/11/2007|20:22] C:\DOCUME~1\Djouher\APPLIC~1\CyberLink
   [03/05/2008|12:35] C:\DOCUME~1\Djouher\APPLIC~1\DivX
   [26/11/2008|12:58] C:\DOCUME~1\Djouher\APPLIC~1\DMCache
   [25/09/2008|18:02] C:\DOCUME~1\Djouher\APPLIC~1\e frontier
   [03/11/2008|10:39] C:\DOCUME~1\Djouher\APPLIC~1\Epson
   [19/04/2008|20:16] C:\DOCUME~1\Djouher\APPLIC~1\Google
   [22/04/2008|16:47] C:\DOCUME~1\Djouher\APPLIC~1\Help
   [16/08/2004|17:19] C:\DOCUME~1\Djouher\APPLIC~1\Identities
   [21/09/2008|18:49] C:\DOCUME~1\Djouher\APPLIC~1\IDM
   [25/09/2007|16:21] C:\DOCUME~1\Djouher\APPLIC~1\InstallShield
   [25/09/2007|16:21] C:\DOCUME~1\Djouher\APPLIC~1\InstallShield Installation Information
   [21/05/2008|18:12] C:\DOCUME~1\Djouher\APPLIC~1\Leadertech
   [02/11/2007|17:40] C:\DOCUME~1\Djouher\APPLIC~1\LogProtect
   [07/10/2007|16:03] C:\DOCUME~1\Djouher\APPLIC~1\Macromedia
   [25/11/2008|20:00] C:\DOCUME~1\Djouher\APPLIC~1\Malwarebytes
   [24/11/2008|20:10] C:\DOCUME~1\Djouher\APPLIC~1\Microsoft
   [19/06/2008|18:17] C:\DOCUME~1\Djouher\APPLIC~1\Mozilla
   [08/10/2007|17:36] C:\DOCUME~1\Djouher\APPLIC~1\MusicNet
   [05/05/2008|19:34] C:\DOCUME~1\Djouher\APPLIC~1\OmniPokedex
   [02/11/2008|21:25] C:\DOCUME~1\Djouher\APPLIC~1\OpenOffice.org2
   [22/11/2008|13:03] C:\DOCUME~1\Djouher\APPLIC~1\Phoenix
   [05/11/2007|14:05] C:\DOCUME~1\Djouher\APPLIC~1\Real
   [25/09/2007|16:21] C:\DOCUME~1\Djouher\APPLIC~1\sixteen tons entertainment
   [02/12/2007|18:35] C:\DOCUME~1\Djouher\APPLIC~1\Sonic
   [14/06/2008|15:49] C:\DOCUME~1\Djouher\APPLIC~1\SPAMfighter
   [23/11/2008|17:58] C:\DOCUME~1\Djouher\APPLIC~1\Spyware Terminator
   [17/05/2008|18:42] C:\DOCUME~1\Djouher\APPLIC~1\Styler
   [30/08/2007|20:40] C:\DOCUME~1\Djouher\APPLIC~1\Sun
   [30/08/2007|20:47] C:\DOCUME~1\Djouher\APPLIC~1\Symantec
   [23/04/2008|14:04] C:\DOCUME~1\Djouher\APPLIC~1\Thinstall
   [22/04/2008|16:30] C:\DOCUME~1\Djouher\APPLIC~1\TuneUp Software
   [22/03/2008|17:43] C:\DOCUME~1\Djouher\APPLIC~1\URSoft
   [22/03/2008|18:47] C:\DOCUME~1\Djouher\APPLIC~1\vlc
   [09/04/2008|16:13] C:\DOCUME~1\Djouher\APPLIC~1\WinRAR
   [30/08/2007|20:45] C:\DOCUME~1\Djouher\APPLIC~1\You've Got Pictures Screensaver
   [21/11/2008|19:58] C:\DOCUME~1\Djouher\APPLIC~1\zweitgeist


   [08/09/2007|17:54] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [24/09/2008|19:44] C:\DOCUME~1\MOHAME~1\APPLIC~1\Adobe
   [14/06/2008|16:25] C:\DOCUME~1\MOHAME~1\APPLIC~1\Apple Computer
   [01/11/2008|20:53] C:\DOCUME~1\MOHAME~1\APPLIC~1\Epson
   [10/03/2008|21:24] C:\DOCUME~1\MOHAME~1\APPLIC~1\Google
   [16/08/2004|17:19] C:\DOCUME~1\MOHAME~1\APPLIC~1\Identities
   [03/12/2007|18:49] C:\DOCUME~1\MOHAME~1\APPLIC~1\InstallShield
   [03/11/2007|19:50] C:\DOCUME~1\MOHAME~1\APPLIC~1\LogProtect
   [04/11/2007|10:46] C:\DOCUME~1\MOHAME~1\APPLIC~1\Macromedia
   [20/11/2008|09:13] C:\DOCUME~1\MOHAME~1\APPLIC~1\Microsoft
   [19/06/2008|16:25] C:\DOCUME~1\MOHAME~1\APPLIC~1\Mozilla
   [04/12/2007|10:28] C:\DOCUME~1\MOHAME~1\APPLIC~1\MusicNet
   [08/05/2008|15:27] C:\DOCUME~1\MOHAME~1\APPLIC~1\Real
   [14/06/2008|14:39] C:\DOCUME~1\MOHAME~1\APPLIC~1\SPAMfighter
   [30/08/2007|20:40] C:\DOCUME~1\MOHAME~1\APPLIC~1\Sun
   [30/08/2007|20:47] C:\DOCUME~1\MOHAME~1\APPLIC~1\Symantec
   [10/09/2008|19:18] C:\DOCUME~1\MOHAME~1\APPLIC~1\Viewpoint
   [30/08/2007|20:45] C:\DOCUME~1\MOHAME~1\APPLIC~1\You've Got Pictures Screensaver

   [08/09/2007|17:38] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

   [15/10/2007|19:57] C:\DOCUME~1\PROPRI~1\APPLIC~1\You've Got Pictures Screensaver
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [26/11/2008 14:49][--a------] C:\WINDOWS	asks\GoogleUpdateTaskUser.job
   [26/11/2008 15:00][--a------] C:\WINDOWS	asks\1-Click Maintenance.job
   [26/11/2008 09:29][--ah-----] C:\WINDOWS	asks\MP Scheduled Scan.job
   [30/08/2007 20:58][--a------] C:\WINDOWS	asks\Rappel d'enregistrement 2.job
   [26/11/2008 09:26][--ah-----] C:\WINDOWS	asks\SA.DAT
   [05/08/2004 13:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [04/03/2008|06:20] C:\Program Files\7-Zip
   [27/06/2008|06:55] C:\Program Files\Adobe
   [23/11/2008|19:35] C:\Program Files\Ad-remover
   [21/11/2008|09:40] C:\Program Files\Ahead
   [17/09/2007|13:36] C:\Program Files\Alwil Software
   [17/01/2008|19:20] C:\Program Files\aod
   [30/08/2007|20:45] C:\Program Files\AOL 9.0
   [30/08/2007|20:45] C:\Program Files\AOL Compagnon
   [10/10/2007|20:10] C:\Program Files\ArcSoft
   [13/07/2008|14:20] C:\Program Files\Athan
   [24/11/2008|22:03] C:\Program Files\Auslogics
   [21/11/2008|10:07] C:\Program Files\AVS4YOU
   [21/11/2008|10:08] C:\Program Files\Axialis
   [05/01/2008|11:43] C:\Program Files\Babylon
   [15/10/2008|18:35] C:\Program Files\Bonjour
   [10/10/2007|20:11] C:\Program Files\Caere
   [09/04/2008|16:13] C:\Program Files\Common Files
   [16/08/2004|17:05] C:\Program Files\ComPlus Applications
   [22/03/2008|18:38] C:\Program Files\Conjugaison
   [30/08/2007|20:49] C:\Program Files\CyberLink
   [10/02/2008|11:49] C:\Program Files\DAP
   [24/12/2007|16:00] C:\Program Files\DicoRime
   [20/11/2007|23:51] C:\Program Files\Dictionnaire
   [16/10/2008|20:46] C:\Program Files\DivX
   [22/09/2007|11:49] C:\Program Files\DK
   [22/03/2008|18:44] C:\Program Files\DMV
   [20/10/2007|16:18] C:\Program Files\EA Games
   [22/09/2008|17:42] C:\Program Files\Empire Interactive
   [01/11/2008|19:18] C:\Program Files\EPSON
   [01/11/2008|19:18] C:\Program Files\Epson Software
   [04/04/2008|19:22] C:\Program Files\ESET
   [23/11/2008|19:32] C:\Program Files\Fichiers communs
   [16/11/2007|13:50] C:\Program Files\Foreignword
   [30/08/2007|21:56] C:\Program Files\Foxit Software
   [28/03/2008|23:08] C:\Program Files\Generalia Multimedia
   [17/05/2008|11:27] C:\Program Files\GOA
   [21/11/2008|17:47] C:\Program Files\Google
   [11/05/2008|14:38] C:\Program Files\Harf
   [21/11/2008|10:43] C:\Program Files\InstallShield Installation Information
   [30/08/2007|21:34] C:\Program Files\Intel
   [16/10/2008|20:49] C:\Program Files\Internet Explorer
   [31/12/2007|12:21] C:\Program Files\islamuslim
   [21/11/2008|18:19] C:\Program Files\iTunes
   [21/11/2008|17:39] C:\Program Files\Java
   [27/09/2007|12:32] C:\Program Files\Lame MP3 Codec
   [21/11/2008|17:31] C:\Program Files\Lavasoft
   [30/08/2007|20:45] C:\Program Files\Learn2.com
   [13/11/2007|00:29] C:\Program Files\LeConjugueur
   [21/11/2008|19:56] C:\Program Files\Legacy Interactive
   [10/01/2008|20:48] C:\Program Files\Ligos
   [21/11/2008|18:16] C:\Program Files\LogProtect
   [26/11/2008|13:48] C:\Program Files\Lopxp
   [25/11/2008|20:00] C:\Program Files\Malwarebytes' Anti-Malware
   [27/09/2007|12:30] C:\Program Files\MarkAny
   [21/11/2008|20:11] C:\Program Files\Mes Vacances en Photo
   [16/08/2008|10:18] C:\Program Files\Messenger
   [10/01/2008|20:51] C:\Program Files\metagenia
   [16/10/2008|13:38] C:\Program Files\Microsoft
   [21/09/2008|13:17] C:\Program Files\Microsoft ActiveSync
   [16/08/2004|17:11] C:\Program Files\microsoft frontpage
   [17/11/2007|16:54] C:\Program Files\Microsoft Games
   [05/05/2008|12:15] C:\Program Files\Microsoft Office
   [16/10/2008|13:48] C:\Program Files\Microsoft Office Outlook Connector
   [27/10/2008|20:14] C:\Program Files\Microsoft Silverlight
   [15/01/2008|18:50] C:\Program Files\Microsoft SQL Server Compact Edition
   [05/05/2008|12:14] C:\Program Files\Microsoft.NET
   [29/04/2008|19:09] C:\Program Files\mobile PhoneTools
   [16/08/2004|17:06] C:\Program Files\Movie Maker
   [26/11/2008|14:21] C:\Program Files\Mozilla Firefox
   [16/08/2004|17:03] C:\Program Files\MSN
   [16/08/2004|17:03] C:\Program Files\MSN Gaming Zone
   [31/08/2007|12:20] C:\Program Files\MSXML 4.0
   [04/04/2008|12:16] C:\Program Files\MUSICMATCH
   [27/09/2007|12:40] C:\Program Files\MyFree Codec
   [23/11/2008|15:24] C:\Program Files\Navilog1
   [16/08/2004|17:06] C:\Program Files\NetMeeting
   [17/11/2007|17:46] C:\Program Files\Nobilis
   [01/11/2007|11:07] C:\Program Files
ouf.org
   [23/04/2008|14:15] C:\Program Files\Omni Pokedex
   [16/08/2004|17:03] C:\Program Files\Online Services
   [01/05/2008|22:49] C:\Program Files\OpenOffice.org 2.4
   [31/08/2007|12:18] C:\Program Files\Outlook Express
   [20/10/2008|08:04] C:\Program Files\Picasa2
   [29/06/2008|14:17] C:\Program Files\PopUp Destroy
   [26/11/2008|12:54] C:\Program Files\Prayer
   [22/04/2008|17:27] C:\Program Files\Proxomitron Naoko v4.5
   [15/10/2008|19:19] C:\Program Files\QuickTime
   [01/06/2008|18:57] C:\Program Files\QuickZip4
   [31/05/2008|14:45] C:\Program Files\Quran_AR
   [02/11/2007|19:27] C:\Program Files\RaimaRadio
   [12/11/2007|17:57] C:\Program Files\Real
   [21/11/2008|10:59] C:\Program Files\Registry Mechanic
   [21/09/2008|13:17] C:\Program Files\Ressources Windows Mobile
   [01/11/2007|10:27] C:\Program Files\RM to MP3 Converter
   [15/10/2008|18:43] C:\Program Files\Safari
   [27/09/2007|12:30] C:\Program Files\Samsung
   [16/08/2004|17:07] C:\Program Files\Services en ligne
   [12/07/2008|11:26] C:\Program Files\sixteen tons entertainment
   [05/04/2008|15:39] C:\Program Files\Small Rockets
   [30/08/2007|20:51] C:\Program Files\Sonic
   [21/11/2008|18:00] C:\Program Files\speed-bit
   [23/11/2008|17:58] C:\Program Files\Spyware Terminator
   [12/09/2007|14:43] C:\Program Files\Strategy First
   [21/11/2008|17:58] C:\Program Files\Time4Worker
   [21/11/2008|10:09] C:\Program Files\Transparent
   [17/11/2007|16:40] C:\Program Files\Ubi Soft
   [16/08/2004|17:19] C:\Program Files\Uninstall Information
   [16/06/2008|19:09] C:\Program Files\UNYK
   [14/11/2007|22:56] C:\Program Files\ViceVersa Pro 2
   [09/11/2008|11:12] C:\Program Files\VideoLAN
   [17/05/2008|10:02] C:\Program Files\Vstep
   [21/11/2008|19:58] C:\Program Files\weblin
   [29/04/2008|17:55] C:\Program Files\WIDCOMM
   [30/08/2007|21:58] C:\Program Files\Windows Defender
   [16/10/2008|13:48] C:\Program Files\Windows Live
   [15/01/2008|18:52] C:\Program Files\Windows Live Favorites
   [16/10/2008|13:41] C:\Program Files\Windows Live Toolbar
   [08/09/2007|17:50] C:\Program Files\Windows Media Connect 2
   [13/11/2008|08:34] C:\Program Files\Windows Media Player
   [16/08/2004|17:03] C:\Program Files\Windows NT
   [16/08/2004|17:07] C:\Program Files\WindowsUpdate
   [22/04/2008|16:47] C:\Program Files\WinRAR
   [13/06/2008|19:45] C:\Program Files\WorkTime
   [16/08/2004|17:11] C:\Program Files\xerox
   [27/09/2007|12:31] C:\Program Files\XviD
   [09/05/2008|20:09] C:\Program Files\Yahoo!
   [16/11/2007|13:38] C:\Program Files\ZikiTranslator

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [18/05/2008|19:49] C:\Program Files\Fichiers communs\Adobe
   [30/08/2007|20:45] C:\Program Files\Fichiers communs\AOL
   [30/08/2007|20:45] C:\Program Files\Fichiers communs\aolshare
   [15/10/2008|19:18] C:\Program Files\Fichiers communs\Apple
   [01/10/2007|22:56] C:\Program Files\Fichiers communs\AVSMedia
   [10/10/2007|20:11] C:\Program Files\Fichiers communs\Caere
   [05/05/2008|12:15] C:\Program Files\Fichiers communs\DESIGNER
   [09/09/2007|17:13] C:\Program Files\Fichiers communs\DirectX
   [01/11/2008|19:18] C:\Program Files\Fichiers communs\InstallShield
   [16/10/2008|13:38] C:\Program Files\Fichiers communs\Microsoft Shared
   [16/08/2004|17:06] C:\Program Files\Fichiers communs\MSSoap
   [30/08/2007|20:44] C:\Program Files\Fichiers communs\Nullsoft
   [16/08/2004|16:57] C:\Program Files\Fichiers communs\ODBC
   [29/01/2008|23:12] C:\Program Files\Fichiers communs\Real
   [16/08/2004|17:06] C:\Program Files\Fichiers communs\Services
   [30/08/2007|20:51] C:\Program Files\Fichiers communs\Sonic Shared
   [16/08/2004|16:56] C:\Program Files\Fichiers communs\SpeechEngines
   [09/05/2008|20:09] C:\Program Files\Fichiers communs\SureThing Shared
   [17/09/2007|20:17] C:\Program Files\Fichiers communs\Symantec Shared
   [16/10/2008|13:48] C:\Program Files\Fichiers communs\System
   [16/10/2008|13:26] C:\Program Files\Fichiers communs\Windows Live
   [15/01/2008|18:47] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [21/11/2008|17:31] C:\Program Files\Fichiers communs\Wise Installation Wizard
   [29/01/2008|23:13] C:\Program Files\Fichiers communs\xing shared

   --------------------\  Process

   ( 48 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-11-26 15:18:45
   Windows 5.1.2600 Service Pack 2 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 12
 
   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [F:113][D:26]-> C:\DOCUME~1\Djouher\LOCALS~1\Temp
   [F:136][D:0]-> C:\DOCUME~1\Djouher\Cookies
   [F:288][D:4]-> C:\DOCUME~1\Djouher\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 26/11/2008|14:35 - Option : [1]
   2 - "C:\Lop SD\LopR_2.txt" - 26/11/2008|15:19 - Option : [2]

   --------------------\  Fin du rapport a 15:19:53

Utilisateur anonyme · Answer

Refait un hijack

karimosouli · Answer

voila:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:31:54, on 26/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Documents and Settings\Djouher\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Prayer\Prayer.exe
C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEMonitor.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\Documents and Settings\Djouher\Mes documents\Downloads\Programs\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/ymj/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMIECC.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealOne Playerpbrowserrecordplugin.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Windows Live Toolbar Beta - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: islamuslim Toolbar - {fcd5ee58-54d8-4d33-aa8d-54ae85597966} - C:\Program Files\islamuslim	bisl0.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: islamuslim Toolbar - {fcd5ee58-54d8-4d33-aa8d-54ae85597966} - C:\Program Files\islamuslim	bisl0.dll
O3 - Toolbar: &Windows Live Toolbar Beta - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [EEventManager] C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [IDMan] C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe /onboot
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Djouher\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'HADJAB')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S (User 'HADJAB')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'HADJAB')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" (User 'HADJAB')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'HADJAB')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [EPSON PX800FW Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIEME.EXE /FU "C:\WINDOWS\TEMP\E_S5D7.tmp" /EF "HKCU" (User 'HADJAB')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [Netlog Music Tool] "C:\Program Files\Netlog Music Tool\NetlogMusicTool.exe" (User 'HADJAB')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [Heartbags] C:\DOCUME~1\HADJAB\APPLIC~1\ITCHSE~1\DASH BLEH.exe (User 'HADJAB')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-21-2227724090-2535785734-815230075-1006 Startup: OpenOffice.org 2.4.lnk (User 'HADJAB')
O4 - S-1-5-21-2227724090-2535785734-815230075-1006 User Startup: OpenOffice.org 2.4.lnk (User 'HADJAB')
O4 - Global Startup: Bilal.lnk = C:\Program Files\Prayer\Prayer.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: Download all links with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEExt.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
O23 - Service: Localisateur d'appels de procédure distante (RPC) (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe
O23 - Service: QoS RSVP (RSVP) - Unknown owner - C:\WINDOWS\system32svp.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

Utilisateur anonyme · Answer

Comment va ton ordi ?
Fait comme même ça :
Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
***Si le lien ne fonctionne pas, essaie celui-ci :
http://download.bleepingcomputer.com/andymanchesta/SDFix.exe ***

Double clique sur SDFix.exe et choisis Install. L'outil sera extrait à la racine du lecteur système (généralement le C:\).
Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
· Redémarre ton ordinateur
· Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (F5 sur certains PC), une pression par seconde.
· A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
· Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
· Choisis ton compte.
Déroule la liste des instructions ci-dessous :
· Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.cmd pour lancer le script.
· Appuie sur Y pour commencer le processus de nettoyage.
· Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
· Appuie sur une touche pour redémarrer le PC.
· Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
· Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
· Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
· Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
· Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum

karimosouli · Answer

tien:


[b]SDFix: Version 1.240 [/b]
Run by Djouher on 26/11/2008 at 21:21

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

No Trojan Files Found






Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-26 21:40:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00025b01219e]
"001a1bc8134d"=hex:b8,51,37,8e,ff,b9,a4,98,64,ec,4a,ad,08,c4,c3,a9
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\00025b01219e]
"001a1bc8134d"=hex:b8,51,37,8e,ff,b9,a4,98,64,ec,4a,ad,08,c4,c3,a9

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%ProgramFiles%\AOL 9.0\aol.exe"="%ProgramFiles%\AOL 9.0\aol.exe:*:Enabled:AOL"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\APPS\Inventime\my.exe"="C:\APPS\Inventime\my.exe:*:Enabled:INVENTIME"
"C:\WINDOWS\system32\muzapp.exe"="C:\WINDOWS\system32\muzapp.exe:*:Enabled:MUZ AOD APP player"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\sixteen tons entertainment\Emergency 4\Em4.exe"="C:\Program Files\sixteen tons entertainment\Emergency 4\Em4.exe:*:Enabled:Em4"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"C:\Program Files\Real\RealOne Player\realplay.exe"="C:\Program Files\Real\RealOne Player\realplay.exe:*:Enabled:RealPlayer"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"="C:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe:*:Enabled:tu_logonui"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[b]Remaining Files [/b]:



[b]Files with Hidden Attributes [/b]:

Mon  7 Jan 2008           352 A..H. --- "C:\WINDOWS
od32fixtemdono.reg"
Fri 12 Mar 2004        54,384 A..H. --- "C:\Program Files\AOL 9.0\aolphx.exe"
Fri 12 Mar 2004       156,784 A..H. --- "C:\Program Files\AOL 9.0\aoltray.exe"
Fri 12 Mar 2004        31,344 A..H. --- "C:\Program Files\AOL 9.0\RBM.exe"
Thu 16 Oct 2008     6,108,728 A..H. --- "C:\Program Files\Picasa2\setup.exe"
Fri 12 Mar 2004       106,496 A..H. --- "C:\Program Files\Fichiers communs\aolshare\shell\fr\shellext.dll"

[b]Finished![/b]

Utilisateur anonyme · Answer

Refait un hijackthis

karimosouli · Answer

tien:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:49:27, on 28/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Documents and Settings\Djouher\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Program Files\Prayer\Prayer.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEMonitor.exe
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\Documents and Settings\Djouher\Mes documents\Downloads\Programs\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/ymj/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMIECC.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealOne Playerpbrowserrecordplugin.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Windows Live Toolbar Beta - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: islamuslim Toolbar - {fcd5ee58-54d8-4d33-aa8d-54ae85597966} - C:\Program Files\islamuslim	bisl0.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: islamuslim Toolbar - {fcd5ee58-54d8-4d33-aa8d-54ae85597966} - C:\Program Files\islamuslim	bisl0.dll
O3 - Toolbar: &Windows Live Toolbar Beta - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [EEventManager] C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [IDMan] C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe /onboot
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Djouher\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1008\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Mohamed-Amine')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1008\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime (User 'Mohamed-Amine')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1008\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Mohamed-Amine')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1008\..\Run: [EPSON PX800FW Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIEME.EXE /FU "C:\DOCUME~1\MOHAME~1\LOCALS~1\Temp\E_S253.tmp" /EF "HKCU" (User 'Mohamed-Amine')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1008\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart (User 'Mohamed-Amine')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1008\..\Run: [ecd85eae] rundll32.exe "C:\WINDOWS\system32\hewurogo.dll",b (User 'Mohamed-Amine')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1008\..\Run: [fuyamawewu] Rundll32.exe "C:\WINDOWS\system32\meburaro.dll",s (User 'Mohamed-Amine')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1008\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Mohamed-Amine')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1008\..\Run: [CPMefeb6d32] Rundll32.exe "c:\windows\system32\jojayuza.dll",a (User 'Mohamed-Amine')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bilal.lnk = C:\Program Files\Prayer\Prayer.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: Download all links with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEExt.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
O23 - Service: Localisateur d'appels de procédure distante (RPC) (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe
O23 - Service: QoS RSVP (RSVP) - Unknown owner - C:\WINDOWS\system32svp.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

Utilisateur anonyme · Answer

Télécharge FindyKill (Merci à Chiquitine29 !!)

Fais un clic droit sur le lien, enregister sous .....sur le bureau
=> http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe

Dézippe le sur le bureau

Entre dans le dossier FindyKill
Double clique sur FindyKill.exe
Choisis l'option 1 (recherche)
Un rapport va s'ouvrir, poste le dans ta prochaine réponse stp

Note : le rapport FindyKill.txt est sauvegardé a la racine du disque (C:\FindyKill.txt)

karimosouli · Answer

chaud devant: ----------------- FindyKill V4.706 ------------------ * User : Djouher - SN104681400316 * Emplacement : C:\Program Files\FindyKill * Outils Mis a jours le 27/11/08 par Chiquitine29 * Recherche effectuée à 20:30:54 le 28/11/2008 * Windows XP - Internet Explorer 6.0.2900.2180 ((((((((((((((((( *** Recherche *** )))))))))))))))))) --------------- [ Processus actifs ] ---------------- C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe c:\APPS\HIDSERVICE\HIDSERVICE.exe C:\WINDOWS\system32\slserv.exe C:\Program Files\Spyware Terminator\sp_rsser.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\Documents and Settings\Djouher\Local Settings\Application Data\Google\Update\GoogleUpdate.exe C:\PROGRA~1\MI3AA1~1\rapimgr.exe C:\Program Files\Prayer\Prayer.exe C:\Program Files\Windows Live\Contacts\wlcomm.exe C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEMonitor.exe C:\Program Files\Windows Live\Mail\wlmail.exe --------------- [ Fichiers/Dossiers infectieux ] ---------------- »»»» Presence des fichiers dans C: »»»» Presence des fichiers dans C:\WINDOWS »»»» Presence des fichiers dans C:\WINDOWS\Prefetch »»»» Presence des fichiers dans C:\WINDOWS\system32 »»»» Presence des fichiers dans C:\WINDOWS\system32\drivers »»»» Presence des fichiers dans C:\Documents and Settings\Djouher\Application Data »»»» Presence des fichiers dans C:\DOCUME~1\Djouher\LOCALS~1\Temp »»»» Presence des fichiers dans C:\Documents and Settings\Djouher\Local Settings\Temporary Internet Files\Content.IE5 Found ! [29/04/2008 18:24] - C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Local Cache\D3987B641C134048B815DB578D607F42_more.jpg --------------- [ Registre / Startup ] ---------------- [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run] IDMan=C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe /onboot H/PC Connection Agent="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" MsnMsgr="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background Google Update="C:\Documents and Settings\Djouher\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run] TkBellExe="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot QuickTime Task="C:\Program Files\QuickTime\QTTask.exe" -atboottime AppleSyncNotifier=C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe EEventManager=C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe egui="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents= = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL= = Installed=1 HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI= = Installed=1 NoChange=1 HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS= = Installed=1 [HKEY_CURRENT_USER\software\local appwizard-generated applications\MMDiag] [HKEY_CURRENT_USER\software\local appwizard-generated applications\Samsung Media Studio] --------------- [ Registre / Clés infectieuses ] ---------------- --------------- [ Etat / Services ] ---------------- +- Services : [ Auto=2 / Demande=3 / Désactivé=4 ] Ndisuio - Type de démarrage = 3 Ip6Fw - Type de démarrage = 3 SharedAccess - Type de démarrage = 2 wuauserv - Type de démarrage = 2 wscsvc - Type de démarrage = 2 WinDefend - Type de démarrage = 2 --------------- [ Recherche dans supports amovibles] ---------------- +- Informations : C: - Lecteur fixe +- presence des fichiers : --------------- [ Registre / Mountpoint2 ] ---------------- -> Not found ! ------------------- ! Fin du rapport ! --------------------

Utilisateur anonyme · Answer

Relance findykill option 2 et montre le rapport

karimosouli · Answer

voici le rapport:



----------------- FindyKill V4.706 ------------------

* User : Djouher - SN104681400316
* executed from : C:\Program Files\FindyKill
* Update on 27/11/08 par Chiquitine29
* Start at 12:36:35 the 29/11/2008
* Windows XP - Internet Explorer 6.0.2900.2180
 
 
((((((((((((((( *** deleting *** ))))))))))))))))))  
 
 
--------------- [ Active Processes ] ----------------  
 

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler	u_logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\WgaTray.exe
 
--------------- [ Infected files / folders ] ----------------  
 
 
»»»» Supression files in C: 
 
 
»»»» Supression files in C:\WINDOWS 
 
 
»»»» Supression files in C:\WINDOWS\Prefetch 
 
 
»»»» Supression files in C:\WINDOWS\system32 
 
 
»»»» Supression files in C:\WINDOWS\system32\drivers 
 
 
»»»» Supression files in C:\Documents and Settings\Djouher\Application Data 
 
 
»»»» Supression files in C:\DOCUME~1\Djouher\LOCALS~1\Temp 
 
 
»»»» Supression files in C:\Documents and Settings\Djouher\Local Settings\Temporary Internet Files\Content.IE5 
 
Deleted ! - C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Local Cache\D3987B641C134048B815DB578D607F42_more.jpg    
 
--------------- [  Registry / Infected keys ] ---------------- 
 
 
--------------- [ States / Restarting of services ] ---------------- 
 


+- Services : [ Auto=2 / Request=3 / Disable=4 ] 

 Ndisuio - Type of startup  = 3 
 
 Ip6Fw - Type of startup  = 2 
 
 SharedAccess - Type of startup  = 2 
 
 wuauserv - Type of startup  = 2 
 
 wscsvc - Type of startup  = 2 
 
 WinDefend - Type of startup  = 2 
 
 
---------------   [ Cleaning removable drives ] ----------------  
 
+- Informations : 

C: - Lecteur fixe

 
+- deleting files : 
 
 
--------------- [ Registry / Mountpoint2 ] ----------------  
 
 
 -> Not found ! 
 
 
--------------- [ Searching Cracks / Keygen ] ----------------  
 
 
 
---------------- ! End of report ! ------------------

Utilisateur anonyme · Answer

On va supprimer tout les fix et en réinstaller quelque un comme hijackthis

-Télécharge ToolsCleaner sur ton bureau : http://pc-system.fr/
-Double-clique sur « Toolscleaner.exe »
-Clique sur "restauration" pour créer un point de restauration.
-Puis clique sur « recherche »
-Quand la recherche sera terminée, clique sur "suppression".
-A la fin (il y aura des indications dans le cadre en-dessous), clique sur "quitter" et poste le rapport qui se trouve dans %systemdrive%\Tcleaner.txt

karimosouli · Answer

le voici:

[ Rapport ToolsCleaner version 2.2.6 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

C:\Combofix.txt: trouvé !
C:\fixnavi.txt: trouvé !
C:\cleannavi.txt: trouvé !
C:\lopR.txt: trouvé !
C:\TB.txt: trouvé !
C:\FindyKill.txt: trouvé !
C:\SDFIX: trouvé !
C:\Lop SD: trouvé !
C:\Qoobox: trouvé !
C:\_OtMoveIt: trouvé !
C:\Toolbar SD: trouvé !
C:\Documents and Settings\All Users\Bureau\Navilog1.lnk: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: trouvé !
C:\Documents and Settings\Djouher\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\Djouher\Menu Démarrer\Programmes\FindyKill: trouvé !
C:\Documents and Settings\Djouher\Mes documents\Downloads\LopSD.exe: trouvé !
C:\Documents and Settings\Djouher\Mes documents\Downloads\Programs\SdFix.exe: trouvé !
C:\Documents and Settings\Djouher\Mes documents\Downloads\Programs\Navilog1.exe: trouvé !
C:\Documents and Settings\Djouher\Mes documents\Downloads\Programs\ComboFix.exe: trouvé !
C:\Documents and Settings\Djouher\Mes documents\Downloads\Programs\HijackThis.exe: trouvé !
C:\Documents and Settings\Djouher\Mes documents\Downloads\Programs\ToolBarSD.exe: trouvé !
C:\Documents and Settings\Djouher\Mes documents\Downloads\Programs\hijackthis.log: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files\lopxp: trouvé !
C:\Program Files\FindyKill: trouvé !
C:\Program Files\Navilog1\Navilog1.bat: trouvé !

---------------------------------
-->- Suppression: 

C:\Documents and Settings\All Users\Bureau\Navilog1.lnk: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: supprimé !
C:\Documents and Settings\Djouher\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Documents and Settings\Djouher\Mes documents\Downloads\LopSD.exe: supprimé !
C:\Documents and Settings\Djouher\Mes documents\Downloads\Programs\SdFix.exe: supprimé !
C:\Documents and Settings\Djouher\Mes documents\Downloads\Programs\Navilog1.exe: supprimé !
C:\Documents and Settings\Djouher\Mes documents\Downloads\Programs\ComboFix.exe: supprimé !
C:\Documents and Settings\Djouher\Mes documents\Downloads\Programs\HijackThis.exe: supprimé !
C:\Documents and Settings\Djouher\Mes documents\Downloads\Programs\ToolBarSD.exe: supprimé !
C:\Program Files\Navilog1\Navilog1.bat: supprimé !
C:\Combofix.txt: supprimé !
C:\fixnavi.txt: supprimé !
C:\cleannavi.txt: supprimé !
C:\lopR.txt: supprimé !
C:\TB.txt: supprimé !
C:\FindyKill.txt: supprimé !
C:\Documents and Settings\Djouher\Mes documents\Downloads\Programs\hijackthis.log: supprimé !
C:\SDFIX: supprimé !
C:\Lop SD: supprimé !
C:\Qoobox: supprimé !
C:\_OtMoveIt: supprimé !
C:\Toolbar SD: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: supprimé !
C:\Documents and Settings\Djouher\Menu Démarrer\Programmes\FindyKill: supprimé !
C:\Program Files\Navilog1: supprimé !
C:\Program Files\lopxp: supprimé !
C:\Program Files\FindyKill: ERREUR DE SUPPRESSION !!

Utilisateur anonyme · Answer

On recommence,
Télécharge Navilog1 depuis-ce lien :
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe

Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau.
Ensuite double clique sur navilog1.exe pour lancer l'installation.

Une fois l'installation terminée, le fix s'exécutera automatiquement.
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau).


Au menu principal, Fais le choix 1 >> Recherche
Laisse toi guider et patiente.
Patiente jusqu'au message :
*** Analyse Termine le ..... *** >>>>> Le fix peut durer une dizaine de minutes ;)
Appuie sur une touche le bloc note va s'ouvrir.
Copie-colle le rapport ici.

A toute.
++

karimosouli · Answer

tien:

Search Navipromo version 3.6.9 commencé le 29/11/2008 à 15:19:00,43

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1
Session actuelle : "Djouher" 

Mise à jour le 05.11.2008 à 21h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 6.0.2900.2180 
Système de fichiers : NTFS

Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "C:\WINDOWS" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Djouher\applic~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\MOHAME~1\applic~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\PROPRI~1\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\Djouher\locals~1\applic~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\MOHAME~1\locals~1\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\Djouher\menudm~1\progra~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\MOHAME~1\menudm~1\progra~1" *** 


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings\Djouher\locals~1\applic~1" * 

* Recherche dans "C:\DOCUME~1\MOHAME~1\locals~1\applic~1" * 



*** Recherche fichiers *** 



*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :


* Dans "C:\Documents and Settings\Djouher\locals~1\applic~1" : 


* Dans "C:\DOCUME~1\MOHAME~1\locals~1\applic~1" : 


3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :



*** Analyse terminée le 29/11/2008 à 15:29:03,10 ***

Utilisateur anonyme · Answer

--------------------------------------------- [ ! ATTENTION ! ] ----------------------------------------------------------
!! déconnecte toi, ferme toutes tes applications en cours et DÉSACTIVE TOUTES TES DÉFENSES (anti-virus, antispyware, pare-feu) le temps de la manipulation : en effet , activés, ils pourraient gêner fortement la procédure de recherche et de nettoyage de l'outil ( voir planter le PC )...Tu les réactiveras donc après !!

---> Surtout, si tu rencontres des difficultés à ce niveau là, dis le moi avant de poursuivre...

Tuto ici : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
---------------------------------------------------------------------------------------------------------------------------------

Ensuite :

Double-clique sur C-Fix.exe (= combofix.exe ) .

Appuie sur une touche pour démarrer le scan .

Attention : n'utilise pas ta souris ni ton clavier pendant que le programme tourne. Cela pourrait figer l'ordi ---> si un message d'erreur windows apparait à un moment : clique sur la croix rouge en haut à droite de la fenêtre pour la fermer

Le rapport sera crée dans: C:\Combofix.txt , poste le ici stp

karimosouli · Answer

tien : ComboFix 08-11-29.03 - Djouher 2008-11-30 12:44:49.2 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.209 [GMT 1:00] Lancé depuis: c:\documents and settings\Djouher\Bureau\ComboFix.exe Commutateurs utilisés :: c:\documents and settings\Djouher\Bureau\WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe * Un nouveau point de restauration a été créé . ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-28 au 2008-11-30 )))))))))))))))))))))))))))))))))))) . 2008-11-29 14:47 . 2008-11-29 15:29 d-------- c:\program files\Navilog1 2008-11-28 20:30 . 2008-11-29 13:26 d-------- c:\program files\FindyKill 2008-11-26 21:16 . 2008-11-29 13:26 d-------- c:\windows\ERUNT 2008-11-26 21:16 . 2008-11-26 21:42 d-------- C:\Backups 2008-11-25 20:00 . 2008-11-25 20:00 d-------- c:\documents and settings\Djouher\Application Data\Malwarebytes 2008-11-25 20:00 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2008-11-25 19:59 . 2008-11-25 20:00 d-------- c:\program files\Malwarebytes' Anti-Malware 2008-11-25 19:59 . 2008-11-25 19:59 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2008-11-25 19:59 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2008-11-24 22:03 . 2008-11-24 22:03 d-------- c:\program files\Auslogics 2008-11-24 22:03 . 2008-11-24 22:03 d-------- c:\documents and settings\Djouher\Application Data\Auslogics 2008-11-23 18:52 . 2008-11-23 19:35 d-------- c:\program files\Ad-remover 2008-11-23 17:57 . 2008-11-23 17:58 d-------- c:\program files\Spyware Terminator 2008-11-23 17:57 . 2008-11-23 17:58 d-------- c:\documents and settings\Djouher\Application Data\Spyware Terminator 2008-11-23 17:57 . 2008-11-23 17:57 d-------- c:\documents and settings\All Users\Application Data\Spyware Terminator 2008-11-23 17:57 . 2008-11-23 17:57 142,592 --a------ c:\windows\system32\drivers\sp_rsdrv2.sys 2008-11-22 13:03 . 2008-11-22 13:03 d-------- c:\documents and settings\Djouher\Application Data\Phoenix 2008-11-21 09:52 . 2008-11-21 09:54 d-------- c:\documents and settings\All Users\Application Data\Lavasoft 2008-11-19 13:33 . 2008-11-21 19:58 d-------- c:\program files\weblin 2008-11-19 13:32 . 2008-11-21 19:58 d-------- c:\documents and settings\Djouher\Application Data\zweitgeist 2008-11-15 22:48 . 2008-11-15 22:48 0 --ah----- c:\windows\SwSys2.bmp 2008-11-15 22:48 . 2008-11-15 22:48 0 --ah----- c:\windows\SwSys1.bmp 2008-11-15 22:44 . 2008-11-21 19:56 d-------- c:\program files\Legacy Interactive 2008-11-09 11:12 . 2008-11-09 11:12 d-------- c:\program files\VideoLAN 2008-11-09 10:20 . 2002-07-09 18:07 724,992 --------- c:\windows\NuNinst.exe 2008-11-09 10:19 . 2002-03-13 14:13 610,304 --------- c:\windows\UNNMP.exe 2008-11-09 10:19 . 2002-03-13 14:44 39,936 --------- c:\windows\UNNMP.cfg 2008-11-09 10:18 . 2008-11-21 09:40 d-------- c:\program files\Ahead 2008-11-03 20:43 . 2008-11-03 20:43 d-------- c:\windows\system32\Midnight Club Los Angeles dir 2008-11-03 20:43 . 2008-11-03 20:43 520,192 --a------ c:\windows\system32\Midnight Club Los Angeles.scr 2008-11-02 21:25 . 2008-11-02 21:25 d-------- c:\documents and settings\Djouher\Application Data\OpenOffice.org2 2008-11-02 11:23 . 2008-11-03 10:39 d-------- c:\documents and settings\Djouher\Application Data\Epson 2008-11-01 20:20 . 2008-11-01 20:20 0 --a------ c:\windows\EEventManager.INI 2008-11-01 19:21 . 2007-12-07 03:08 86,528 --a------ c:\windows\system32\E_FLBEME.DLL 2008-11-01 19:21 . 2007-12-07 03:01 78,848 --a------ c:\windows\system32\E_FD4BEME.DLL 2008-11-01 19:21 . 2007-04-10 02:06 8,192 --a------ c:\windows\system32\E_DCINST.DLL 2008-11-01 19:19 . 2008-11-01 19:19 d-------- c:\documents and settings\All Users\Application Data\UDL 2008-11-01 19:17 . 2008-11-01 19:18 d-------- c:\program files\Epson Software 2008-11-01 19:15 . 2008-11-01 19:22 d-------- c:\documents and settings\All Users\Application Data\EPSON 2008-10-27 20:16 . 2003-07-02 17:54 475,136 --a------ c:\windows\system32\SLLights.dll 2008-10-27 20:16 . 2003-07-02 17:23 401,408 --a------ c:\windows\system32\slcpappl.cpl 2008-10-27 20:16 . 2003-07-02 17:12 376,832 --a------ c:\windows\system32\slmh.exe 2008-10-27 20:16 . 2003-07-02 17:12 351,388 --a------ c:\windows\system32\slmh.cab 2008-10-27 20:16 . 2003-07-02 16:39 167,936 --a------ c:\windows\system32\minirec.exe 2008-10-27 20:16 . 2003-07-02 16:41 155,648 --a------ c:\windows\system32\amr_cpl.dll 2008-10-27 20:16 . 2003-05-15 15:31 138,560 --a------ c:\windows\system32\slcpappl.chm 2008-10-27 20:16 . 2003-07-16 12:40 135,168 --a------ c:\windows\system32\SLMOHServ.dll 2008-10-27 20:16 . 2003-06-09 10:25 130,190 --a------ c:\windows\sl.lng 2008-10-27 20:16 . 2003-07-02 17:44 61,440 --a------ c:\windows\SmCfg.exe 2008-10-27 20:16 . 2003-07-02 18:38 14,976 --a------ c:\windows\system32\drivers\winddx.sys 2008-10-23 16:22 . 2008-11-21 20:11 d-------- c:\program files\Mes Vacances en Photo 2008-10-18 09:32 . 2008-11-30 10:21 d-------- c:\documents and settings\Mohamed-Amine\Tracing 2008-10-16 19:47 . 2008-10-20 08:04 d-------- c:\program files\Picasa2 2008-10-16 13:48 . 2008-10-16 13:48 d-------- c:\program files\Microsoft Office Outlook Connector 2008-10-16 13:48 . 2008-09-04 21:03 56,344 --a------ c:\windows\system32\drivers\fssfltr.sys 2008-10-16 13:38 . 2008-10-16 13:38 d-------- c:\program files\Microsoft 2008-10-16 13:26 . 2008-10-16 13:26 d-------- c:\program files\Fichiers communs\Windows Live 2008-10-15 19:21 . 2008-11-21 18:19 d-------- c:\program files\iTunes 2008-10-15 19:18 . 2008-10-15 19:19 d-------- c:\program files\QuickTime 2008-10-15 18:35 . 2008-10-15 18:35 d-------- c:\program files\Bonjour 2008-10-09 18:21 . 2008-11-30 12:39 d-------- c:\documents and settings\Djouher\Tracing . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 3427-09-25 20:40 2,191,881 ----a-w c:\windows\system32 aruto.scr 2008-11-30 11:42 --------- d-----w c:\program files\Prayer 2008-11-30 11:42 --------- d-----w c:\documents and settings\Djouher\Application Data\DMCache 2008-11-26 12:52 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP 2008-11-21 17:16 --------- d-----w c:\program files\LogProtect 2008-11-21 17:00 --------- d-----w c:\program files\speed-bit 2008-11-21 16:58 --------- d-----w c:\program files\Time4Worker 2008-11-21 16:47 --------- d-----w c:\program files\Google 2008-11-21 16:39 --------- d-----w c:\program files\Java 2008-11-21 16:31 --------- d-----w c:\program files\Lavasoft 2008-11-21 16:31 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard 2008-11-21 09:43 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-21 09:09 --------- d-----w c:\program files\Transparent 2008-11-21 09:08 --------- d-----w c:\program files\Axialis 2008-11-21 09:07 --------- d-----w c:\program files\AVS4YOU 2008-11-01 18:18 --------- d-----w c:\program files\Fichiers communs\InstallShield 2008-11-01 18:18 --------- d-----w c:\program files\EPSON 2008-10-27 19:14 --------- d-----w c:\program files\Microsoft Silverlight 2008-10-27 18:38 --------- d-----w c:\documents and settings\All Users\Application Data\Skype 2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-24 11:10 453,632 ------w c:\windows\system32\dllcache\mrxsmb.sys 2008-10-16 19:46 --------- d-----w c:\program files\DivX 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll 2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll 2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll 2008-10-16 12:48 --------- d-----w c:\program files\Windows Live 2008-10-16 12:41 --------- d-----w c:\program files\Windows Live Toolbar 2008-10-15 18:18 --------- d-----w c:\program files\Fichiers communs\Apple 2008-10-15 17:43 --------- d-----w c:\program files\Safari 2008-10-15 16:59 332,800 ------w c:\windows\system32\dllcache etapi32.dll 2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll 2008-09-25 17:02 3,120 ----a-w c:\windows\system32\6ffdbcaf-f6c1-42d3-a4a9-c7957224a70b.dll 2008-09-16 00:14 524,288 ----a-w c:\windows\system32\DivXsm.exe 2008-09-16 00:14 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll 2008-09-16 00:12 81,920 ----a-w c:\windows\system32\dpl100.dll 2008-09-16 00:12 593,920 ----a-w c:\windows\system32\dpuGUI11.dll 2008-09-16 00:12 57,344 ----a-w c:\windows\system32\dpv11.dll 2008-09-16 00:12 53,248 ----a-w c:\windows\system32\dpuGUI10.dll 2008-09-16 00:12 344,064 ----a-w c:\windows\system32\dpus11.dll 2008-09-16 00:12 294,912 ----a-w c:\windows\system32\dpu11.dll 2008-09-16 00:12 294,912 ----a-w c:\windows\system32\dpu10.dll 2008-09-16 00:12 200,704 ----a-w c:\windows\system32\ssldivx.dll 2008-09-16 00:12 196,608 ----a-w c:\windows\system32\dtu100.dll 2008-09-16 00:12 1,044,480 ----a-w c:\windows\system32\libdivx.dll 2008-09-16 00:11 823,296 ----a-w c:\windows\system32\divx_xx0c.dll 2008-09-16 00:11 823,296 ----a-w c:\windows\system32\divx_xx07.dll 2008-09-16 00:11 815,104 ----a-w c:\windows\system32\divx_xx0a.dll 2008-09-16 00:11 802,816 ----a-w c:\windows\system32\divx_xx11.dll 2008-09-16 00:11 683,520 ----a-w c:\windows\system32\DivX.dll 2008-09-16 00:11 161,096 ----a-w c:\windows\system32\DivXCodecVersionChecker.exe 2008-09-16 00:11 12,288 ----a-w c:\windows\system32\DivXWMPExtType.dll 2008-09-15 15:39 1,846,144 ----a-w c:\windows\system32\win32k.sys 2008-09-15 15:39 1,846,144 ------w c:\windows\system32\dllcache\win32k.sys 2008-09-08 22:03 51,712 ----a-w c:\windows\system32\sirenacm.dll 2008-09-05 13:56 287,744 ----a-w c:\windows\WLXPGSS.SCR 2008-09-04 16:45 1,106,944 ----a-w c:\windows\system32\msxml3.dll 2008-09-04 16:45 1,106,944 ------w c:\windows\system32\dllcache\msxml3.dll 2008-08-29 08:18 87,336 ----a-w c:\windows\system32\dns-sd.exe 2008-08-29 07:53 61,440 ----a-w c:\windows\system32\dnssd.dll 2008-08-28 10:04 333,056 ------w c:\windows\system32\dllcache\srv.sys 2008-08-19 09:38 18,432 ------w c:\windows\system32\dllcache\iedw.exe 2008-08-14 13:44 2,182,400 ------w c:\windows\system32\dllcache toskrnl.exe 2008-08-14 13:44 2,138,112 ----a-w c:\windows\system32 toskrnl.exe 2008-08-14 13:44 2,138,112 ------w c:\windows\system32\dllcache tkrnlmp.exe 2008-08-14 13:44 2,059,776 ------w c:\windows\system32\dllcache tkrnlpa.exe 2008-08-14 13:44 2,017,792 ----a-w c:\windows\system32 tkrnlpa.exe 2008-08-14 13:44 2,017,792 ------w c:\windows\system32\dllcache tkrpamp.exe 2008-08-14 09:51 138,368 ------w c:\windows\system32\dllcache\afd.sys . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9421DD08-935F-4701-A9CA-22DF90AC4EA6}] 2008-04-02 13:24 266240 --a------ c:\program files\Epson Software\Easy Photo Print\EPTBL.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fcd5ee58-54d8-4d33-aa8d-54ae85597966}] 2008-11-22 22:27 1784856 --a------ c:\program files\islamuslim bisl0.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{fcd5ee58-54d8-4d33-aa8d-54ae85597966}"= "c:\program files\islamuslim bisl0.dll" [2008-11-22 1784856] "{9421DD08-935F-4701-A9CA-22DF90AC4EA6}"= "c:\program files\Epson Software\Easy Photo Print\EPTBL.dll" [2008-04-02 266240] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{FCD5EE58-54D8-4D33-AA8D-54AE85597966}"= "c:\program files\islamuslim bisl0.dll" [2008-11-22 1784856] [HKEY_CLASSES_ROOT\clsid\{fcd5ee58-54d8-4d33-aa8d-54ae85597966}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IDMan"="c:\documents and settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe" [2007-12-21 2573744] "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000] "MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2008-09-08 3513344] "Google Update"="c:\documents and settings\Djouher\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-11-26 133104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB ealsched.exe" [2008-01-29 185896] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696] "AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936] "EEventManager"="c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe" [2008-05-07 591696] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2007-12-21 1443072] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Bilal.lnk - c:\program files\Prayer\Prayer.exe [2006-02-03 1447424] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{88485281-8b4b-4f8d-9ede-82e29a064277}"= "c:\progra~1\MarkAny\CONTEN~1\MACSMA~1.DLL" [2004-11-23 192512] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "UIHost"="c:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%ProgramFiles%\AOL 9.0\aol.exe"= "%windir%\system32\sessmgr.exe"= "c:\APPS\Inventime\my.exe"= "c:\WINDOWS\system32\muzapp.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "c:\Program Files\sixteen tons entertainment\Emergency 4\Em4.exe"= "c:\program files\Microsoft ActiveSync apimgr.exe"= c:\program files\Microsoft ActiveSync apimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "c:\Program Files\Real\RealOne Player\realplay.exe"= "c:\Program Files\Bonjour\mDNSResponder.exe"= "c:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"= "c:\Program Files\Windows Live\Messenger\msnmsgr.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service R1 epfwtdir;epfwtdir;c:\windows\system32\DRIVERS\epfwtdir.sys [2007-12-21 33800] R2 fssfltr;FssFltr;c:\windows\system32\DRIVERS\fssfltr.sys [2008-10-16 56344] S3 fsssvc;Windows Live Family Safety;"c:\program files\Windows Live\Family Safety\fsssvc.exe" [2008-09-04 512536] *Newly Created Service* - IP6FW . Contenu du dossier 'Tâches planifiées' 2008-11-30 c:\windows\Tasks\1-Click Maintenance.job - c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [] 2008-11-29 c:\windows\Tasks\GoogleUpdateTaskUser.job - c:\documents and settings\Djouher\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-11-26 14:00] 2008-11-29 c:\windows\Tasks\MP Scheduled Scan.job - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20] 2007-08-30 c:\windows\Tasks\Rappel d'enregistrement 2.job - c:\windows\system32\OOBE\oobebaln.exe [2004-08-05 13:00] . . ------- Examen supplémentaire ------- . FireFox -: Profile - c:\documents and settings\Djouher\Application Data\Mozilla\Firefox\Profiles\xy7y4dxb.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.fr FF -: plugin - c:\documents and settings\Djouher\Local Settings\Application Data\Google\Update\1.2.131.27 pGoogleOneClick6.dll FF -: plugin - c:\program files\DivX\DivX Content Uploader pUpload.dll FF -: plugin - c:\program files\Microsoft Silverlight\2.0.30523.8 pctrl.dll FF -: plugin - c:\program files\Microsoft Silverlight\2.0.31005.0 pctrl.1.0.30401.0.dll FF -: plugin - c:\program files\Microsoft Silverlight\2.0.31005.0 pctrl.dll FF -: plugin - c:\program files\Picasa2 pPicasa2.dll FF -: plugin - c:\program files\Real\RealOne Player\Netscape6 ppl3260.dll FF -: plugin - c:\program files\Real\RealOne Player\Netscape6 prjplug.dll FF -: plugin - c:\program files\Real\RealOne Player\Netscape6 prpjplug.dll FF -: plugin - c:\program files\Real\RhapsodyPlayerEngine prhapengine.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-30 12:47:48 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MysqlInventime] "ImagePath"="c:\mysql\bin\mysqld-nt MysqlInventime" . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'winlogon.exe'(572) c:\windows\system32\midimap.dll . Heure de fin: 2008-11-30 12:49:24 ComboFix-quarantined-files.txt 2008-11-30 11:49:20 Avant-CF: 102 840 356 864 octets libres Après-CF: 102,833,602,560 octets libres 262 --- E O F --- 2008-11-23 16:24:18

Utilisateur anonyme · Answer

Télécharger HijackThis sur cette page : https://www.commentcamarche.net/telecharger/ 159 hijackthis


Utilisation :

* L'installer dans un dossier prévu à cet effet.
o Par exemple, C:\HijackThis
o Choisir l'option "do a system scan and save a logfile"; un rapport va être généré…
o Copier/coller le rapport sur le forum virus/sécurité de CCM.



Tutoriel d'utilisation, section "Générer un rapport" ici : http://pageperso.aol.fr/balltrap34/demohijack.htm
(Merci à balltrap34 pour cette réalisation)

karimosouli · Answer

le voila:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:30:17, on 30/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Documents and Settings\Djouher\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Prayer\Prayer.exe
C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEMonitor.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/ymj/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMIECC.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealOne Playerpbrowserrecordplugin.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Windows Live Toolbar Beta - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: islamuslim Toolbar - {fcd5ee58-54d8-4d33-aa8d-54ae85597966} - C:\Program Files\islamuslim	bisl0.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: islamuslim Toolbar - {fcd5ee58-54d8-4d33-aa8d-54ae85597966} - C:\Program Files\islamuslim	bisl0.dll
O3 - Toolbar: &Windows Live Toolbar Beta - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [EEventManager] C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [IDMan] C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe /onboot
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Djouher\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bilal.lnk = C:\Program Files\Prayer\Prayer.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: Download all links with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEExt.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
O23 - Service: Localisateur d'appels de procédure distante (RPC) (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe
O23 - Service: QoS RSVP (RSVP) - Unknown owner - C:\WINDOWS\system32svp.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

Utilisateur anonyme · Answer

Mais a jour malwarebyte's anti-malware et fait un scan complet en mode sans échec, montre le rapport ensuite !

karimosouli · Answer

tien:

Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1454
Windows 5.1.2600 Service Pack 2

03/12/2008 21:55:52
mbam-log-2008-12-03 (21-55-52).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 243716
Temps écoulé: 2 hour(s), 18 minute(s), 48 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055c089-8582-441b-a0bf-17b458c2a3a8} (Trojan.BHO.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0055c089-8582-441b-a0bf-17b458c2a3a8} (Trojan.BHO.H) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMIECC.dll (Trojan.BHO.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\HADJAB\Local Settings\Temporary Internet Files\Content.IE5\EWRWEQEM\style[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\HADJAB\Local Settings\Temporary Internet Files\Content.IE5\M3MDITSD\style[1] (Trojan.Vundo) -> Quarantined and deleted successfully.

Utilisateur anonyme · Answer

Bon, tu as encore des prb ??

Refait un hijack stp

karimosouli · Answer

non je n'ai plus de probleme merci:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:37:34, on 12/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Documents and Settings\Djouher\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Prayer\Prayer.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEMonitor.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fr.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/ymj/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealOne Playerpbrowserrecordplugin.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Windows Live Toolbar Beta - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (file missing)
O2 - BHO: islamuslim Toolbar - {fcd5ee58-54d8-4d33-aa8d-54ae85597966} - C:\Program Files\islamuslim	bisl0.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: islamuslim Toolbar - {fcd5ee58-54d8-4d33-aa8d-54ae85597966} - C:\Program Files\islamuslim	bisl0.dll
O3 - Toolbar: &Windows Live Toolbar Beta - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (file missing)
O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [EEventManager] C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [IDMan] C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IDMan.exe /onboot
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Djouher\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'HADJAB')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S (User 'HADJAB')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'HADJAB')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" (User 'HADJAB')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'HADJAB')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [EPSON PX800FW Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIEME.EXE /FU "C:\WINDOWS\TEMP\E_S5D7.tmp" /EF "HKCU" (User 'HADJAB')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [Netlog Music Tool] "C:\Program Files\Netlog Music Tool\NetlogMusicTool.exe" (User 'HADJAB')
O4 - HKUS\S-1-5-21-2227724090-2535785734-815230075-1006\..\Run: [Heartbags] C:\DOCUME~1\HADJAB\APPLIC~1\ITCHSE~1\DASH BLEH.exe (User 'HADJAB')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bilal.lnk = C:\Program Files\Prayer\Prayer.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: Download all links with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Documents and Settings\Default User\Local Settings\Temp\bsasee3y5d\IEExt.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
O23 - Service: Localisateur d'appels de procédure distante (RPC) (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe
O23 - Service: QoS RSVP (RSVP) - Unknown owner - C:\WINDOWS\system32svp.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

Utilisateur anonyme · Answer

Salut,
Rien de bien vilan dans ce log.
Qu'une certaine 'lourdeur.
Beaucoup d'auto-démarrages inutiles et bouffeurs de ressources, mais sans grand effets, sinon un démarrage plus lent.

Parcontre Java est désuet.
https://filehippo.com/download_jre_32/?ex=CORE-116.0

Bien-sûr, les vieux java tu les supprimes.
Justement, 'Filehippo Update Checker', te serait d'un bon secours, pour tout garder à jour.
https://filehippo.com/windows/tuning-utilities/

Mais pour les mise à jour, lis ceci : http://ww1.purforum.com

Refait un hijack ensuite

L'invasion des pubs

71 réponses

Discussions similaires