virus jojo,maradona,akonRésolu/Fermé

Question

Bonjour,
SVP,aidez moi a eradiquer ces virus de mon pc,dans mes disques locaux g jojo,maradona,akon,merci d'avance

madsoli · Answer

Rebonjour;
Svp aidez moi à resoudre mon probléme,voila apparement g a faire avec le virus logoneui.exe,c lui qui me creé les dossiers jojo.maradona,akon,zidane...j'attends avec impatience.
Merci

Destrio5 · Answer

Salut,

- Télécharge HijackThis v2.0.2 sur ton Bureau.

- Double-clique sur HJTInstall afin de lancer l'installation.

- Clique sur Install ensuite sur I Accept.

- Clique sur Do a system scan and save a logfile.

- Le bloc-notes s'ouvrira, fais un copier/coller de tout son contenu ici dans ton prochain message.

madsoli · Answer

Bonjour,
Merci pour votre reponse voila mon fichier log:



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:19:54, on 05/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
C:\WINDOWS\system32\logoneui.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://famous2.topcities.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = google.net-studio.org
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 172.23.1.0:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll
F2 - REG:system.ini: Shell=Explorer.exe logoneui.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1	oolbar.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Vimicro USB PC Camera 305
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AVP] "G:\kaspersky\Kaspersky Lab Tool\setup_7.0.0.180_10.05.2008_16-32.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [firewall 2008] C:\WINDOWS\system32\logoneui.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RESEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?3cfc080c604349278fa1a4fb7adee1bc
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?3cfc080c604349278fa1a4fb7adee1bc
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.google.com/?gws_rd=ssl
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = domaine
O17 - HKLM\Software\..\Telephony: DomainName = domaine
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = domaine
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: setup_7.0.0.180_10.05.2008_16-32 - Unknown owner - G:\kaspersky\Kaspersky Lab Tool\setup_7.0.0.180_10.05.2008_16-32.exe (file missing)
O23 - Service: Client de gestion Symantec  (SmcService) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
O23 - Service: Symantec Network Access Control (SNAC) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Fichiers communs\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

Destrio5 · Answer

Tu as Kaspersky et Norton ?

- Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.

- Double-clique sur RSIT.exe afin de lancer le programme.

- Clique sur Continue à l'écran Disclaimer.

- Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

- Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

Note : Les rapports sont sauvegardés dans le dossier C:\rsit.

Utilisateur anonyme · Answer

Salut,

pour suivre merci

Destrio5 · Answer

Je me disais bien aussi ^^

madsoli · Answer

Bonjour;
Merci pour votre aide voila les deux fichiers:

info.txt logfile of random's system information tool 1.04 2008-12-06 09:05:01

======Uninstall list======

-->C:\Program Files\DivX\ConverterUninstall.exe /CONVERTER
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0B095086-7205-4D48-90DF-DCD16613C6D4}\setup.exe" -l0x40c 
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0B095086-7205-4D48-90DF-DCD16613C6D4}\setup.exe" -l0x40c  /remove
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{103BCDA0-E063-46AC-8028-64E78722ABA7}\setup.exe" -l0x40c 
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{103BCDA0-E063-46AC-8028-64E78722ABA7}\setup.exe" -l0x40c  /remove
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2616B36E-38CE-4357-8AB5-8B3EE9B1C117}\setup.exe" -l0x40c 
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2616B36E-38CE-4357-8AB5-8B3EE9B1C117}\setup.exe" -l0x40c  /remove
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{57FA4E0F-82C9-417D-87BC-0186D6CB7A44}\setup.exe" -l0x40c 
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{63A317D0-60A6-43FC-848A-9FE4A53B29CE}\setup.exe" -l0x40c 
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x40c 
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x40c  /remove
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{836612F0-1571-4C65-A4B7-58A39AA578EE}\setup.exe" -l0x40c 
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{836612F0-1571-4C65-A4B7-58A39AA578EE}\setup.exe" -l0x40c  /remove
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9AB14DF5-3B04-4E3B-9969-695DBA7F2008}\setup.exe" -l0x40c 
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9AB14DF5-3B04-4E3B-9969-695DBA7F2008}\setup.exe" -l0x40c  /remove
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A82F10CB-18B5-4EAC-AEF2-FA49CD565626}\setup.exe" -l0x40c 
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CB99E420-8071-48F9-9567-4A53BE7569C4}\setup.exe" -l0x40c 
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CB99E420-8071-48F9-9567-4A53BE7569C4}\setup.exe" -l0x40c  /remove
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D42EFA6C-0553-45F7-AD03-6D36207CA6D4}\setup.exe" -l0x40c 
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D42EFA6C-0553-45F7-AD03-6D36207CA6D4}\setup.exe" -l0x40c  /remove
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D524239C-FD5C-4183-A49C-7930915A9C0A}\setup.exe" -l0x40c 
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D524239C-FD5C-4183-A49C-7930915A9C0A}\setup.exe" -l0x40c  /remove
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DD2D9012-E5A1-4717-8EE9-8DB3F36E2F8C}\setup.exe" -l0x40c 
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DD2D9012-E5A1-4717-8EE9-8DB3F36E2F8C}\setup.exe" -l0x40c  /remove
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0015-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0019-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {5A2F65A4-808F-4A1E-973E-92E17824982D}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {B3F4DC34-7F60-4B7C-A79F-1C13012D99D4}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
2007 Microsoft Office system-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROHYBRIDR /dll OSETUP.DLL
Adobe Flash Player 9 ActiveX-->MsiExec.exe /X{8E9DB7EF-5DD3-499E-BA2A-A1F3153A4DF8}
Adobe Flash Player ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Photoshop 7.0 ME-->C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Adobe\Photoshop 7.0 ME\Uninst.isu" -c"C:\Program Files\Adobe\Photoshop 7.0 ME\Uninst.dll"
Adobe Reader 7.0.8 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A70800000002}
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
Assistant de connexion Windows Live-->MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
Complément Microsoft Enregistrer en tant que PDF ou XPS pour programmes Microsoft Office 2007-->MsiExec.exe /X{90120000-00B2-040C-0000-0000000FF1CE}
Complément Office 2007 - Microsoft Enregistrer en tant que PDF ou XPS (Beta)-->MsiExec.exe /X{30120000-00B2-040C-0000-0000000FF1CE}
Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Correctif pour Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Creative Jukebox Driver-->C:\Program Files\Creative\Jukebox 3 Drivers\DrvUnins.exe /s
Creative MediaSource-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2E0C1913-886B-4C5C-8DAF-D1E649CE5FCC}\setup.exe" -l0x40c  /remove
Creative NOMAD II Driver-->C:\Program Files\Creative\NOMAD2 Driver\DrvUnins.exe /s
Creative System Information-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{63A317D0-60A6-43FC-848A-9FE4A53B29CE}\setup.exe" -l0x40c  /remove
Creative Zen Micro-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D944236D-7992-41D6-8257-930B5832F1CC}\SETUP.EXE" -l0x40c  /remove
Dell Resource CD-->MsiExec.exe /X{2764CA82-DFB9-4498-AF85-719340BF5305}
Détecteur de flux Windows Live Toolbar-->MsiExec.exe /X{B9C5669B-4705-4046-A3EE-0BFD08D7B668}
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Content Uploader-->C:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
DivX Converter-->C:\Program Files\DivX\ConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
EasyRecovery Professional Essai-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{A45F4518-0DC7-474A-BBE1-F04CC2D6FD93} /l1036 
EPSON Logiciel imprimante-->C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /R
Extension MSN pour Windows Live Toolbar-->MsiExec.exe /X{0C858954-92B6-40C8-84D0-D095070C263C}
Fichiers de prise en charge de l'installation de Microsoft SQL Server (Français)-->MsiExec.exe /X{3380F354-C5F7-4E71-8F51-EEE6C3F06C62}
FileMaker Pro 6 Essai-->MsiExec.exe /I{59F626C3-8CA3-4196-9610-557762962A16}
Free Mp3 Wma Converter V 1.4.0-->"C:\Program Files\Free Audio Pack\unins000.exe"
Free PDF2Word Converter-->MsiExec.exe /I{2B1F0D3F-E38C-4189-ACED-5DD413E029E6}
FreeUndelete-->C:\Program Files\FreeUndelete\GLF134.exe /handle:fru
Gestionnaire de contacts professionnels pour Outlook 2007 SP1-->"C:\Program Files\Microsoft Small Business\Business Contact Manager\SetupBootstrap\Setup.exe" /remove {69ca8988-1c6c-4285-b8af-db780a6e42af}
Gestionnaire de contacts professionnels pour Outlook 2007 SP1-->MsiExec.exe /X{69CA8988-1C6C-4285-B8AF-DB780A6E42AF}
Gestionnaire de disques amovible Creative-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{57FA4E0F-82C9-417D-87BC-0186D6CB7A44}\setup.exe" -l0x40c  /remove
Google Toolbar for Internet Explorer-->MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar1.dll"
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 2.0 (KB922981)-->C:\WINDOWS\system32\msiexec.exe /promptrestart /uninstall {A1D5A6B2-B620-41F9-B435-10A4FF3C18A2} /package {7131646D-CD3C-40F4-97B9-CD9E4E6262EF}
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix pour Microsoft .NET Framework 2.0 (KB923319)-->C:\WINDOWS\system32\msiexec.exe /promptrestart /uninstall {3C87D1CF-1592-4BFA-9B3E-380580EFAF51} /package {7131646D-CD3C-40F4-97B9-CD9E4E6262EF}
LeConjugueur-->"C:\Program Files\LeConjugueur\uninstall.exe"
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
LiveUpdate 3.3 (Symantec Corporation)-->"C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
Maxthon2 Browser (remove only)-->C:\Program Files\Maxthon2\MaxthonUINST.exe
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Encarta 2008 - Etudes-->MsiExec.exe /I{08181881-FCA5-44A7-B863-D66037A16AAF}
Microsoft Encarta Maths-->MsiExec.exe /I{07183840-959A-4B0D-8825-2C533F0DDB19}
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office 2003 Web Components-->MsiExec.exe /I{90A4040C-6000-11D3-8CFE-0150048383C9}
Microsoft Office 2007 Primary Interop Assemblies-->MsiExec.exe /X{50120000-1105-0000-0000-0000000FF1CE}
Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office Language Pack 2007 Service Pack 1 (SP1)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {EC50B538-CBE1-42E6-B7FE-87AA540AADFB}
Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Professional Hybrid 2007-->MsiExec.exe /X{91120000-0031-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Small Business Connectivity Components-->MsiExec.exe /X{A939D341-5A04-4E0A-BB55-3E65B386432D}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)-->MsiExec.exe /I{480DBB60-F0B6-45F2-B26F-1A2E11197791}
Microsoft SQL Server 2005-->"c:\Program Files\Microsoft SQL Server\90\Setup Bootstrap\ARPWrapper.exe" /Remove
Microsoft SQL Server Native Client-->MsiExec.exe /I{90283F22-0731-43B6-81FD-E6DD911A31FB}
Microsoft SQL Server VSS Writer-->MsiExec.exe /I{C74B273E-DF20-4955-899B-15205119894C}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951618-v2)-->"C:\WINDOWS\$NtUninstallKB951618-v2$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - FRA\install.exe
MSXML 6.0 Parser (KB933579)-->MsiExec.exe /I{1787603C-E6E3-42D4-8034-55F358486F1D}
Navigation par onglets (Windows Live Toolbar)-->MsiExec.exe /X{C087CD39-A5D9-4F1A-9BC6-3670C54A0912}
PDFCreator Toolbar-->"C:\WINDOWS\PDFCreator_Toolbar_Uninstaller_6718.exe"  _?=C:\Program Files\PDFCreator Toolbar
PDFCreator-->"C:\WINDOWS\PDFCreator_Toolbar_Uninstaller_6718.exe"  -hu  _?=C:\Program Files\PDFCreator Toolbar
Programme de désinstallation hp LaserJet 5100-->C:\Program Files\Hewlett-Packard\LJ5100\Uninstall\unhp.exe ciuninst.ini
Quicktime Browser Plug-In-->C:\WINDOWS\uninst.exe -f"C:\Program Files\Netscape\Navigator\Program\Plugins
pqtw\DeIsL1.isu"
Recover My Files v2.53-->"C:\Program Files\Recover My Files\unins000.exe"
Roxio Creator Audio-->MsiExec.exe /I{83FFCFC7-88C6-41c6-8752-958A45325C82}
Roxio Creator Copy-->MsiExec.exe /I{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}
Roxio Creator Data-->MsiExec.exe /I{0D397393-9B50-4c52-84D5-77E344289F87}
Roxio Creator DE-->MsiExec.exe /I{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}
Roxio Creator Tools-->MsiExec.exe /I{0394CDC8-FABD-4ed8-B104-03393876DFDF}
Roxio Drag-to-Disc-->MsiExec.exe /I{2F4C24E6-CBD4-4AAC-B56F-C9FD44DE5668}
Roxio Express Labeler-->MsiExec.exe /I{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
Roxio Update Manager-->MsiExec.exe /I{30465B6C-B53F-49A1-9EBA-A3F187AD502E}
R-Studio Emergency Startup Media Creator 4.2-->C:\Program Files\R-Studio Emergency\Uninstall.exe
Security Update for 2007 Microsoft Office System (KB951550)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85}
Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
Security Update for 2007 Microsoft Office System (KB955936)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {1D94099C-2BBA-440E-BD5E-093BBDF8F028}
Security Update for Microsoft Office Excel 2007 (KB955470)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {6E8637D8-10D6-4568-AA06-E2706F31685E}
Security Update for Microsoft Office PowerPoint 2007 (KB951338)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {558B709B-821B-4FC5-90FC-9A8890641E77}
Security Update for Microsoft Office Publisher 2007 (KB950114)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {F9C3CDBA-1F00-4D4D-959D-75C9D3ACDD85}
Security Update for Microsoft Office system 2007 (KB951808)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {8F375E11-4FD6-4B89-9E2B-A76D48B51E00}
Security Update for Microsoft Office system 2007 (KB954326)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
Security Update for Microsoft Office Word 2007 (KB950113)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {AD72BABE-C733-4FCF-9674-4314466191B9}
Sonic Activation Module-->MsiExec.exe /I{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}
SuperCopier2-->"C:\Program Files\SuperCopier2\SC2Uninst.exe"
SweetIM For Internet Explorer 3.0b-->MsiExec.exe /X{F6D63A65-BD23-46F3-B9A3-87F442423481}
Symantec Endpoint Protection-->MsiExec.exe /I{FB8A4E30-9915-4814-ADF9-42E00D9FDC3D}
Update for Microsoft Office Excel 2007 Help (KB957242)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {49E314EE-81FA-4007-8F1A-8D39BDBB4498}
Update for Microsoft Office Outlook 2007 (KB952142)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {4AD3A076-427C-491F-A5B7-7D1DE788A756}
Update for Microsoft Office Outlook 2007 Help (KB957246)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {80E46078-C1C5-4AE8-8744-3EAFC812E118}
Update for Office 2007 (KB946691)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
Update for Outlook 2007 Junk Email Filter (kb957829)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {07A1F6B6-4F1C-418C-A605-755A121C4A16}
VideoLAN VLC media player 0.8.6d-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Vimicro USB PC Camera 305-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0700\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{41E496B5-47F4-11D6-9BBB-00E0987BB2CD}\setup.exe" -l0x9 
Vista ScreenSavers-->C:\WINDOWS\UnDeploy.exe "C:\Program Files\Vista ScreenSavers\Deploy.log"
Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
Windows Live Toolbar-->C:\Program Files\Windows Live Toolbar\UnInstall.exe {DE56FE92-9AD5-4DCB-9111-DDDF73EA5E5E}
Windows Live Toolbar-->MsiExec.exe /X{DE56FE92-9AD5-4DCB-9111-DDDF73EA5E5E}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"

======Security center information======

AV: Symantec Endpoint Protection

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\WBEM;c:\Program Files\Microsoft SQL Server\90\Tools\binn\;C:\Program Files\Fichiers communs\Roxio Shared\DLLShared\;C:\PROGRA~1\FICHIE~1\Odbc\FILEMA~1
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 6 Stepping 5, GenuineIntel
"PROCESSOR_REVISION"=0605
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"RoxioCentral"=C:\Program Files\Fichiers communs\Roxio Shared\9.0\Roxio Central33\

-----------------EOF-----------------


*******************

Logfile of random's system information tool 1.04 (written by random/random)
Run by dyndns at 2008-12-06 09:03:50
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 3 GB (8%) free of 40 GB
Total RAM: 1022 MB (50% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:04:31, on 06/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
C:\Documents and Settings\utilisateur.domaine\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\dyndns.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://famous2.topcities.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = google.net-studio.org
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 172.23.1.0:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll
F2 - REG:system.ini: Shell=Explorer.exe logoneui.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1	oolbar.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Vimicro USB PC Camera 305
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AVP] "G:\kaspersky\Kaspersky Lab Tool\setup_7.0.0.180_10.05.2008_16-32.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [firewall 2008] C:\WINDOWS\system32\logoneui.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RESEAU')
O4 - HKUS\S-1-5-21-3000773108-2044865755-3758816984-1110\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-3000773108-2044865755-3758816984-1731\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'utilisateur')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?3cfc080c604349278fa1a4fb7adee1bc
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?3cfc080c604349278fa1a4fb7adee1bc
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.google.com/?gws_rd=ssl
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = domaine
O17 - HKLM\Software\..\Telephony: DomainName = domaine
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = domaine
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: setup_7.0.0.180_10.05.2008_16-32 - Unknown owner - G:\kaspersky\Kaspersky Lab Tool\setup_7.0.0.180_10.05.2008_16-32.exe (file missing)
O23 - Service: Client de gestion Symantec  (SmcService) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
O23 - Service: Symantec Network Access Control (SNAC) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Fichiers communs\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

Utilisateur anonyme · Answer

Salut, pour avancer :


Telecharge UsbFix sur ton bureau

--> Lance l installation avec les parametres par default

Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d avoir été infectés sans les ouvrir

--> Double clic sur le raccourci UsbFix sur ton bureau

-->choisi l option 1 (nettoyage)

--> Le pc va redémarer

-->Apres redémarrage post le rapport UsbFix.txt 

Note : le rapport UsbFix.txt est sauvegardé a la racine du disque
Note : 
"Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. 
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. 
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

Destrio5 · Answer

Je suis d'accord avec Chiquitine.

madsoli · Answer

Rebonjour;
Merci pour vos réponse,mais je n'arrive pas à installer usbfix,on me dit ( Répertoire déstination n'existe pas,voulez vous le créer) et quand g reponds (oui) ,on me dit (répertoire invalide).veulliez me donnez plus de détails SVPMerci d'avance

Utilisateur anonyme · Answer

re

tu laisses bien usbfix s installer dans program files ?

Utilisateur anonyme · Answer

HELLO NOC !! -;)

madsoli · Answer

Rebonjour,
voila maintenant j'arrive à installer usbfix mais le probléme est que le pc ne démarre pas tout seul aprés néttoyage,et qaund g le redémarre moi même ,g ne retrouve pas le fichier usbfix.txt

Utilisateur anonyme · Answer

réouvre hijackthis
fais scan only
coches cette ligne :

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 


tu la coches et tu clic sur fix checked

ensuite rééssai usbfix

madsoli · Answer

Désolée,g désinstallé et réinstallé usbfix et maintenant le pc redémarre tout seul,le seul souci est que je ne retrouve pas le fichier usbfix mais le fichier Changelog UsbFix.txt qui se trouve dans C:\Program Files\UsbFix Je vous le poste au cas oû c le bon fichier Changelog UsbFix établit le 2 decembre 2008 outils créé par Chiquitine29 , aide aux mises a jours -> Chimay8 >>>>>>in "ProgramFiles"<<<<<<<<< Internet Explorer\Connection Wizard\icwconn1 ada Internet Explorer\Connection Wizard\icwconn1 ade Internet Explorer\Connection Wizard\icwconn1 adf Internet Explorer\Connection Wizard\icwconn1 ad5 Internet Explorer\Connection Wizard\icwconn1 ad0 Internet Explorer\Connection Wizard\icwconn1 ad9 Internet Explorer\Connection Wizard\icwconn1 ad4 Internet Explorer\Connection Wizard\icwconn1 ad1 Internet Explorer\Connection Wizard\icwconn1 Movie Maker\explorer.exe Internet Explorer\explorer.exe >>>>>>in "Windows"<<<<<<<<< autorun.inf autorun.exe autorun.vbs autorun.reg autorun.ini autorun.fcb autorun.bat autorun.com AdobeR.exe Alecks.vbs bittorrent.exe cmd32.exe CwbRmDir.bat Fonts\Fonts.exe FS6519.dll.vbs funny.exe GMOGLFEO.exe hiqalowo.inf icapy.scr ilezyvu.bin Lany.vbs lumy.exe manulopa.reg MS32DLL.dll.vbs MyMP3.vbs nar.vbs osok.inf osotilasiq.pif oxafa.com qobo.dat rundll32.vbe sleep.vbe SysRes.vbs takice.lib tusoha.exe unahafiwik.exe waol.exe waziqepehi.ban WillPolo.vbs Win32DLL.vbs win.vbe window.exe wyzeha.com xcopy.exe yjilu.inf ylacupyb.dll RECYCLER\systems.com temp\039.tmp >>>>>>in "Windows\system32"<<<<<<<<< agucuri.vbs ahr.exe Alecks.vbs antinul.vbe amvo.exe amvo0.dll amvo1.dll amvo2.dll autorun.bat Autorun.com autorun.exe autorun.fcb autorun.inf autorun.ini autorun.reg autorun.vbs Autoruns.exe avpo.exe avpo0.dll avpo1.dll Bitkvo.exe Bitkv0.dll Bitkv1.dll cftmonn.exe Christina.jpg Christina.vbs ckvo.exe ckvo0.dll ckvo1.dll ckvo2.dll cradle_of_filth.vbe delself.bat FS6519.dll.vbs GMOGLFEO.exe icf.exe.exe ie.exe jvvo.exe jvvo0.dll jvvo1.dll jvvo2.dll jvvo3.dll j3ewro.exe jwedsfdo0.dll jwedsfdo1.dll jwedsfdo2.dll jwedsfdo3.dll jxnraqjxg.exe kavo.exe kamsoft.exe kav0.dll kav1.dll kav2.dll kav3.dll kavo0.dll kavo1.dll kavo2.dll kavo3.dll kdkfm.exe KEYBOARD.exe keygen.exe kulitut.bat kulitut.vbs kxvo.exe kxvo0.dll kxvo1.dll kxvo2.dll kxvo3.dll lExplore.exe loader.exe logoneui.exe LOVE-LETTER-FOR-YOU.HTM LOVE-LETTER-FOR-YOU.TXT.vbs msfun80.exe msime82.exe MSKernel32.vbs ne0kS.dll.wsf ne0kS.exe OeApi.vbs pubnet.vbs rs32net.exe SemiAntiVirus.vbs Sexy Girls.scr SpiderH.bmp SpiderH.jpeg SpiderH.vbs sys.vbs Syso.vbs SysRes.vbs syx.exe taso.exe tavo.exe tavo0.dll tavo1.dll tavo2.dll tavo3.dll temp1.exe temp2.exe temp?.exe text.txt Ecran.exe THe Girls tmp.reg tmp.txt t.txt vb@dock.vbs vl@dock.vbs Win32.vbs winudp64.exe dllcache\Default.exe >>>>>>in "Windows\system32\drivers"<<<<<<<<< ._Sanaa style-1 les formes.exe 0hct8ybw.exe 1ere partie du projet modifier.exe abdelali lahrach.exe Analyse transactionnelle.exe AutoRun.exe Bernoulli01215.exe" Cahiers français Quels modes de financement pour les entreprises - La Documentation française.exe Copie de Devoir I.exe e-ticket Juba Paris.exe fdfp2.exe fihi ghizlane Rapport de stage.exe graphic.exe intel.exe isew32.exe kheireddine.exe le_cadeau_du_sud(1).exe LEADERSHIP SKILLS FINAL.exe lettre de motivation.exe MSDS.exe Note.exe PREMIER CHAPITRE modifié.exe Raila Odinga.exe Rapport NADIA.exe spectro_masse1.exe td de reacteur.exe these-223.exe xyw9tmdj.exe >>>>>>in "Documents and Settings"<<<<<<<<< tazebama.dl_ hook.dl_ >>>>>>in "appdata"<<<<<<<<< fetomiv.vbs gumugy.vbs jicapikase.vbs mobyhikaja.vbs nebohozi.com orimuwy.exe sidymyvig.vbs tazebama azebama.log tazebama\zPharaoh.dat tazebama >>>>>>in "Temp files"<<<<<<<<< 1.reg 2.dll 6257890.exe fq9.dll help.exe help1.rar inst.exe system.dll w2e.sys winhqqo.exe wintoift.exe xhjb.dll xxx6042.exe zb5ok.dll >>>>>>in "All Drives"<<<<<<<<< ._autorun.inf autorun.inf autorun.ini autorun.reg autorun.bat autorun.vbs autorun2.inf autosys.exe 00hoeav.com 096.bat 0gjn3yw.exe 0qx0sc6.bat 0tmhoc.cmd 0u.cmd 0w.com 0wk2.cmd 108i.cmd 1aq1obb.bat 1bbvq96y.com 1dg.exe 1i.com 1nkbd8h.bat 1rfw8hjr.com 1u0o8bnq.cmd 1weicxa.com 1XXEC.exe 22xo.exe 2ifetri.cmd 2y8la.exe 30ed3.exe 33gmhso.bat 39lpji.com 3o.exe 3wcxx91.cmd 3xXx31.exe 4vzjaw3o.sys 62oop0ak.bat 68.exe 6tkoyhx.cmd 6x8be16.cmd 8e9gmih.bat 8ng8w.com 93vx0c.com 9yqusig.bat 22wcb21o.exe 31n3b2h.exe 39lpji.com 80avp08.com 82r9.cmd 83fgj.com 83l3v.cmd 8df.exe > 8h3hh3m.exe 8tss2gwq.bat 90imhpnc.exe 92j11sm.com 9es.com a1.bat a9.com abk.bat activexdebugger32.exe Administrateur_Fichiers.exe admp.exe adobeR.exe Akon.exe Alecks.vbs antihost.exe antinul.vbe aoutfq.exe ar.exe Atisetup.exe auto.exe autorum.exe AutoRun\Demo.exe autorun.exe autorun.pif autoruns.exe AutoScr.exe ay8p6v3.cmd Ayame.exe b3b9u.com bicsxk03.com bittorrent.exe bndafai.exe bo1dhu.bat bobm.exe boot.exe bootin.exe bplrl98.cmd buis.exe bwpncb6.com bxuup9r.bat c18vk.exe c9.com c9hehpa.bat camp.exe cayfq2.cmd cd8idoyl.com cdr.exe ceb6eu98.bat cekbru.pif clear.bat ClickMe.exe cftmonn.exe cfv90h.com Christina.vbs cjq.exe commands.txt comment.htt copetttt.com copy.exe cradle_of_filth.vbe cqdis.cmd cvqkuk.exe d3bn0j.exe ddyikr.cmd delautorun.bat DFD34719171.bat DFD34719375.bat DFD34719609.bat DFD34723328.bat DFD34723375.bat DFD34723781.bat DFD34724390.bat DFD34719609.bat DFD34724531.bat DFD34724656.bat DFD34725125.bat DFD34725218.bat DFD34726312.bat DFD34724390.bat DFD34726328.bat DFD34729609.bat DFD34730531.bat DFD34730937.bat DFD34734937.bat DFD34739859.bat DFD34741421.bat DFD34741734.bat DFD34741843.bat DFD*.bat dhv2u8.cmd DPFMate.exe dstart.exe dtqlv.exe dynrn6e.cmd e898.com e9ehn1m8.com eb9ehyh.exe Ecran.exe ek.com ekf6dbg0.com ekugb3.bat erdeIect.com esta ig.vbs ev60a2.cmd explorer.exe exqmmle.exe f0.cmd f2ir.com fe.bat ffojc.com fi.cmd FLIPART.EXE folder.exe Folder.htt fooool.exe Form5.exe forSV.exe FS6519.dll.vbs fucker.vbs fun.xls.exe g2p3s.exe g2pfnid.com g83816.com gdmae.bmp Ghost.pif gkyzcijfb.exe GMOGLFEO.exe gqsk.bat graphic.exe gsxlexd.cmd gxlxknou.exe gy.cmd h0s2.bat h2.com hfhludy.exe hgu.bat hni.cmd host.exe hsomklg.exe hxt9.bat i0.cmd i8.cmd ie.exe igxv.cmd ij.bat ilpg9ejd.com info.exe infrom.exe ino6.com install.exe intel.exe intro.exe ipy.cmd iq0ecwcj.cmd lsass.exe itsduel.exe iwjj.com j4c8t8b5l3a6.exe j8q8d.cmd jbfqv8j.cmd jdhc2x2.com jdwx.exe jfjsipw.exe jfvkcsy.bat jiwsxh39.exe JJJ.exe Jojo.exe jwwgtuh.exe jxnraqjxg.exe jxpiinstall.exe k6wkwon2.exe ka1nk.bat kaq86asx.bat kayira.bat kbqbptn.exe kdkfm.exe kdy.cmd kfmyoc.pif khbph.exe killVBS.vbs kk3.bat KM.exe kmd.exe kn6jhgc.cmd kqnns.exe kqsr.exe krg62.cmd kulitut.bat kulitut.vbs kxax.cmd l2f.cmd l9dwu8.bat lExplore.exe lgcadwx.bat lgrncie.bat lky.exe ln9.exe lo.exe loader.exe logoneui.exe Long.exe LOVE.PIF ltljrg.exe lumy.exe lurjlnps.exe lvxvo1xg.cmd m1t8ta.com m9j.com mail.exe manulopa.reg mcxa.exe Menu.exe mgjpcfdg.cm mnl6on3.com mp.bat mp.cmd mp.com Movie1.exe mrsne.bat MS-DOS.com MS32DLL.dll.vbs MSd040.vbs MSdC64.vbs MSdFB7.vbs MSd141.vbs MSd191.vbs MSd49A.vbs MSdE78.vbs MSd*.vbs mshta.exe MSKernel32.vbs muniu.exe MyMP3.vbs n1detect.com n2de.cmd n6j.com n6j6pc0.com n6t1h.cmd nansy ajram.vbs nar.vbs ne0kS.exe nemesis.exe nemesis.inf nfdmg.com nideiect.com niu.exe njibyekk.com nl.com nncu6kk.com NoLimit.exe np.exe nq0cq.cmd nqvarn.pif nriljal.exe ntde1ect.com ntdelect.com nq.bat nq0cq.cmd nqgcd.com nsv.bat nw0t1l0d.exe o2yf0w.bat o9o2u.bat o6opnro.bat OeApi.vbs oegbi.exe ogcikeq.com oka3yrf.bat oq.cmd oskkofa.exe osotilasiq.pif osy3.sys otyh.cmd oufddh.exe oxafa.com p3r1ud.exe p83gjy.exe p9.exe pa39xth.cmd pagefile.pif pbwkwj.com pefbutr.exe pkxfkrki.bat ph.com phgr1j.bat phim_nguoi_lon.exe pnc.exe prhyper.exe psqrhqn.exe pxka.exe q3v.com q83iwmgf.bat q8sywiva.cmd qcwpung.exe qd.cmd qjfl.exe qkarc.exe qquq.bat qqzjnhuoi.exe qpe6.com qobo.dat qrkugxtw.exe qxbx9blb.com r1y1.bat r2nl.com r6r.exe r813.bat Raila Odinga.exe Raila Odinga.gif ranvrgn.exe ravmon.exe ravmon.log ReadMe.exe RecInfo\RecInfo.exe Recycle.exe Recycled\ctfmon.exe RECYCLED\INFO.exe Recycled.exe RECYCLER\Lock Folder.exe RECYCLER\RECYCLER.exe RECYCLER\*.exe regxpcom.exe resycled\boot.com resycled\ctfmon.exe revo.exe rggbw.exe rjiybg.exe rn.exe rombkaewl.exe rosftpm.exe rqq2v.bat rs.cmd rt.exe Run.exe runaut~1\autorun.pif RunDll32.exe rxukgcm.exe s38k.exe sal.xls.exe sasyg1y8.com script.bat scriptlo.txt scvhosts.exe sdcvhost.exe SemiAntiVirus.vbs smkjd.cmd smss.exe semo2x.exe spq.bat serivces.exe server.exe server.inf Sex City.jpg.wsf sowar.vbs SpiderH.vbs sq.com sqlserv.exe SSVICHOSST.exe stwi.com svch0st.exe scvhosts.exe svdioajm.cmd sxs.exe sydp.exe sys.vbs Syso.vbs SysRes.vbs system.exe system32.exe systems.com systems.exe t82e2v.cmd TAE7ESLP.exe taipingtianguov1.1.exe takice.lib tel.xls.exe temp.bat temp.exe temp.temp temp1.exe temp2.exe test.exe testfile.bat testflo.bat tfk8.exe The_Cars.vbs THe Girls tknapl.exe tknn6.bat tmf3w3g0.com TMMDW8LP.exe Toy.exe tusoha.exe tyktjfww.exe u18vxqle.com u6k.cmd u9dyi.exe udnnnvq.exe UFO.exe ufuaugwq.exe uis.com uis.exe um.cmd un9.cmd unahafiwik.exe UnplugDrive.exe uorys.cmd update.exe uqhqx1.cmd usdeiect.com userinit.exe utdetect.com uxdeiect.com u?de?ect.com v2h3.exe v3pif.bat VB6FR.DLL vb@dock.vbs vfpkkbq.exe vksucydrh.exe vl@dock.vbs vmhr.bat vmyphd.bat vva0hc0p.cmd vxl.exe w0o.com w0owgn.bat w32sys.exe w3dn9f.bat waziqepehi.ban wa6.vbs Wallpaper.vbs WallpaperMEHDI.vbs wfhth.exe whi.com WillPolo.vbs WINDOWS.EXE Windows.scr winfile.exe winglogon.exe winrun.vbs winstall.exe wjlfhtfm.cmd wol.exe wsctf.exe wtbcccq.exe x0.cmd XAdeIect.com xcopy.exe xfoolavp.com xih9.cmd xj.bat xk2n.bat xlk9.com xlu8a8sy.exe xmnm2.cmd xn1i9x.com xnynrnh.exe xo8wr9.exe xp19.com xpbkh.com xqf.com xvlyb.exe xyhav.pif y82td3td.com ybj8df.exe yew.bat yg.cmd yjilu.inf ylacupyb.dl ylr.exe yjkjfuo.cmd yjvmtaa.exe ynfs9ks.cmd yssjnngm.cmd yvmkdwn.exe zPharaoh.exe 0.cmd 1.cmd 2.cmd 3.cmd 4.cmd 5.cmd 6.cmd 7.cmd 8.cmd 9.cmd 0.bat 1.bat 2.bat 3.bat 4.bat 5.bat 6.bat 7.bat 8.bat 9.bat 0.exe 1.exe 2.exe 3.exe 4.exe 5.exe 6.exe 7.exe 8.exe 9.exe 0.com 1.com 2.com 3.com 4.com 5.com 6.com 7.com 8.com 9.com 0.vbs 1.vbs 2.vbs 3.vbs 4.vbs 5.vbs 6.vbs 7.vbs 8.vbs 9.vbs a.com b.com c.com d.com e.com f.com g.com h.com i.com j.com k.com l.com m.com n.com o.com p.com q.com r.com s.com t.com u.com v.com w.com x.com y.com z.com a.bat b.bat c.bat d.bat e.bat f.bat g.bat h.bat i.bat j.bat k.bat l.bat m.bat n.bat o.bat p.bat q.bat r.bat s.bat t.bat u.bat v.bat w.bat x.bat y.bat z.bat a.cmd b.cmd c.cmd d.cmd e.cmd f.cmd g.cmd h.cmd i.cmd j.cmd k.cmd l.cmd m.cmd n.cmd o.cmd p.cmd q.cmd r.cmd s.cmd t.cmd u.cmd v.cmd w.cmd x.cmd y.cmd z.cmd a.exe b.exe c.exe d.exe e.exe f.exe g.exe h.exe i.exe j.exe k.exe l.exe m.exe n.exe o.exe p.exe q.exe r.exe s.exe t.exe u.exe v.exe w.exe x.exe y.exe z.exe a.vbs b.vbs c.vbs d.vbs e.vbs f.vbs g.vbs h.vbs i.vbs j.vbs k.vbs l.vbs m.vbs n.vbs o.vbs p.vbs q.vbs r.vbs s.vbs t.vbs u.vbs v.vbs w.vbs x.vbs y.vbs z.vbs *.dll.vbs >>Dossiers : AutoRun autorun.inf fsc.tmp RecInfo Recycled\Recycled Recycler\Recycler resycled runaut~1 sdlflzoip >>>>>>"Registry"<<<<<<<<< [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Window Title"=- "Start Page"=- "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN] "Start Page"="https://www.msn.com/fr-fr" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "fucker"=- "SysDir"=- "ms32dll"=- "cftmonn"=- "Lany"=- "Zip"=- "RavAV"=- "cmd32"=- "Install.exe"=- "FIXEDFON.FON"=- "MS-RAD0"=- "MS-RAD1"=- "MS-RAD2"=- "MS-RAD3"=- "MS-RAD4"=- "MS-RAD5"=- "MS-RAD6"=- "MS-RAD7"=- "MS-RAD8"=- "MS-RAD9"=- "MS-RADA"=- "MS-RADB"=- "MS-RADC"=- "MS-RADD"=- "MS-RADE"=- "MS-RADF"=- "MS-RADG"=- "MS-RADH"=- "MS-RADI"=- "MS-RADJ"=- "MS-RADK"=- "MS-RADL"=- "MS-RADM"=- "MS-RADN"=- "MS-RADO"=- "MS-RADP"=- "MS-RADQ"=- "MS-RADR"=- "MS-RADS"=- "MS-RADT"=- "MS-RADU"=- "MS-RADV"=- "MS-RADW"=- "MS-RADX"=- "MS-RADY"=- "MS-RADZ"=- " "=- "winrun.dll"=- "loader.exe"=- "recinfo49"=- "System"=- "System Updater Machine"=- "SpiderH"=- "winudp64.exe"=- "System12"=- "System64"=- "IMJPMIG8.2"=- "CARPService"=- "039.tmp"=- "userd"=- "nar"=- "MSKernel32"=- "WillPolo"=- "MyMP3"=- "FS6519"=- "Windows\SysRes.vbs"=- "SysRes"=- "Raila Odinga"=- "reginit"=- "lnternet Update"=- "GMOGLFEO"=- "WintelUpdate"=- "Pubnet"=- "antihost"=- [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices] "System Updater Machine"=- "Win32DLL"=- "lnternet Update"=- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] " "=- [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RavAV] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "kamsoft"=- "amva"=- "kava"=- "tava"=- "avpa"=- "internet_explorer"=- "anti-virus 2007"=- "Mp3 player"=- "kxvo"=- "EXPLORER.EXE"=- "wsctf.exe"=- "loader.exe"=- "jvvo"=- "taso"=- "Avg_AntiHost"=- "jvsoft"=- "tasoft"=- "SpiderH"=- "MsServer"=- "MSFox"=- "msn"=- "????r"=- "Windows Update"=- "Microsoft Debug Manager"=- "protect_autorun"=- "Le Petit Robert Hyperappel"=- "firewall 2008"=- " "=- [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce] " "=- [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] "test"=- "Msn"=- "MsnHost"=- "MsnLoad"=- "MsnConvert"=- "MsnMessendger"=- "sys"=- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "DefaultUserName"=- "LegalNoticeCaption"=- "LegalNoticeText"=- [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop\NoChangingWallPaper] ------------------------------------------------------------------------------------------------------------- Mises a jours du 5 decembre 2008 >>>>>>in "All Drives"<<<<<<<<< 6xdgw26.com 6xig.com 8386nac.com 8e.com 8u.com 8uot.exe arun.exe asneg.com bpu.exe br1e.com cdwfql2v.com ceqfqp.bat cm0.com d1y36.com dh66ln.cmd dpu1.exe dyr2j6mv.exe ermvu8.cmd fblfnthuh.exe fn20.exe fufb6tq3.cmd g2o1n.exe gx.com h3hi1k3.exe i8.com ivcvknr.bat jv.exe kernel32.dll.vbs kg2v.com klp8j6i.com ktnquo.exe l1.cmd lp3c.bat m0g8sqx.cmd m6dqm2vd.exe m8wafly.com m9as2c.cmd MicrosoftPowerPoint.exe MSd30D.vbs msnmsgr_plus.exe ncyrf.bat ntdeIect.com ntnq.exe ntphyy.com NTsys.exe o6pq1n8.com okhr.exe ous.exe ox.cmd p1f6b.exe program.exe qeoc6sj.exe qwultj1.bat rcukd.cmd rdsfk.com rjx0.exe rqb0v2ot.bat scene.exe Server082.exe tigi.cmd uh31.exe uwlmj.com uxkktr.cmd vd91t29.exe w2qagd.com welcome.exe WindowsXP.exe winsys3.exe ypjq1.cmd .MGT_reg32.dll.vbs achitasin.dll.vbs autoupdate.dll.vbs bat32.txt happy.vbs ie.vbs killgodzilla.vbs maskrider.dll.vbs maskrider2001.vbs msiexec.dll.vbs MsUpdate.sys.vbs nohack.vbs RUNDLL64.dll.vbs setup.dll.vbs VBRuntime32.dll.vbs viva.dll.vbs Win32.dll.vbs winconfig.dll.vbs xepet.html xepet.txt >>>>>>in "Windows"<<<<<<<<< .MGT_reg32.dll.vbs achitasin.dll.vbs autoupdate.dll.vbs bat32.txt boot.ini happy.vbs ie.vbs killgodzilla.vbs maskrider.dll.vbs maskrider2001.vbs msiexec.dll.vbs MsUpdate.sys.vbs nohack.vbs RUNDLL64.dll.vbs setup.dll.vbs VBRuntime32.dll.vbs viva.dll.vbs Win32.dll.vbs winconfig.dll.vbs xepet.html xepet.txt >>>>>>in "Windows\system32"<<<<<<<<< gasretyw0.dll gasretyw1.dll gasretyw2.dll gasretyw3.dll DC4491.DLL >>>>>>"Registry"<<<<<<<<< [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Winboot"=- [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "UC"=- "r4n694-24y"=- "kernel32"=- "MSConfigs"=- "Microsoft"=- "MGT_reg"=- "Winboot"=- "Winamp"=- "Macromedia"=- "WINFIX"=- "winconfig"=- "Achitasin"=- "mcafee"=- "wscript32dll"=- "Batch32"=- "maskrider"=- "autoupdate"=- "KILLMS32DLL"=- "WinExpress"=- "WinDebugger"=- "C:\WINDOWS\system32\kdyul.exe"=-

Destrio5 · Answer

C'est le changelog d'UsbFix ^^

madsoli · Answer

oui c bien ça,c le bon alors ?

Destrio5 · Answer

Non, ce n'est pas le bon.

madsoli · Answer

malheuresement c'est tout ce que g comme fichier text consernant usbfix,pouvez vous me donner le nom exacte de ce fichier pour faire une recherche dans mon pc,Merci

Destrio5 · Answer

---> Supprime le dossier RSIT situé dans C:\

---> Refais un scan RSIT et poste les deux rapports.

madsoli · Answer

Svp,pouvez vous me donner plus de pécision pour retrouver ce fichier

Destrio5 · Answer

Quel fichier ?

madsoli · Answer

Voila les 2 fichiers
Logfile of random's system information tool 1.04 (written by random/random)
Run by dyndns at 2008-12-06 17:06:28
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 3 GB (8%) free of 40 GB
Total RAM: 1022 MB (54% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:06:36, on 06/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
C:\WINDOWS\system32\logoneui.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\logoneui.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\logoneui.exe
C:\logoneui.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\System32\NOTEPAD.EXE
G:\logoneui.exe
H:\New Folder.exe
G:\logoneui.exe
C:\Documents and Settings\dyndns.domaine\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\dyndns.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://famous2.topcities.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = google.net-studio.org
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 172.23.1.0:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll
F2 - REG:system.ini: Shell=Explorer.exe logoneui.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1	oolbar.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Vimicro USB PC Camera 305
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AVP] "G:\kaspersky\Kaspersky Lab Tool\setup_7.0.0.180_10.05.2008_16-32.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [firewall 2008] C:\WINDOWS\system32\logoneui.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Yahoo Messengger] C:\WINDOWS\system32\SSVICHOSST.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RESEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?3cfc080c604349278fa1a4fb7adee1bc
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?3cfc080c604349278fa1a4fb7adee1bc
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.google.com/?gws_rd=ssl
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = domaine
O17 - HKLM\Software\..\Telephony: DomainName = domaine
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = domaine
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: setup_7.0.0.180_10.05.2008_16-32 - Unknown owner - G:\kaspersky\Kaspersky Lab Tool\setup_7.0.0.180_10.05.2008_16-32.exe (file missing)
O23 - Service: Client de gestion Symantec  (SmcService) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
O23 - Service: Symantec Network Access Control (SNAC) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Fichiers communs\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

Destrio5 · Answer

Fais la manip' UsbFix sans brancher de clé USB.

madsoli · Answer

Re;
usbfix ne marche pas sans les usb,quand g clique dessus rien ne se passe,mais quand g branche les usb ça s'éxécute

Destrio5 · Answer

---> Branche tes sources de données externes à ton PC (clé USB, disque dur externe, etc...) sans les ouvrir.

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau :
http://oldtimer.geekstogo.com/OTMoveIt3.exe

---> Double-clique sur OTMoveIt3.exe afin de le lancer.

---> Copie (Ctrl+C) le texte suivant ci-dessous : 





:processes
explorer.exe 

:services
setup_7.0.0.180_10.05.2008_16-32

:files 
C:\WINDOWS\system32\logoneui.exe 
C:\logoneui.exe
H:\logoneui.exe
G:\logoneui.exe 
D:\logoneui.exe  
E:\logoneui.exe
C:\WINDOWS\system32\SSVICHOSST.exe  
C:\WINDOWS\SSVICHOSST.exe 
C:\WINDOWS\system32\autorun.ini 
C:\Jojo.exe
C:\info.bat  

:reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{197dd0bb-3aa1-11dc-84a2-806d6172696f}]  
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3cc886b2-c2b5-11dd-8e65-0019b93afaaf}]  
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b449e148-c085-11dd-abca-0019b93afaaf}]  
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b71c9b82-3ab1-11dc-af79-0019b93afaaf}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b71c9b83-3ab1-11dc-af79-0019b93afaaf}] 

:commands
[purity]
[emptytemp]
[start explorer]
[reboot]





---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log

madsoli · Answer

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
Service setup_7.0.0.180_10.05.2008_16-32 stopped successfully.
Service setup_7.0.0.180_10.05.2008_16-32 deleted successfully.
========== FILES ==========
C:\WINDOWS\system32\logoneui.exe moved successfully.
C:\logoneui.exe moved successfully.
File move failed. H:\logoneui.exe scheduled to be moved on reboot.
File move failed. G:\logoneui.exe scheduled to be moved on reboot.
File move failed. D:\logoneui.exe scheduled to be moved on reboot.
File move failed. E:\logoneui.exe scheduled to be moved on reboot.
C:\WINDOWS\system32\SSVICHOSST.exe moved successfully.
C:\WINDOWS\SSVICHOSST.exe moved successfully.
C:\WINDOWS\system32\autorun.ini moved successfully.
C:\Jojo.exe moved successfully.
C:\info.bat moved successfully.
========== REGISTRY ==========
Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{197dd0bb-3aa1-11dc-84a2-806d6172696f}\ deleted successfully.
Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3cc886b2-c2b5-11dd-8e65-0019b93afaaf}\ deleted successfully.
Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b449e148-c085-11dd-abca-0019b93afaaf}\ deleted successfully.
Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b71c9b82-3ab1-11dc-af79-0019b93afaaf}\ deleted successfully.
Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b71c9b83-3ab1-11dc-af79-0019b93afaaf}\ deleted successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\user~1.MUD\LOCALS~1\Temp\21.tmp\b2e.exe scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\user~1.MUD\LOCALS~1\Temp\13.tmp\b2e.exe scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS	emp\Perflib_Perfdata_56c.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Temp folders emptied.
Explorer started successfully
 
OTMoveIt3 by OldTimer - Version 1.0.7.2 log created on 12062008_174421

Files moved on Reboot...
H:\logoneui.exe moved successfully.
G:\logoneui.exe moved successfully.
D:\logoneui.exe moved successfully.
E:\logoneui.exe moved successfully.
C:\DOCUME~1\user~1.MUD\LOCALS~1\Temp\21.tmp\b2e.exe moved successfully.
C:\DOCUME~1\user~1.MUD\LOCALS~1\Temp\13.tmp\b2e.exe moved successfully.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
C:\WINDOWS	emp\Perflib_Perfdata_56c.dat moved successfully.

Destrio5 · Answer

---> Désinstalle UsbFix puis réinstalle-le.

---> Refais la manip' avec UsbFix.

madsoli · Answer

Je tiens à vous signaler aussi que maintenant g un méssage d'érreur qui apparait au démarrage me disant que windows ne trouve pas 'logoneui.Merci encore pour votre aide

Destrio5 · Answer

Oui, c'est normal.

madsoli · Answer

merci beaucoup pour votre aide,maintenant quand g clique sur mes disques locaux g la fenêtre Ouvrir avec qui s'affiche.

Destrio5 · Answer

---> Télécharge SDFix (créé par AndyManchesta) sur ton Bureau :
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
- Double-clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. 
- Redémarre ton ordinateur en mode sans échec.

---> Pour redémarrer en mode sans échec :
- Redémarre ton PC.
- Au démarrage, tapote sur F8 (F5 sur certains PC) juste après l'affichage du BIOS et juste avant le chargement de Windows.
- Dans le menu d'options avancées, choisis Mode sans échec.
- Choisis ton compte.

---> Déroule la liste des instructions ci-dessous :
- Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double-clique sur RunThis.bat pour lancer le script.
- Appuie sur Y pour commencer le processus de nettoyage.
- Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
- Appuie sur une touche pour redémarrer le PC.
- Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
- Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
- Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
- Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
- Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse.

madsoli · Answer

Désolée je doix sortir alors Si vous voulez bien continuer à m'aider ,on se donne RDV demain ;Encore mille Merci,vous êtes un ange !!!!!!!!!! et bonne soirée

Destrio5 · Answer

Ok, à demain.

madsoli · Answer

Bonjour;
 voila g fais ce que vous m'avez demandé et le rapport est le suivant:

[b]SDFix: Version 1.240 [/b]
Run by Administrateur on 06/12/2008 at 18:18

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

Trojan Files Found:

C:\autorun.inf - Deleted





Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-07 07:17:26
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\FileMaker\FileMaker Pro 6 Essai\Modeles\(ducation\"=""
"C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - )tudes DVD\"=""
"C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - )tudes DVD\EDICT\"=""
"C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - )tudes DVD\Pushpins\"=""
"C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - )tudes DVD\Tasks\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - )tudes DVD\GEOCOMP.DLL"=dword:00000001
"C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - )tudes DVD\MOBB200.DLL"=dword:00000001
"C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - )tudes DVD\QMLISTUI.DLL"=dword:00000001
"C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - )tudes DVD\ENCARTA.EXE"=dword:00000001
"C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - )tudes DVD\ENCARTAU.DLL"=dword:00000001
"C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - )tudes DVD\ENCARTAR.DLL"=dword:00000001
"C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - )tudes DVD\ENCSPLSH.DLL"=dword:00000001
"C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - )tudes DVD\EDICT.EXE"=dword:00000001
"C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - )tudes DVD\ENCSET.EXE"=dword:00000001
"C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - )tudes DVD\EDICTRES.DLL"=dword:00000001
"C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - )tudes DVD\CONTENTUPDATEDOWNLOADER.EXE"=dword:00000001
"C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - )tudes DVD\ESBSI.EXE"=dword:00000001
"C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - )tudes DVD\MICROSOFT.ENCARTA.UTILITY.DLL"=dword:00000001
"C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - )tudes DVD\MICROSOFT.ENCARTA.BTREE.DLL"=dword:00000001
"C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - )tudes DVD\MICROSOFT.ENCARTA.SEARCH.DLL"=dword:00000001
"C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - )tudes DVD\MICROSOFT.ENCARTA.FGSEARCH.DLL"=dword:00000001
"C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - )tudes DVD\MICROSOFT.ENCARTA.QUICKMATCHINTEROP.DLL"=dword:00000001
"C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - )tudes DVD\MSSPELL3.DLL"=dword:00000001
"C:\Program Files\Microsoft Etudes\Microsoft Encarta 2008 - )tudes DVD\CUSTSAT.DLL"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Reporting\EventCache\Sus]
"FlushCacheFiles"=str(7):"d\2\xebb8\1\x382\xdd84\xffc8\xffffv \x90\0\xdb100\1\0\1\0\x3330EAB5948D920\x3044FC\x3344\xfff0\xffffLocal\0\xffe8\xffff°N&#1611;O O\xffff\xffff\xffff\2\0\0\0\0\0\0\0\0\0\b\0G\x2d4fLs¨\xffffn \x215cG&#1570;&#1577;\0\0\xe8580\0\0\0\0\xffff\xffff\xffff\xffff\t\0\xea600\xffff\xffff\0\0\0\0\32\0006\0\32\0\1\0000E\1\0\xffd8\xffffv\f\4DsbeSt\xffe0\xffffv\0056\0\xe9780\1\0\1gGODp\xffc0\xffffStratégie de groupe locale\0\0v\3\xffe0\xffffv\6\2.\xffd8\xffff\x28b0.\xec280\xe9080\xe9300\xdd58.\xe9580\xe9d80\xe9f80\xe9b80¨\xffffn \x215cG&#1570;&#1577;\0\0\xe8580\0\0\0\0\xffff\xffff\xffff\xffff\t\0ˆX\xffff\xffff\0\0\0\0\32\0\0\4v\0N\0&#1705;E\1\0\0s\xfff8\xffff\xdae00\xffe8\xffffl\2\xe0d80&#1600;t\xe0200ü¶\xfff0\xffffREG_SZ\xffe8\xffffv\0\32\0&#1729;1\1\0\0c\xfff8\xffff\xe4380\xffd8\xffffv\17&#1616;\0\xe7b00\a\0\10FuhahFls\xfff8\xffff\xdd280\xfff0\xffff10\00ü¶\xffe8\xffffv\0N\0\xe2100\1\0\0o\xfff0\xffffREG_SZ\xffe0\xffffv\6X\0\xf4380\1\0\1KGo\x3070K\xffd8\xffffv\r\2\0\0-\0\x2d53\x2d31\x2d352\x312d1\x30369\x3031\x312d3\x333388\x2d38\x3231\x3230602\x312d\x32313\0 \xffffn p<&#1570;&#1577;\0\0\xec580\0\0\0\0\xffff\xffff\xffff\xffff\t\0\xef880\xffff\xffff\0\0\0\0\f\0\0\1\0\17\0Gopebrhp\xffe0\xffffv\6Z\0\xed580\1\0\1)Go\x3070\xf69e \xffffS-1-5-21-117609710-1383384898-1202660629-513\0\6\xffe0\xffffv\6\20\0p0\1\0\1KGopK\xffe0\xffffv\6\32\0\xedf80\1\0\1\0Go\x3270\0\xffe0\xffffS-1-5-32-544\0000\xffe0\xffffv\6\32\0\xee380\1\0\0014Go\x3370-\xffe0\xffffS-1-5-32-545\0\0\xffe8\xffffS-1-2-0\0\xf1d8J\xffe0\xffffv\6\20\0\xdfe80\1\0\1JGop\xffff\xffe0\xffffv\6\22\0\xeeb00\1\0\1KGop\0\xffe8\xffffS-1-5-11\0\xffff\xffe0\xffffv\5\41-117609710-1383384898-1202660629-1396\0\xffd8\xffff\xed380\xedb80\xedd80\xee180\xee700\xee900\xeee80\xef080\xeec80\xfff0\xffffl\1\xecd80&#1612;‰\xffe0\xffffv\6X\0\xf1000\1\0\1\x85Go\x3070\x85\xffe0\xffffv\6\20\0\xf1600\1\0\1\0Gop\x85hi\xf0000\0\0\0\0\0\xff80\xffffn p<&#1570;&#1577;\0\0&#1705;0\1\0\0\0\xf1780\xffff\xffff\0\0\xffff\xffff\xffff\xffff\36\0\0\0\0\0\0\0B\0,\0\x2d53\x2d31\x2d352\x322d\x3230522\x2d352179\x2d37\x33389\x32321\x2d35\x3031\x3330an \xffffn p<&#1570;&#1577;\0\0\xf0200\0\0\0\0\xffff\xffff\xffff\xffff\b\0\xf2f00\xffff\xffff\0\0\0\0\f\0X\0\0\0\17\0Gopebrhp \xffffS-1-5-21-2025429265-261478967-839522115-513\00004\xffe8\xffffS-1-1-0\0ˆ\x85\xfff0\xffffl\1\xf0a00&#1612;‰\xffe0\xffffv\6\32\0\xf1a80\1\0\1\x85Go\x3270\xffff\xffe0\xffffS-1-5-32-544\0\0\xffe0\xffffv\6\32\0\xf1e80\1\0\1­Go\x3370\0\xffe0\xffffS-1-5-32-545\0m\xffe8\xffffS-1-2-0\0io\xffe0\xffffv\6\20\0\xf2400\1\0\1nGopr\xffe8\xffffS-1-5-4\0™&#1575;\xffe0\xffffv\6\22\0\xf2780\1\0\1\xffffGop\x85\xffe8\xffffS-1-5-11\0\0\xffe0\xffffv\6\20\0\xf4980\1\0\1\0Gop\0\xffe0\xffffv\6\20\0\xf2080\1\0\1\0Gopb\xffe0\xffffv\5\4+\0\x2d53\x2d31\x2d352\x322d\x3230522\x2d352179\x2d37\x33389\x32321\x2d35\x30350\0\0\xffe0\xffffv\6Z\0h\1\0\1)Go\x3070I\xffe0\xffffv\6\20\0pU\1\0\1MGop‡ \xffffn p<&#1570;&#1577;\0\0\xf3180\0\0\0\0\xffff\xffff\xffff\xffff\b\0\xf6280\xffff\xffff\0\0\0\0\f\0X\0\0\0\17\0Gopebrhp \xffffS-1-5-21-2025429265-261478967-839522115-513\0\0\0\xffe8\xffffS-1-1-0\0\0\0\xfff0\xffffl\1\xf3d80&#1612;‰\xffe0\xffffv\6\32\0\xf4e00\1\0\1\0Go\x3270\0\xffe0\xffffS-1-5-32-544\0\0\xffe0\xffffv\6\32\0\xf5200\1\0\1\0Go\x3370\0\xffe0\xffffS-1-5-32-545\0\0\xffe8\xffffS-1-2-0\0\x1a90K\xffe0\xffffv\6\20\0\xf5780\1\0\1\0Gop\0\xffe8\xffffS-1-5-4\0\0\0\xffe0\xffffv\6\22\0\xf5b00\1\0\1\0Gop\0\xffe8\xffffS-1-5-11\0\0\xfff0\xffffl\1\xddd0\2ˆô\xfff0\xffff&#1576;U&#1584;U0\0\xffe0\xffffv\6\20\0\xf5400\1\0\1\0Gop\0\xffe0\xffffv\5\4-00C04F79DBC0}\0002-9 \xffffn &#1688;\x321aé&#1576;\0\00\0\0\0\0\xffff\xffff\xffff\xffff\1\0(18^°0\0\0\0\0\0\0\4\0te\n\fNmehd-mu\xffe8\xffffv\0(\0\x2a301\1\0\0=\xffe8\xffffl\2\xfa600&#1600;t\xf8400ü¶\xfff0\xffffREG_SZ\xfff8\xffffH0\xfff0\xffff€UàUin\xfff0\xffffLocal\0\xff88\xffffn R\x321cé&#1576;\0\0ˆm\2\0\0\0\xf7780\xffff\xffff\1\0ˆ18^\xf8d80 \0\f\0\0\0(\0og&\f{E\x3331E\x2d33A7-D\x2d3995\x302dE\x323862A7B \xffffn &#1688;\x321aé&#1576;\0\0\xf7c80\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xf8b008^\xfdd80\0\0\0\0\0\0N\0ac\20\fPoytbli\x3233\xfff0\xffffREG_SZ\xfff8\xffff\x2ec01\xffe0\xffffv\5N\0`T\1\0\10ApDe\xfff0\xffffREG_SZ\xffe8\xffffv\0N\0\xf6a80\1\0\0d\xfff8\xffff\xf8e80\xfff8\xffff\x2ad01 \xffffn &#1688;\x321aé&#1576;\0\00\0\0\0\0\xffff\xffff\xffff\xffff\1\0tbli\x3233\xfff0\xffff\x1b40£\x1ca0£\xf1a8l\xfff0\xffffREG_SZ\xfff0\xffffl\1\x215810\0\xffe0\xffffv\a\4470-00C04F79DBC0}\0{53 \xffffn R\x321cé&#1576;\0\0\xf7c80\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x261818^\x2a601\0\0\0\0\0\0\4\0[{\n\fNmehdE-6\xffe8\xffffv\0\4\0000D&\f{\x304334\x2d450D-D\x2d4193\x302d\x3236\x3333ADD5E \xffffn R\x321cé&#1576;\0\0\xfad80\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x2a7018^\xf8a00\0\0\0\0\0\0N\0D6\20\fPoytbli\x3233\xfff0\xffff&#1591;i ixi\xffe8\xffffv\0N\0&#1591;0\1\0\0F¨\xffff{1DCB3A00-33ED-11D3-8470-00C04F79DBC0}\0\0X\35\xffe8\xffffv\0\32\0\x24782\1\0\0\xffe8\xffffv\0\2\xffffv\0D\0\x2b28H\2\0\00\xfff8\xffff&#1576;0\xff88\xffffn &#1688;\x321aé&#1576;\0\0ˆm\2\0\0\0&#1729;0\xffff\xffff\1\0\xa5818^€0 \0\f\0\0\0\30\0\1\0&\f{836\x2d44EE-6\x2d39B\x3342-DF\x3236751b\xffd8\xffffv\t0\0à0\1\0\1\x85St-ae\0{E\xfff0\xffffREG_SZ\xffe8\xffffl\2\xf7000&#1600;t0ü¶\xfff0\xffffREG_SZ\xfff0\xffff&#1711;c&#1591;cPc\xfff8\xffff¨1¨\xffffn \xff03S&#1570;&#1577;\0\0&#1705;0\27\0\0\0\xd948“\xffff\xffff\0\0\xffff\xffff\xffff\xffff\0\0\0\0\0\0\00\0\5\0Sa\x2865\x85¨\xffffn &#1608;A&#1570;&#1577;\0\0\xfe000\4\0\0\0\x7081\xffff\xffff\b\01\xffff\xffff\34\0\0\0,\0\x82\0\xffff\xffff\a\0Mcie\xffd0\xffffv\26\4v\b\4NxRfehoe\xffd0\xffffv\21\4\xffff\xffff\xffff\6\0\x2d01\xffff\xffff\0\0\0\0\32\0\4\0\1\0&\0\x307b\x3030\x3030\x3030\x2d30\x3030\x3030\x302d\x3030\x2d30\x3030\x3030\x302d\x3030\x3030\x3030\x3030\x30300\0\xffd8\xffffv\v\4\0\0\xffd8\xffffv\t\4\Symantec\Symantec Endpoint Protection\IMailUI.ocx\0B8B\xfff8\xffffp1\xffd8\xffffv\f\4\x5a81\xffe8\xffffv\0N\0 X\1\0\0s\xffe0\xffffstHost Class\01\xfff8\xffff\x25a01\xffe8\xffffv\0N\0 e\1\0\0\0\xfff0\xffff w&#1584;w\0\0\xfff0\xffffl\1\xf701\xee90&#1662;\xffc8\xffffv R\0°1\1\0\1S\x3330EAB5948D920\x3044FC\x3344\xffe8\xffffv\0 \0&#1576;@\1\0\0a\xfff8\xffff\x5581\xffe0\xffffv\6\2o\b\0\x6101\xffe8\xffffv\0N\0@a\1\0\0e\xffe0\xffffv\a\4\0&#1587;)x\xbe\x868p\xff90\xffffn \x85a&#1657;&#1570;&#1577;\0\0h2\0\0\0\0\xffff\xffff\xffff\xffff\1\0à1&#1591;\xffff\xffff\0\0\0\0@\0\x88\0Sy \03E9\x3235E5DDCB226A46\xff90\xffffn ¼™&#1570;&#1577;\0\0h2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x5a01&#1591;\xffff\xffff\0\0\0\0@\0p\0a  \04\x3035\x32337\x3344FB640B5\x304681\x3333\xffe8\xffffv\0Z\0^\1\0\0\xfff0\xffff7A0\x32354CC\x333467A04\xff90\xffffn D×&#1570;&#1577;\0\0h2\0\0\0\0\xffff\xffff\xffff\xffff\1\0à2&#1591;\xffff\xffff\0\0\0\0@\0|\0\0\0 \09AD\x32420D74F\x3037D36\x3341\x3342\x3030\xfff0\xffff¨wXwB\x3338¨\xffffn ´¥&#1570;&#1577;\0\0&#1705;*\0\0\0\0\xffff\xffff\xffff\xffff\0\0\xffff\xffff\xffff\xffff\0\0\0\0\0\0\0\0\xffff\xffff\4\0CLiP\xffc0\xffffl\as&#1601;\x2605\xe9b0i\xb62&#1591;\xe690	c&#1603;&#1611;[/\xe29f0®\x2a2epQ–\xa595\xe198K(S\xfff8\xffff01\xffe8\xffffv\0N\0&#1611;X\1\0\0[\xfff8\xffffx0\xfff0\xffffl\1\x1dd81\xee90&#1662;\xffc8\xffffv \x88\0\xb501\1\0\11\x3330EAB5948D920\x3044FC\x3344\xfff8\xffff 1\xffe8\xffffv\0N\0&#1591;X\1\0\0¶\xff90\xffffn \x1b08&#1616;&#1570;&#1577;\0\0h2\0\0\0\0\xffff\xffff\xffff\xffff\1\0\xd9c80&#1591;\xffff\xffff\0\0\0\0@\0\x86\0ro \0CE\x3335\x3245E\x30301271D\x3244B\x3341B\x3338\xfff8\xffff\x8101\xfff0\xffffˆzèzld\xff70\xffffC:\Program Files\Symantec\Symantec Endpoint Protection\SavEmail.dll\0v \xffc8\xffffv p\0\x8381\1\0\1B\x3330EAB5948D920\x3044FC\x3344\xfff8\xffff\x5c01\xfff8\xffffè1\xfff8\xffff\x2ea81\xff80\xffffn &#1608;A&#1570;&#1577;\0\0\xfe000\5\0\0\0\x1b181\xffff\xffff\b\0\xee81\xffff\xffff(\0\0\0,\0\x80\0\0\0-\0\x2d53\x2d31\x2d352\x312d1\x30369\x3031\x312d3\x333388\x2d38\x3231\x3230602\x312d\x32313\xffff\xffd0\xffffv\26\4remier-Site-par-defaut\0\xf2e0J\xffd0\xffffv\22\x80\0\xd701\1\0\1\5Dsigih\x2d64Nm\0\xf420J\xff78\xffffCN=Akram ALLOUANI,CN=Users,DC=dml-for,DC=amt,DC=sonatrach,DC=dz\0Co\xffe0\xffffv\b\4v\21\4\xffff\xffffL\0\0\0\0\0\0\0\0\0\16\0Etni\x2d6eLs\xffff\xff88\xffffn &#1608;A&#1570;&#1577;\0\0\xf101\0\0\0\0\xffff\xffff\xffff\xffff\6\0è1\xffff\xffff\0\0\0\0\32\0\4\0\0\0&\0\x307b\x3030\x3030\x3030\x2d30\x3030\x3030\x302d\x3030\x2d30\x3030\x3030\x302d\x3030\x3030\x3030\x3030\x30300\0\xffe8\xffffl\2H10\0ˆ11\0hi\0\4\0\1\0Lgigtts\0\xffe0\xffff 1\x10481\x10701\x10981\xe701&#1729;1\0\0 \xffffn &#1608;A&#1570;&#1577;\0\001\2\0\0\0°1\xffff\xffff\0\0\xffff\xffff\xffff\xffff\2\0\0\0\0\0\0\0\b\0\v\0GLn-it&#1585;&#1575;¨\xffffn &#1608;A&#1570;&#1577;\0\01\0\0\0\0\xffff\xffff\xffff\xffff\4\0p1\xffff\xffff\0\0\0\0\24\0\22\0B\0\1\0000\0\0\0\xffe0\xffffv\a\4\0\01\0\0\0\0\xffff\xffff\xffff\xffff\4\0&#1705;1\xffff\xffff\0\0\0\0\24\0&#1578;\0DO\1\0001sys\xffe0\xffffv\a\4-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=dml-for,DC=amt,DC=sonatrach,DC=dz\0n\xffe0\xffffv\3J\0H1\1\0\1\0SM
°\xffffDC=dml-for,DC=amt,DC=sonatrach,DC=dz\0\0\xffe8\xffffà1\xffff\0\0\xffff\xffff\xffff\xffff\2\0\0\0\0\0\0\0\xffff\xffff\b\0G\x2d4fLs\xffd8\xffffv\t0\0\xf368U\1\0\1\0St-ae\0\0\0¨\xffffn &#1608;A&#1570;&#1577;\0\0&#1576;1\0\0\0\0\xffff\xffff\xffff\xffff\t\0\x17601\xffff\xffff\0\0\0\0\32\0006\0P\0\1\0000WIN\xffe0\xffffv\a\4\4\0\1MVrin\xffd8\xffffv\r\4\0\0\30\0\xffe0\xffffv\6\2\xffff\t\0\x1a201\xffff\xffff\0\0\0\0\32\0X\0h\0\1\0001\0n \xffe0\xffffv\a\4\xffff\xf7600\xffe0\xffffv\a\4natrach,DC=dz\0a\x2e65\xffd8\xffffv\v,\0\x19f01\1\0\1JDslyaeOb\xffd0\xffffDefault Domain Policy\0\xffd8\xffff\x17e01\x18001(1P1&#1711;1\x18b01\x19481\x19c81\x19281\xff98\xffffn &#1608;A&#1570;&#1577;\0\001\0\0\0\0\xffff\xffff\xffff\xffff\0\0\xffff\xffff\xffff\xffff\0\0\0\0\0\0\0\0aa\24\0Lobc-Pi\x2d6bLs\0\0\xff98\xffffn &#1608;A&#1570;&#1577;\0\001\0\0\0\0\xffff\xffff\xffff\xffff\0\0\xffff\xffff\xffff\xffff\0\0\0\0\0\0\0\0N\0\21\0Lobc-P-itD76\xffc0\xffffl\5\xf101Jf1\x1c32&#1607;&#1576;1&#1587;)\x1a481V1\x1ab01Gb\0\0\0\0\0\0\0\0\xff80\xffffn &#1548;D&#1570;&#1577;\0\0\xfe000\5\0\0\0\x24801\xffff\xffff\b\0\x1d281\xffff\xffff(\0\0\0,\0000\0p\0,\0\x2d53\x2d31\x2d352\x322d\x3230522\x2d352179\x2d37\x33389\x32321\x2d35\x3031\x333064\xffd0\xffffv\26\4Nm\0&#1617;\x85\xffe0\xffffv\b\4\xffd8\xffff\x1bd81 1\x1c081\x1c381\x1c581\x1c801\x1cd01\x1cf81\0\0\xffd8\xffffv\t0\0@\1\0\1ISt-a\x24651S\xe412 \xffffn &#1548;D&#1570;&#1577;\0\0\x1b581\1\0\0\0\xa601\xffff\xffff\0\0\xffff\xffff\xffff\xffffL\0\0\0\0\0\0\0\0\0\16\0Etni\x2d6eLs\0\xff88\xffffn &#1548;D&#1570;&#1577;\0\0\x1d781\0\0\0\0\xffff\xffff\xffff\xffff\6\01\xffff\xffff\0\0\0\0\32\0\4\0\0\0&\0\x307b\x3030\x3030\x3030\x2d30\x3030\x3030\x302d\x3030\x2d30\x3030\x3030\x302d\x3030\x3030\x3030\x3030\x30300\0\xffd8\xffffv\v\4\xf45d&#1575;\4\0\1\0Satiei\0\0\xffd8\xffffv\t\4\xffff\xffff\2\0\0\0\0\0\0\0\0\0\v\0GLn-it\0\0¨\xffffn &#1548;D&#1570;&#1577;\0\081\0\0\0\0\xffff\xffff\xffff\xffff\4\0\xe4100\xffff\xffff\0\0\0\0\24\0\22\0\0\0\1\0000\0\0\0\xfff0\xffffLocal\0hi\x20001\xffffv\6\22\0\x23981\1\0\1rDPt\0\xffe0\xffffv\3\f\0\x1ff01\1\0\1\0SMt\0\xffd8\xffffv\16\24\0€1\1\0\1\x2028Traigoee\xffd8\xffffv\17\xbe\0&#1576;U\1\0\1Uisaltig¨\xffffn &#1548;D&#1570;&#1577;\0\0\x1b581\1\0\0\0&#1711;0\xffff\xffff\0\0\xffff\xffff\xffff\xffff\2\0\0\0\0\0\0\08\0\b\0G\x2d4fLs\xffd8\xffffv\t0\0\xaa18\1\0\1\0St-ae\0\0\0¨\xffffn &#1548;D&#1570;&#1577;\0\0\x20d81\0\0\0\0\xffff\xffff\xffff\xffff\t\0\x23501\xffff\xffff\0\0\0\0\32\0006\0\0\0\1\00au\0\xffd8\xffffv\r\4\xffffv\f\4\x23101\1\0\1\x85Dslyae\x18781\xffc0\xffffStratégie de groupe locale\0\0St\xffd8\xffff\xf500+\x21b01\x21d81\x22001\x22281\x22481\x22c81\x22e81\x22a81\xffe0\xffffv\a\4\xffff\xffff\0\0\xffff\xffff\xffff\xffff\0\0\0\0\0\0\0\0\0\0\24\0Lobc-Pi\x2d6bLs\0\0\xff98\xffffn &#1548;D&#1570;&#1577;\0\0\x1b581\0\0\0\0\xffff\xffff\xffff\xffff\0\0\xffff\xffff\xffff\xffff\0\0\0\0\0\0\0\0 \0\21\0Lobc-P-it\0\0\0\xffc0\xffffl\5\x1d781Jf81\x1c32&#1607;\x20d81&#1587;)\x23b01V1\x24181Gb\0\0\0\0\0\0\0\0\xff80\xffffn &#1548;D&#1570;&#1577;\0\0\xfe000\5\0\0\0\x2e101\xffff\xffff\b\0\x26f01\xffff\xffff(\0\0\0,\0000\0\0\0+\0\x2d53\x2d31\x2d352\x322d\x3230522\x2d352179\x2d37\x33389\x32321\x2d35\x30350\0\0\xffd0\xffffv\26\4\4\0\1\0Freoerudogn\0\xfff0\xffffl\1\x2af810\0\xfff0\xffffLocal\0\xfff0\xffffl\1\x295810\0\xffe8\xffffv\0&\0°E\1\0\0[\xffd0\xffffv\22\2\xffd8\xffffv\17\41\x26981\x26c01\0\0 \xffffn &#1548;D&#1570;&#1577;\0\0\x24c01\1\0\0\0\x26081\xffff\xffff\0\0\xffff\xffff\xffff\xffffL\0\0\0\0\0\0\0\0\0\16\0Etni\x2d6eLs\0\xff88\xffffn &#1548;D&#1570;&#1577;\0\0\x27181\0\0\0\0\xffff\xffff\xffff\xffff\6\0\x28d81\xffff\xffff\0\0\0\0\32\0\4\0\0\0&\0\x307b\x3030\x3030\x3030\x2d30\x3030\x3030\x302d\x3030\x2d30\x3030\x3030\x302d\x3030\x3030\x3030\x3030\x30300\0\xffd8\xffffv\v\4\0\1\0Ediei\0\0\0\xffe0\xffffv\6\4\v\0GLn-it\0\0¨\xffffn &#1548;D&#1570;&#1577;\0\0\x28f81\0\0\0\0\xffff\xffff\xffff\xffff\4\0\x2a181\xffff\xffff\0\0\0\0\24\0\22\0\0\0\1\0000\0\0\0\xffd8\xffffv\n\4\xffff\x2d081\x29b01\x29d81\x29f81\0\0\xffd0\xffffIMDServiceProvider3\0v\6\xfff0\xffffREG_SZ\xfff8\xffff\xfbc00¨\xffffn &#1548;D&#1570;&#1577;\0\0\x24c01\1\0\0\0\x25701\xffff\xffff\0\0\xffff\xffff\xffff\xffff\2\0\0\0\0\0\0\0\0\0\b\0G\x2d4fLs\xffe8\xffffv\0\2\0\0\0\xfff0\xffff°282¸2¨\xffffn &#1548;D&#1570;&#1577;\0\0\x2a781\0\0\0\0\xffff\xffff\xffff\xffff\t\0`[\xffff\xffff\0\0\0\0\32\0006\0\0\0\1\0000\0\0\0\xffd8\xffffv\r\4Dsbe\1\0\xffe8\xffffLocalGPO\01\xffe0\xffffv\a\4\0\1tDslyaee \xffc0\xffffStratégie de groupe locale\01\x2bc81\xffe0\xffffv\a\4\xff98\xffffn &#1548;D&#1570;&#1577;\0\0\x24c01\0\0\0\0\xffff\xffff\xffff\xffff\0\0\xffff\xffff\xffff\xffff\0\0\0\0\0\0\0\0\0\0\21\0Lobc-P-itP-i\xfff8\xffff00\xffc0\xffffl\5\x27181Jf\x28f81\x1c32&#1607;\x2a781&#1587;)\x2d381V1\x2da01Gb\0\0\0\0\0\0\0\0¨\xffffn \xff03S&#1570;&#1577;\0\0\x2078-\0\0\0\0\xffff\xffff\xffff\xffff\0\0\xffff\xffff0&#1574;\xffff\xffff\0\0\0\0\0\0\0\0p\1\a\0\x3348\x3332TP\xffe8\xffffv\0\4\0°1 N\xffff\xffff\30\0\0\0"\0*\0\0\0\t\0Isalr\0\0\0\xff70\xffffs\0&#1591;\x2e40L\0x\0\1\0l\0\0\0\24\0\2H\3\0\x300\24?\17\0\0\x500\22\0\x300\24\31\2\0\02\0\0hi\x30001\x220\0\x501\0\0\x500\25\0¹\xda37•\x1743\x320aô\0\x501\0\0\x500\25\0¹\xda37•\x1743\x320a\0\x1a00\24@\0\0\0\x500\22\0\x1a00\24\0m32\0\16\xfff8\xffffP1 \xffffn \x2db6b&#1570;&#1577;\0\0èI"\0\0\0€&#1729;\xffff\xffff\0\0\xffff\xffff0&#1574;\xffff\xffff\20\0\0\0\0\0\0\0\0\0\20\0PoetHnlr¨\xffffn \x2db6b&#1570;&#1577;\0\0\x31b81\0\0\0\0\xffff\xffff\xffff\xffff\1\0\x328810&#1574;\xffff\xffff\0\0\0\0\0\0N\0\0\0\6\0.cd\0\xffe8\xffffv\0N\0&#1711;I\1\0\0i\xfff8\xffff\x32701¨\xffffv?\2cmusMcoo\x2074Sae\ep\xff80\xffffva\2sMcoo\x2074Sae\FIE2\0\0\xffe0\xffffSae\ep\x3031\x3234\0¨\xffffv=\2musMcoo\x2074Sae\ep\x30313\0¨\xffffv=\2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts]
"'\6D\6,\0062\6'\6&\0061\6 ?'\6D\6%\0063\6D\6'\6E\6J\6)\6 ?(?T?r?u?e?T?y?p?e?)?"="dthuluth.ttf"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:000001c6

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe"="C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe:*:Enabled:SMC Service"
"C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE"="C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE:*:Enabled:SNAC Service"
"C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe:*:Enabled:Symantec Email"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Wed  7 Mar 2007     1,316,912 A..H. --- "C:\Utilities\CD Ressources\RCDMENU.EXE"
Thu 24 Apr 2008    21,346,111 A..H. --- "C:\Documents and Settings\Ordinateur.domaine\Mes documents\av-i386-cumul.zip"
Fri 14 Sep 2007       365,976 A..H. --- "C:\Documents and Settings\Ordinateur.domaine\Mes documents\emoticones1_5.exe"
Mon 25 Jun 2007     2,687,688 A..H. --- "C:\Documents and Settings\Ordinateur.domaine\Mes documents\Europe_Algerie.exe"
Wed 16 Jan 2008     4,155,752 A..H. --- "C:\Documents and Settings\Ordinateur.domaine\Mes documents\SweetImSetup.exe"
Tue  4 Mar 2008     2,402,832 A..H. --- "C:\Documents and Settings\Ordinateur.domaine\Mes documents\WLinstaller.exe"
Mon 31 Dec 2007         4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Thu 14 Aug 2008       285,184 A.SHR --- "C:\_OTMoveIt\MovedFiles\12062008_174421\logoneui.exe"
Mon  3 Mar 2008    18,297,389 A..H. --- "C:\Documents and Settings\Ordinateur.domaine\Mes documents\kasp_WinWorkstation-6.0\maj_kaspersky6_av-i386-ids-cumul03.03.2008.zip"
Tue 26 Sep 2006     2,453,461 A..H. --- "C:\Documents and Settings\Ordinateur.domaine\Mes documents\Utilitaires\DicoMots_Install....bon.zip"
Tue 19 Sep 2006    33,708,196 A..H. --- "C:\Documents and Settings\Ordinateur.domaine\Mes documents\Utilitaires\klmcodec158.exe"
Tue 26 Sep 2006     5,980,410 A..H. --- "C:\Documents and Settings\Ordinateur.domaine\Mes documents\Utilitaires\mot_mysterieux_eval....bon(enfant).exe"
Tue 26 Sep 2006    14,640,964 A..H. --- "C:\Documents and Settings\Ordinateur.domaine\Mes documents\Utilitaires\pendu...bon.exe"
Tue 26 Sep 2006     2,863,798 A..H. --- "C:\Documents and Settings\Ordinateur.domaine\Mes documents\Utilitaires\ScrabbleZ...bon.EXE"
Thu 10 Aug 2006     4,663,080 A..H. --- "C:\Documents and Settings\Ordinateur.domaine\Mes documents\Utilitaires\TypingMasterENG630.exe"
Sat 26 Aug 2006        92,203 A..H. --- "C:\Documents and Settings\Ordinateur.domaine\Mes documents\Utilitaires\VisualTaskTips_21.exe"
Sat 24 Jun 2006     1,014,477 A..H. --- "C:\Documents and Settings\Ordinateur.domaine\Mes documents\Utilitaires\wrar351.exe"
Mon  4 Apr 2005       416,768 A..H. --- "C:\Documents and Settings\Ordinateur.domaine\Mes documents\verbes\Verbe32.exe"
Sat 22 Dec 2007             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Sun 27 Apr 2008           407 A..H. --- "C:\Program Files\Fichiers communs\Symantec Shared\COH\COH32LU.reg"
Sun 27 Apr 2008           400 A..H. --- "C:\Program Files\Fichiers communs\Symantec Shared\COH\COHDLU.reg"
Sat 23 Feb 2008         7,558 A..H. --- "C:\Documents and Settings\Ordinateur.domaine\Application Data\Microsoft\Internet Explorer\brndlog.bak"
Sat 23 Feb 2008           424 A..H. --- "C:\Documents and Settings\Ordinateur.domaine\Application Data\Microsoft\Internet Explorer\rsoplog.bak"
Tue 15 Jul 2008    25,446,400 ...H. --- "C:\Documents and Settings\Ordinateur.domaine\Application Data\Microsoft\Word\~WRL2709.tmp"
Mon 14 Jul 2008    25,443,328 ...H. --- "C:\Documents and Settings\Ordinateur.domaine\Local Settings\Temporary Internet Files\Content.MSO\~WRL0003.tmp"
Tue 22 Oct 2002     2,973,696 A..H. --- "C:\Documents and Settings\Ordinateur.domaine\Mes documents\Houhou\NFSHP2\NFSHP2.exe"
Tue 22 Oct 2002        41,900 A..H. --- "C:\Documents and Settings\Ordinateur.domaine\Mes documents\Houhou\NFSHP2\RegSetup.exe"
Thu  8 Aug 2002       153,088 A..H. --- "C:\Documents and Settings\Ordinateur.domaine\Mes documents\Houhou\NFSHP2\UNWISE.EXE"
Tue 22 Oct 2002        45,184 A..H. --- "C:\Documents and Settings\Ordinateur.domaine\Mes documents\Houhou\NFSHP2\Win2kHook.dll"
Wed  6 Feb 2008     1,036,800 ...H. --- "C:\Documents and Settings\aZerrouki\Application Data\Microsoft\Word\~WRL0693.tmp"
Wed  6 Feb 2008     1,036,800 ...H. --- "C:\Documents and Settings\aZerrouki\Application Data\Microsoft\Word\~WRL1921.tmp"
Wed  6 Feb 2008     1,040,896 ...H. --- "C:\Documents and Settings\aZerrouki\Application Data\Microsoft\Word\~WRL2858.tmp"
Wed  6 Feb 2008       628,224 ...H. --- "C:\Documents and Settings\aZerrouki\Application Data\Microsoft\Word\~WRL2974.tmp"
Wed  6 Feb 2008     1,071,616 ...H. --- "C:\Documents and Settings\aZerrouki\Application Data\Microsoft\Word\~WRL2989.tmp"
Wed  6 Feb 2008     1,080,320 ...H. --- "C:\Documents and Settings\aZerrouki\Application Data\Microsoft\Word\~WRL3304.tmp"
Wed  6 Feb 2008     1,058,816 ...H. --- "C:\Documents and Settings\aZerrouki\Application Data\Microsoft\Word\~WRL3699.tmp"
Thu 15 Nov 2007       545,792 ...H. --- "C:\Documents and Settings\aZerrouki\Application Data\Microsoft\Word\~WRL3752.tmp"
Thu 14 Aug 2008       285,184 A.SHR --- "C:\_OTMoveIt\MovedFiles\12062008_174421\WINDOWS\system32\logoneui.exe"
Tue 21 Oct 2008       240,128 A.SHR --- "C:\_OTMoveIt\MovedFiles\12062008_174421\WINDOWS\system32\SSVICHOSST.exe"
Tue 11 Mar 2008         1,028 A..H. --- "C:\Documents and Settings\Ordinateur.domaine\Local Settings\Application Data\Microsoft\Internet Explorer\rsoplog.bak"
Sat 21 Jun 2008       196,608 A..H. --- "C:\Documents and Settings\Ordinateur.domaine\Local Settings\Application Data\Microsoft\Outlook\~outlook.ost.tmp"
Thu 19 Apr 2007             0 A..H. --- "C:\Documents and Settings\ordinateur1.domaine\Bureau\Micro user1\photo generale\photo user1\remise m‚dailles1\DSC00927.JPG~RF1493e82a.TMP"

[b]Finished![/b]

madsoli · Answer

RE,
Pour répondre à la question de afideg ''C'est quoi ça ? ==> H:\New Folder.exe'',c justement ça le probléme j'avais des dossiers bizzare dans tous mes disques locaux :
dans le disque local c j'avais  JOJO.exe
dans le disque local D j'avais Akon.exe
dans le disque local E j'avais maradona.exe

et qaund g placé mes usb g eu:
dans le G zidane Vs tito.exe
et enfin dans  H  folder.exe

en fait,maintenant le disque C s'ouvre par double clique mais consernant les disques D et E g toujours la fenêtre ''ouvrir avec'' qui apparit ,la bonne nouvelle est qu'en les explorant je ne trouve plus jojo,akon et maradona.
qaund à mes usb g ne veux pas les remettre de peur d'infecter à nouveau mon pc,en fait g fais comment pour les désinfecter.Mille Merci

madsoli · Answer

Re;
Désolée de vous décevoir mais apparement jojo,akon et maradona sont toujours sur mon PC ,ils ont réapparu quand g cliqué sur le dossier ''_OTMoveIt'' présent dans c:/, j'espere tout de même que g ne suis pas retourné à la case départ.

Utilisateur anonyme · Answer

Salut,


fais ceci :

Télécharge ToolsCleaner sur ton bureau. 
--> 
http://pc-system.fr/ 
http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner

# Clique sur Recherche et laisse le scan agir ... 
# Clique sur Suppression pour finaliser. 
# Tu peux, si tu le souhaites, te servir des Options facultatives. 
# Clique sur Quitter pour obtenir le rapport. 
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\). 


ensuite :

telecharge ce fichier sur le bureau :

http://sd-1.archive-host.com/membres/up/116615172019703188/Scan.bat

branche toutes tes clé usbb et disque dur externes

ensuite double clic sur scan.bat et post le rapport qui va apparaitre (list.txt)

madsoli · Answer

Salut;
tooulscleaner tarde trop,quand g lance recherche rien ne se passe ,Est ce que g peux passer à scan.bat.Merci

Utilisateur anonyme · Answer

oui fais scan.bat

madsoli · Answer

--------------- [ Lecteur C ] ---------------- 

C: - Lecteur fixe


+- Listing des fichiers présents :

[25/07/2007 09:49][--a------] C:\AUTOEXEC.BAT   
[25/07/2007 09:49][--a------] C:\info.bat   
[05/08/2004 11:00][-rahs----] C:\NTDETECT.COM   
[14/08/2008 23:40][--a------] C:\Jojo.exe   
[14/08/2008 23:40][--a------] C:\logoneui.exe   
[02/12/2008 17:25][-rahs----] C:\boot.ini   
[07/12/2008 07:56][-rahs----] C:\autorun.inf   
[07/12/2008 15:57][--a------] C:\List.txt   
[07/12/2008 15:57][--a------] C:\prv_log.txt   
[25/07/2007 09:49][--a------] C:\CONFIG.SYS   
[25/07/2007 09:49][--a------] C:\IO.SYS   
[25/07/2007 09:49][--a------] C:\MSDOS.SYS   
[25/07/2007 09:49][--a------] C:\pagefile.sys   

--------------- [ Lecteur D ] ---------------- 

D: - Lecteur fixe


+- Listing des fichiers présents :

[14/08/2008 23:40][--a------] D:\Akon.exe   
[14/08/2008 23:40][--a------] D:\logoneui.exe   
[07/12/2008 07:56][-rahs----] D:\autorun.inf   

--------------- [ Lecteur E ] ---------------- 

E: - Lecteur fixe


+- Listing des fichiers présents :

[14/08/2008 23:40][-rahs----] E:\logoneui.exe   
[14/08/2008 23:40][-rahs----] E:\Maradona.exe   
[07/12/2008 07:56][-rahs----] E:\autorun.inf   

--------------- [ Lecteur G ] ---------------- 

G: - Lecteur amovible


+- Listing des fichiers présents :

[14/08/2008 23:40][-rahs----] G:\logoneui.exe   
[14/08/2008 23:40][-rahs----] G:\HJTInstall.exe   
[14/08/2008 23:40][-rahs----] G:\New Folder.exe   
[14/08/2008 23:40][-rahs----] G:\SSVICHOSST.exe   
[04/12/2008 14:55][-rahs----] G:\autorun.inf   

--------------- [ Lecteur H ] ---------------- 

H: - Lecteur amovible


+- Listing des fichiers présents :

[14/08/2008 23:40][--a------] H:\Zidan vs Tito.exe   
[14/08/2008 23:40][--a------] H:\logoneui.exe   
[14/08/2008 23:40][--a------] H:\New Folder.exe   
[14/08/2008 23:40][--a------] H:\SSVICHOSST.exe   
[03/12/2008 15:08][-rahs----] H:\autorun.inf

Utilisateur anonyme · Answer

ok

refais un scan hijackthis et post le rapport stp

madsoli · Answer

A vos ordre,Merci et désolée pour le dérangement:



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:12:08, on 07/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
C:\WINDOWS\system32\logoneui.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\logoneui.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\logoneui.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\dyndns.domaine\Bureau\ToolsCleaner2.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://famous2.topcities.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = google.net-studio.org
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 172.23.1.0:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll
F2 - REG:system.ini: Shell=Explorer.exe logoneui.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1	oolbar.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Vimicro USB PC Camera 305
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AVP] "G:\kaspersky\Kaspersky Lab Tool\setup_7.0.0.180_10.05.2008_16-32.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [firewall 2008] C:\WINDOWS\system32\logoneui.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RESEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?3cfc080c604349278fa1a4fb7adee1bc
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?3cfc080c604349278fa1a4fb7adee1bc
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.google.com/?gws_rd=ssl
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = domaine
O17 - HKLM\Software\..\Telephony: DomainName = domaine
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = domaine
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Client de gestion Symantec  (SmcService) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
O23 - Service: Symantec Network Access Control (SNAC) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Fichiers communs\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

Utilisateur anonyme · Answer

branche toutes tes clé usn et tes disques externes


---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau : 
http://oldtimer.geekstogo.com/OTMoveIt3.exe 

---> Double-clique sur OTMoveIt3.exe afin de le lancer. 

---> Copie (Ctrl+C) le texte suivant ci-dessous : 





:processes 
explorer.exe 
logoneui.exe

:files 
C:\WINDOWS\system32\logoneui.exe 
C:\info.bat 
C:\Jojo.exe 
C:\logoneui.exe 
C:\autorun.inf 
D:\Akon.exe 
D:\logoneui.exe 
D:\autorun.inf 
E:\logoneui.exe 
E:\Maradona.exe 
E:\autorun.inf 
G:\logoneui.exe 
G:\New Folder.exe 
G:\SSVICHOSST.exe 
G:\autorun.inf 
H:\Zidan vs Tito.exe 
H:\logoneui.exe 
H:\New Folder.exe 
H:\SSVICHOSST.exe 
H:\autorun.inf

:reg 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"firewall 2008"=- 

:commands 
[emptytemp] 
[start explorer] 
[reboot] 




---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved. 

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3. 

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. 
Accepte en cliquant sur YES. 

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\ 
Le nom du rapport correspond au moment de sa création : date_heure.log

madsoli · Answer

[ Rapport ToolsCleaner version 2.2.6 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

C:\SDFIX: trouvé !
C:\_OtMoveIt: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\dyndns.domaine\Bureau\SdFix.exe: trouvé !
C:\Documents and Settings\dyndns.domaine\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\dyndns.domaine\Bureau\HJTInstall.exe: trouvé !
C:\Documents and Settings\dyndns.domaine\Bureau\UsbFix.exe: trouvé !
C:\Documents and Settings\dyndns.domaine\Bureau\UsbFix.lnk: trouvé !
C:\Documents and Settings\dyndns.domaine\Bureau\OTMoveIt3.exe: trouvé !
C:\Documents and Settings\dyndns.domaine\Bureau\Rsit.exe: trouvé !
C:\Documents and Settings\dyndns.domaine\Menu Démarrer\Programmes\UsbFix: trouvé !
C:\Documents and Settings\dyndns.domaine\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: trouvé !
C:\Documents and Settings\dyndns.domaine\Recent\UsbFix.lnk: trouvé !
C:\Documents and Settings\user.domaine\Bureau\UsbFix.exe: trouvé !
C:\Documents and Settings\user.domaine\Bureau\Rsit.exe: trouvé !
C:\Documents and Settings\user.domaine\Bureau\UsbFix: trouvé !
C:\Program Files\UsbFix: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !
C:\Program Files\UsbFix\UsbFix.exe: trouvé !

---------------------------------
-->- Suppression: 

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\dyndns.domaine\Bureau\SdFix.exe: supprimé !
C:\Documents and Settings\dyndns.domaine\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\dyndns.domaine\Bureau\HJTInstall.exe: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Documents and Settings\dyndns.domaine\Bureau\UsbFix.exe: supprimé !
C:\Documents and Settings\dyndns.domaine\Bureau\UsbFix.lnk: supprimé !
C:\Documents and Settings\dyndns.domaine\Bureau\OTMoveIt3.exe: supprimé !
C:\Documents and Settings\dyndns.domaine\Bureau\Rsit.exe: supprimé !
C:\Documents and Settings\dyndns.domaine\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: supprimé !
C:\Documents and Settings\dyndns.domaine\Recent\UsbFix.lnk: supprimé !
C:\Documents and Settings\user.domaine\Bureau\UsbFix.exe: supprimé !
C:\Documents and Settings\user.domaine\Bureau\Rsit.exe: supprimé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\Program Files\UsbFix\UsbFix.exe: supprimé !
C:\SDFIX: supprimé !
C:\_OtMoveIt: supprimé !
C:\Rsit: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Documents and Settings\dyndns.domaine\Menu Démarrer\Programmes\UsbFix: supprimé !
C:\Documents and Settings\user.domaine\Bureau\UsbFix: supprimé !
C:\Program Files\UsbFix: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

Utilisateur anonyme · Answer

fais ceci :

http://www.commentcamarche.net/forum/affich 9729510 virus jojo maradona akon?page=3#48

madsoli · Answer

========== PROCESSES ==========
Process explorer.exe killed successfully.
Process logoneui.exe killed successfully.
========== FILES ==========
C:\WINDOWS\system32\logoneui.exe moved successfully.
C:\info.bat moved successfully.
C:\Jojo.exe moved successfully.
C:\logoneui.exe moved successfully.
C:\autorun.inf moved successfully.
D:\Akon.exe moved successfully.
D:\logoneui.exe moved successfully.
D:\autorun.inf moved successfully.
E:\logoneui.exe moved successfully.
E:\Maradona.exe moved successfully.
E:\autorun.inf moved successfully.
G:\logoneui.exe moved successfully.
G:\New Folder.exe moved successfully.
G:\SSVICHOSST.exe moved successfully.
G:\autorun.inf moved successfully.
H:\Zidan vs Tito.exe moved successfully.
H:\logoneui.exe moved successfully.
H:\New Folder.exe moved successfully.
H:\SSVICHOSST.exe moved successfully.
H:\autorun.inf moved successfully.
========== REGISTRY ==========
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\firewall 2008 deleted successfully.
========== COMMANDS ==========
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS	emp\Perflib_Perfdata_7b0.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Temp folders emptied.
Explorer started successfully
 
OTMoveIt3 by OldTimer - Version 1.0.7.2 log created on 12072008_162535

Files moved on Reboot...
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File C:\WINDOWS	emp\Perflib_Perfdata_7b0.dat not found!

Utilisateur anonyme · Answer

comment va le pc ?


Télécharge HijackThis (outils de diagnostic) ici 

->  Fais un clic droit sur un des liens et choisi enregistrer la cible sous .... le bureau

-> Fais un double-clic sur HJTInstall.exe afin de lancer l'installation 

-> Clique sur Install ensuite sur I Accept 

-> Clique sur Do a scan system and save log file 

-> Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse
A découvrir : Estopa, Rosario Flores, La Oreja De Van Gogh
                   Bonne écoute 
                   @ + T' Chiki.

madsoli · Answer

C bon mes disques s'ouvrent normalement mais g toujours le dossiers _OTMoveIt dans c:/ et g peur qu'il me régénére les virus

Utilisateur anonyme · Answer

Bug ?

Utilisateur anonyme · Answer

fais hijackthis 

ensuite on supprimera otmoveit

madsoli · Answer

A present g peux ouvrir les disques normalement et g plus de jojo,maradona...mais le dossiers _OTMoveIT dans C et g peur qu'il me régénére ces virus.


 Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:44:35, on 07/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://famous2.topcities.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = google.net-studio.org
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 172.23.1.0:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll
F2 - REG:system.ini: Shell=Explorer.exe logoneui.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1	oolbar.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Vimicro USB PC Camera 305
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AVP] "G:\kaspersky\Kaspersky Lab Tool\setup_7.0.0.180_10.05.2008_16-32.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RESEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?3cfc080c604349278fa1a4fb7adee1bc
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?3cfc080c604349278fa1a4fb7adee1bc
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.google.com
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = domaine
O17 - HKLM\Software\..\Telephony: DomainName = domaine
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = domaine
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Client de gestion Symantec  (SmcService) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
O23 - Service: Symantec Network Access Control (SNAC) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Fichiers communs\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

Utilisateur anonyme · Answer

pour le dossier otmoveit ne craint rien

réouvre hijackthis
fais scan only
coches ces lignes :

F2 - REG:system.ini: Shell=Explorer.exe logoneui.exe 

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) 

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') 
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RESEAU') 
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') 
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present 
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present 
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) 

O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab 
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab 
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

tu les coches et tu clic sur fix checked 


ensuite :


Télécharge Ad-remover ( de C_XX ) sur ton bureau ( et pas ailleurs!) : 

http://sd-1.archive-host.com/membres/up/16506160323759868/AD-R.exe

! Déconnecte toi et ferme toutes applications en cours ! 

* Clique sur "Ad-R.exe" pour lancer l'installation et laisse les paramètres d'installe par défaut . 
* Double-clique sur le raccourci Ad-remover qui est sur ton bureau pour lancer l'outil . 
* Au menu principal choisis l'option "A" et tape sur [entrée] . 

Laisse travailler l'outil et ne touche à rien ... 

--> Poste le rapport qui apparait à la fin . 

( le rapport est sauvegardé aussi sous C:\Ad-report.log ) 

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller ) 

Note : 
"Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. 
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. 
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

madsoli · Answer

Merci beaucoup;
g ferai ça mardi,à présent g doix sortir,on se donne RDV mardi

Utilisateur anonyme · Answer

ok

@++

madsoli · Answer

Bonjour;
 Merci énormément pour votre aide,voila le rapport:


--------- Logfile of AD-Remover 1.0.6.6 by C_XX ---------
 
# START at:  7:15:28 | Mar 12-09-2008 ON Microsoft® Windows XP ™ v5.1.2600 
# BOOT MODE: Normal
 
# OPTION: Scan
# EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat
 
# PC: ordinateur | USER: user ( Current user is an administrator )
 
# DRIVE(S):  A:\
# Systemdrive: C:\ (NTFS)
# Internet Explorer v7.0.5730.11
 
--------- [ RUNNING PROCESSES: 32 ] --------- 

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32
tvdm.exe
 
----------------------------------- 

 
+-----------------------| Boonty/Boonty Games Elements found.. 

.
 
+-----------------------| Eorezo Elements found.. 

.
 
+-----------------------| Everest Poker Elements found.. 

.
 
+-----------------------| FunWebProducts/MyWay/MyWebSearch/MyGlobalSearch Elements found.. 

.
 
+-----------------------| Messenger Skinner Elements found.. 

.
 
+-----------------------| Sweetim Elements found.. 

"HKEY_CLASSES_ROOT\CLSID\{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938}"
"HKEY_CLASSES_ROOT\CLSID\{1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A}"
"HKEY_CLASSES_ROOT\SWEETIE.IEToolbar"
"HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1"
"HKEY_CLASSES_ROOT\SWEETIE.SWEETIE"
"HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.1"
"HKEY_CLASSES_ROOT\ToolBand.SWEETIE"
"HKEY_CLASSES_ROOT\ToolBand.SWEETIE.1"
"HKEY_CLASSES_ROOT\Typelib\{58906392-79C4-497C-ACC6-6942B59F1A08}"
"HKEY_CURRENT_USER\SOFTWARE\SWEETIE"
"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks" /v "{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938}"
"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1A0AADCD-3A72-4B5F-900F-E3BB5A838E2A}"
"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Macrogaming"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar" /v "{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9"
.
[16/01/2008 11:36|d--------] C:\Program Files\Macrogaming
 
+-----------------------| ADDED SCAN .. 

+--[HKEY_CURRENT_USER\..\Run] 

CTFMON.EXE	REG_SZ	C:\WINDOWS\system32\ctfmon.exe
swg	REG_SZ	C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
 
+--[HKEY_LOCAL_MACHINE\..\Run] 

RoxioDragToDisc	REG_SZ	"C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
ISUSPM Startup	REG_SZ	C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
ISUSScheduler	REG_SZ	"C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
SoundMAXPnP	REG_SZ	C:\Program Files\Analog Devices\Core\smax4pnp.exe
IMJPMIG8.1	REG_SZ	"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
MSPY2002	REG_SZ	C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
PHIME2002ASync	REG_SZ	C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
PHIME2002A	REG_SZ	C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
TkBellExe	REG_SZ	"C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
BigDogPath	REG_SZ	C:\WINDOWS\VM_STI.EXE Vimicro USB PC Camera 305
ccApp	REG_SZ	"C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
AVP	REG_SZ	"G:\kaspersky\Kaspersky Lab Tool\setup_7.0.0.180_10.05.2008_16-32.exe"
 
+--[HKEY_USERS\.DEFAULT\..\Run] 

 
+--[HKEY_CURRENT_USER\..\Internet Explorer\MAIN] 

Start Page : hxxp://famous2.topcities.com
 
+--[HKEY_LOCAL_MACHINE\..\Internet Explorer\MAIN] 

Start Page : hxxp://www.01net.com/\0http
 
+---------------------------------------------------------------------------+ 

- "C:\AD-report-09.12.2008.log" (5428 octets) 

[ END at:  7:15:55 | 09/12/2008 ] - [ Time elapsed: 26.5 seconds  ]
 
+---------------------------------------------------------------------------+
+------------------------------- [ E.O.F - 117 lines ]
+---------------------------------------------------------------------------+

madsoli · Answer

Juste pour indication:
j'ai toujours pas ''options des dossiers'' dans Outils
Gestionnaire des tâches est toujours grisé 


Pour le moment c'est tout ce que je constate

En fait,est ce que vous pensez que mes flashs disks ne sont plus virusés du fait qu'ils n'ont plus de zidane vs tito.exe et new folder.exe.
et est ce qu'il ya un moyen de complétement supprimer le dossier présent dans c ( _OTMoveIT ),car g n'arrive pas à le supprimer (Accés refusé ) et g peur qu'il me regénére les dossiers (jojo et companie) 

Merci pour votre aide, vous êtes d'un grand secours

madsoli · Answer

Bonjour ;
Tout d’abord je tiens à remercier Chiquitine29 pour son aide si précieux, je tiens à vous faire savoir que grâce à vous mon problème est résolu.

Quand à _MoveIT je suis arrivé à le supprimer avec le logiciel ToolsCleaner 
 
http://pc-system.fr/ 
https://www.commentcamarche.net/telecharger/ 34055291 toolscleaner  

-  Pour le ‘’gestionnaire des tâches’’ je l’ai rétabli à partir de regedit :
Démarrer > Exécuter >regedit > HKEY_Curent_User  > Software > Microsoft > Windows > Curent version > Policies > System 
Dans « Disable Taskmgr » changer la valeur à ‘0’

- Pour rétablir ‘’Otions des dossiers’’ allez à :
Démarrer > Exécuter > regedit >  HKEY_Curent_User  > Software > Microsoft > Windows > Curent version > Policies > Explorer
Dans « NoFolderOptions» changer la valeur à ‘0’
Redémarrer le PC.

Sur ce ;merci pour tout Chiquitine29 et à très bientôt dans d’éventuelles d’autres intervenions.

bklmm · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:02:39, on 14/03/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\windows\Explorer.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\vsnp2std.exe
C:\Program Files\BearShare\BearShare.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\logoneui.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe
C:\windows\system32\ctfmon.exe
C:\windows\system32\logoneui.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\windows\system32\svchost.exe
C:\windows\System32\WScript.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60327
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60327
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60327
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60327
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: Shell=Explorer.exe logoneui.exe
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [firewall 2008] C:\windows\system32\logoneui.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKLM\..\Policies\Explorer\Run: [SOL-9E16EA905C1] .vbe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\ie_banner_deny.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\SCIEPlgn.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: wbsys.dll,C:\PROGRA~1\KASPER~1\KASPER~1.0FO\adialhk.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O24 - Desktop Component 0: (no name) - http://free-viruscan.com/00/00/00/item1.gif
O24 - Desktop Component 1: (no name) - http://free-viruscan.com/4/images/i2.gif

afideg · Answer

Salut bklmm, 1°- Je dis bonjour ! 2°- J'explique clairement le souci qui m'envoie ici ! Afin de bénéficier d'une aide détaillée, vous devez également détailler vos problèmes pour en connaître l'origine (publicités, messages d'erreur...). 3°- Je ne squatte pas le topic d'un autre !! Il serait préférable que tu fasses ton message personnel, cela rendra les postes plus compréhensibles et la réponse à ton problème sera plus efficace Procède comme ceci : < http://pageperso.aol.fr/balltrap34/demofairesontmessage.htm > ou ainsi < http://perso.orange.fr/rginformatique/section%20virus/demofairesontmessage.htm > Guide d'utilisation du forum de CommentCaMarche.net https://www.commentcamarche.net/infos/25843-guide-d-utilisation-du-forum-de-commentcamarche-net/ Inscription CCM < http://www.commentcamarche.net/communaute/inscription.php3 >; en effet, pour contacter personnellement les seuls membres inscrits sur ce ForumCCM, il faut être également soi-même inscrit ! Bon dimanche Al.

alpha · Answer

cv tu va bien

eternam · Answer

bonjour ! 

j'ai un virus qui s'est installé sur C:\ il se nomme jojo . meme en formatant et en reinstallant XP ; il revient  Ni Norton no AVG n'ont rien fait!!

merci de votre aide 

bonnes fêtes à tous

Virus jojo,maradona,akon

62 réponses

Discussions similaires

Newsletters