Gros Problème avec bagle persistant

Ok pas de problème mais je le poste a ki le rapport ? Dsl qi ma kestion est bête mais bon, je me coucherai moins bête ce soir lol...

Cordialement,

Ca me note "recherche de fichier dossiers mais je n'ai rien qui s'affiche. Ca prends bcp de tps ?

Me revoila :



----------------- FindyKill V4.705 ------------------

* User : Admin - XPSP2-BAE6CEDF5
* executed from : C:\Program Files\FindyKill
* Update on 17/11/08 par Chiquitine29
* Start at 19:08:12 the 27/11/2008
* Windows XP - Internet Explorer 6.0.2900.2180


((((((((((((((( *** deleting *** ))))))))))))))))))


--------------- [ Active Processes ] ----------------


C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\userinit.exe

--------------- [ Infected files / folders ] ----------------


»»»» Supression files in C:

Deleted ! - C:\InfoSat.txt

»»»» Supression files in C:\WINDOWS


»»»» Supression files in C:\WINDOWS\Prefetch

Deleted ! - C:\WINDOWS\prefetch\12137072.EXE-22543546.pf
Deleted ! - C:\WINDOWS\prefetch\127012.EXE-0C7256D8.pf
Deleted ! - C:\WINDOWS\prefetch\127953.EXE-27EDA9BA.pf
Deleted ! - C:\WINDOWS\prefetch\131298.EXE-336709DE.pf
Deleted ! - C:\WINDOWS\prefetch\132700.EXE-3AF6E188.pf
Deleted ! - C:\WINDOWS\prefetch\135154.EXE-28055FCE.pf
Deleted ! - C:\WINDOWS\prefetch\137507.EXE-256D3176.pf
Deleted ! - C:\WINDOWS\prefetch\141052.EXE-3A86B3C1.pf
Deleted ! - C:\WINDOWS\prefetch\141683.EXE-195AA696.pf
Deleted ! - C:\WINDOWS\prefetch\157506.EXE-154B33FC.pf
Deleted ! - C:\WINDOWS\prefetch\168151.EXE-0FC6D9C8.pf
Deleted ! - C:\WINDOWS\prefetch\173479.EXE-220EF18F.pf
Deleted ! - C:\WINDOWS\prefetch\173569.EXE-07AD56B0.pf
Deleted ! - C:\WINDOWS\prefetch\174641.EXE-0375823B.pf
Deleted ! - C:\WINDOWS\prefetch\208329.EXE-0DC62EF3.pf
Deleted ! - C:\WINDOWS\prefetch\89668.EXE-13B8C011.pf
Deleted ! - C:\WINDOWS\prefetch\91591.EXE-0E95072D.pf
Deleted ! - C:\WINDOWS\prefetch\93304.EXE-18DEE04A.pf
Deleted ! - C:\WINDOWS\prefetch\95367.EXE-30D5F742.pf
Deleted ! - C:\WINDOWS\prefetch\FLEC006.EXE-1808CC41.pf
Deleted ! - C:\WINDOWS\prefetch\MDELK.EXE-1D176F91.pf
Deleted ! - C:\WINDOWS\prefetch\WINFILSE.EXE-17C2CF68.pf
Deleted ! - C:\WINDOWS\prefetch\WINTEMS.EXE-2A563F9B.pf

»»»» Supression files in C:\WINDOWS\system32

Deleted ! - C:\WINDOWS\system32\mdelk.exe

»»»» Supression files in C:\WINDOWS\system32\drivers

Deleted ! - C:\WINDOWS\system32\drivers\srosa2.sys
Deleted ! - C:\WINDOWS\system32\drivers\winfilse.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\101435.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\104219.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\104370.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\105611.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\107324.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\107835.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\108235.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\108816.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\110358.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\111450.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\12106918.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\12108741.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\12137072.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\127012.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\127953.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\131298.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\132700.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\135154.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\137507.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\141052.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\141683.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\157506.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\168151.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\171075.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\171817.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\173479.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\173569.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\174641.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\178206.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\191725.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\208329.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\212355.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\221588.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\223771.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\224262.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\225283.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\225554.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\228638.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\230892.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\232834.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\233856.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\263038.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\267554.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\271260.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\286171.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\289676.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\305479.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\312709.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\313691.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\327380.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\330585.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\417079.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\457527.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\477456.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\85623.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\89668.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\91591.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\93304.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\95367.exe
Deleted ! - "C:\WINDOWS\system32\drivers\downld"

»»»» Supression files in C:\Documents and Settings\Admin\Application Data

Deleted ! - "C:\Documents and Settings\Admin\Application Data\m"

»»»» Supression files in C:\DOCUME~1\Admin\LOCALS~1\Temp


»»»» Supression files in C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5

Deleted ! - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\APB05G7A\b64[1].jpg
Deleted ! - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\G167SDA7\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\G167SDA7\b64_3[2].jpg
Deleted ! - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\G167SDA7\b64_3[3].jpg
Deleted ! - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\G167SDA7\D36439BF6AFB645FD2B2F5627D57B[1].jpg
Deleted ! - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\G167SDA7\sc=553375&dw=50&dh=50&cs=00d591e7e00741d50cbc4ca9722cb64d&rnd=9895[1].jpg
Deleted ! - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\GHIJKLMN\53C5F73672AF3C6CB6423A86E56[1].jpg
Deleted ! - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\GHIJKLMN\7D47E622E82D3304EFDB64F3EB042[1].jpg
Deleted ! - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\GHIJKLMN\b64[1].jpg
Deleted ! - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\GHIJKLMN\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\GHIJKLMN\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\GHIJKLMN\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\OPQRSTUV\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\OPQRSTUV\b64_1[2].jpg
Deleted ! - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\OPQRSTUV\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\OPQRSTUV\b64_2[2].jpg
Deleted ! - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\OPQRSTUV\b64_2[3].jpg
Deleted ! - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\OPQRSTUV\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\UBIXW163\b64[1].jpg
Deleted ! - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\UBIXW163\b64[2].jpg
Deleted ! - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\UBIXW163\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\UBIXW163\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\W3TJQU7D\b64_2[1].jpg

--------------- [ Registry / Infected keys ] ----------------

Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_CURRENT_CONFIG\System\CurrentControlSet\Enum\ROOT\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_USERS\S-1-5-21-602162358-1677128483-1060284298-1003\Software\Local AppWizard-Generated Applications\winfilse

--------------- [ States / Restarting of services ] ----------------



+- Services : [ Auto=2 / Request=3 / Disable=4 ]

Ndisuio - Type of startup = 3

Ip6Fw - Type of startup = 2

SharedAccess - Type of startup = 2

wuauserv - Type of startup = 2

wscsvc - Type of startup = 2


--------------- [ Cleaning removable drives ] ----------------

+- Informations :

C: - Lecteur fixe

F: - Lecteur amovible


+- deleting files :


--------------- [ Registry / Mountpoint2 ] ----------------


-> Not found !


--------------- [ Searching Cracks / Keygen ] ----------------

Ok le voila...

[ Rapport ToolsCleaner version 2.2.6 (par A.Rothstein & dj QUIOU) ]

-->- Recherche:

C:\Infosat.txt: trouvé !

---------------------------------
-->- Suppression:

C:\Infosat.txt: supprimé !

----------------- FindyKill V4.705 ------------------

* User : Admin - XPSP2-BAE6CEDF5
* Emplacement : C:\Program Files\FindyKill
* Outils Mis a jours le 17/11/08 par Chiquitine29
* Recherche effectuée à 18:54:18 le 27/11/2008
* Windows XP - Internet Explorer 6.0.2900.2180

((((((((((((((((( *** Recherche *** ))))))))))))))))))


--------------- [ Processus actifs ] ----------------


C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Labtec\WebCam10\WebCam10.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Fighters\spywarefighter\SpywarefighterUser.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE
C:\documents and settings\admin\local settings\application data\uahutaov.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Documents and Settings\Admin\Bureau\ELIBAGLA.ØFABBØØH.EXE

--------------- [ Fichiers/Dossiers infectieux ] ----------------


»»»» Presence des fichiers dans C:

Found ! [27/11/2008 18:51] - C:\InfoSat.txt

»»»» Presence des fichiers dans C:\WINDOWS


»»»» Presence des fichiers dans C:\WINDOWS\Prefetch

Found ! - C:\WINDOWS\prefetch\12137072.EXE-22543546.pf
Found ! - C:\WINDOWS\prefetch\127012.EXE-0C7256D8.pf
Found ! - C:\WINDOWS\prefetch\127953.EXE-27EDA9BA.pf
Found ! - C:\WINDOWS\prefetch\131298.EXE-336709DE.pf
Found ! - C:\WINDOWS\prefetch\132700.EXE-3AF6E188.pf
Found ! - C:\WINDOWS\prefetch\135154.EXE-28055FCE.pf
Found ! - C:\WINDOWS\prefetch\137507.EXE-256D3176.pf
Found ! - C:\WINDOWS\prefetch\141052.EXE-3A86B3C1.pf
Found ! - C:\WINDOWS\prefetch\141683.EXE-195AA696.pf
Found ! - C:\WINDOWS\prefetch\157506.EXE-154B33FC.pf
Found ! - C:\WINDOWS\prefetch\168151.EXE-0FC6D9C8.pf
Found ! - C:\WINDOWS\prefetch\173479.EXE-220EF18F.pf
Found ! - C:\WINDOWS\prefetch\173569.EXE-07AD56B0.pf
Found ! - C:\WINDOWS\prefetch\174641.EXE-0375823B.pf
Found ! - C:\WINDOWS\prefetch\208329.EXE-0DC62EF3.pf
Found ! - C:\WINDOWS\prefetch\89668.EXE-13B8C011.pf
Found ! - C:\WINDOWS\prefetch\91591.EXE-0E95072D.pf
Found ! - C:\WINDOWS\prefetch\93304.EXE-18DEE04A.pf
Found ! - C:\WINDOWS\prefetch\95367.EXE-30D5F742.pf
Found ! - C:\WINDOWS\prefetch\FLEC006.EXE-1808CC41.pf
Found ! - C:\WINDOWS\prefetch\MDELK.EXE-1D176F91.pf
Found ! - C:\WINDOWS\prefetch\WINFILSE.EXE-17C2CF68.pf
Found ! - C:\WINDOWS\prefetch\WINTEMS.EXE-2A563F9B.pf

»»»» Presence des fichiers dans C:\WINDOWS\system32

Found ! [27/11/2008 15:03] - C:\WINDOWS\system32\mdelk.exe
Found ! [27/11/2008 15:03] - C:\WINDOWS\system32\wintems.exe

»»»» Presence des fichiers dans C:\WINDOWS\system32\drivers

Found ! [27/11/2008 15:19] - C:\WINDOWS\system32\drivers\srosa.sys
Found ! [27/11/2008 15:19] - C:\WINDOWS\system32\drivers\srosa2.sys
Found ! [27/03/2005 05:01] - C:\WINDOWS\system32\drivers\winfilse.exe
Found ! [27/11/2008 15:24] - "C:\WINDOWS\system32\drivers\downld"
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\101435.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\104219.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\104370.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\105611.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\107324.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\107835.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\108235.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\108816.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\110358.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\111450.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\12106918.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\12108741.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\12137072.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\127012.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\127953.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\131298.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\132700.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\135154.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\137507.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\141052.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\141683.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\157506.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\168151.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\171075.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\171817.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\173479.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\173569.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\174641.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\178206.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\191725.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\208329.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\212355.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\221588.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\223771.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\224262.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\225283.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\225554.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\228638.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\230892.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\232834.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\233856.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\263038.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\267554.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\271260.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\286171.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\289676.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\305479.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\312709.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\313691.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\327380.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\330585.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\417079.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\457527.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\477456.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\85623.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\89668.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\91591.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\93304.exe
Found ! [27/11/2008 15:24] - C:\WINDOWS\system32\drivers\downld\95367.exe

»»»» Presence des fichiers dans C:\Documents and Settings\Admin\Application Data

Found ! [27/11/2008 15:20] - "C:\Documents and Settings\Admin\Application Data\m\flec006.exe"
Found ! [27/11/2008 17:55] - "C:\Documents and Settings\Admin\Application Data\m\shared"
Found ! [27/11/2008 17:55] - "C:\Documents and Settings\Admin\Application Data\m"

»»»» Presence des fichiers dans C:\DOCUME~1\Admin\LOCALS~1\Temp


»»»» Presence des fichiers dans C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5

Found ! [27/11/2008 15:20] - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\APB05G7A\b64[1].jpg
Found ! [27/11/2008 14:36] - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\G167SDA7\b64_3[1].jpg
Found ! [27/11/2008 14:43] - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\G167SDA7\b64_3[2].jpg
Found ! [27/11/2008 14:50] - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\G167SDA7\b64_3[3].jpg
Found ! [13/11/2008 12:15] - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\G167SDA7\D36439BF6AFB645FD2B2F5627D57B[1].jpg
Found ! [27/11/2008 14:16] - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\G167SDA7\sc=553375&dw=50&dh=50&cs=00d591e7e00741d50cbc4ca9722cb64d&rnd=9895[1].jpg
Found ! [23/11/2008 19:36] - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\GHIJKLMN\53C5F73672AF3C6CB6423A86E56[1].jpg
Found ! [08/11/2008 11:17] - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\GHIJKLMN\7D47E622E82D3304EFDB64F3EB042[1].jpg
Found ! [27/11/2008 14:51] - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\GHIJKLMN\b64[1].jpg
Found ! [27/11/2008 15:20] - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\GHIJKLMN\b64_1[1].jpg
Found ! [27/11/2008 14:44] - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\GHIJKLMN\b64_2[1].jpg
Found ! [27/11/2008 14:33] - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\GHIJKLMN\b64_3[1].jpg
Found ! [27/11/2008 14:50] - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\OPQRSTUV\b64_1[1].jpg
Found ! [27/11/2008 14:51] - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\OPQRSTUV\b64_1[2].jpg
Found ! [27/11/2008 14:37] - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\OPQRSTUV\b64_2[1].jpg
Found ! [27/11/2008 14:42] - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\OPQRSTUV\b64_2[2].jpg
Found ! [27/11/2008 15:04] - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\OPQRSTUV\b64_2[3].jpg
Found ! [27/11/2008 15:03] - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\OPQRSTUV\b64_3[1].jpg
Found ! [27/11/2008 14:36] - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\UBIXW163\b64[1].jpg
Found ! [27/11/2008 14:43] - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\UBIXW163\b64[2].jpg
Found ! [27/11/2008 14:36] - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\UBIXW163\b64_2[1].jpg
Found ! [27/11/2008 14:51] - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\UBIXW163\b64_3[1].jpg
Found ! [27/11/2008 15:21] - C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\W3TJQU7D\b64_2[1].jpg

--------------- [ Registre / Startup ] ----------------

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]

BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
MsnMsgr="C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
WINSOS VERIFY="C:\Program Files\Winsos\WINSOS.EXE" MINI
cseee=c:\documents and settings\admin\local settings\application data\cseee.exe cseee
EPSON Stylus DX8400 Series=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE /FU "C:\WINDOWS\TEMP\E_SD0.tmp" /EF "HKCU"
uahutaov="c:\documents and settings\admin\local settings\application data\uahutaov.exe" uahutaov

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]

NeroFilterCheck=C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
KernelFaultCheck=%systemroot%\system32\dumprep 0 -k
LogMeIn GUI="C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
Sony Ericsson PC Suite="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
SunJavaUpdateSched="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
LogitechCommunicationsManager="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
<NO NAME>=
LogitechQuickCamRibbon="C:\Program Files\Labtec\WebCam10\WebCam10.exe" /hide
TkBellExe="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
spywarefighterguard=C:\Program Files\Fighters\spywarefighter\SpywarefighterUser.exe
avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL=
Installed=1
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI=
NoChange=1
Installed=1
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS=
Installed=1
<NO NAME>=

--------------- [ Registre / Clés infectieuses ] ----------------


Found ! - HKEY_USERS\S-1-5-21-602162358-1677128483-1060284298-1003\Software\Local AppWizard-Generated Applications\winfilse
Found ! - HKEY_USERS\S-1-5-21-602162358-1677128483-1060284298-1003\Software\FFC
Found ! - HKEY_USERS\S-1-5-21-602162358-1677128483-1060284298-1003\Software\FirtR
Found ! - HKEY_USERS\S-1-5-21-602162358-1677128483-1060284298-1003\Software\MuleAppData
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winfilse
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Found ! - HKEY_CURRENT_USER\Software\FirtR
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sK9Ou0s

--------------- [ Etat / Services ] ----------------



+- Services : [ Auto=2 / Demande=3 / Désactivé=4 ]

/!\ Ndisuio - Type de démarrage = 4

/!\ Ip6Fw - Type de démarrage = 4

SharedAccess - Type de démarrage = 2

wuauserv - Type de démarrage = 2

/!\ wscsvc - Type de démarrage = 4



--------------- [ Recherche dans supports amovibles] ----------------


+- Informations :

C: - Lecteur fixe

F: - Lecteur amovible


+- presence des fichiers :



--------------- [ Registre / Mountpoint2 ] ----------------


-> Not found !


------------------- ! Fin du rapport ! --------------------

Search Navipromo version 3.6.9 commencé le 27/11/2008 à 19:16:46,23

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "Admin"

Mise à jour le 05.11.2008 à 21h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 6.0.2900.2180
Système de fichiers : NTFS

Recherche executé en mode normal

*** Recherche Programmes installés ***

Favorit

*** Recherche dossiers dans "C:\WINDOWS" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Admin\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\LOGMEI~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Admin\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\LOGMEI~1\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Admin\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\LOGMEI~1\menudm~1\progra~1" ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings\Admin\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\LOGMEI~1\locals~1\applic~1" *



*** Recherche fichiers ***


C:\WINDOWS\system32\nvs2.inf trouvé !

*** Recherche clés spécifiques dans le Registre ***

HKEY_CURRENT_USER\Software\Lanconfig trouvé !

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :


* Dans "C:\Documents and Settings\Admin\locals~1\applic~1" :

cseee.dat trouvé !
cseee_nav.dat trouvé !
cseee_navps.dat trouvé !
uahutaov.exe trouvé !
uahutaov.dat trouvé !
uahutaov_nav.dat trouvé !
uahutaov_navps.dat trouvé !

* Dans "C:\DOCUME~1\LOGMEI~1\locals~1\applic~1" :


3)Recherche Certificats :

Certificat Egroup trouvé !
Certificat Electronic-Group trouvé !
Certificat Montorgueil absent !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :



*** Analyse terminée le 27/11/2008 à 19:21:55,67 ***

Clean Navipromo version 3.6.9 commencé le 27/11/2008 à 19:25:45,18

Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "Admin"

Mise à jour le 05.11.2008 à 21h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 6.0.2900.2180
Système de fichiers : NTFS

Mode suppression automatique
avec prise en charge résultats Catchme et GNS


Nettoyage exécuté au redémarrage de l'ordinateur


*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)


*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\WINDOWS\System32" *


* Suppression dans "C:\Documents and Settings\Admin\locals~1\applic~1" *


* Suppression dans "C:\DOCUME~1\LOGMEI~1\locals~1\applic~1" *


*** Suppression dossiers dans "C:\WINDOWS" ***


*** Suppression dossiers dans "C:\Program Files" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\Admin\applic~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\LOGMEI~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\Admin\locals~1\applic~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\LOGMEI~1\locals~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\Admin\menudm~1\progra~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\LOGMEI~1\menudm~1\progra~1" ***



*** Suppression fichiers ***

C:\WINDOWS\system32\nvs2.inf supprimé !

*** Suppression fichiers temporaires ***

Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\Admin\locals~1\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\WINDOWS\system32" *


* Dans "C:\Documents and Settings\Admin\locals~1\applic~1" *


cseee.dat trouvé !
Copie cseee.dat réalisée avec succès !
cseee.dat supprimé !

cseee_nav.dat trouvé !
Copie cseee_nav.dat réalisée avec succès !
cseee_nav.dat supprimé !

cseee_navps.dat trouvé !
Copie cseee_navps.dat réalisée avec succès !
cseee_navps.dat supprimé !

uahutaov.exe trouvé !
Copie uahutaov.exe réalisée avec succès !
uahutaov.exe supprimé !

uahutaov.dat trouvé !
Copie uahutaov.dat réalisée avec succès !
uahutaov.dat supprimé !

uahutaov_nav.dat trouvé !
Copie uahutaov_nav.dat réalisée avec succès !
uahutaov_nav.dat supprimé !

uahutaov_navps.dat trouvé !
Copie uahutaov_navps.dat réalisée avec succès !
uahutaov_navps.dat supprimé !

C:\WINDOWS\prefetch\uahutaov*.pf trouvé !
Copie C:\WINDOWS\prefetch\uahutaov*.pf réalisée avec succès !
C:\WINDOWS\prefetch\uahutaov*.pf supprimé !


* Dans "C:\DOCUME~1\LOGMEI~1\locals~1\applic~1" *


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup supprimé !
Certificat Electronic-Group supprimé !
Certificat Montorgueil absent !
Certificat OOO-Favorit supprimé !
Certificat Sunny-Day-Design-Ltdt absent !

*** Nettoyage terminé le 27/11/2008 à 19:29:05,18 ***

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:35:15, on 27/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Labtec\WebCam10\WebCam10.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Fighters\spywarefighter\SpywarefighterUser.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://fr.rd.yahoo.com/customize/ycomp/defaults/sb/*http://fr.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/toolbar/ie8/sidebar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Labtec\WebCam10\WebCam10.exe" /hide
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [spywarefighterguard] C:\Program Files\Fighters\spywarefighter\SpywarefighterUser.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WINSOS VERIFY] "C:\Program Files\Winsos\WINSOS.EXE" MINI
O4 - HKCU\..\Run: [EPSON Stylus DX8400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE /FU "C:\WINDOWS\TEMP\E_SD0.tmp" /EF "HKCU"
O4 - HKUS\S-1-5-19\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'Default user')
O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Unknown owner - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe (file missing)
O23 - Service: LVSrvLauncher - Labtec Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe

Dsl pr le tps ke cela met mais l'anti virus est super long à se télécharger. Je n'en suis ka 59 %....

e fichier a déjà été analysé:
MD5: 43722d15c8a955a8130acd3151178ce5
First received: 2008.05.01 11:06:42 (CET)
Date 2008.11.25 22:01:56 (CET) [+1D]
Résultats 0/37
Permalink: analisis/4c2ba13fb14c2904676f0694f4a52654

Je ne vois pas la taille du fichier...

Fichier devldr32.exe reçu le 2008.11.25 22:00:06 (CET)
Situation actuelle: terminé
Résultat: 0/37 (0.00%)
Formaté Formaté
Impression des résultats Impression des résultats
Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.11.24.3 2008.11.25 -
AntiVir 7.9.0.35 2008.11.25 -
Authentium 5.1.0.4 2008.11.25 -
Avast 4.8.1281.0 2008.11.25 -
AVG 8.0.0.199 2008.11.25 -
BitDefender 7.2 2008.11.25 -
CAT-QuickHeal 10.00 2008.11.25 -
ClamAV 0.94.1 2008.11.25 -
DrWeb 4.44.0.09170 2008.11.25 -
eSafe 7.0.17.0 2008.11.25 -
eTrust-Vet 31.6.6227 2008.11.25 -
Ewido 4.0 2008.11.25 -
F-Prot 4.4.4.56 2008.11.25 -
F-Secure 8.0.14332.0 2008.11.25 -
Fortinet 3.117.0.0 2008.11.25 -
GData 19 2008.11.25 -
Ikarus T3.1.1.45.0 2008.11.25 -
K7AntiVirus 7.10.533 2008.11.25 -
Kaspersky 7.0.0.125 2008.11.25 -
McAfee 5445 2008.11.25 -
McAfee+Artemis 5445 2008.11.25 -
Microsoft 1.4104 2008.11.25 -
NOD32 3640 2008.11.25 -
Norman 5.80.02 2008.11.25 -
Panda 9.0.0.4 2008.11.25 -
PCTools 4.4.2.0 2008.11.25 -
Prevx1 V2 2008.11.25 -
Rising 21.05.12.00 2008.11.25 -
SecureWeb-Gateway 6.7.6 2008.11.25 -
Sophos 4.35.0 2008.11.25 -
Sunbelt 3.1.1823.2 2008.11.22 -
Symantec 10 2008.11.25 -
TheHacker 6.3.1.1.162 2008.11.25 -
TrendMicro 8.700.0.1004 2008.11.25 -
VBA32 3.12.8.9 2008.11.25 -
ViRobot 2008.11.25.1485 2008.11.25 -
VirusBuster 4.5.11.0 2008.11.25 -
Information additionnelle
File size: 24064 bytes
MD5...: 43722d15c8a955a8130acd3151178ce5
SHA1..: 5f69ef6573c26bb0dd67199d8c356d64180b8581
SHA256: 0ba7f87d150d77cf34ca8125852fda024487666ed9aae95de16b3d360766fb18
SHA512: 25c87d967bcad40af533f27bdc390613b51c32345512ef9fb23e63998265b521
812a0c54719d58dbfa5cf791de2f1dd749e9902058e69573a622f6c2f8cacedd
ssdeep: 384:Hl7QA7fIcUAN6DzCefOSIvvtHK3b23v/vP4AYZ0jqT2I/ugncDU:hUrMqLiK
36//34BhMscDU
PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1002bcf
timedatestamp.....: 0x3b6b5fb2 (Sat Aug 04 02:36:34 2001)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x5022 0x5200 6.36 77d523c04469211ddf82203599328c89
.data 0x7000 0x898 0x400 2.20 53771d9ef84c8a95fb7decdc559a5412
.rsrc 0x8000 0x398 0x400 3.02 ef3dd986480a4d1b5bbe2766178272af

( 4 imports )
> ADVAPI32.dll: FreeSid, CheckTokenMembership, AllocateAndInitializeSid, RegCloseKey, RegSetValueExW, RegOpenKeyExW, RegQueryValueExW, RegEnumKeyExW, GetUserNameW
> KERNEL32.dll: GetLastError, GetVersion, CloseHandle, CreateMutexW, GetVersionExW, DeviceIoControl, CreateFileW, WaitForSingleObject, ExitThread, SetEvent, CreateEventW, WinExec, SetThreadPriority, CreateThread, FreeLibrary, GetProcAddress, LoadLibraryW, GetModuleHandleA, GetStartupInfoA, GetCommandLineA, GetVersionExA, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, GetFileType, HeapDestroy, HeapCreate, VirtualFree, HeapFree, LoadLibraryA, GetACP, GetOEMCP, GetCPInfo, HeapAlloc, VirtualAlloc, HeapReAlloc, LCMapStringA, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW, RtlUnwind, GetLocaleInfoA, VirtualProtect, GetSystemInfo, VirtualQuery
> USER32.dll: DestroyWindow, EndPaint, BeginPaint, DefWindowProcW, SetForegroundWindow, ShowWindow, IsIconic, CreateWindowExW, PostMessageW, KillTimer, DispatchMessageW, TranslateMessage, PostQuitMessage, GetMessageW, SetTimer, FindWindowW, RegisterClassW
> SHELL32.dll: ShellExecuteW

( 0 exports )

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:23:52, on 27/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Labtec\WebCam10\WebCam10.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Fighters\spywarefighter\SpywarefighterUser.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\trend micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://fr.rd.yahoo.com/customize/ycomp/defaults/sb/*http://fr.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/toolbar/ie8/sidebar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Labtec\WebCam10\WebCam10.exe" /hide
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [spywarefighterguard] C:\Program Files\Fighters\spywarefighter\SpywarefighterUser.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WINSOS VERIFY] "C:\Program Files\Winsos\WINSOS.EXE" MINI
O4 - HKCU\..\Run: [EPSON Stylus DX8400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE /FU "C:\WINDOWS\TEMP\E_SD0.tmp" /EF "HKCU"
O4 - HKUS\S-1-5-19\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'Default user')
O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Unknown owner - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe (file missing)
O23 - Service: LVSrvLauncher - Labtec Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe

j'ai pourtant réinstallé java...


F --------- Logfile of AD-Remover 1.0.4.8 by C_XX ---------

* OPTION: Scan

START at: 20:35:43 | 27/11/2008
ON: Microsoft Windows XP [version 5.1.2600] ( Windows XP )
Internet Explorer: 6.0.2900.2180
EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat
USER: Admin | PC: XPSP2-BAE6CEDF5
BOOT MODE: Normal
DRIVE(S): A:\
-
Systemdrive: C:\ (NTFS)

--------- [ PROCESSES ] ---------

\SystemRoot\System32\smss.exe
\??\C:\WINDOWS\system32\csrss.exe
\??\C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Labtec\WebCam10\WebCam10.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Fighters\spywarefighter\SpywarefighterUser.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

---------------------------- [~> 30]


+---------------------------------------------------------------------------+
+------------------------------- SERVICES FOUND
+---------------------------------------------------------------------------+

Found ! - "Boonty Games"

+---------------------------------------------------------------------------+
+------------------------------- REGISTRY ELEMENTS FOUND
+---------------------------------------------------------------------------+

"HKEY_CURRENT_USER\SOFTWARE\Boonty"
"HKEY_LOCAL_MACHINE\Software\Boonty"
"HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Boonty Games"
"HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_BOONTY_GAMES"
"HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Boonty Games"
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Boonty Games"

+---------------------------------------------------------------------------+
+------------------------------- FILES\FOLDERS FOUND
+---------------------------------------------------------------------------+

[10/05/2008 11:35|d--------] C:\Program Files\Boonty
[10/05/2008 11:40|d--------] C:\Program Files\BoontyGames
[10/05/2008 11:36|d--------] C:\Program Files\Fichiers communs\BOONTY Shared
[10/05/2008 11:37|d--------] C:\Documents and Settings\All Users\Application Data\BOONTY
[10/05/2008 11:40|d--------] C:\Documents and Settings\All Users\MENUDM~1\PROGRA~1\BoontyGames


+---------- Scanning prefs.js ... ( # Mozilla User Preferences )

...\tibtdfyl.default\prefs.js :

~~~~ Mozilla FireFox version 2.0.0.18 ~~~~


+----------+


+---------------------------------------------------------------------------+


+---------- Added scan ...

+--[HKEY_LOCAL_MACHINE\...\Run]

NeroFilterCheck REG_SZ C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
KernelFaultCheck REG_EXPAND_SZ %systemroot%\system32\dumprep 0 -k
LogMeIn GUI REG_SZ "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
Sony Ericsson PC Suite REG_SZ "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
LogitechCommunicationsManager REG_SZ "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
<SANS NOM> REG_SZ
LogitechQuickCamRibbon REG_SZ "C:\Program Files\Labtec\WebCam10\WebCam10.exe" /hide
TkBellExe REG_SZ "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
spywarefighterguard REG_SZ C:\Program Files\Fighters\spywarefighter\SpywarefighterUser.exe
avgnt REG_SZ "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

+--[HKEY_CURRENT_USER\...\Run]

BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} REG_SZ "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
MsnMsgr REG_SZ "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
WINSOS VERIFY REG_SZ "C:\Program Files\Winsos\WINSOS.EXE" MINI
EPSON Stylus DX8400 Series REG_SZ C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE /FU "C:\WINDOWS\TEMP\E_SD0.tmp" /EF "HKCU"

+--[HKEY_LOCAL_MACHINE\...\Internet Explorer\MAIN]

Start Page : hxxp://fr.yahoo.com

+--[HKEY_CURRENT_USER\...\Internet Explorer\MAIN]

Start Page : hxxp://fr.yahoo.com/

+---------------------------------------------------------------------------+
+------------------------------- [ EOF - 106 lines ]
+---------------------------------------------------------------------------+

[ END at: 20:36:32 | 27/11/2008 ] - [ Time elapsed: 49.0 seconds ]

Bon j'espere ke le dernier rapport te semble bon...

Tiens moi au courant si tu as vu un pb...

Merci encore pr tt..

Bonne soirée.

Moi aussi j'ai été okp !!!

Alors 1er rapport :



* OPTION: Clean

START at: 22:23:56 | 27/11/2008
ON: Microsoft Windows XP [version 5.1.2600] ( Windows XP )
Internet Explorer: 6.0.2900.2180

*** Limited to ***

Boonty/BoontyGames

******************

EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat
USER: Admin | PC: XPSP2-BAE6CEDF5
BOOT MODE: Normal
DRIVE(S): A:\
-
Systemdrive: C:\ (NTFS)

--------- [ PROCESSES ] ---------

\SystemRoot\System32\smss.exe
\??\C:\WINDOWS\system32\csrss.exe
\??\C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Labtec\WebCam10\WebCam10.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe

---------------------------- [~> 32]

(!) ---- IE start pages reset

+---------------------------------------------------------------------------+
+------------------------------- SERVICES DELETED
+---------------------------------------------------------------------------+

Deleted successfully ! - "Boonty Games"

+---------------------------------------------------------------------------+
+------------------------------- REGISTRY ELEMENTS DELETED
+---------------------------------------------------------------------------+

"HKEY_CURRENT_USER\SOFTWARE\Boonty"
"HKEY_LOCAL_MACHINE\Software\Boonty"
"HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_BOONTY_GAMES"
"HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Boonty Games"

+---------------------------------------------------------------------------+
+------------------------------- FILES\FOLDERS DELETED
+---------------------------------------------------------------------------+

[10/05/2008 11:35|d--------] C:\Program Files\Boonty
[10/05/2008 11:40|d--------] C:\Program Files\BoontyGames
[10/05/2008 11:36|d--------] C:\Program Files\Fichiers communs\BOONTY Shared
[10/05/2008 11:37|d--------] C:\Documents and Settings\All Users\Application Data\BOONTY
[10/05/2008 11:40|d--------] C:\Documents and Settings\All Users\MENUDM~1\PROGRA~1\BoontyGames

(!) ---- Temp files deleted.
(!) ---- Recycle bin emptied in all drives.



+---------- Added scan ...

+--[HKEY_LOCAL_MACHINE\...\Run]

NeroFilterCheck REG_SZ C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
KernelFaultCheck REG_EXPAND_SZ %systemroot%\system32\dumprep 0 -k
LogMeIn GUI REG_SZ "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
Sony Ericsson PC Suite REG_SZ "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
LogitechCommunicationsManager REG_SZ "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
<SANS NOM> REG_SZ
LogitechQuickCamRibbon REG_SZ "C:\Program Files\Labtec\WebCam10\WebCam10.exe" /hide
TkBellExe REG_SZ "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
avgnt REG_SZ "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe"

+--[HKEY_CURRENT_USER\...\Run]

BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} REG_SZ "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
MsnMsgr REG_SZ "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
WINSOS VERIFY REG_SZ "C:\Program Files\Winsos\WINSOS.EXE" MINI
EPSON Stylus DX8400 Series REG_SZ C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE /FU "C:\WINDOWS\TEMP\E_SD0.tmp" /EF "HKCU"

+--[HKEY_LOCAL_MACHINE\...\Internet Explorer\MAIN]

Start Page : hxxp://fr.msn.com/

+--[HKEY_CURRENT_USER\...\Internet Explorer\MAIN]

Start Page : hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

+---------------------------------------------------------------------------+
+------------------------------- [ EOF - 101 lines ]
+---------------------------------------------------------------------------+

[ END at: 22:25:03 | 27/11/2008 ] - [ Time elapsed: 67.4 seconds ]

dsl mais le scan est super long.. ca fé déja 30 min...

Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1430
Windows 5.1.2600 Service Pack 2

27/11/2008 23:22:31
mbam-log-2008-11-27 (23-22-31).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 82156
Temps écoulé: 44 minute(s), 50 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Dsl de ne te répondre ke mnt mais g eu des imprévus à la maison :

Voici le dernier rapport de Toolcleaner :

[ Rapport ToolsCleaner version 2.2.6 (par A.Rothstein & dj QUIOU) ]

-->- Recherche:

C:\fixnavi.txt: trouvé !
C:\cleannavi.txt: trouvé !
C:\FindyKill.txt: trouvé !
C:\Documents and Settings\Admin\Bureau\ANTI BAGLE\HijackThis.lnk: trouvé !
C:\Documents and Settings\Admin\Bureau\ANTI BAGLE\Navilog1.exe: trouvé !
C:\Documents and Settings\Admin\Bureau\ANTI BAGLE\Navilog1.lnk: trouvé !
C:\Documents and Settings\Admin\Bureau\ANTI BAGLE\HJTInstall.exe: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files\FindyKill: trouvé !
C:\Program Files\trend micro\HijackThis: trouvé !
C:\Program Files\trend micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\trend micro\HijackThis\hijackthis.log: trouvé !

---------------------------------
-->- Suppression:

C:\Documents and Settings\Admin\Bureau\ANTI BAGLE\HijackThis.lnk: supprimé !
C:\Documents and Settings\Admin\Bureau\ANTI BAGLE\Navilog1.exe: supprimé !
C:\Documents and Settings\Admin\Bureau\ANTI BAGLE\Navilog1.lnk: supprimé !
C:\Documents and Settings\Admin\Bureau\ANTI BAGLE\HJTInstall.exe: supprimé !
C:\Program Files\trend micro\HijackThis\HijackThis.exe: supprimé !
C:\fixnavi.txt: supprimé !
C:\cleannavi.txt: supprimé !
C:\FindyKill.txt: supprimé !
C:\Program Files\trend micro\HijackThis\hijackthis.log: supprimé !
C:\Program Files\Navilog1: supprimé !
C:\Program Files\FindyKill: supprimé !
C:\Program Files\trend micro\HijackThis: supprimé !

Par contre, je n'ai pas l'onglet de restauration du système dans Poste de travail - Propriétés...

Je viens d'ouvrir correctement mes yeux et c bon j'ai désactiver et réactiver la restauration system...

Bonjour,

Et bien encore un pti souci ce matin en allumnt l'ordi...

Il me dit ke Windows ne trouve pas C// Program ????

Tu as une idée de ce ki se passe ?

merci

Tt est rentré ds l'ordre...

Merci encore de ton aide...

Bonne journée...

Cordialement,