win 32 invalide Résolu

Question

Bonjour,
 voilat suite a un téléchargement j'ai beaucoup de probléme mon anti -virus avast a arrétè de fonctionné en me disant qu'un programme éssaie de changé mon script .

J'éssaie les scan en ligne impossible , je demarre windows defender sa me dit " n'est pas une application valide win 32" j'éssaie de démarré hijach tis mais sa bloque et je suis obligé de redémarré. 

MAlgré mes recherches sur le site j'ai pas de réponce.
voila merci d'avance pour votre aide et si le probléme a déjà était posé dsl

sKe69 · Answer

Salut,

1-IMPORTANT : 
je rappelle que bagle est amené par un crack et qu'il se relance dès que tu te sers de celui ci; même si tu ne sers pas, il peut se relancer de lui même au démarrage de ton PC . En claire : 
Essaye surtout de te rappeler si récemment tu n'as pas cliquer sur un "patch" ou un "keygen" pour installer un logiciel, un jeu cracké ou avoir une version complète d'un soft , et qu'il ne se soit rien passé de particulier ... C'est la que les bagles s'infiltrent ! Si tu retrouves ce crack en particulier ,scratch tout ( le crack, le soft ou encore les zip concernés). Si tu ne te rappelles plus trop , je te conseille fortement de supprimer tous les cracks qui sont sur ton PC ... ;)


2-Télécharge FindyKill de Chiquitine29 : 

http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe

->Enregistre le sur ton bureau et pas ailleurs !

!! Déconnecte toi et ferme toutes applications en cours !!

( Si ton anti-virus s'affolle au moment de l'enregistrement ou de l'utilisation de l'outil , ignore l'alerte ...)

-> Clique sur "FindyKill.exe" pour lancer l'installe de l'outil . Ne touche surtout pas aux paramètres d'installation. 


Notes importantes : 
* si tu as le prg Elibagla sur ton PC , supprime le ( risque de conflit entre les deux outils ) .

--> Double clique sur le raccourci " FindyKill " qui est sur ton bureau .
( sur la 1er fenêtre , tapes f puis [entrèe] pour la version en français ). 

-->choisis l'option 1 ( recherche ) . Puis laisse travailler l'outil sans rien toucher ...

Une fois terminé, poste le rapport FindyKill.txt qui est généré ...

( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt )

PS : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. 
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. 
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.


Tuto : https://www.malekal.com/tutorial-findykill/

cedd974 · Answer

Tient voila le rapport : ----------------- FindyKill V4.706 ------------------ * User : cedd - PC-DE-CEDD * Emplacement : C:\Program Files\FindyKill * Outils Mis a jours le 27/11/08 par Chiquitine29 * Recherche effectuée à 14:28:10 le 05/12/2008 * Windows Vista - Internet Explorer 7.0.6001.18000 ((((((((((((((((( *** Recherche *** )))))))))))))))))) --------------- [ Processus actifs ] ---------------- C:\Windows\System32\smss.exe C:\Windows\system32\csrss.exe C:\Windows\system32\csrss.exe C:\Windows\system32\wininit.exe C:\Windows\system32\services.exe C:\Windows\system32\lsass.exe C:\Windows\system32\lsm.exe C:\Windows\system32\winlogon.exe C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe C:\Windows\system32\Ati2evxx.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe C:\Program Files\Thomson\ST330\service\st330service.exe C:\Windows\system32\Ati2evxx.exe C:\Windows\system32\svchost.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe C:\Acer\Empowering Technology\ePerformance\MemCheck.exe C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Windows\system32\svchost.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\Windows\system32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\system32\SearchIndexer.exe C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe C:\Windows\system32\WUDFHost.exe C:\Windows\system32\iashost.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\Dwm.exe C:\Windows\system32 askeng.exe C:\Windows\RtHDVCpl.exe C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe C:\Program Files\Alcatel\SpeedTouch USB\dragdiag.exe C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Siber Systems\AI RoboForm obotaskbaricon.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\ehome\ehmsas.exe C:\Windows\system32\svchost.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\Windows\system32\conime.exe C:\Windows\Explorer.EXE C:\Windows\System32\mobsync.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Program Files\Windows Media Player\wmplayer.exe --------------- [ Fichiers/Dossiers infectieux ] ---------------- »»»» Presence des fichiers dans C: »»»» Presence des fichiers dans C:\Windows »»»» Presence des fichiers dans C:\Windows\Prefetch »»»» Presence des fichiers dans C:\Windows\system32 »»»» Presence des fichiers dans C:\Windows\system32\drivers Found ! [05/12/2008 08:28] - C:\Windows\system32\drivers\srosa.sys Found ! [05/12/2008 10:04] - C:\Windows\system32\drivers\srosa2.sys Found ! [01/10/2004 07:08] - C:\Windows\system32\drivers\winfilse.exe Found ! [05/12/2008 08:30] - "C:\Windows\system32\drivers\downld" Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\109195551.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\109221447.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\109225098.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\109324112.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\109394094.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\109400349.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\109408992.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\109464169.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\109508177.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\14945020.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\14968295.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\14970604.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\15066545.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\15131254.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\15135934.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\15144280.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\15199099.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\15234043.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\170072.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\182224.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\184315.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\187918.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\190570.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\241910.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\287041.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\352328.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\356680.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\367725.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\414245.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\46017533.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\46040029.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\46042181.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\46113583.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\46192754.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\46196763.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\46207230.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\46264795.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\46292672.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\482838.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\60731891.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\60755104.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\60757787.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\60787131.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\60843338.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\60907251.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\60913382.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\60921292.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\60975517.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\61019089.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\75452831.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\75478384.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\75483891.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\75564216.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\75637724.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\75645212.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\75656241.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\75715366.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\75750247.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\94412444.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\94479431.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\94482738.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\94563484.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\94623233.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\94627835.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\946442.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\94659581.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\94705258.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\94734493.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\966769.exe Found ! [05/12/2008 08:30] - C:\Windows\system32\drivers\downld\969031.exe »»»» Presence des fichiers dans C:\Users\cedd\AppData\Roaming »»»» Presence des fichiers dans C:\Users\cedd\AppData\Local\Temp »»»» Presence des fichiers dans C:\Users\cedd\Local Settings\Temporary Internet Files\Content.IE5 Found ! [26/10/2008 14:43] - C:\Users\cedd\Music\Lil Jon & the East Side Boyz\Kings of Crunk (Explicit Retai\AlbumArt_{05EA33E2-D701-4096-B648-DAF1C52E8D4E}_Large.jpg Found ! [26/10/2008 14:42] - C:\Users\cedd\Music\Lil Jon & the East Side Boyz\Kings of Crunk (Explicit Retai\AlbumArt_{05EA33E2-D701-4096-B648-DAF1C52E8D4E}_Small.jpg --------------- [ Registre / Startup ] ---------------- [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion un] Sidebar=C:\Program Files\Windows Sidebar\sidebar.exe /autoRun Acer Tour Reminder=C:\Acer\AcerTour\Reminder.exe ehTray.exe=C:\Windows\ehome\ehTray.exe msnmsgr="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background RoboForm="C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" WMPNSCFG=C:\Program Files\Windows Media Player\WMPNSCFG.exe SpybotSD TeaTimer=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion un] RtHDVCpl=RtHDVCpl.exe Acer Empowering Technology Monitor=C:\Acer\Empowering Technology\SysMonitor.exe eDataSecurity Loader=C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe WarReg_PopUp=C:\Acer\WR_PopUp\WarReg_PopUp.exe Acer Tour Reminder=C:\Acer\AcerTour\Reminder.exe SpeedTouch USB Diagnostics="C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon diagnostics="C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe" /icon -l:fr IntelliPoint="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" SunJavaUpdateSched="C:\Program Files\Java\jre6\bin\jusched.exe" SpywareTerminator="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents= = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents\IMAIL= Installed=1 = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents\MAPI= NoChange=1 Installed=1 = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents\MSFS= Installed=1 = [HKEY_CURRENT_USER\software\local appwizard-generated applications\Browse] [HKEY_CURRENT_USER\software\local appwizard-generated applications\install_patch] [HKEY_CURRENT_USER\software\local appwizard-generated applications\NTI WaveEditor] [HKEY_CURRENT_USER\software\local appwizard-generated applications\playplus] [HKEY_CURRENT_USER\software\local appwizard-generated applications\Reminder] [HKEY_CURRENT_USER\software\local appwizard-generated applications\SkyTel] [HKEY_CURRENT_USER\software\local appwizard-generated applications\vscap] [HKEY_CURRENT_USER\software\local appwizard-generated applications\winfilse] --------------- [ Registre / Clés infectieuses ] ---------------- Found ! - HKEY_USERS\S-1-5-21-881487021-2558403990-3707160938-1000\Software\Local AppWizard-Generated Applications\install_patch Found ! - HKEY_USERS\S-1-5-21-881487021-2558403990-3707160938-1000\Software\Local AppWizard-Generated Applications\winfilse Found ! - HKEY_USERS\S-1-5-21-881487021-2558403990-3707160938-1000\Software\bisoft Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\install_patch Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winfilse Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA Found ! - HKEY_CURRENT_USER\Software\bisoft Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sK9Ou0s Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sK9Ou0s --------------- [ Etat / Services ] ---------------- +- Services : [ Auto=2 / Demande=3 / Désactivé=4 ] /!\ Ndisuio - Type de démarrage = 4 EapHost - Type de démarrage = 3 Wlansvc - Type de démarrage = 3 SharedAccess - Type de démarrage = 2 wuauserv - Type de démarrage = 2 wscsvc - Type de démarrage = 2 /!\ WinDefend - Type de démarrage = 4 --------------- [ Recherche dans supports amovibles] ---------------- +- Informations : C: - Lecteur fixe D: - Lecteur fixe +- presence des fichiers : --------------- [ Registre / Mountpoint2 ] ---------------- -> Not found ! ------------------- ! Fin du rapport ! --------------------

sKe69 · Answer

la suite :


1- Important :
Branche toutes tes unités externes au PC ( DD externes , clé USB , lecteur mp3, ect...) mais sans les ouvrir ! 
Tu les retireras après la manipe ... 


2- ! Ferme toutes applications en cours !

Relance FindyKill :

-> choisis cette fois-ci l'option 2 .

/!\ ton PC va redémarrer de lui même , c'est normal !... Laisse travailler l'outil jusqu' à l'apparition du message :
 "nettoyage terminé" . 

Note : lors du message d'avertissement , clique sur " Ok " .

--> ensuite poste le nouveau rapport FindyKill.txt qui est généré et attends la suite ...

( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt )


PS : Si le Bureau ne réapparait pas, presse Ctrl + Alt + Suppr , Onglet "Fichier"-> "Nouvelle tâche":
tape explorer.exe et valide .


une fois ce rapport posté ( et pas avant ! ) , fais ceci :


========================


3- Télécharge et installe le logiciel HijackThis : 

ici HijackThis 
ou ici http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe
ou ici https://www.clubic.com/telecharger-fiche17891-hijackthis.html

* Clique sur le setup pour lancer l'installe : laisse toi guider et ne modifie pas les paramètres d'installation . 
A la fin de l'installe , le prg ce lance automatiquement : ferme le en cliquant sur la croix rouge . 
Au final, tu dois avoir un raccourci sur ton bureau et aussi un cheminement comme : 
"C:\ program files\Trend Micro\HijackThis\HijackThis.exe " . 

tuto pour utilisation :
Regarde ici, c'est parfaitement expliqué en images (merci balltrap34), 
http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm 
( Ne fixe encore AUCUNE ligne, cela pourrait empêcher ton PC de fonctionner correctement )

*  !! Déconnecte toi et ferme toutes tes applications en cours !! 

Clique sur le raccourci du bureau pour lancer le prg : 
fais un scan HijackThis en cliquant sur : "Do a system scan and save a logfile" 

---> Poste le rapport généré pour analyse ...

cedd974 · Answer

suite rapport :



----------------- FindyKill V4.706 ------------------

* User : cedd - PC-DE-CEDD
* executed from : C:\Program Files\FindyKill
* Update on 27/11/08 par Chiquitine29
* Start at 14:50:29 the 05/12/2008
* Windows Vista - Internet Explorer 7.0.6001.18000
 
 
((((((((((((((( *** deleting *** ))))))))))))))))))  
 
 
--------------- [ Active Processes ] ----------------  
 

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\LogonUI.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Thomson\ST330\service\st330service.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\msinfo32.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\iashost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\alg.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\taskeng.exe
\?\C:\Windows\system32\wbem\WMIADAP.EXE
C:\Windows\system32\DllHost.exe
C:\Windows\system32\userinit.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\runonce.exe
C:\Windows\system32\conime.exe
 
--------------- [ Infected files / folders ] ----------------  
 
 
»»»» Supression files in C: 
 
 
»»»» Supression files in C:\Windows 
 
 
»»»» Supression files in C:\Windows\Prefetch 
 
 
»»»» Supression files in C:\Windows\system32 
 
 
»»»» Supression files in C:\Windows\system32\drivers 
 
Deleted ! - C:\Windows\system32\drivers\srosa.sys  
Deleted ! - C:\Windows\system32\drivers\srosa2.sys  
Deleted ! - C:\Windows\system32\drivers\winfilse.exe  
Deleted ! - C:\Windows\system32\drivers\downld\109195551.exe 
Deleted ! - C:\Windows\system32\drivers\downld\109221447.exe 
Deleted ! - C:\Windows\system32\drivers\downld\109225098.exe 
Deleted ! - C:\Windows\system32\drivers\downld\109324112.exe 
Deleted ! - C:\Windows\system32\drivers\downld\109394094.exe 
Deleted ! - C:\Windows\system32\drivers\downld\109400349.exe 
Deleted ! - C:\Windows\system32\drivers\downld\109408992.exe 
Deleted ! - C:\Windows\system32\drivers\downld\109464169.exe 
Deleted ! - C:\Windows\system32\drivers\downld\109508177.exe 
Deleted ! - C:\Windows\system32\drivers\downld\14945020.exe 
Deleted ! - C:\Windows\system32\drivers\downld\14968295.exe 
Deleted ! - C:\Windows\system32\drivers\downld\14970604.exe 
Deleted ! - C:\Windows\system32\drivers\downld\15066545.exe 
Deleted ! - C:\Windows\system32\drivers\downld\15131254.exe 
Deleted ! - C:\Windows\system32\drivers\downld\15135934.exe 
Deleted ! - C:\Windows\system32\drivers\downld\15144280.exe 
Deleted ! - C:\Windows\system32\drivers\downld\15199099.exe 
Deleted ! - C:\Windows\system32\drivers\downld\15234043.exe 
Deleted ! - C:\Windows\system32\drivers\downld\170072.exe 
Deleted ! - C:\Windows\system32\drivers\downld\182224.exe 
Deleted ! - C:\Windows\system32\drivers\downld\184315.exe 
Deleted ! - C:\Windows\system32\drivers\downld\187918.exe 
Deleted ! - C:\Windows\system32\drivers\downld\190570.exe 
Deleted ! - C:\Windows\system32\drivers\downld\241910.exe 
Deleted ! - C:\Windows\system32\drivers\downld\287041.exe 
Deleted ! - C:\Windows\system32\drivers\downld\352328.exe 
Deleted ! - C:\Windows\system32\drivers\downld\356680.exe 
Deleted ! - C:\Windows\system32\drivers\downld\367725.exe 
Deleted ! - C:\Windows\system32\drivers\downld\414245.exe 
Deleted ! - C:\Windows\system32\drivers\downld\46017533.exe 
Deleted ! - C:\Windows\system32\drivers\downld\46040029.exe 
Deleted ! - C:\Windows\system32\drivers\downld\46042181.exe 
Deleted ! - C:\Windows\system32\drivers\downld\46113583.exe 
Deleted ! - C:\Windows\system32\drivers\downld\46192754.exe 
Deleted ! - C:\Windows\system32\drivers\downld\46196763.exe 
Deleted ! - C:\Windows\system32\drivers\downld\46207230.exe 
Deleted ! - C:\Windows\system32\drivers\downld\46264795.exe 
Deleted ! - C:\Windows\system32\drivers\downld\46292672.exe 
Deleted ! - C:\Windows\system32\drivers\downld\482838.exe 
Deleted ! - C:\Windows\system32\drivers\downld\60731891.exe 
Deleted ! - C:\Windows\system32\drivers\downld\60755104.exe 
Deleted ! - C:\Windows\system32\drivers\downld\60757787.exe 
Deleted ! - C:\Windows\system32\drivers\downld\60787131.exe 
Deleted ! - C:\Windows\system32\drivers\downld\60843338.exe 
Deleted ! - C:\Windows\system32\drivers\downld\60907251.exe 
Deleted ! - C:\Windows\system32\drivers\downld\60913382.exe 
Deleted ! - C:\Windows\system32\drivers\downld\60921292.exe 
Deleted ! - C:\Windows\system32\drivers\downld\60975517.exe 
Deleted ! - C:\Windows\system32\drivers\downld\61019089.exe 
Deleted ! - C:\Windows\system32\drivers\downld\75452831.exe 
Deleted ! - C:\Windows\system32\drivers\downld\75478384.exe 
Deleted ! - C:\Windows\system32\drivers\downld\75483891.exe 
Deleted ! - C:\Windows\system32\drivers\downld\75564216.exe 
Deleted ! - C:\Windows\system32\drivers\downld\75637724.exe 
Deleted ! - C:\Windows\system32\drivers\downld\75645212.exe 
Deleted ! - C:\Windows\system32\drivers\downld\75656241.exe 
Deleted ! - C:\Windows\system32\drivers\downld\75715366.exe 
Deleted ! - C:\Windows\system32\drivers\downld\75750247.exe 
Deleted ! - C:\Windows\system32\drivers\downld\94412444.exe 
Deleted ! - C:\Windows\system32\drivers\downld\94479431.exe 
Deleted ! - C:\Windows\system32\drivers\downld\94482738.exe 
Deleted ! - C:\Windows\system32\drivers\downld\94563484.exe 
Deleted ! - C:\Windows\system32\drivers\downld\94623233.exe 
Deleted ! - C:\Windows\system32\drivers\downld\94627835.exe 
Deleted ! - C:\Windows\system32\drivers\downld\946442.exe 
Deleted ! - C:\Windows\system32\drivers\downld\94659581.exe 
Deleted ! - C:\Windows\system32\drivers\downld\94705258.exe 
Deleted ! - C:\Windows\system32\drivers\downld\94734493.exe 
Deleted ! - C:\Windows\system32\drivers\downld\966769.exe 
Deleted ! - C:\Windows\system32\drivers\downld\969031.exe 
Deleted ! - "C:\Windows\system32\drivers\downld"  
 
»»»» Supression files in C:\Users\cedd\AppData\Roaming 
 
 
»»»» Supression files in C:\Users\cedd\AppData\Local\Temp 
 
 
»»»» Supression files in C:\Users\cedd\Local Settings\Temporary Internet Files\Content.IE5 
 
Deleted ! - C:\Users\cedd\Music\Lil Jon & the East Side Boyz\Kings of Crunk (Explicit Retai\AlbumArt_{05EA33E2-D701-4096-B648-DAF1C52E8D4E}_Large.jpg    
Deleted ! - C:\Users\cedd\Music\Lil Jon & the East Side Boyz\Kings of Crunk (Explicit Retai\AlbumArt_{05EA33E2-D701-4096-B648-DAF1C52E8D4E}_Small.jpg    
 
--------------- [  Registry / Infected keys ] ---------------- 
 
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa   
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA   
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA   
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA     
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S   
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S   
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S   
Deleted ! - HKEY_USERS\S-1-5-21-881487021-2558403990-3707160938-1000\Software\Local AppWizard-Generated Applications\install_patch   
Deleted ! - HKEY_USERS\S-1-5-21-881487021-2558403990-3707160938-1000\Software\Local AppWizard-Generated Applications\winfilse   
 
--------------- [ States / Restarting of services ] ---------------- 
 


+- Services : [ Auto=2 / Request=3 / Disable=4 ] 

 Ndisuio - Type of startup  = 3 
 
 EapHost - Type of startup  = 2 
 
 Wlansvc - Type of startup  = 2 
 
 SharedAccess - Type of startup  = 2 
 
 wuauserv - Type of startup  = 2 
 
 wscsvc - Type of startup  = 2 
 
 WinDefend - Type of startup  = 2 
 
 
---------------   [ Cleaning removable drives ] ----------------  
 
+- Informations : 

C: - Lecteur fixe
D: - Lecteur fixe
J: - Lecteur amovible
L: - Lecteur amovible
 
+- deleting files : 
 
 
--------------- [ Registry / Mountpoint2 ] ----------------  
 
 
 -> Not found ! 
 
 
--------------- [ Searching Cracks / Keygen ] ----------------  
 
C:\Users\cedd\Desktop\projetC‚dric\Crack
C:\Users\cedd\Desktop\projetC‚dric\Crack\keygen.exe
C:\Users\cedd\Desktop\projetC‚dric\Crack\Long term serial.txt
C:\Users\cedd\Desktop\projetCédric\Avast AntiVirus PRO Edition 4.8.1169\Keygen.exe
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\CD VDJTimeCode
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\install_virtualdj_v3.2.exe
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Skins
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\virtualdj.exe
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\CD VDJTimeCode\VDJTimeCode.mp3
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\1 cut per beat.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\16 cuts per beat.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\2 cuts per beat.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\3 cuts per beat.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\32 cuts per beat.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\4 cuts per beat.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\6 cuts per beat.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\8 cuts per beat.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Adjustable AutoWah.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Adjustable Compressor.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Adjustable Linear Sawtooth Flanger.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Adjustable Phaser.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\AutoCut.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\AutoWah.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\AutoWah2.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\backspin.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\balance.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Beat break.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\BeatRepeat.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Brake Beat.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\brake.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Brake2.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\BrakeAndSwirlUp.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Classic Phaser.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Classic Series License Agreement.pdf
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Compressor_1.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Compressor_2.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Cut.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\cut2.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\cutfx.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\cutoff_w_slider.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Devil_Chorus.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\DFV Flanger.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Distort.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\DJCorpse_Flanger.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Echo.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Expander.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Filters.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\flanger.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Flanger2.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Flanger_Lite.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\flanger_lite_8x.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Flanging_Chorus.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Flippin Doubles.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\FlippinDouble.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\FlippinDoubles.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Full_Reverse.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Funny flanger v2.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Hallway Echo.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Heavy Echo.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\HighPass.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\highpass_w_slider.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\JN-cut.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\karaoke.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\karlette.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\LFO.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\LFO_att.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\LFO_bmh.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Limiter.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\LongFlanger.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\loop back.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\LowPass.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Matrix v1[1].1.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\metal.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\MetalSweep.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Mic_CTRL v1[1].2.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\noise.pcm
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\NorthPole.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\overloop.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\pan flanger.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Pan.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\panfx.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\panv2.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\pan_volumefix.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\plug in VST.txt
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\plug_in.xml
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\PsychoEcho.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\QuadriPhonic Flanger.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Read me first.pdf
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Repeat song.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Repeat%20song.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Repeat.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Repeat20song.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Reverb.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\reverse.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\reverse2.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Sampler.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Scicht.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Scrambler.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\ScratchRoutine01.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Scribble Scratch Beta.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\slideloop.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\SmartRepeat.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Stabs Scratch Beta.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\TK Filter V2.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Tremolo.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\TTS.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Turntable Brake.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Tv Effect.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\varloop.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Vinyl.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Virtualdj slideloop.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Virtualdj varloop.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\Vocal Remover.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\vocals+.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\vocals.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\WaterSweep.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\_PsycBpmCorrector.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Effects\_PsycOverLoop.dll
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\(Sound Effects) DJ Tools - Ambulance Passing With Siren.mp3
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\03 Now that love has gone [extract].mp3
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\20 Fingers - Short Dick Man.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\alarma submarino.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\AlbumArtSmall.jpg
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\AlbumArt_{DC823FBA-8DFF-475C-AF65-35DAC7880E1E}_Large.jpg
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\AlbumArt_{DC823FBA-8DFF-475C-AF65-35DAC7880E1E}_Small.jpg
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\alert.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\alors les jeunes ca va.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\aplauso corto.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\aplauso largo.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\around the world (8).vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\Arriba progressiva.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\bad touch.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\basic theme voice + snare.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\bel amour.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\bell.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\beso.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\Bongo safri duo.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\bounce loop.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\can't get no sleep.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\clap.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\clubland 121.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\comida de culo.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\confusion.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\copyright.txt
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\cotton eyed joe.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\coucher avec moi.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\desktop.ini
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\disco rallado.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\DJ intro jingle.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\DJ Seb MLMP - Born To Disco [extract].mp3
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\DJ Tools - Ladies & Gentlemen... I'm Your DJ.mp3
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\doo wap.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\Electric A.mp3
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\everybody have fun tonight.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\everybody say hou.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\explode.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\eye of the tiger.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\Fiesta.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\floorfilla.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\Fly with me (12).vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\Folder.jpg
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\follow me.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\FX BONGA.MP3
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\Gala - Freed From Desire (129).vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\gato.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\get busy loop.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\get low loop.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\Get more free sound effects on www.a1freesoundeffects.com.url
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\giddy laugh.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\good times 125.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\gran portazo.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\grito hombre.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\gym tonic.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\hayou ho you (4).vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\horn.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\how much is the fish.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\I can feel it.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\I have a dream.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\insomnia.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\jxcore.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\ladrido.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\latin lover (16).vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\laugh.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\les hommes c'est pas des mecs bien.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\Les nuits sans soleil(16).vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\like it like that.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\LOOP 140 ELECTRO 05.MP3
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\loose yourself loop.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\love parade.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\mama say mama sa mama cousa (4).vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\maya hii maya hou maya ho ho.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\miamy sound 116.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\no matter what you do.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\No matter who do you do (16).vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\one more time.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\oveja.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\panjabi loop.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\Peaches And Cream.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\Peche A.mp3
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\pedo.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\pills - rock me (130).vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\pump it up.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\pump up the volume.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\push.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\Put your hands up, get on the floor (summerjam sample).vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\put your hands up.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\rebuzno.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\risa hombre.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\risa mujer.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\Rock steady.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\ronquido.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\Satisfaction BASS LINE.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\satisfaction.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\sax 125.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\saxo.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\scooter maria.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\Scrathing ahh yeah (119[1].9 BMP).vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\scream.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\sex any time any where right now (16).vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\shake your body don't stop loop.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\shiny disco.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\siren.mp3
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\siren.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\siren.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\sirena.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\star trek.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\stardust 124.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\Stay.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\storm.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\syndicate of law.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\tailfeather remix intro loop.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\tarzan.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\the dj calling me (8).vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\This is one DJ you dont wanna fuck with!.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\this this this.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\tipsy loop.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\to late (4).vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\toilet.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\up and down.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\we were we will rock you[1]...singin'!!.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\whistle wolf.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\whistle.wav
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\Wooshe A.mp3
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\Wooshe B.mp3
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\yeah loop.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\zumba ‚ tchik and tchak.vdj
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Skins\@2[3].xx_Pioneer-700_COLOUR.zip
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Skins\A-Trakt.zip
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Skins\Always.zip
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Skins\ATOMIX-FR 1[1].1.zip
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Skins\Atomix.zip
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Skins\BOANERGES V 1[1].1.zip
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Skins\Boanerges.zip
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Skins\CDJ100S - By Paky_&_Snake + font for skin.zip
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Skins\CDJ100S - By Paky_&_Snake_V2+font_skin.zip
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Skins\Darkfun V2[1].01.zip
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Skins\Darkfun.zip
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Skins\D

sKe69 · Answer

Heureusement que je t'ai dis de virer tous tes cracks ! Sinon qu'est-ce que ce serait ...  ^^"

cedd974 · Answer

mdrr désolé il faut que je recommence ou pas ?

Voila le rapport de hijack:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:04:14, on 05/12/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\conime.exe
C:\Windows\explorer.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\System32\mobsync.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://moteur.chat-land.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [diagnostics] "C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe" /icon -l:fr
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: []  (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: []  (User 'Default user')
O4 - Global Startup: PCM Media Sharing.lnk = C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson/ST330/service/st330service.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: Marvell Yukon Service (yksvc) - Unknown owner - RUNDLL32.EXE (file missing)

sKe69 · Answer

Bien ...

d'autres infections en plus ....


dans l'ordre :

1- Télécharge : - CCleaner 
https://www.pcastuces.com/logitheque/ccleaner.htm 
Ce logiciel va permettre de supprimer tous les fichiers temporaires et de corriger ton registre . 
Lors de l'installation: 
-choisis bien "francais" en langue . 
-avant de cliquer sur le bouton "installer", décoche toutes les "options supplémentaires" sauf les 2 premières. 


Un tuto ( aide ): 
http://perso.orange.fr/jesses/Docs/Logiciels/CCleaner.htm 

---> Utilisation:
! déconnecte toi et ferme toutes applications en cours !
* va dans "nettoyeur" : fais -analyse- puis -nettoyage- 
* va dans "registre" : fais -chercher les erreurs- et -réparer toutes les erreurs- 
( plusieurs fois jusqu'à ce qu'il n'y est plus d'erreur ) . 

( CCleaner : soft à garder sur son PC , super utile pour de bons nettoyages ... )



2- Important :
Désactive le "tea timer" de Spybot S&D en t'aidant de ce tuto animé (merci Balltrap ;) ) : 
http://perso.orange.fr/rginformatique/section%20virus/demo%20spybot.htm
( sur la 1er image , clique sur "tea timer" pour lancer l'animation ).

En effet , il risque de géner dans le bon déroulement des outils de désinfections ...

Tu le réactiveras une fois qu'on aura finis de désinfecter ( et pas avant ! ) . 
Attention , à ce moment là, Spybot te demandera des modifs de registres : 
tu les accepteras toutes ! ...



une fois ceci fais ( et pas avant ! ) , enchaine avec la suite :


3- Télécharge ToolBar S&D ( de Eric_71/Team IDN ) sur ton bureau  :
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

( Tuto : https://sites.google.com/site/toolbarsd/aideenimages )

!! Déconnecte toi et ferme toutes tes applications en cours le temps de la manipe !! 

* Double-clique sur ToolBar SD.exe pour lancer l'outil et laisse toi guider ...  
--> Tapes sur 2 ( option " nettoyage " ) puis tape sur [Entrée]. 

Le nettoyage commence .
! ne touche à rien lors de la suppression ! 

Un rapport sera généré à la fin du processus : poste son contenu dans ta prochaine réponse
accompagné d'un nouveau rapport hijackthis pour analyse ... 

( le rapport est en outre sauvegardé ici -> C:\TB.txt )

cedd974 · Answer

-----------\  ToolBar S&D 1.2.6   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6001 ) Service Pack 1
   X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 X2 Dual Core Processor 4000+ )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : cedd ( Not Administrator ! )
   BOOT : Normal boot
   Antivirus : Norton Internet Security 2007 (Not Activated)
   Firewall  : Norton Internet Security 2007 (Not Activated)
   C:\ (Local Disk) - NTFS - Total:69 Go (Free:19 Go)
   D:\ (Local Disk) - NTFS - Total:69 Go (Free:14 Go)
   E:\ (CD or DVD)
   F:\ (USB)
   G:\ (USB)
   H:\ (USB)
   I:\ (USB)
   J:\ (USB) - FAT32 - Total:3773 Mo (Free:3 Go)
   K:\ (CD or DVD)
   L:\ (USB) - FAT - Total:1 Mo (Free:0 Go)

   "C:\ToolBar SD" ( MAJ : 04-12-2008|20:40 )
   Option : [2] ( 05/12/2008|15:37 )

   -----------\ SUPPRESSION

   Supprime! - C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Crawler Toolbar
   Supprime! - C:\Program Files\Crawler\Toolbar
   Supprime! - C:\Program Files\GamesBar\Localization-French.ini
   Supprime! - C:\Program Files\Crawler
   Supprime! - C:\Program Files\GamesBar

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="http://moteur.chat-land.org/"
   "SEARCH PAGE"="http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/"
   "SearchMigratedDefaultURL"="https://search.yahoo.com/web{searchTerms}&ei=utf-8&fr=b1ie7"
   "Url"="https://www.msn.com/fr-fr/actualite/"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="https://www.msn.com/fr-fr/"
   "Default_Page_URL"="https://fr.yahoo.com/"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"


   --------------------\  Recherche d'autres infections

   --------------------\  ROOTKIT !!

   Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA]
   Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA]
   Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA]

   --------------------\  Cracks & Keygens ..

   C:\Users\cedd\Desktop\projetC‚dric\Crack
   C:\Users\cedd\Desktop\projetC‚dric\Crack\keygen.exe
   C:\Users\cedd\Desktop\projetC‚dric\Crack\Long term serial.txt
   C:\Users\cedd\Desktop\projetCédric\Avast AntiVirus PRO Edition 4.8.1169\Keygen.exe
   C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples
   C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples
   C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples
   C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\desktop.ini



   1 - "C:\ToolBar SD\TB_1.txt" - 05/12/2008|15:38 - Option : [2]

   -----------\  Fin du rapport a 15:38:16,50




hijack


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:39:23, on 05/12/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\conime.exe
C:\Windows\explorer.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://moteur.chat-land.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [diagnostics] "C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe" /icon -l:fr
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: []  (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: []  (User 'Default user')
O4 - Global Startup: PCM Media Sharing.lnk = C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O13 - Gopher Prefix: 
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson/ST330/service/st330service.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: Marvell Yukon Service (yksvc) - Unknown owner - RUNDLL32.EXE (file missing)

cedd974 · Answer

J'airais jamais cru que mon pc était aussi infecté pourtant j'avais Avast .

sKe69 · Answer

Tu n'as toujours pas désactivé le "tea timer" de Spybot .... FAIS  LE  !


-> Important :
Désactive le "tea timer" de Spybot S&D en t'aidant de ce tuto animé (merci Balltrap ;) ) : 
http://perso.orange.fr/rginformatique/section%20virus/demo%20spybot.htm
( sur la 1er image , clique sur "tea timer" pour lancer l'animation ).

En effet , il risque de géner dans le bon déroulement des outils de désinfections ...

Tu le réactiveras une fois qu'on aura finis de désinfecter ( et pas avant ! ) . 
Attention , à ce moment là, Spybot te demandera des modifs de registres : 
tu les accepteras toutes ! ...



une fois fais , repostes un nouvel hijackthis de contrôle stp ....

cedd974 · Answer

Merci désolé si quelque fois je fait mon boulet lol

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:39:23, on 05/12/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\conime.exe
C:\Windows\explorer.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://moteur.chat-land.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [diagnostics] "C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe" /icon -l:fr
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: []  (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: []  (User 'Default user')
O4 - Global Startup: PCM Media Sharing.lnk = C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O13 - Gopher Prefix: 
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson/ST330/service/st330service.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: Marvell Yukon Service (yksvc) - Unknown owner - RUNDLL32.EXE (file missing)

cedd974 · Answer

bon j'ai refait toute les analyses pour etre plus sur :


   -----------\  ToolBar S&D 1.2.6   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6001 ) Service Pack 1
   X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 X2 Dual Core Processor 4000+ )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : cedd ( Not Administrator ! )
   BOOT : Normal boot
   Antivirus : Norton Internet Security 2007 (Not Activated)
   Firewall  : Norton Internet Security 2007 (Not Activated)
   C:\ (Local Disk) - NTFS - Total:69 Go (Free:19 Go)
   D:\ (Local Disk) - NTFS - Total:69 Go (Free:14 Go)
   E:\ (CD or DVD)
   F:\ (USB)
   G:\ (USB)
   H:\ (USB)
   I:\ (USB)
   J:\ (USB) - FAT32 - Total:3773 Mo (Free:3 Go)
   K:\ (CD or DVD)
   L:\ (USB) - FAT - Total:1 Mo (Free:0 Go)

   "C:\ToolBar SD" ( MAJ : 04-12-2008|20:40 )
   Option : [2] ( 05/12/2008|16:17 )

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="http://moteur.chat-land.org/"
   "SEARCH PAGE"="http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/"
   "SearchMigratedDefaultURL"="https://search.yahoo.com/web{searchTerms}&ei=utf-8&fr=b1ie7"
   "Url"="https://www.msn.com/fr-fr/actualite/"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="https://www.msn.com/fr-fr/"
   "Default_Page_URL"="https://fr.yahoo.com/"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"


   --------------------\  Recherche d'autres infections

   --------------------\  ROOTKIT !!

   Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA]
   Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA]
   Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA]

   --------------------\  Cracks & Keygens ..

   C:\Users\cedd\Desktop\projetC‚dric\Crack
   C:\Users\cedd\Desktop\projetC‚dric\Crack\keygen.exe
   C:\Users\cedd\Desktop\projetC‚dric\Crack\Long term serial.txt
   C:\Users\cedd\Desktop\projetCédric\Avast AntiVirus PRO Edition 4.8.1169\Keygen.exe
   C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples
   C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples
   C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples
   C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples\desktop.ini



   1 - "C:\ToolBar SD\TB_1.txt" - 05/12/2008|15:38 - Option : [2]
   2 - "C:\ToolBar SD\TB_2.txt" - 05/12/2008|16:18 - Option : [2]

   -----------\  Fin du rapport a 16:18:13,63








Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:39:23, on 05/12/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\conime.exe
C:\Windows\explorer.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://moteur.chat-land.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [diagnostics] "C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe" /icon -l:fr
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: []  (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: []  (User 'Default user')
O4 - Global Startup: PCM Media Sharing.lnk = C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O13 - Gopher Prefix: 
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson/ST330/service/st330service.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: Marvell Yukon Service (yksvc) - Unknown owner - RUNDLL32.EXE (file missing)

sKe69 · Answer

re, tu me postes à chaque fois le même rapport hijackthis !!!


refais un scan Hijackthis et postes moi le NOUVEAU rapport obtenu pour analyse ....

cedd974 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:39:23, on 05/12/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\conime.exe
C:\Windows\explorer.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://moteur.chat-land.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [diagnostics] "C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe" /icon -l:fr
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: []  (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: []  (User 'Default user')
O4 - Global Startup: PCM Media Sharing.lnk = C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O13 - Gopher Prefix: 
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson/ST330/service/st330service.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: Marvell Yukon Service (yksvc) - Unknown owner - RUNDLL32.EXE (file missing)

sKe69 · Answer

Dis moi .... tu le fais exprès ???


Logfile of Trend Micro HijackThis v2.0.2 
Scan saved at 15:39:23, on 05/12/2008 
Platform: Windows Vista SP1 (WinNT 6.00.1905) 
MSIE: Internet Explorer v7.00 (7.00.6001.18000) 
Boot mode: Normal 

C'est 4 fois le même rapport que tu me postes .... -_-

UN NOUVEAU RAPPORT .... tu refais un scan hijackthis , un fois le scan terminé , le rapport s'affiche : tu copies/colles le contenu ici .... merci

cedd974 · Answer

Non j'ai refait le scan pourtant et  entre temps j'ai téléchargé et scan avec anti-ver gdata.
 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:39:23, on 05/12/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\conime.exe
C:\Windows\explorer.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://moteur.chat-land.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [diagnostics] "C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe" /icon -l:fr
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: []  (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: []  (User 'Default user')
O4 - Global Startup: PCM Media Sharing.lnk = C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O13 - Gopher Prefix: 
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson/ST330/service/st330service.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: Marvell Yukon Service (yksvc) - Unknown owner - RUNDLL32.EXE (file missing)

cedd974 · Answer

Attend je comprend pas a chaque fois il me donne le même rapport !!!

cedd974 · Answer

Bon j'ai désinstallé avast  et installé antivir qui ma trouvé sa "TR/Dldr.Bagle.agx"

sKe69 · Answer

Ecoute, fais ce qui suit dans l'ordre :



1- protocole à suivre pour  Windows Vista :

*Désactiver le contrôle des comptes utilisateurs ou UAC (le réactiver seulement à la fin de la désinfection) :
 
Aller dans "démarrer" puis "panneau de configuration" : 
--->Sur la droite de la fenêtre , cliques sur " affichage classique "
--->Double-Cliquer sur l'icône "Comptes d'utilisateurs" 
--->Cliquer ensuite sur "Activer ou désactiver le contrôle ..." .
--->Décocher la case "utlisiser le contrôle ..." et cliquer sur OK .
Puis redémarrer le PC quand il le vous saura demandé ...

Tuto : https://forum.malekal.com/viewtopic.php?f=59&t=6517 


* Important :
Pour installer ou pour lancer les outils, que tu utiliseras au court de la désinfection, fais toujours ainsi :
clique DROIT ( sur le setup d'installe ou l'outil ) -> choisis " Exécuter entant qu'administrateur " .
Fais ce-ci systématiquement ! ...


une fois ceci fait et pris en compte , commence par ce qui suit :



2- Télécharge OTMoveIt3 (de Old_Timer) sur ton Bureau. 

http://oldtimer.geekstogo.com/OTMoveIt3.exe

! Déconnecte toi et ferme toutes tes applications en cours !
 
Double clique sur "OTMoveIt3.exe" pour ouvrir le prg . 
Puis copie ce qui se trouve en citation ci-dessous,
 

:Processes
explorer.exe

:Services

:Reg

:Files
C:\Users\cedd\Desktop\projetCédric\Avast AntiVirus PRO Edition 4.8.1169\Keygen.exe
C:\Users\cedd\Desktop\projetCédric\Crack
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples

:Commands
[start explorer]


et colle le dans le cadre de gauche de OTMoveIt3 : 
Paste Instructions for items to be moved.
(ne touche à rien d'autre !) 
 
-> clique sur MoveIt! pour lancer la suppression.
-> laisse travailler l'outil ... 

( Note : ton bureau va disparaitre puis réapparaitre, c'est normal .)

-> une fois finis , un petite fenêtre s'ouvre : clique sur " Yes " .

Ton PC va redémarrer de lui même ...

-->Poste le contenu du rapport qui se trouve dans le dossier "C:\_OTMoveIt\MovedFiles"  
( " xxxx2008_xxxxxx.log "  où les "x" correspondent au jour et à l'heure de l'utilisation  ).



3- Télécharge Random's System Information Tool (RSIT) de random/random et enregistre l'exécutable  sur ton Bureau.

-> http://images.malwareremoval.com/random/RSIT.exe

! Ferme bien toutes tes applications en cours !

Double-clique sur " RSIT.exe " pour le lancer .

-> Une première fenêtre s'ouvre avec en titre : " Disclaimer of warranty " . 

* Devant l'option "List files/folders created ..." , tu choisis : 2 months 

* clique ensuite sur " Continue " pour lancer l'analyse ...


( Note : Si la dernière version de HijackThis n'est pas détectée sur ton PC, RSIT le téléchargera et te demandera d'accepter la licence.)


-> laisse faire le scan et ne touche pas au PC ...


Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront (probablement avec le bloc-note). 

Poste le contenu de " log.txt " (c'est celui qui apparait à l'écran), ainsi que de " info.txt " (que tu verras dans la barre des tâches), pour analyse et attends la suite ...

Important : poste un rapport, puis l'autre dans la réponse suivante ... si tu essaies de poster les deux en même temps,
cela risque d'être trop long pour le forum ... 
Et si "log.txt" seul, ne passe pas non plus , fais le en 2 fois ... merci ...

( Note : les rapports seront en outre sauvegardés dans ce dossier -> C:\rsit )

cedd974 · Answer

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
File/Folder C:\Users\cedd\Desktop\projetCédric\Avast AntiVirus PRO Edition 4.8.1169\Keygen.exe not found.
C:\Users\cedd\Desktop\projetCédric\Crack moved successfully.
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples moved successfully.
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples moved successfully.
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples moved successfully.
========== COMMANDS ==========
Explorer started successfully
 
OTMoveIt3 by OldTimer - Version 1.0.7.2 log created on 12052008_193714

cedd974 · Answer

info.txt logfile of random's system information tool 1.04 2008-12-05 19:50:54

======Uninstall list======

-->MsiExec /X{7104189A-C592-4A56-AC9E-7C0CA135DA3C}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {5A2F65A4-808F-4A1E-973E-92E17824982D}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {B3F4DC34-7F60-4B7C-A79F-1C13012D99D4}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-00A1-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
Acer Arcade Live Main Page-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EFBDC2B0-FAA8-4B78-8DE1-AEBE7958FA37}\SETUP.exe"  -uninstall
Acer DV Magician-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F6EFFB76-4A07-11DA-9D78-000129760D75}\SETUP.exe"  -uninstall
Acer DVDivine-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B145EC69-66F5-11D8-9D75-000129760D75}\SETUP.exe"  -uninstall
Acer eDataSecurity Management-->C:\Acer\Empowering Technology\eDataSecurity\eDSnstHelper.exe -Operation UNINSTALL
Acer Empowering Technology-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AB6097D9-D722-4987-BD9E-A076E2848EE2}\setup.exe" -l0x40c  -removeonly
Acer ePerformance Management-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D462BF9E-0C35-4705-BF9B-3DF9F3816643}\setup.exe" -l0x40c  -removeonly
Acer HomeMedia Connect-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{132888AE-EF67-41C5-BCA2-7D5D2488AB63}\SETUP.exe"  -uninstall
Acer HomeMedia-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AA4BF92B-2AAF-11DA-9D78-000129760D75}\SETUP.exe"  -uninstall
Acer ScreenSaver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}\setup.exe" -l0x9  -removeonly
Acer SlideShow DVD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{41581EF5-45A7-11DA-9D78-000129760D75}\SETUP.exe"  -uninstall
Acer Tour-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{94389919-B0AA-4882-9BE8-9F0B004ECA35}\setup.exe" -l0x40c  -removeonly
Acer VideoMagician-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F79A208D-D929-11D9-9D77-000129760D75}\SETUP.exe"  -uninstall
Activation Assistant for the 2007 Microsoft Office suites-->"C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}\Microsoft Office Activation Assistant.exe" REMOVE=TRUE MODIFY=FALSE
Adobe Acrobat 5.0-->C:\WINDOWS\ISUN040C.EXE -f"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.isu" -c"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.dll"
Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flash Player 9 ActiveX-->C:\Windows\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
Adobe Reader 9 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A90000000001}
AGEIA PhysX v6.10.25-->MsiExec.exe /X{7104189A-C592-4A56-AC9E-7C0CA135DA3C}
AI RoboForm (All Users)-->"C:\Program Files\Siber Systems\AI RoboForm\rfwipeout.exe"
Alcatel SpeedTouch USB Software-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D41FAAA9-8048-4906-86B2-9AADEA1FA0B7}\Setup.exe"  /l040c -Control_Panel
AppCore-->MsiExec.exe /I{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}
Apple Software Update-->MsiExec.exe /I{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}
Assistant de connexion Windows Live-->MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
ATI Uninstaller-->C:\Program Files\ATI\CIM\Bin\Atisetup.exe -uninstall all
AV-->MsiExec.exe /I{F4DB525F-A986-4249-B98B-42A8066251CA}
avast! Antivirus-->rundll32 C:\PROGRA~1\ALWILS~1\Avast4\Setup\setiface.dll,RunSetup
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
Brain Coaching-->MsiExec.exe /I{42AD6CE4-B761-4ED1-9A3C-3E168F256504}
CamStudio 2.0 Fr-->"C:\Program Files\CamStudio\unins000.exe"
Capturino 1.4-->C:\Program Files\Capturino 1.4\Uninstal.exe
ccCommon-->MsiExec.exe /I{3CCAD2EF-CFF2-4637-82AA-AABF370282D3}
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Corel Paint Shop Pro Photo XI-->MsiExec.exe /I{E1C7EF5E-3A7B-4ED4-A48B-F70F1B36EAB4}
Driver Genius Professional Edition 2007-->"C:\Program Files\Driver-Soft\DriverGenius\unins000.exe"
EasyCleaner-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F5346614-B7C4-4E94-826A-E2363155233D}\setup.exe" -l0x9 
eMule-->"C:\Program Files\eMule\Uninstall.exe"
eSobi v2-->C:\Program Files\InstallShield Installation Information\{15D967B5-A4BE-42AE-9E84-64CD062B25AA}\setup.exe -runfromtemp -l0x040c
EVEREST Ultimate Edition v4.50-->"C:\Program Files\Lavalys\EVEREST Ultimate Edition\unins000.exe"
FindyKill-->C:\Program Files\FindyKill\Uninstal.exe
FirstStop WebSearch 5.0 Free Edition-->"C:\Program Files\BrushGroup\FS WebSearch 5\unins000.exe"
Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
i-Covers 2008.a-->"C:\Program Files\i-Covers\unins000.exe"
IZArc 3.6-->"C:\Program Files\IZArc\unins001.exe"
JAP-->C:\Program Files\JAP\uninstall.exe
Java(TM) 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216010FF}
Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
LiveUpdate 3.2 (Symantec Corporation)-->"C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
LiveUpdate Notice (Symantec Corporation)-->MsiExec.exe /X{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}
Ma-Config.com-->MsiExec.exe /X{49C3F7D7-215F-47D7-A93B-E9FC772A5E96}
Marvell Miniport Driver-->C:\Program Files\Marvell\Miniport Driver\Uninst.exe
MeshX - 2.0-->C:\Windows\Sbuninst.exe C:\Program Files\MeshX\uninstal.inf
Messenger Plus! Live-->"C:\Program Files\Messenger Plus! Live\Uninstall.exe"
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1 Hotfix (KB929729)-->"C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\M929729\M929729Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office Home and Student 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL
Microsoft Office Home and Student 2007-->MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE}
Microsoft Office Language Pack 2007 Service Pack 1 (SP1)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {EC50B538-CBE1-42E6-B7FE-87AA540AADFB}
Microsoft Office OneNote MUI (French) 2007-->MsiExec.exe /X{90120000-00A1-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Works-->MsiExec.exe /I{6B1CB38D-E2E4-4A30-933D-EFDEBA76AD9C}
Mozilla Firefox (3.0.4)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSN Reaper-->"C:\Program Files\MSN Reaper\uninst.exe"
MSRedist-->MsiExec.exe /I{B7C61755-DB48-4003-948F-3D34DB8EAF69}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
MSXML4 Parser-->MsiExec.exe /I{01501EBA-EC35-4F9F-8889-3BE346E5DA13}
Norton AntiVirus-->MsiExec.exe /X{830D8CBD-C668-49e2-A969-C2C2106332E0}
Norton Confidential Browser Component-->MsiExec.exe /I{4843B611-8FCB-4428-8C23-31D0A5EAE164}
Norton Confidential Web Protection Component-->MsiExec.exe /I{D353CC51-430D-4C6F-9B7E-52003DA1E05A}
Norton Internet Security (Symantec Corporation)-->"C:\Program Files\Common Files\Symantec Shared\SymSetup\{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}_10_1_0_26\{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}.exe" /X
Norton Internet Security-->MsiExec.exe /I{3672B097-EA69-4bfe-B92F-29AE6D9D2B34}
Norton Internet Security-->MsiExec.exe /I{48185814-A224-447A-81DA-71BD20580E1B}
Norton Internet Security-->MsiExec.exe /I{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}
Norton Internet Security-->MsiExec.exe /I{E3EFA461-EB83-4C3B-9C47-2C1D58A01555}
Norton Internet Security-->MsiExec.exe /I{E5EE9939-259F-4DE2-8023-5C49E16A4F43}
Norton Protection Center-->MsiExec.exe /I{9A129ABC-A53A-4209-A21E-D5DEDFB7CCA8}
NTI Backup NOW! 4.7-->"C:\Program Files\InstallShield Installation Information\{67ADE9AF-5CD9-4089-8825-55DE4B366799}\setup.exe" -removeonly 
NTI CD & DVD-Maker-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2} /l1036 CDM7
OpenOffice.org Installer 1.0-->MsiExec.exe /X{3A2AF807-9F9F-43C9-A24A-17B617238B74}
Panda ActiveScan 2.0-->C:\Program Files\Panda Security\ActiveScan 2.0\as2uninst.exe
Pilote de stockage USB2 LaCie-->C:\Windows\Drivers\LaCie\UNWISE.EXE C:\Windows\Drivers\LaCie\INSTALL.LOG
Quick Zip 4.60.019-->"C:\Program Files\QuickZip4\unins000.exe"
QuickTime-->MsiExec.exe /I{1838C5A2-AB32-4145-85C1-BB9B8DFA24CD}
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m
Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
Security Update for 2007 Microsoft Office System (KB955936)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {1D94099C-2BBA-440E-BD5E-093BBDF8F028}
Security Update for Microsoft Office Excel 2007 (KB955470)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {6E8637D8-10D6-4568-AA06-E2706F31685E}
Security Update for Microsoft Office OneNote 2007 (KB950130)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {F1B2401C-B610-4BF2-AA1C-52C55827A8F4}
Security Update for Microsoft Office PowerPoint 2007 (KB951338)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {558B709B-821B-4FC5-90FC-9A8890641E77}
Security Update for Microsoft Office system 2007 (KB951808)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {8F375E11-4FD6-4B89-9E2B-A76D48B51E00}
Security Update for Microsoft Office system 2007 (KB954326)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
Security Update for Microsoft Office Word 2007 (KB950113)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {AD72BABE-C733-4FCF-9674-4314466191B9}
Security Update for Visio 2007 (KB947590)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {6BAD036C-261F-4BEF-96CF-C20678D07A41}
Sid Meier's Civilization 4 1.61-->C:\Program Files\Take Two\Sid Meier's Civilization 4\uninst.exe
SopCast 3.0.3-->C:\Program Files\SopCast\uninst.exe
SPBBC 32bit-->MsiExec.exe /I{77772678-817F-4401-9301-ED1D01A8DA56}
SpeedTouch 330-->C:\Program Files\Thomson\ST330\Uninstall\stInstall.exe -s:scen_uninstall_st330.xml -l:fr
Spyware Terminator-->"C:\Program Files\Spyware Terminator\unins000.exe"
SymNet-->MsiExec.exe /I{2DA85B02-13C0-4E6D-9A76-22E6B3DD0CB2}
System Requirements Lab-->C:\Program Files\SystemRequirementsLab\Uninstall.exe
TuneUp Utilities 2008-->MsiExec.exe /I{5888428E-699C-4E71-BF71-94EE06B497DA}
Update for Office 2007 (KB946691)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
VideoLAN VLC media player 0.8.6b-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Virtual DJ - Atomix Productions-->C:\PROGRA~1\VIRTUA~1\UNWISE.EXE C:\PROGRA~1\VIRTUA~1\INSTALL.LOG
Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
XviD MPEG-4 Video Codec-->"C:\Program Files\XviD\unins000.exe"

======Security center information======

AV: Norton Internet Security (disabled) (outdated)
FW: Norton Internet Security (disabled)
AS: Windows Defender
AS: Norton Internet Security (disabled) (outdated)

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\QuickTime\QTSystem\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 107 Stepping 1, AuthenticAMD
"PROCESSOR_REVISION"=6b01
"NUMBER_OF_PROCESSORS"=2
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip

-----------------EOF-----------------

cedd974 · Answer

Logfile of random's system information tool 1.04 (written by random/random)
Run by cedd at 2008-12-05 19:50:51
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 1
System drive C: has 18 GB (25%) free of 71 GB
Total RAM: 1791 MB (62% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:50:52, on 05/12/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Alcatel\SpeedTouch USB\dragdiag.exe
C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Siber Systems\AI RoboFormobotaskbaricon.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32	askeng.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\explorer.exe
C:\Windows\system32\wuauclt.exe
C:\Users\cedd\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\cedd.exe
C:\Program Files\Windows Media Player\wmplayer.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://moteur.chat-land.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [diagnostics] "C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe" /icon -l:fr
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: []  (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: []  (User 'Default user')
O4 - Global Startup: PCM Media Sharing.lnk = C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O13 - Gopher Prefix: 
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson/ST330/service/st330service.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: Marvell Yukon Service (yksvc) - Unknown owner - RUNDLL32.EXE (file missing)

cedd974 · Answer

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
File/Folder C:\Users\cedd\Desktop\projetCédric\Avast AntiVirus PRO Edition 4.8.1169\Keygen.exe not found.
C:\Users\cedd\Desktop\projetCédric\Crack moved successfully.
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Samples moved successfully.
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples moved successfully.
C:\Users\cedd\Downloads\eMule\Incoming\Atomix Virtual DJ 3.2 + crack + 38 skins + 109 effects + 123 samples moved successfully.
========== COMMANDS ==========
Explorer started successfully
 
OTMoveIt3 by OldTimer - Version 1.0.7.2 log created on 12052008_193714

sKe69 · Answer

j'analyse cela et te donne la suite ...

sKe69 · Answer

Bien .... encore du travail ...



1- Tu as de gros reste de norton qu'il faut nettoyer ainsi :
Télécharge Norton removal tool sur ton bureau :
ftp://ftp.symantec.com/public/francais/removal_tools/Norton_Removal_Tool.exe

Déconnecte toi . 
Ensuite désinstalle Norton avec "Norton removal tool": tu double-cliques dessus et tu te laisses guider ... il faut le désinstaller correctement ( fais la manipe 2 fois si possible ). 




2- refais un coup de CCleaner ( registre compris ) .



3- Télécharge UsbFix ( de Chiquitine29 et Chimay8 ) sur ton bureau : 

http://sd-1.archive-host.com/membres/up/116615172019703188/UsbFix.exe

! Déconnecte toi d'internet et ferme toutes applications en cours !

--> Double-clique sur l' .exe pour lancer l'installation de l'outil ( ne touche pas aux paramètres d'installe ) .

Impératif :
Branche toutes tes unités externes à ton PC (clé USB, DD externe, flash disk, lecteur MP3, etc...) succeptibles d'avoir été infectés, ainsi que les CD et DVD rom dont tu te sers éventuellement le plus souvent ( mais sans les ouvrir ! ) . 


--> Double-clique sur le raccourci "UsbFix" qui est sur ton bureau pour lancer l'outil :

* Tape sur 1 ( option " nettoyage " ) puis sur [entrée] et suis les instructions ...

--> Le pc va redémarrer ... laisse travailler l'outil et ne touche à rien ...
( Note : pour les unités externes non utlisées, clique sur "continuer" lors du message d'avertissement )


--> Une fois de retour à ton bureau , attends le message de fin du nettoyage ,
puis appuie sur une touche pour que le rapport "UsbFix.txt" s'affiche .

Fais un copier/coller de son contenu dans ta prochaine réponse pour analyse et attends la suite .... 

( Note : le rapport UsbFix.txt est sauvegardé a la racine du disque dur > C:\UsbFix.txt )


PS : Si le Bureau ne réapparait pas, presse Ctrl + Alt + Suppr , Onglet "Fichier"-> "Nouvelle tâche":
tape explorer.exe et valides .



4- Refais un scan RSIT , poste le nouveau rapport " log.txt" obtenu et attends la suite ....

cedd974 · Answer

Le rapport ne s'est pas affiché apres re démarrage : mias je s'est pas si s'est sa j'ai recherche dans la racine rien donc j'ai cherché dans le programme : c:/programme/usbfix/changelog Changelog UsbFix établit le 2 decembre 2008 outils créé par Chiquitine29 , aide aux mises a jours -> Chimay8 >>>>>>in "ProgramFiles"<<<<<<<<< Internet Explorer\Connection Wizard\icwconn1 ada Internet Explorer\Connection Wizard\icwconn1 ade Internet Explorer\Connection Wizard\icwconn1 adf Internet Explorer\Connection Wizard\icwconn1 ad5 Internet Explorer\Connection Wizard\icwconn1 ad0 Internet Explorer\Connection Wizard\icwconn1 ad9 Internet Explorer\Connection Wizard\icwconn1 ad4 Internet Explorer\Connection Wizard\icwconn1 ad1 Internet Explorer\Connection Wizard\icwconn1 Movie Maker\explorer.exe Internet Explorer\explorer.exe >>>>>>in "Windows"<<<<<<<<< autorun.inf autorun.exe autorun.vbs autorun.reg autorun.ini autorun.fcb autorun.bat autorun.com AdobeR.exe Alecks.vbs bittorrent.exe cmd32.exe CwbRmDir.bat Fonts\Fonts.exe FS6519.dll.vbs funny.exe GMOGLFEO.exe hiqalowo.inf icapy.scr ilezyvu.bin Lany.vbs lumy.exe manulopa.reg MS32DLL.dll.vbs MyMP3.vbs nar.vbs osok.inf osotilasiq.pif oxafa.com qobo.dat rundll32.vbe sleep.vbe SysRes.vbs takice.lib tusoha.exe unahafiwik.exe waol.exe waziqepehi.ban WillPolo.vbs Win32DLL.vbs win.vbe window.exe wyzeha.com xcopy.exe yjilu.inf ylacupyb.dll RECYCLER\systems.com temp\039.tmp >>>>>>in "Windows\system32"<<<<<<<<< agucuri.vbs ahr.exe Alecks.vbs antinul.vbe amvo.exe amvo0.dll amvo1.dll amvo2.dll autorun.bat Autorun.com autorun.exe autorun.fcb autorun.inf autorun.ini autorun.reg autorun.vbs Autoruns.exe avpo.exe avpo0.dll avpo1.dll Bitkvo.exe Bitkv0.dll Bitkv1.dll cftmonn.exe Christina.jpg Christina.vbs ckvo.exe ckvo0.dll ckvo1.dll ckvo2.dll cradle_of_filth.vbe delself.bat FS6519.dll.vbs GMOGLFEO.exe icf.exe.exe ie.exe jvvo.exe jvvo0.dll jvvo1.dll jvvo2.dll jvvo3.dll j3ewro.exe jwedsfdo0.dll jwedsfdo1.dll jwedsfdo2.dll jwedsfdo3.dll jxnraqjxg.exe kavo.exe kamsoft.exe kav0.dll kav1.dll kav2.dll kav3.dll kavo0.dll kavo1.dll kavo2.dll kavo3.dll kdkfm.exe KEYBOARD.exe keygen.exe kulitut.bat kulitut.vbs kxvo.exe kxvo0.dll kxvo1.dll kxvo2.dll kxvo3.dll lExplore.exe loader.exe logoneui.exe LOVE-LETTER-FOR-YOU.HTM LOVE-LETTER-FOR-YOU.TXT.vbs msfun80.exe msime82.exe MSKernel32.vbs ne0kS.dll.wsf ne0kS.exe OeApi.vbs pubnet.vbs rs32net.exe SemiAntiVirus.vbs Sexy Girls.scr SpiderH.bmp SpiderH.jpeg SpiderH.vbs sys.vbs Syso.vbs SysRes.vbs syx.exe taso.exe tavo.exe tavo0.dll tavo1.dll tavo2.dll tavo3.dll temp1.exe temp2.exe temp?.exe text.txt Ecran.exe THe Girls tmp.reg tmp.txt t.txt vb@dock.vbs vl@dock.vbs Win32.vbs winudp64.exe dllcache\Default.exe >>>>>>in "Windows\system32\drivers"<<<<<<<<< ._Sanaa style-1 les formes.exe 0hct8ybw.exe 1ere partie du projet modifier.exe abdelali lahrach.exe Analyse transactionnelle.exe AutoRun.exe Bernoulli01215.exe" Cahiers français Quels modes de financement pour les entreprises - La Documentation française.exe Copie de Devoir I.exe e-ticket Juba Paris.exe fdfp2.exe fihi ghizlane Rapport de stage.exe graphic.exe intel.exe isew32.exe kheireddine.exe le_cadeau_du_sud(1).exe LEADERSHIP SKILLS FINAL.exe lettre de motivation.exe MSDS.exe Note.exe PREMIER CHAPITRE modifié.exe Raila Odinga.exe Rapport NADIA.exe spectro_masse1.exe td de reacteur.exe these-223.exe xyw9tmdj.exe >>>>>>in "Documents and Settings"<<<<<<<<< tazebama.dl_ hook.dl_ >>>>>>in "appdata"<<<<<<<<< fetomiv.vbs gumugy.vbs jicapikase.vbs mobyhikaja.vbs nebohozi.com orimuwy.exe sidymyvig.vbs tazebama azebama.log tazebama\zPharaoh.dat tazebama >>>>>>in "Temp files"<<<<<<<<< 1.reg 2.dll 6257890.exe fq9.dll help.exe help1.rar inst.exe system.dll w2e.sys winhqqo.exe wintoift.exe xhjb.dll xxx6042.exe zb5ok.dll >>>>>>in "All Drives"<<<<<<<<< ._autorun.inf autorun.inf autorun.ini autorun.reg autorun.bat autorun.vbs autorun2.inf autosys.exe 00hoeav.com 096.bat 0gjn3yw.exe 0qx0sc6.bat 0tmhoc.cmd 0u.cmd 0w.com 0wk2.cmd 108i.cmd 1aq1obb.bat 1bbvq96y.com 1dg.exe 1i.com 1nkbd8h.bat 1rfw8hjr.com 1u0o8bnq.cmd 1weicxa.com 1XXEC.exe 22xo.exe 2ifetri.cmd 2y8la.exe 30ed3.exe 33gmhso.bat 39lpji.com 3o.exe 3wcxx91.cmd 3xXx31.exe 4vzjaw3o.sys 62oop0ak.bat 68.exe 6tkoyhx.cmd 6x8be16.cmd 8e9gmih.bat 8ng8w.com 93vx0c.com 9yqusig.bat 22wcb21o.exe 31n3b2h.exe 39lpji.com 80avp08.com 82r9.cmd 83fgj.com 83l3v.cmd 8df.exe > 8h3hh3m.exe 8tss2gwq.bat 90imhpnc.exe 92j11sm.com 9es.com a1.bat a9.com abk.bat activexdebugger32.exe Administrateur_Fichiers.exe admp.exe adobeR.exe Akon.exe Alecks.vbs antihost.exe antinul.vbe aoutfq.exe ar.exe Atisetup.exe auto.exe autorum.exe AutoRun\Demo.exe autorun.exe autorun.pif autoruns.exe AutoScr.exe ay8p6v3.cmd Ayame.exe b3b9u.com bicsxk03.com bittorrent.exe bndafai.exe bo1dhu.bat bobm.exe boot.exe bootin.exe bplrl98.cmd buis.exe bwpncb6.com bxuup9r.bat c18vk.exe c9.com c9hehpa.bat camp.exe cayfq2.cmd cd8idoyl.com cdr.exe ceb6eu98.bat cekbru.pif clear.bat ClickMe.exe cftmonn.exe cfv90h.com Christina.vbs cjq.exe commands.txt comment.htt copetttt.com copy.exe cradle_of_filth.vbe cqdis.cmd cvqkuk.exe d3bn0j.exe ddyikr.cmd delautorun.bat DFD34719171.bat DFD34719375.bat DFD34719609.bat DFD34723328.bat DFD34723375.bat DFD34723781.bat DFD34724390.bat DFD34719609.bat DFD34724531.bat DFD34724656.bat DFD34725125.bat DFD34725218.bat DFD34726312.bat DFD34724390.bat DFD34726328.bat DFD34729609.bat DFD34730531.bat DFD34730937.bat DFD34734937.bat DFD34739859.bat DFD34741421.bat DFD34741734.bat DFD34741843.bat DFD*.bat dhv2u8.cmd DPFMate.exe dstart.exe dtqlv.exe dynrn6e.cmd e898.com e9ehn1m8.com eb9ehyh.exe Ecran.exe ek.com ekf6dbg0.com ekugb3.bat erdeIect.com esta ig.vbs ev60a2.cmd explorer.exe exqmmle.exe f0.cmd f2ir.com fe.bat ffojc.com fi.cmd FLIPART.EXE folder.exe Folder.htt fooool.exe Form5.exe forSV.exe FS6519.dll.vbs fucker.vbs fun.xls.exe g2p3s.exe g2pfnid.com g83816.com gdmae.bmp Ghost.pif gkyzcijfb.exe GMOGLFEO.exe gqsk.bat graphic.exe gsxlexd.cmd gxlxknou.exe gy.cmd h0s2.bat h2.com hfhludy.exe hgu.bat hni.cmd host.exe hsomklg.exe hxt9.bat i0.cmd i8.cmd ie.exe igxv.cmd ij.bat ilpg9ejd.com info.exe infrom.exe ino6.com install.exe intel.exe intro.exe ipy.cmd iq0ecwcj.cmd lsass.exe itsduel.exe iwjj.com j4c8t8b5l3a6.exe j8q8d.cmd jbfqv8j.cmd jdhc2x2.com jdwx.exe jfjsipw.exe jfvkcsy.bat jiwsxh39.exe JJJ.exe Jojo.exe jwwgtuh.exe jxnraqjxg.exe jxpiinstall.exe k6wkwon2.exe ka1nk.bat kaq86asx.bat kayira.bat kbqbptn.exe kdkfm.exe kdy.cmd kfmyoc.pif khbph.exe killVBS.vbs kk3.bat KM.exe kmd.exe kn6jhgc.cmd kqnns.exe kqsr.exe krg62.cmd kulitut.bat kulitut.vbs kxax.cmd l2f.cmd l9dwu8.bat lExplore.exe lgcadwx.bat lgrncie.bat lky.exe ln9.exe lo.exe loader.exe logoneui.exe Long.exe LOVE.PIF ltljrg.exe lumy.exe lurjlnps.exe lvxvo1xg.cmd m1t8ta.com m9j.com mail.exe manulopa.reg mcxa.exe Menu.exe mgjpcfdg.cm mnl6on3.com mp.bat mp.cmd mp.com Movie1.exe mrsne.bat MS-DOS.com MS32DLL.dll.vbs MSd040.vbs MSdC64.vbs MSdFB7.vbs MSd141.vbs MSd191.vbs MSd49A.vbs MSdE78.vbs MSd*.vbs mshta.exe MSKernel32.vbs muniu.exe MyMP3.vbs n1detect.com n2de.cmd n6j.com n6j6pc0.com n6t1h.cmd nansy ajram.vbs nar.vbs ne0kS.exe nemesis.exe nemesis.inf nfdmg.com nideiect.com niu.exe njibyekk.com nl.com nncu6kk.com NoLimit.exe np.exe nq0cq.cmd nqvarn.pif nriljal.exe ntde1ect.com ntdelect.com nq.bat nq0cq.cmd nqgcd.com nsv.bat nw0t1l0d.exe o2yf0w.bat o9o2u.bat o6opnro.bat OeApi.vbs oegbi.exe ogcikeq.com oka3yrf.bat oq.cmd oskkofa.exe osotilasiq.pif osy3.sys otyh.cmd oufddh.exe oxafa.com p3r1ud.exe p83gjy.exe p9.exe pa39xth.cmd pagefile.pif pbwkwj.com pefbutr.exe pkxfkrki.bat ph.com phgr1j.bat phim_nguoi_lon.exe pnc.exe prhyper.exe psqrhqn.exe pxka.exe q3v.com q83iwmgf.bat q8sywiva.cmd qcwpung.exe qd.cmd qjfl.exe qkarc.exe qquq.bat qqzjnhuoi.exe qpe6.com qobo.dat qrkugxtw.exe qxbx9blb.com r1y1.bat r2nl.com r6r.exe r813.bat Raila Odinga.exe Raila Odinga.gif ranvrgn.exe ravmon.exe ravmon.log ReadMe.exe RecInfo\RecInfo.exe Recycle.exe Recycled\ctfmon.exe RECYCLED\INFO.exe Recycled.exe RECYCLER\Lock Folder.exe RECYCLER\RECYCLER.exe RECYCLER\*.exe regxpcom.exe resycled\boot.com resycled\ctfmon.exe revo.exe rggbw.exe rjiybg.exe rn.exe rombkaewl.exe rosftpm.exe rqq2v.bat rs.cmd rt.exe Run.exe runaut~1\autorun.pif RunDll32.exe rxukgcm.exe s38k.exe sal.xls.exe sasyg1y8.com script.bat scriptlo.txt scvhosts.exe sdcvhost.exe SemiAntiVirus.vbs smkjd.cmd smss.exe semo2x.exe spq.bat serivces.exe server.exe server.inf Sex City.jpg.wsf sowar.vbs SpiderH.vbs sq.com sqlserv.exe SSVICHOSST.exe stwi.com svch0st.exe scvhosts.exe svdioajm.cmd sxs.exe sydp.exe sys.vbs Syso.vbs SysRes.vbs system.exe system32.exe systems.com systems.exe t82e2v.cmd TAE7ESLP.exe taipingtianguov1.1.exe takice.lib tel.xls.exe temp.bat temp.exe temp.temp temp1.exe temp2.exe test.exe testfile.bat testflo.bat tfk8.exe The_Cars.vbs THe Girls tknapl.exe tknn6.bat tmf3w3g0.com TMMDW8LP.exe Toy.exe tusoha.exe tyktjfww.exe u18vxqle.com u6k.cmd u9dyi.exe udnnnvq.exe UFO.exe ufuaugwq.exe uis.com uis.exe um.cmd un9.cmd unahafiwik.exe UnplugDrive.exe uorys.cmd update.exe uqhqx1.cmd usdeiect.com userinit.exe utdetect.com uxdeiect.com u?de?ect.com v2h3.exe v3pif.bat VB6FR.DLL vb@dock.vbs vfpkkbq.exe vksucydrh.exe vl@dock.vbs vmhr.bat vmyphd.bat vva0hc0p.cmd vxl.exe w0o.com w0owgn.bat w32sys.exe w3dn9f.bat waziqepehi.ban wa6.vbs Wallpaper.vbs WallpaperMEHDI.vbs wfhth.exe whi.com WillPolo.vbs WINDOWS.EXE Windows.scr winfile.exe winglogon.exe winrun.vbs winstall.exe wjlfhtfm.cmd wol.exe wsctf.exe wtbcccq.exe x0.cmd XAdeIect.com xcopy.exe xfoolavp.com xih9.cmd xj.bat xk2n.bat xlk9.com xlu8a8sy.exe xmnm2.cmd xn1i9x.com xnynrnh.exe xo8wr9.exe xp19.com xpbkh.com xqf.com xvlyb.exe xyhav.pif y82td3td.com ybj8df.exe yew.bat yg.cmd yjilu.inf ylacupyb.dl ylr.exe yjkjfuo.cmd yjvmtaa.exe ynfs9ks.cmd yssjnngm.cmd yvmkdwn.exe zPharaoh.exe 0.cmd 1.cmd 2.cmd 3.cmd 4.cmd 5.cmd 6.cmd 7.cmd 8.cmd 9.cmd 0.bat 1.bat 2.bat 3.bat 4.bat 5.bat 6.bat 7.bat 8.bat 9.bat 0.exe 1.exe 2.exe 3.exe 4.exe 5.exe 6.exe 7.exe 8.exe 9.exe 0.com 1.com 2.com 3.com 4.com 5.com 6.com 7.com 8.com 9.com 0.vbs 1.vbs 2.vbs 3.vbs 4.vbs 5.vbs 6.vbs 7.vbs 8.vbs 9.vbs a.com b.com c.com d.com e.com f.com g.com h.com i.com j.com k.com l.com m.com n.com o.com p.com q.com r.com s.com t.com u.com v.com w.com x.com y.com z.com a.bat b.bat c.bat d.bat e.bat f.bat g.bat h.bat i.bat j.bat k.bat l.bat m.bat n.bat o.bat p.bat q.bat r.bat s.bat t.bat u.bat v.bat w.bat x.bat y.bat z.bat a.cmd b.cmd c.cmd d.cmd e.cmd f.cmd g.cmd h.cmd i.cmd j.cmd k.cmd l.cmd m.cmd n.cmd o.cmd p.cmd q.cmd r.cmd s.cmd t.cmd u.cmd v.cmd w.cmd x.cmd y.cmd z.cmd a.exe b.exe c.exe d.exe e.exe f.exe g.exe h.exe i.exe j.exe k.exe l.exe m.exe n.exe o.exe p.exe q.exe r.exe s.exe t.exe u.exe v.exe w.exe x.exe y.exe z.exe a.vbs b.vbs c.vbs d.vbs e.vbs f.vbs g.vbs h.vbs i.vbs j.vbs k.vbs l.vbs m.vbs n.vbs o.vbs p.vbs q.vbs r.vbs s.vbs t.vbs u.vbs v.vbs w.vbs x.vbs y.vbs z.vbs *.dll.vbs >>Dossiers : AutoRun autorun.inf fsc.tmp RecInfo Recycled\Recycled Recycler\Recycler resycled runaut~1 sdlflzoip >>>>>>"Registry"<<<<<<<<< [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Window Title"=- "Start Page"=- "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN] "Start Page"="https://www.msn.com/fr-fr" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "fucker"=- "SysDir"=- "ms32dll"=- "cftmonn"=- "Lany"=- "Zip"=- "RavAV"=- "cmd32"=- "Install.exe"=- "FIXEDFON.FON"=- "MS-RAD0"=- "MS-RAD1"=- "MS-RAD2"=- "MS-RAD3"=- "MS-RAD4"=- "MS-RAD5"=- "MS-RAD6"=- "MS-RAD7"=- "MS-RAD8"=- "MS-RAD9"=- "MS-RADA"=- "MS-RADB"=- "MS-RADC"=- "MS-RADD"=- "MS-RADE"=- "MS-RADF"=- "MS-RADG"=- "MS-RADH"=- "MS-RADI"=- "MS-RADJ"=- "MS-RADK"=- "MS-RADL"=- "MS-RADM"=- "MS-RADN"=- "MS-RADO"=- "MS-RADP"=- "MS-RADQ"=- "MS-RADR"=- "MS-RADS"=- "MS-RADT"=- "MS-RADU"=- "MS-RADV"=- "MS-RADW"=- "MS-RADX"=- "MS-RADY"=- "MS-RADZ"=- " "=- "winrun.dll"=- "loader.exe"=- "recinfo49"=- "System"=- "System Updater Machine"=- "SpiderH"=- "winudp64.exe"=- "System12"=- "System64"=- "IMJPMIG8.2"=- "CARPService"=- "039.tmp"=- "userd"=- "nar"=- "MSKernel32"=- "WillPolo"=- "MyMP3"=- "FS6519"=- "Windows\SysRes.vbs"=- "SysRes"=- "Raila Odinga"=- "reginit"=- "lnternet Update"=- "GMOGLFEO"=- "WintelUpdate"=- "Pubnet"=- "antihost"=- [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices] "System Updater Machine"=- "Win32DLL"=- "lnternet Update"=- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] " "=- [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RavAV] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "kamsoft"=- "amva"=- "kava"=- "tava"=- "avpa"=- "internet_explorer"=- "anti-virus 2007"=- "Mp3 player"=- "kxvo"=- "EXPLORER.EXE"=- "wsctf.exe"=- "loader.exe"=- "jvvo"=- "taso"=- "Avg_AntiHost"=- "jvsoft"=- "tasoft"=- "SpiderH"=- "MsServer"=- "MSFox"=- "msn"=- "????r"=- "Windows Update"=- "Microsoft Debug Manager"=- "protect_autorun"=- "Le Petit Robert Hyperappel"=- "firewall 2008"=- " "=- [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce] " "=- [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] "test"=- "Msn"=- "MsnHost"=- "MsnLoad"=- "MsnConvert"=- "MsnMessendger"=- "sys"=- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "DefaultUserName"=- "LegalNoticeCaption"=- "LegalNoticeText"=- [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop\NoChangingWallPaper]

cedd974 · Answer

Bon j'ai refait une analyse hijack voila le resultat :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:50:52, on 05/12/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Alcatel\SpeedTouch USB\dragdiag.exe
C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Siber Systems\AI RoboFormobotaskbaricon.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32	askeng.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\explorer.exe
C:\Windows\system32\wuauclt.exe
C:\Users\cedd\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\cedd.exe
C:\Program Files\Windows Media Player\wmplayer.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://moteur.chat-land.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [diagnostics] "C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe" /icon -l:fr
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: []  (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: []  (User 'Default user')
O4 - Global Startup: PCM Media Sharing.lnk = C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O13 - Gopher Prefix: 
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson/ST330/service/st330service.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: Marvell Yukon Service (yksvc) - Unknown owner - RUNDLL32.EXE (file missing)

sKe69 · Answer

ce n'est pas ce que je t'ai demandé ...

" 4- Refais un scan RSIT , poste le nouveau rapport " log.txt" obtenu et attends la suite .... "


^^

cedd974 · Answer

Logfile of random's system information tool 1.04 (written by random/random)
Run by cedd at 2008-12-05 21:40:24
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 1
System drive C: has 18 GB (26%) free of 71 GB
Total RAM: 1791 MB (62% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:40:26, on 05/12/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Alcatel\SpeedTouch USB\dragdiag.exe
C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Siber Systems\AI RoboFormobotaskbaricon.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\wuauclt.exe
C:\Users\cedd\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\cedd.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://moteur.chat-land.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [diagnostics] "C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe" /icon -l:fr
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: []  (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: []  (User 'Default user')
O4 - Global Startup: PCM Media Sharing.lnk = C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O13 - Gopher Prefix: 
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson/ST330/service/st330service.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: Marvell Yukon Service (yksvc) - Unknown owner - RUNDLL32.EXE (file missing)

sKe69 · Answer

BOn ...cela n'a pas fonctionné ....


mais je viens d'apprendre que UsbFix viens juste d'être mis à jours ... ^^


donc voilà ce que tu vas faire :


1- Important :

Supprime UsbFix ainsi :
* Va sur " démarrer " / "tous les programmes" / "UsbFix" --> clique sur "Uninstal Usbfix" . 

* Ou bien rends toi dans ce dossier > C:\Program Files\UsbFix .
là tu double-cliques sur le fichier " Uninstal.exe " pour désinstaller proprement l'outil ...



2- Re-télécharge la dernière version et on recommence :

Télécharge UsbFix ( de Chiquitine29 et Chimay8 ) sur ton bureau : 

http://sd-1.archive-host.com/membres/up/116615172019703188/UsbFix.exe

! Déconnecte toi d'internet et ferme toutes applications en cours !

--> Double-clique sur l' .exe pour lancer l'installation de l'outil ( ne touche pas aux paramètres d'installe ) .

Impératif :
Branche toutes tes unités externes à ton PC (clé USB, DD externe, flash disk, lecteur MP3, etc...) succeptibles d'avoir été infectés, ainsi que les CD et DVD rom dont tu te sers éventuellement le plus souvent ( mais sans les ouvrir ! ) . 


--> Double-clique sur le raccourci "UsbFix" qui est sur ton bureau pour lancer l'outil :

* Tape sur 1 ( option " nettoyage " ) puis sur [entrée] et suis les instructions ...

--> Le pc va redémarrer ... laisse travailler l'outil et ne touche à rien ...
( Note : pour les unités externes non utlisées, clique sur "continuer" lors du message d'avertissement )


--> Une fois de retour à ton bureau , attends le message de fin du nettoyage ,
puis appuie sur une touche pour que le rapport "UsbFix.txt" s'affiche .

Fais un copier/coller de son contenu dans ta prochaine réponse pour analyse et attends la suite .... 

( Note : le rapport UsbFix.txt est sauvegardé a la racine du disque dur > C:\UsbFix.txt )


PS : Si le Bureau ne réapparait pas, presse Ctrl + Alt + Suppr , Onglet "Fichier"-> "Nouvelle tâche":
tape explorer.exe et valides .

sKe69 · Answer

Et n'oublie pas ! 
-> toujours : clique droit / " exécuter entends qu'administrateur " pour lancer un outil ! ... ;)

cedd974 · Answer

JE vais continuer la manip demain je te remerci déjà pour ton aide mon PC est déjà beaucoup plus rapide .

cedd974 · Answer

Bonjour , 
j'ai fait exactement se que tu ma dit mais aucun rapport même dans la racine j'ai fait une capture :

https://imageshack.com/

sKe69 · Answer

Salut,


Arff ... je sais d'où cela vient ^^


Toolbar S&D à réactiver l'UAC ... Donc il faut que tu refasses ceci :


*Désactiver le contrôle des comptes utilisateurs ou UAC (le réactiver seulement à la fin de la désinfection) :
 
Aller dans "démarrer" puis "panneau de configuration" : 
--->Sur la droite de la fenêtre , cliques sur " affichage classique "
--->Double-Cliquer sur l'icône "Comptes d'utilisateurs" 
--->Cliquer ensuite sur "Activer ou désactiver le contrôle ..." .
--->Décocher la case "utlisiser le contrôle ..." et cliquer sur OK .
Puis redémarrer le PC quand il le vous saura demandé ...

Tuto : https://forum.malekal.com/viewtopic.php?f=59&t=6517 


* Important :
Pour installer ou pour lancer les outils, que tu utiliseras au court de la désinfection, fais toujours ainsi :
clique DROIT ( sur le setup d'installe ou l'outil ) -> choisis " Exécuter entant qu'administrateur " .
Fais ce-ci systématiquement ! ...


une fois ceci fait et pris en compte , reprends la manipe de UsbFix et poste moi le rapport obtenu ... ;)

cedd974 · Answer

-------------- UsbFix V2.413.3 --------------- * User : cedd - PC-DE-CEDD * Outils mis a jours le 05/12/2008 par Chiquitine29 et Chimay8 * Recherche effectuée à 18:10:48 le 06/12/2008 * Windows Vista - Internet Explorer 7.0.6001.18000 --------------- [ Processus actifs ] ---------------- C:\Windows\System32\smss.exe C:\Windows\system32\csrss.exe C:\Windows\system32\wininit.exe C:\Windows\system32\csrss.exe C:\Windows\system32\services.exe C:\Windows\system32\lsass.exe C:\Windows\system32\lsm.exe C:\Windows\system32\winlogon.exe C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe C:\Windows\system32\Ati2evxx.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe C:\Windows\system32\Ati2evxx.exe C:\Program Files\Thomson\ST330\service\st330service.exe C:\Windows\system32\msinfo32.exe C:\Windows\system32\svchost.exe C:\Windows\System32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Windows\system32\svchost.exe C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe C:\Acer\Empowering Technology\ePerformance\MemCheck.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\Windows\system32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\RUNDLL32.EXE C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe C:\Windows\system32\iashost.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\System32\alg.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\userinit.exe C:\Windows\system32\Dwm.exe C:\Windows\system32 askeng.exe C:\Windows\system32 askeng.exe C:\Users\cedd\AppData\Local\Temp\E501.tmp\b2e.exe C:\Windows\system32\conime.exe C:\Windows\RtHDVCpl.exe C:\Acer\Empowering Technology\SysMonitor.exe C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe C:\Acer\WR_PopUp\WarReg_PopUp.exe C:\Program Files\Alcatel\SpeedTouch USB\dragdiag.exe C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\Adobe\Reader 9.0\Reader eader_sl.exe C:\Windows\system32\DllHost.exe --------------- [ Informations lecteurs ] ---------------- C: - Lecteur fixe D: - Lecteur fixe E: - Lecteur de CD-ROM J: - Lecteur amovible L: - Lecteur amovible +- Contenu de l'autorun : E:\autorun.inf [autorun] ICON=hm.ico OPEN=Hackers_Mag_24.exe --------------- [ Lecteur C ] ---------------- C: - Lecteur fixe +- Listing des fichiers présents : [12/09/2008 22:07][--a--c---] C:\AUTOEXEC.BAT [01/09/2008 19:57][--a--c---] C:\AILog.txt [01/09/2008 19:57][--a--c---] C:\FindyKill.txt [01/09/2008 19:57][--a--c---] C:\TB.txt [01/09/2008 19:57][--a--c---] C:\UsbFix.txt [19/09/2006 00:43][--a------] C:\config.sys [19/09/2006 00:43][--a------] C:\IO.SYS [19/09/2006 00:43][--a------] C:\MSDOS.SYS [19/09/2006 00:43][--a------] C:\pagefile.sys --------------- [ Lecteur D ] ---------------- D: - Lecteur fixe +- Listing des fichiers présents : [08/08/2008 00:57][--ahs----] D:\desktop.ini --------------- [ Lecteur E ] ---------------- E: - Lecteur de CD-ROM +- Listing des fichiers présents : [19/06/2008 13:10][-r-------] E:\Hackers_Mag_24.exe [19/06/2008 13:12][-r-------] E:\autorun.inf --------------- [ Lecteur J ] ---------------- J: - Lecteur amovible +- Listing des fichiers présents : [04/12/2008 11:29][--ah-----] J:\audio_play_list.txt --------------- [ Lecteur L ] ---------------- L: - Lecteur amovible +- Listing des fichiers présents : [27/11/2008 19:27][---h-----] L:\audio_play_list.txt --------------- [ Registre / Startup ] ---------------- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "Userinit"="C:\Windows\system32\userinit.exe," [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "SEARCH PAGE"="http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/" "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion un] Sidebar=C:\Program Files\Windows Sidebar\sidebar.exe /autoRun ehTray.exe=C:\Windows\ehome\ehTray.exe msnmsgr="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background RoboForm="C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" WMPNSCFG=C:\Program Files\Windows Media Player\WMPNSCFG.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion un] RtHDVCpl=RtHDVCpl.exe Acer Empowering Technology Monitor=C:\Acer\Empowering Technology\SysMonitor.exe eDataSecurity Loader=C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe WarReg_PopUp=C:\Acer\WR_PopUp\WarReg_PopUp.exe SpeedTouch USB Diagnostics="C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon diagnostics="C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe" /icon -l:fr IntelliPoint="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" SunJavaUpdateSched="C:\Program Files\Java\jre6\bin\jusched.exe" SpywareTerminator="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe avgnt="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents= = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents\IMAIL= Installed=1 = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents\MAPI= NoChange=1 Installed=1 = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents\MSFS= Installed=1 = --------------- [ Registre / Mountpoint2 ] ---------------- Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\J\Shell\AutoRun\command Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\J\Shell\explore\Command Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\J\Shell\open\Command Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\L\Shell\AutoRun\command Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a39a6ade-220c-11dd-ad21-0090d0ee5683}\Shell\AutoRun\command Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bd78dd15-2583-11dd-9cb6-0090d0ee5683}\Shell\AutoRun\command Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e5def4e4-017d-11dd-af3b-001c252ffd05}\Shell\AutoRun\command Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e5def4e4-017d-11dd-af3b-001c252ffd05}\Shell\explore\Command Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e5def4e4-017d-11dd-af3b-001c252ffd05}\Shell\open\Command --------------- [ Nettoyage des disques ] ---------------- Echec de la supression !! - [19/06/2008 13:12] E:\autorun.inf Echec de la supression !! - [19/06/2008 13:12] E:\autorun.inf Echec de la supression !! - [19/06/2008 13:12] E:\autorun.inf --------------- [ Resumé ] ---------------- -> /!\ Le resultat doit etre interprété par un spécialiste /!\ [12/09/2008 22:07][--a--c---] C:\AUTOEXEC.BAT [08/08/2008 00:57][--ahs----] D:\desktop.ini [19/06/2008 13:10][-r-------] E:\Hackers_Mag_24.exe [19/06/2008 13:12][-r-------] E:\autorun.inf --------------- ! Fin du rapport ! ----------------

sKe69 · Answer

Impec !


Refais un scan RSIT et poste le nouveau rapport "log.txt" obtenu et attends la suite ....

cedd974 · Answer

Logfile of random's system information tool 1.04 (written by random/random)
Run by cedd at 2008-12-06 20:56:47
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 1
System drive C: has 18 GB (25%) free of 71 GB
Total RAM: 1791 MB (66% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:56:52, on 06/12/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\conime.exe
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Alcatel\SpeedTouch USB\dragdiag.exe
C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Windows\explorer.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Users\cedd\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\cedd.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.fr.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [diagnostics] "C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe" /icon -l:fr
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: []  (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: []  (User 'Default user')
O4 - Global Startup: PCM Media Sharing.lnk = C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O13 - Gopher Prefix: 
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson/ST330/service/st330service.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: Marvell Yukon Service (yksvc) - Unknown owner - RUNDLL32.EXE (file missing)

sKe69 · Answer

Bien ... on poursuit ...


Plusieurs Av sur un PC , c'est aussi néfaste que les virus !


Donc fais ceci dans l'ordre :


1- Nettoyes les reste de Norton ainsi :
Télécharge Norton removal tool sur ton bureau :
ftp://ftp.symantec.com/public/francais/removal_tools/Norton_Removal_Tool.exe

Déconnecte toi . 
Ensuite désinstalle Norton avec "Norton removal tool": tu double-cliques dessus et tu te laisses guider ... il faut le désinstaller correctement ( fais la manipe 2 fois si possible ). 



2- Désinstalle proprement Avast en suvant cette astuce :
http://www.commentcamarche.net/faq/sujet 8172 desinstaller proprement avast



3- Une fois ceci fais , un bon coup de CCleaner ( registre compris ) .



4- Télécharges MalwareByte's : 
ici http://www.commentcamarche.net/telecharger/telecharger 34055379 malwarebytes anti malware
ou ici : http://www.malwarebytes.org/mbam.php
 
* Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour . 

(NB : S'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharge le ici : https://www.malekal.com/tutorial-aboutbuster/ )

* Potasse le tuto pour te familiariser avec le prg : 
https://forum.pcastuces.com/sujet.asp?f=31&s=3
( cela dis, il est très simple d'utilisation ).

! Déconnecte toi et ferme toutes applications en cours ! 

* Lance Malwarebyte's .

Fais un examen dit "complet" ( sélectionne bien tous tes disks avant le scan ! ).

--> Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ). 
--> à la fin tu cliques sur "résultat" . 
--> Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .

Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !

Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date) pour analyse ...



3- refais un scan RSIT, poste le nouveau "log.txt" et attends la suite ....

cedd974 · Answer

Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1469
Windows 6.0.6001 Service Pack 1

07/12/2008 18:06:10
mbam-log-2008-12-07 (18-06-10).txt

Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|I:\|K:\|)
Eléments examinés: 148338
Temps écoulé: 47 minute(s), 56 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

cedd974 · Answer

Logfile of random's system information tool 1.04 (written by random/random)
Run by cedd at 2008-12-07 18:08:04
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 1
System drive C: has 28 GB (40%) free of 71 GB
Total RAM: 1791 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:08:13, on 07/12/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Alcatel\SpeedTouch USB\dragdiag.exe
C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Siber Systems\AI RoboFormobotaskbaricon.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\cedd\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\cedd.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [diagnostics] "C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe" /icon -l:fr
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: []  (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: []  (User 'Default user')
O4 - Global Startup: PCM Media Sharing.lnk = C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O13 - Gopher Prefix: 
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson/ST330/service/st330service.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: Marvell Yukon Service (yksvc) - Unknown owner - RUNDLL32.EXE (file missing)

sKe69 · Answer

Bien ...


la suite dans l'ordre :


1- Ferme toutes tes applications ( navigateur compris ) et déconnecte toi .

Relance Hijackthis mais clique sur " Do a scan only " 
Tu vois donc apparaitre le résultat du scan : une multitudes de lignes ,chacunes précédées d'un carré vide . 
Tu vas cliquer sur les carrés des lignes suivantes : 

O4 - HKUS\S-1-5-18\..\Run: [] (User 'SYSTEM') 
O4 - HKUS\.DEFAULT\..\Run: [] (User 'Default user') 


Tu cliques en bas sur le bouton FIX CHECKED et valide .


2-Télécharge ToolsCleaner (de A.Rothstein) sur ton Bureau. 
http://pc-system.fr/

Déconnecte toi et ferme bien toutes tes applications en cours .

Clique droit sur le prg et choisis "éxécuter en tant que Administrateur"
 
*Clique sur Recherche et laisse le scan se terminer (cela peut être long). 
*Clique sur Suppression pour finaliser. 
*Clique sur "quitter" pour générer un rapport ( et pas sur la croix rouge !) :
--> Poste ce rapport : il se trouve à la racine de ton disque dur -> C:\TCleaner.txt . 

Note : Ce petit soft va te nettoyer tout les trucs dont on c'est servi pour la désinfection .
Supprime tout les outils , dossiers ou rapports consernant la désinfection que Toolscleaner2 n'a pas supprimé . 

( garde CCleaner et Malwarebytes : très utiles ! )


3- Refais un coup de CCleaner ( registre compris ) .


4- Retélécharge et réinstalle hijackthis ( car supprimé par Toolscleaner2 ) ,

Télécharge et installe le logiciel HijackThis : 

ici ftp://ftp.commentcamarche.com/download/HJTInstall.exe 
ou ici http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe
ou ici https://www.clubic.com/telecharger-fiche17891-hijackthis.html

-> Clique sur le setup pour lancer l'installe : laisse toi guider et ne modifie pas les paramètres d'installation . 
A la fin de l'installe , le prg ce lance automatiquement : ferme le en cliquant sur la croix rouge . 
Au final, tu dois avoir un raccourci sur ton bureau et aussi un cheminement comme : 
"C:\ program files\Trend Micro\HijackThis\HijackThis.exe " .

( ne fais pas de scan pour le moment ) 


- Purge de la restauration système 
-->Désactive ta restauration :
Dans démarrer, clique droit sur ordinateur/propriétés/protection du système : décoche la case devant ton disk dur maitre ( pour toi -> C )  , valide, applique et OK 
Redémarre ton PC ...
 
-->Réactive ta restauration :
Clique droit sur ordinateur/propriétés/protection du système : coche la case devant ton disk dur maitre , valide, applique et OK 
Redémarre ton PC ...

( tuto : http://www.commentcamarche.net/faq/sujet 13214 desactiver reactiver la restauration systeme de vista ) 



5- On va utiliser ton anti-virus :

-> mets AntiVir à jour si besoin .

Aide AntiVir : https://www.malekal.com/avira-free-security-antivirus-gratuit/

Fais ce réglage supplémentaire :

***************************************
Une fois AntiVir ouvert clique sur configuration et coche la case "expert mode" . 
*Puis clique sur configuration en haut a droite; dans la nouvelle fenetre à gauche ->scanner -> coche "scan all files" et en dessous ->scanner priority = High 
*coche : allow stopping the scanner, comme cela tu peux faire une pause pendant le scan si tu le desir. 
*puis sur la droite, coche les cases suivantes : 
scan boot sectors of selected drives 
scan master boot sectors 
scan memory 
search for rootkit before scan 
et décoche : 
ignore off line files 
*toujours a gauche -> scan -> deploie -> heuristique -> macrovirus heuristic = coché et en dessous -> win32 heuristic la case cochée et high detection level aussi ...

---> clique sur "OK" pour valider le réglage ...
****************************************

Une fois fait , 
Impératif : Démarrer en mode sans echec .

 /!\ Ne jamais démarrer en mode sans échec via MSCONFIG /!\ 

Comment aller en Mode sans échec :
1) Redémarre ton ordi .
2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip" .
3) Tu tapotes jusqu' à l'apparition de l'écran avec les options de démarrage . 
4) Choisis la première option : Sans Échec , et valide en tapant sur [Entrée] .
5) Choisis ton compte habituel ( et pas Administrateur ). 
attention : pas de connexion possible en mode sans échec , donc copie ou imprime bien la manipe pour éviter les erreurs ...

Lance un scan complet de ton PC , mets tout ce qu'il peut trouver en "quarantaine" ... 
Redémarre ton PC et poste moi le rapport obtenu ... Aide toi bien du tuto ;)

cedd974 · Answer

[ Rapport ToolsCleaner version 2.2.6 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

C:\TB.txt: trouvé !
C:\FindyKill.txt: trouvé !
C:\UsbFix.txt: trouvé !
C:\_OtMoveIt: trouvé !
C:\Toolbar SD: trouvé !
C:\Rsit: trouvé !
C:\Program Files\UsbFix: trouvé !
C:\Program Files\FindyKill: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !
C:\Program Files\UsbFix\UsbFix.exe: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\HijackThis: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\UsbFix: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\FindyKill: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UsbFix: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FindyKill: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UsbFix\UsbFix.lnk: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programmes\HijackThis: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programmes\UsbFix: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programmes\FindyKill: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HijackThis: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\UsbFix: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\FindyKill: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\UsbFix\UsbFix.lnk: trouvé !
C:\Users\cedd\AppData\Local\VirtualStore\Program Files\Trend Micro\HijackThis: trouvé !
C:\Users\cedd\AppData\Local\VirtualStore\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !
C:\Users\cedd\AppData\Roaming\Microsoft\Windows\Start Menu\Programmes\UsbFix: trouvé !
C:\Users\cedd\AppData\Roaming\Microsoft\Windows\Start Menu\Programmes\FindyKill: trouvé !
C:\Users\cedd\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\UsbFix: trouvé !
C:\Users\cedd\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FindyKill: trouvé !
C:\Users\cedd\Desktop\HijackThis.lnk: trouvé !
C:\Users\cedd\Desktop\HJTInstall.exe: trouvé !
C:\Users\cedd\Desktop\ToolBarSD.exe: trouvé !
C:\Users\cedd\Desktop\UsbFix.lnk: trouvé !
C:\Users\cedd\Desktop\OTMoveIt3.exe: trouvé !
C:\Users\cedd\Desktop\Rsit.exe: trouvé !
C:\Users\cedd\Documents\UsbFix.exe: trouvé !
C:\Users\Invité\Desktop\HijackThis.lnk: trouvé !
C:\Users\Invité\Desktop\UsbFix.lnk: trouvé !

---------------------------------
-->- Suppression: 

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: supprimé !
C:\Users\cedd\Desktop\HijackThis.lnk: supprimé !
C:\Users\cedd\Desktop\HJTInstall.exe: supprimé !
C:\Users\cedd\Desktop\ToolBarSD.exe: supprimé !
C:\Users\Invité\Desktop\HijackThis.lnk: supprimé !
C:\TB.txt: supprimé !
C:\FindyKill.txt: supprimé !
C:\UsbFix.txt: supprimé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\Program Files\UsbFix\UsbFix.exe: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UsbFix\UsbFix.lnk: supprimé !
C:\Users\cedd\AppData\Local\VirtualStore\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\Users\cedd\Desktop\UsbFix.lnk: supprimé !
C:\Users\cedd\Desktop\OTMoveIt3.exe: supprimé !
C:\Users\cedd\Desktop\Rsit.exe: supprimé !
C:\Users\cedd\Documents\UsbFix.exe: supprimé !
C:\Users\Invité\Desktop\UsbFix.lnk: supprimé !
C:\_OtMoveIt: supprimé !
C:\Toolbar SD: supprimé !
C:\Rsit: supprimé !
C:\Program Files\UsbFix: supprimé !
C:\Program Files\FindyKill: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\HijackThis: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\UsbFix: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\FindyKill: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UsbFix: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FindyKill: supprimé !
C:\Users\cedd\AppData\Local\VirtualStore\Program Files\Trend Micro\HijackThis: supprimé !
C:\Users\cedd\AppData\Roaming\Microsoft\Windows\Start Menu\Programmes\UsbFix: ERREUR DE SUPPRESSION !!
C:\Users\cedd\AppData\Roaming\Microsoft\Windows\Start Menu\Programmes\FindyKill: ERREUR DE SUPPRESSION !!
C:\Users\cedd\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\UsbFix: supprimé !
C:\Users\cedd\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FindyKill: supprimé !

sKe69 · Answer

Bien ...

une fois finit tu supprimeras findykill ainsi :

Rends toi sur ton PC ici -> C:\Program files\FindyKill  

Dans ce dossier , clique sur " Uninstal.exe " pour désinstaller l'outil .

Supprime aussi le set-up "Findykill.exe" qui est présent sur ton bureau ( directe dans la poubelle ) .



J'attends donc le rapport d' AntiVir ... ;)

cedd974 · Answer

slt ,

Antivir se bloque a 38% après plusieurs tentative toujours rien .

sKe69 · Answer

Salut,


bizard ... 

Et dans ces 38% , il t'a trouvé des infections ? Si oui , tu as un rapport à me posté ? 




ensuite fais ceci :


Télécharge GenProc  (de Jean-Chretien1 et Narco4) sur ton bureau (et pas ailleur !) :
http://www.alt-shift-return.org/Info/Fichiers/GenProc.zip 

!!Déconnecte toi et ferme tes applications en cours !!

Dézippe (=extraire tout) le contenu de ce que tu viens de télécharger sur ton bureau . 

Ouvre le dossier Genproc :
-> clique droit / " executer entant qu'admin..." sur GenProc.bat et laisses faire...

Une fois terminé, poste le contenu du rapport qui s'ouvre ... 

Aide en images ici : http://www.alt-shift-return.org/Info/GenProc-HowTo.html
 
IMPORTANT : poste le rapport et ne fais rien d'autre pour l'instant ( souvant il faut ajouter des consignes à la manipe indiquée pour que cela fonctionne parfaitement ) .

cedd974 · Answer

Salut,

 désolé du retard mais j'ai aucun rapport et aucun virus antivir se bloque toujours et genpro apres décompression est pas sur mon bureau .

Win 32 invalide

46 réponses

Votre réponse

Discussions similaires

Newsletters