Probleme d anti virus

blondie -

Bonjour,
Je n arrive plus a installer d anti virus.Jai fais un scan et voici ce qui me donne.
Que dois je faire?
Merci a celui qui repondra.

Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1475
Windows 5.1.2600 Service Pack 2

08/12/2008 20:39:30
mbam-log-2008-12-08 (20-39-30).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 186224
Temps écoulé: 49 minute(s), 10 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 9
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 4
Fichier(s) infecté(s): 25

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\torrentmanager.webmanager (Trojan.Lop) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\torrentmanager.webmanager.1 (Trojan.Lop) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{d5792aa9-d373-4039-8670-2cdab6a71f15} (Trojan.Lop) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2d2bee6e-3c9a-4d58-b9ec-458edb28d0f6} (Rogue.DriveCleaner) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{d5792aa9-d373-4039-8670-2cdab6a71f15} (Trojan.Lop) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{09f1adac-76d8-4d0f-99a5-5c907dadb988} (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d5792aa9-d373-4039-8670-2cdab6a71f15} (Trojan.Lop) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\BitDownload (Trojan.Lop) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\WakeNet (Trojan.Adware) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mule_st_key (Trojan.Agent) -> Delete on reboot.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\WINDOWS\system32\drivers\downld (Trojan.Agent) -> Files: 946 -> Quarantined and deleted successfully.
C:\Documents and Settings\Propriétaire\Application Data\SystemDoctor 2006 Free (Rogue.SystemDoctor) -> Quarantined and deleted successfully.
C:\Documents and Settings\Propriétaire\Application Data\SystemDoctor 2006 Free\Logs (Rogue.SystemDoctor) -> Quarantined and deleted successfully.
C:\Documents and Settings\Propriétaire\Application Data\m (Trojan.Agent) -> Delete on reboot.

Fichier(s) infecté(s):
C:\Documents and Settings\Propriétaire\Local Settings\Application Data\qquas_navps.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\Propriétaire\Local Settings\Application Data\qquas_nav.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\Propriétaire\Local Settings\Application Data\qquas.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\downld\100078.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\downld\100625.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\downld\150218.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\downld\93671.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\downld\96859.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\downld\129828.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\downld\132531.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\XGW52G1V\b64[3].jpg (Worm.Bagle) -> Quarantined and deleted successfully.
C:\Documents and Settings\Propriétaire\Application Data\SystemDoctor 2006 Free\Logs\update.log (Rogue.SystemDoctor) -> Quarantined and deleted successfully.
C:\Documents and Settings\Propriétaire\Application Data\m\data.oct (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Propriétaire\Application Data\m\list.oct (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Propriétaire\Application Data\m\srvlist.oct (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mdelk.exe (Trojan.Spammer) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wintems.exe (Trojan.Spammer) -> Delete on reboot.
C:\Documents and Settings\Propriétaire\Application Data\m\flec006.exe (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\kzwdmhoe_navps.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kzwdmhoe_nav.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nvs2.inf (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Program Files\EoRezo (Rogue.Eorezo) -> Delete on reboot.
C:\Documents and Settings\Propriétaire\Bureau\Spyware-Secure trial.lnk (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\hldrrr.exe (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\srosa.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.

Configuration: Windows XP
Internet Explorer 7.0

Afficher la suite

A voir également

Probleme d anti virus
Malwarebytes anti-malware - Télécharger - Antivirus & Antimalwares
Anti-twin - Télécharger - Divers Utilitaires
Logiciel anti-spam - Télécharger - Antivirus & Antimalwares
Norton anti virus gratuit - Télécharger - Antivirus & Antimalwares
Virus mcafee - Accueil - Piratage

45 réponses

Résumé de la discussion

Le diagnostic montre une infection multi-malware après un scan antivirus avec Malwarebytes' Anti-Malware, énumérant 9 clés du registre, 4 dossiers et 25 fichiers infectés, dont plusieurs éléments marqués pour suppression au redémarrage. Plusieurs familles de menaces apparaissent, notamment Trojan.Lop, Trojan.Agent, Rogue.SystemDoctor, Worm.Bagle et Rootkit.Agent, et la quarantaine/déletion est effectuée sur certains objets, avec suppression planifiée sur reboot pour d'autres. Des solutions complémentaires sont proposées, comme UsbFix ou FindyKill et l'examen des éléments de démarrage et des extensions suspectes, afin d’éviter la réinfection et de vérifier l’intégrité du système après nettoyage.

Réponse 1 / 45 - Meilleure réponse
La meilleure réponse est la réponse qui a été validée par nos équipes.
g!rly Contributeur
Oué ! Une perle ce Chiquitine :)

3

Réagir
1. blondie
  
  -------------- UsbFix V2.413.4 ---------------
  
  * User : krystel - SEBASTIEN
  * Outils mis a jours le 11/12/2008 par Chiquitine29 et Chimay8
  * Recherche effectuée à 17:58:17 le 28/12/2008
  * Windows Xp - Internet Explorer 7.0.5730.11
  
  --------------- [ Processus actifs ] ----------------
  
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\userinit.exe
  C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  C:\Program Files\McAfee\Common Framework\FrameworkService.exe
  C:\DOCUME~1\krystel\LOCALS~1\Temp\1.tmp\b2e.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
  
  --------------- [ Informations lecteurs ] ----------------
  
  C: - Lecteur fixe
  
  D: - Lecteur fixe
  
  E: - Lecteur de CD-ROM
  
  F: - Lecteur de CD-ROM
  
  --------------- [ Lecteur C ] ----------------
  
  C: - Lecteur fixe
  
  +- Listing des fichiers présents :
  
  [31/05/2005 18:12][--a------] C:\AUTOEXEC.BAT
  [06/09/2006 19:48][-rahs----] C:\NTDETECT.COM
  [11/12/2007 10:57][-rahs----] C:\boot.ini
  [03/12/2007 12:54][--a------] C:\ASLog.txt
  [03/12/2007 12:54][--a------] C:\caavsetupLog.txt
  [03/12/2007 12:54][--a------] C:\caisslog.txt
  [03/12/2007 12:54][--a------] C:\FindyKill.txt
  [03/12/2007 12:54][--a------] C:\hcwclear.txt
  [03/12/2007 12:54][--a------] C:\Log.txt
  [03/12/2007 12:54][--a------] C:\Prodinfo.txt
  [03/12/2007 12:54][--a------] C:\UsbFix.txt
  [01/01/2004 20:05][--a------] C:\CONFIG.SYS
  [01/01/2004 20:05][--a------] C:\hiberfil.sys
  [01/01/2004 20:05][--a------] C:\IO.SYS
  [01/01/2004 20:05][--a------] C:\MSDOS.SYS
  [01/01/2004 20:05][--a------] C:\pagefile.sys
  
  --------------- [ Lecteur D ] ----------------
  
  D: - Lecteur fixe
  
  +- Listing des fichiers présents :
  
  [27/07/2001 20:07][---hs----] D:\AUTOEXEC.BAT
  [25/07/2001 12:00][---hs----] D:\NTDETECT.COM
  [09/01/2002 09:52][---hs----] D:\BOOT.INI
  [09/01/2002 09:52][---hs----] D:\Desktop.ini
  [09/01/2002 09:52][---hs----] D:\WINBOM.INI
  [10/09/2002 07:21][---hs----] D:\Folder.htt
  [27/07/2001 20:07][---hs----] D:\CONFIG.SYS
  [27/07/2001 20:07][---hs----] D:\IO.SYS
  [27/07/2001 20:07][---hs----] D:\MSDOS.SYS
  [27/07/2001 20:07][---hs----] D:\RCBoot.sys
  
  --------------- [ Lecteur E ] ----------------
  
  E: - Lecteur de CD-ROM
  
  +- Listing des fichiers présents :
  
  --------------- [ Lecteur F ] ----------------
  
  F: - Lecteur de CD-ROM
  
  +- Listing des fichiers présents :
  
  --------------- [ Registre / Startup ] ----------------
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
  "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
  
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
  "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
  "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
  ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe
  H/PC Connection Agent="C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
  msnmsgr="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
  LogitechSoftwareUpdate="C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
  WorksFUD=C:\Program Files\Microsoft Works\wkfud.exe
  Microsoft Works Portfolio=C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
  Microsoft Works Update Detection=C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
  QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
  EoEngine=
  EoFlip=
  Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  HPDJ Taskbar Utility=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
  Share-to-Web Namespace Daemon=C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
  SunJavaUpdateSched="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
  SweetIM=C:\Program Files\SweetIM\Messenger\SweetIM.exe
  DLA=C:\WINDOWS\System32\DLA\DLACTRLW.EXE
  HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
  <NO NAME>=
  HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL=
  Installed=1
  <NO NAME>=
  HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI=
  NoChange=1
  Installed=1
  <NO NAME>=
  HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS=
  Installed=1
  <NO NAME>=
  
  --------------- [ Registre / Mountpoint2 ] ----------------
  
  -> Recherche négative.
  
  --------------- [ Nettoyage des disques ] ----------------
  
  Supprimé ! - [10/09/2002 07:21][---hs----] D:\Folder.htt
  
  --------------- [ Resumé ] ----------------
  
  -> /!\ Le resultat doit etre interprété par un spécialiste /!\
  
  [31/05/2005 18:12][--a------] C:\AUTOEXEC.BAT
  [06/09/2006 19:48][-rahs----] C:\NTDETECT.COM
  [11/12/2007 10:57][-rahs----] C:\boot.ini
  [27/07/2001 20:07][---hs----] D:\AUTOEXEC.BAT
  [25/07/2001 12:00][---hs----] D:\NTDETECT.COM
  [09/01/2002 09:52][---hs----] D:\BOOT.INI
  [09/01/2002 09:52][---hs----] D:\Desktop.ini
  [09/01/2002 09:52][---hs----] D:\WINBOM.INI
  
  --------------- ! Fin du rapport ! ----------------
  
  0
  
  Réagir
2. blondie
  
  je fais quoi maintenant?
  
  0
  
  Réagir
Réponse 2 / 45
g!rly Contributeur
Ps : bien joué; ça a le dont d´être très claire !
-> formidable :)

0

Réagir
Réponse 3 / 45
g!rly Contributeur
Merci Jacques :)
J´en ai pris note !

0

Réagir
Réponse 4 / 45
jalobservateur Contributeur sécurité
Oui Julie, il est là maintenant , sauf juste pas dans la bonne FAQ, je demaderai de le déménager ;-)
http://www.commentcamarche.net/faq/sujet 15645 javara indispensable
Voilà.

0

Réagir
Vous n’avez pas trouvé la réponse que vous recherchez ?

La communauté CCM répond en moyenne en moins de 2h.

Posez votre question
Réponse 5 / 45
g!rly Contributeur
Merci Jal,

Je crois déjà avoir un "canned" mais j´attends le tien avec impatience :)

@+

0

Réagir
Réponse 6 / 45
jalobservateur Contributeur sécurité
Hey G!rly, un tuto est en route ici pour JavaRa ;-)
Dans les 'utilitaires'.

0

Réagir
Réponse 7 / 45
g!rly Contributeur
Salut Blondi, Jal,

Jal,

Oui pour javara, mais l´ip pointe toujours vers l´italie !

Blondi,

click sur demarrer > executer > dans la boite de dialogue tape > cmd et valide

dans la fenetre noir tape ceci : ipconfig /flushdns et valide par entree

puis a l´aide de hijack this coche et fix cette ligne

O17 - HKLM\System\CCS\Services\Tcpip\..\{400473F1-AC6C-491F-AFF5-6FCF91F01D42}: NameServer = 212.216.172.62,213.26.80.1

comment fixer :

Tutoriel d´utilisation (video) : (Merci a Balltrap34 pour cette réalisation)

-> http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm

post un nouveau rapport hijack this après la manip

@+

0

Réagir
Réponse 8 / 45
jalobservateur Contributeur sécurité
Salut blonde salut G!rly ;-)
Bon temps pour tester à la fin : Javara ;-)

0

Réagir
Réponse 9 / 45
g!rly Contributeur
salut blondi,

post un nouveau rapport hijack this stp

@+

0

Réagir
1. blondie
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 16:22:57, on 13/01/2009
  Platform: Windows XP SP3 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16762)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
  C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
  C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
  C:\WINDOWS\System32\DLA\DLACTRLW.EXE
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  C:\Program Files\Windows Live\Messenger\msnmsgr.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
  C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
  C:\Program Files\e-Carte Bleue Caisse d'Epargne\ecbl-cnce.exe
  C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\msiexec.exe
  C:\Program Files\Windows Live\Messenger\usnsvc.exe
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\Java\jre1.6.0_04\bin\jucheck.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q304&bd=pavilion&pf=desktop
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://outlook.live.com/owa/
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  R3 - Default URLSearchHook is missing
  O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
  O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
  O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
  O3 - Toolbar: Share Accelerator Toolbar - {f5c93451-2609-4723-a053-5c19516be1a8} - C:\Program Files\Share_Accelerator\tbShar.dll
  O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
  O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
  O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
  O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
  O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
  O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
  O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
  O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
  O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\System32\mstask.exe
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
  O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
  O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
  O4 - Global Startup: e-Carte Bleue Caisse d'Epargne.lnk = C:\Program Files\e-Carte Bleue Caisse d'Epargne\ecbl-cnce.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
  O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
  O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O15 - Trusted Zone: *.registration.sonystyle-europe.com (HKLM)
  O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
  O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase9563.cab
  O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://abonnement.aliceadsl.fr/configurateur/AccountHelper.cab
  O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
  O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://bmm.imgag.com/imgag/cp/install/crusher-fr.cab
  O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game10.zylom.com/activex/zylomgamesplayer.cab
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
  O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/player/install/installer.exe
  O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{400473F1-AC6C-491F-AFF5-6FCF91F01D42}: NameServer = 212.216.172.62,213.26.80.1
  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
  O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program Files\McAfee\Common Framework\FrameworkService.exe (file missing)
  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
  
  0
  
  Réagir
Réponse 10 / 45
g!rly Contributeur
salut blondie,

excuse pour le delais...

télécharges smitfraudfix de S!Ri, balltrap34 et moe31

En image :
http://siri.urz.free.fr/Fix/SmitfraudFix.php

tu doubles cliques sur smitfraudfix.cmd et tu choisi l option 5
cela vas générer un rapport.

Copie/colle le rapport sur le forum stp.

@+

0

Réagir
1. blondie
  
  SmitFraudFix v2.388
  
  Rapport fait à 14:38:32,29, 09/01/2009
  Executé à partir de C:\Documents and Settings\krystel\Bureau\SmitfraudFix
  OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
  Le type du système de fichiers est NTFS
  Fix executé en mode normal
  
  »»»»»»»»»»»»»»»»»»»»»»»» DNS Avant Fix
  
  Description: Olitec Wireless Card - Miniport d'ordonnancement de paquets
  DNS Server Search Order: 212.216.172.62
  DNS Server Search Order: 213.26.80.1
  
  HKLM\SYSTEM\CCS\Services\Tcpip\..\{400473F1-AC6C-491F-AFF5-6FCF91F01D42}: NameServer=212.216.172.62,213.26.80.1
  HKLM\SYSTEM\CCS\Services\Tcpip\..\{C8C1C8A0-6CCE-46A2-A781-80293E432C5E}: DhcpNameServer=192.168.1.1
  HKLM\SYSTEM\CS1\Services\Tcpip\..\{400473F1-AC6C-491F-AFF5-6FCF91F01D42}: NameServer=212.216.172.62,213.26.80.1
  HKLM\SYSTEM\CS1\Services\Tcpip\..\{C8C1C8A0-6CCE-46A2-A781-80293E432C5E}: DhcpNameServer=192.168.1.1
  HKLM\SYSTEM\CS3\Services\Tcpip\..\{400473F1-AC6C-491F-AFF5-6FCF91F01D42}: NameServer=212.216.172.62,213.26.80.1
  HKLM\SYSTEM\CS3\Services\Tcpip\..\{C8C1C8A0-6CCE-46A2-A781-80293E432C5E}: DhcpNameServer=192.168.1.1
  
  »»»»»»»»»»»»»»»»»»»»»»»» DNS Après Fix
  
  Description: Olitec Wireless Card - Miniport d'ordonnancement de paquets
  DNS Server Search Order: 212.216.172.62
  DNS Server Search Order: 213.26.80.1
  
  HKLM\SYSTEM\CCS\Services\Tcpip\..\{400473F1-AC6C-491F-AFF5-6FCF91F01D42}: NameServer=212.216.172.62,213.26.80.1
  HKLM\SYSTEM\CCS\Services\Tcpip\..\{C8C1C8A0-6CCE-46A2-A781-80293E432C5E}: DhcpNameServer=192.168.1.1
  HKLM\SYSTEM\CS1\Services\Tcpip\..\{400473F1-AC6C-491F-AFF5-6FCF91F01D42}: NameServer=212.216.172.62,213.26.80.1
  HKLM\SYSTEM\CS1\Services\Tcpip\..\{C8C1C8A0-6CCE-46A2-A781-80293E432C5E}: DhcpNameServer=192.168.1.1
  HKLM\SYSTEM\CS3\Services\Tcpip\..\{400473F1-AC6C-491F-AFF5-6FCF91F01D42}: NameServer=212.216.172.62,213.26.80.1
  HKLM\SYSTEM\CS3\Services\Tcpip\..\{C8C1C8A0-6CCE-46A2-A781-80293E432C5E}: DhcpNameServer=192.168.1.1
  
  0
  
  Réagir
Réponse 11 / 45
g!rly Contributeur
salut blondie,

post un nouveau rapport hijack this stp

@+

0

Réagir
1. blondie22
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 19:52:40, on 02/01/2009
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16762)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
  C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
  C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
  C:\WINDOWS\System32\DLA\DLACTRLW.EXE
  C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Windows Live\Messenger\msnmsgr.exe
  C:\Program Files\e-Carte Bleue Caisse d'Epargne\ecbl-cnce.exe
  C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
  C:\Program Files\Windows Live\Messenger\usnsvc.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
  C:\Program Files\Java\jre1.6.0_04\bin\jucheck.exe
  C:\Program Files\eMule\emule.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q304&bd=pavilion&pf=desktop
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://outlook.live.com/owa/
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  R3 - Default URLSearchHook is missing
  O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
  O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
  O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
  O3 - Toolbar: Share Accelerator Toolbar - {f5c93451-2609-4723-a053-5c19516be1a8} - C:\Program Files\Share_Accelerator\tbShar.dll
  O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
  O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
  O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
  O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
  O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
  O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
  O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
  O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
  O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\System32\mstask.exe
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
  O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
  O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
  O4 - Global Startup: e-Carte Bleue Caisse d'Epargne.lnk = C:\Program Files\e-Carte Bleue Caisse d'Epargne\ecbl-cnce.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
  O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
  O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O15 - Trusted Zone: *.registration.sonystyle-europe.com (HKLM)
  O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
  O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase9563.cab
  O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://abonnement.aliceadsl.fr/configurateur/AccountHelper.cab
  O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
  O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://bmm.imgag.com/imgag/cp/install/crusher-fr.cab
  O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game10.zylom.com/activex/zylomgamesplayer.cab
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
  O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/player/install/installer.exe
  O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{400473F1-AC6C-491F-AFF5-6FCF91F01D42}: NameServer = 212.216.172.62,213.26.80.1
  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
  O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program Files\McAfee\Common Framework\FrameworkService.exe (file missing)
  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
  
  0
  
  Réagir
Réponse 12 / 45
g!rly Contributeur
blondie tu en es ou ?
meilleurs voeux :)

0

Réagir
1. blondie22
  
  Salut g!rly,
  Meilleurs voeux a toi aussi.
  J ai posté le resultat d antivir en reponse numero 59
  J attends tes instructions pour la suite.
  
  0
  
  Réagir
Réponse 13 / 45
g!rly Contributeur
;-) salut jal :)

0

Réagir
Réponse 14 / 45
jalobservateur Contributeur sécurité
Bonjour ,
Je dirais : Remets un log HJKTS en attendant G!rly, car c'est pas fini ,,,
Puis quelques notions essentielles de sécurité à lire et appliquer une fois la machine propre.
Afin de ne pas répéter l'expérience ;-)

Donc de la lecture, des notes, du copier/coller dans un bloc-note
----------------------
http://ww12.purforum.com

http://ww12.purforum.com

http://ww12.purforum.com

http://ww1.purforum.com

http://ww1.purforum.com

http://ww1.purforum.com

http://ww12.purforum.com

Donc une intro.
Oui c'est un peu de lecture, mais c'est moins long à lire et appliquer que de désinfecter , surtout à répétitions...
Voilà bonne journée. ;-)

0

Réagir
Réponse 15 / 45
Marilyn.Manson
:O 130 fichiers infectés !

c'est l'un des meilleur score que j'ai vu avec malwarebytes

le meilleur score c'est : 347 ! j'avais trouver dans le pc d'un pote

0

Réagir
Réponse 16 / 45
jalobservateur Contributeur sécurité
Hey blondie, petite joke de fin d'année: Il te reste de la place pour tes fichiers avec toutes ces saloperies qui ont adopté ta machine ? ;-)

0

Réagir
1. blondie
  
  Je fait quoi maintenant?
  
  0
  
  Réagir
2. g!rly Contributeur
  
  @blondiesalut blondie,
  
  on va faire un sautre scan :
  
  as tu réglé antivir comme je te l´avais indiqué ?
  
  sinon fais le :
  
  Réglages :
  
  en image :
  
  http://speedweb1.free.fr/frames2.php?page=tuto5
  
  mes explications :
  
  une fois antivir ouvert click surconfiguration et coche la case "expert mode" puis sur l´onglet scanner dans la fenetre du dessous tu va voir : rootkit search click sur le petit + pour deployer et coche la case a coté de ton disk dur
  ceux qui ne voie pas root kit search : clcik sur le parapluie dans ta barre des tache > dans la fenetre d´antivir click sur local protection click en suite sur scanner
  dans la fenetre de droite : tu a rootkit search vers le bas > tu developpe en appuyant sur le petit +
  et coche tes disques...
  puis click sur configuration en haut a droite; dans la nouvelle fenetre a gauche >scanner > coche "scan all files" et en dessous >scanner priority = High
  coche : allow stopping the scanner, comme cela tu peux faire une pause pendant le scan si tu le desir.
  puis sur la droite coche les case suivantes :
  scan boot sectors of selected drives
  scan master boot sectors
  scan memory
  search foe rootkit before scan
  decoche :
  ignore off line files
  toujours a gauche > scan > deploie > heuristique > macrovirus heuristic = coché et en dessous > win32 heuristic la case coché et high detection level
  
  puis redémarres en mode sans echec :
  
  Comment redémarrer en mode sans echec?
  
  Tu redemarre le pc et tapote la touche F8 des le début de l allumage sans t´arrêter.
  Une fenêtre sur fond noir va s’ouvrir, tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
  Une fois sur le bureau si il n y a pas toutes les couleurs et autres c´est normal!
  Ps : si F8 ne marche pas utilise la touche F5.
  
  et lances le sacn avec antivir > click sur le parapluie dans la barres des taches et choisies dans la fenêtre du programme > scan system now.
  
  post le rapport généré
  
  @+
  
  0
  
  Réagir
3. blondie
  
  @g!rlyAvira AntiVir Personal
  Date de création du fichier de rapport : mercredi 31 décembre 2008 12:46
  
  La recherche porte sur 1136798 souches de virus.
  
  Détenteur de la licence :Avira AntiVir PersonalEdition Classic
  Numéro de série : 0000149996-ADJIE-0001
  Plateforme : Windows XP
  Version de Windows :(Service Pack 2) [5.1.2600]
  Mode Boot : Mode sans échec
  Identifiant : krystel
  Nom de l'ordinateur :SEBASTIEN
  
  Informations de version :
  BUILD.DAT : 8.2.0.52 16931 Bytes 02/12/2008 14:55:00
  AVSCAN.EXE : 8.1.4.10 315649 Bytes 18/11/2008 08:21:00
  AVSCAN.DLL : 8.1.4.1 49921 Bytes 21/07/2008 13:44:27
  LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:16
  LUKERES.DLL : 8.1.4.0 13057 Bytes 04/07/2008 07:30:27
  ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 11:30:36
  ANTIVIR1.VDF : 7.1.1.33 1705984 Bytes 24/12/2008 18:13:02
  ANTIVIR2.VDF : 7.1.1.34 2048 Bytes 24/12/2008 18:13:03
  ANTIVIR3.VDF : 7.1.1.54 248832 Bytes 30/12/2008 06:47:14
  Version du moteur: 8.2.0.45
  AEVDF.DLL : 8.1.0.6 102772 Bytes 14/10/2008 10:05:56
  AESCRIPT.DLL : 8.1.1.19 336252 Bytes 28/12/2008 18:13:33
  AESCN.DLL : 8.1.1.5 123251 Bytes 07/11/2008 15:06:41
  AERDL.DLL : 8.1.1.3 438645 Bytes 04/11/2008 13:58:38
  AEPACK.DLL : 8.1.3.4 393591 Bytes 11/11/2008 09:41:39
  AEOFFICE.DLL : 8.1.0.33 196987 Bytes 28/12/2008 18:13:30
  AEHEUR.DLL : 8.1.0.75 1524087 Bytes 28/12/2008 18:13:28
  AEHELP.DLL : 8.1.2.0 119159 Bytes 28/12/2008 18:13:13
  AEGEN.DLL : 8.1.1.8 323956 Bytes 28/12/2008 18:13:11
  AEEMU.DLL : 8.1.0.9 393588 Bytes 14/10/2008 10:05:56
  AECORE.DLL : 8.1.5.2 172405 Bytes 28/12/2008 18:13:07
  AEBB.DLL : 8.1.0.3 53618 Bytes 14/10/2008 10:05:56
  AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:02
  AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:27:58
  AVREP.DLL : 8.0.0.2 98344 Bytes 31/07/2008 12:02:15
  AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:37
  AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:19
  AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:46
  SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
  SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:36
  NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:07
  RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 04/07/2008 07:23:16
  RCTEXT.DLL : 8.0.52.1 86273 Bytes 17/07/2008 10:08:43
  
  Configuration pour la recherche actuelle :
  Nom de la tâche..................: Contrôle intégral du système
  Fichier de configuration.........: c:\program files\avira\antivir personaledition classic\sysscan.avp
  Documentation....................: bas
  Action principale................: supprimer
  Action secondaire................: ignorer
  Recherche sur les secteurs d'amorçage maître: marche
  Recherche sur les secteurs d'amorçage: marche
  Secteurs d'amorçage..............: C:, D:,
  Recherche dans les programmes actifs: marche
  Recherche en cours sur l'enregistrement: marche
  Recherche de Rootkits............: marche
  Fichier mode de recherche........: Tous les fichiers
  Recherche sur les archives.......: marche
  Limiter la profondeur de récursivité: 20
  Archive Smart Extensions.........: marche
  Heuristique de macrovirus........: marche
  Heuristique fichier..............: élevé
  
  Début de la recherche : mercredi 31 décembre 2008 12:46
  
  La recherche d'objets cachés commence.
  Impossible d'initialiser le pilote.
  
  La recherche sur les processus démarrés commence :
  Processus de recherche 'avscan.exe' - '1' module(s) sont contrôlés
  Processus de recherche 'avcenter.exe' - '1' module(s) sont contrôlés
  Processus de recherche 'explorer.exe' - '1' module(s) sont contrôlés
  Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
  Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
  Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
  Processus de recherche 'lsass.exe' - '1' module(s) sont contrôlés
  Processus de recherche 'services.exe' - '1' module(s) sont contrôlés
  Processus de recherche 'winlogon.exe' - '1' module(s) sont contrôlés
  Processus de recherche 'csrss.exe' - '1' module(s) sont contrôlés
  Processus de recherche 'smss.exe' - '1' module(s) sont contrôlés
  '11' processus ont été contrôlés avec '11' modules
  
  La recherche sur les secteurs d'amorçage maître commence :
  Secteur d'amorçage maître HD0
  [INFO] Aucun virus trouvé !
  Secteur d'amorçage maître HD1
  [INFO] Aucun virus trouvé !
  [AVERTISSEMENT] Erreur système [21]: Le périphérique n'est pas prêt.
  Secteur d'amorçage maître HD2
  [INFO] Aucun virus trouvé !
  [AVERTISSEMENT] Erreur système [21]: Le périphérique n'est pas prêt.
  Secteur d'amorçage maître HD3
  [INFO] Aucun virus trouvé !
  [AVERTISSEMENT] Erreur système [21]: Le périphérique n'est pas prêt.
  Secteur d'amorçage maître HD4
  [INFO] Aucun virus trouvé !
  [AVERTISSEMENT] Erreur système [21]: Le périphérique n'est pas prêt.
  
  La recherche sur les secteurs d'amorçage commence :
  Secteur d'amorçage 'C:\'
  [INFO] Aucun virus trouvé !
  Secteur d'amorçage 'D:\'
  [INFO] Aucun virus trouvé !
  
  La recherche sur les renvois aux fichiers exécutables (registre) commence.
  Le registre a été contrôlé ( '64' fichiers).
  
  La recherche sur les fichiers sélectionnés commence :
  
  Recherche débutant dans 'C:\' <HP_PAVILION>
  C:\pagefile.sys
  [AVERTISSEMENT] Impossible d'ouvrir le fichier !
  C:\Documents and Settings\Propriétaire\Bureau\son &video\carol of bells cloche.mp3
  [RESULTAT] Contient le modèle de détection de l'exploit EXP/ASF.GetCodec.Gen
  [REMARQUE] Fichier supprimé.
  C:\Documents and Settings\Propriétaire\Local Settings\Application Data\qquas.exe.xpx
  [0] Type d'archive: HIDDEN
  --> FIL\\\?\C:\Documents and Settings\Propriétaire\Local Settings\Application Data\qquas.exe.xpx
  [RESULTAT] Contient le cheval de Troie TR/Dropper.Gen
  [REMARQUE] Fichier supprimé.
  C:\f7a50988cff06709fd8839e48201c466\mrtstub.exe
  [AVERTISSEMENT] Impossible d'ouvrir le fichier !
  C:\WINDOWS\system32\Macromed\Shockwave 8\Control.dll
  [AVERTISSEMENT] Impossible d'ouvrir le fichier !
  C:\WINDOWS\system32\Macromed\Shockwave 8\dirapi.dll
  [AVERTISSEMENT] Impossible d'ouvrir le fichier !
  C:\WINDOWS\system32\Macromed\Shockwave 8\iml32.dll
  [AVERTISSEMENT] Impossible d'ouvrir le fichier !
  C:\WINDOWS\system32\Macromed\Shockwave 8\Plugin.dll
  [AVERTISSEMENT] Impossible d'ouvrir le fichier !
  C:\WINDOWS\system32\Macromed\Shockwave 8\PluginPing.dll
  [AVERTISSEMENT] Impossible d'ouvrir le fichier !
  C:\WINDOWS\system32\Macromed\Shockwave 8\SwMenu.dll
  [AVERTISSEMENT] Impossible d'ouvrir le fichier !
  Recherche débutant dans 'D:\' <HP_RECOVERY>
  
  Fin de la recherche : mercredi 31 décembre 2008 14:26
  Temps nécessaire: 1:40:15 Heure(s)
  
  La recherche a été effectuée intégralement
  
  9759 Les répertoires ont été contrôlés
  420465 Des fichiers ont été contrôlés
  2 Des virus ou programmes indésirables ont été trouvés
  0 Des fichiers ont été classés comme suspects
  2 Des fichiers ont été supprimés
  0 Des virus ou programmes indésirables ont été réparés
  0 Les fichiers ont été déplacés dans la quarantaine
  0 Les fichiers ont été renommés
  8 Impossible de contrôler des fichiers
  420455 Fichiers non infectés
  14194 Les archives ont été contrôlées
  12 Avertissements
  2 Consignes
  
  0
  
  Réagir
Réponse 17 / 45
g!rly Contributeur
Fais un scan avec cet antispyware :

Telecharge malwarebytes + tutoriel :

-> https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

Tu l´instale; le programme va se mettre automatiquement a jour.

Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".

Click maintenant sur l´onglet recherche et coche la case : "executer un examun complet".

Puis click sur "rechercher".

Laisse le scanner le pc...

Si des elements on ete trouvés > click sur supprimer la selection.

si il t´es demandé de redemarrer > click sur "yes".

A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.

Copie et colle le rapport stp.

@+

0

Réagir
1. blondie
  
  Malwarebytes' Anti-Malware 1.31
  Version de la base de données: 1568
  Windows 5.1.2600 Service Pack 2
  
  29/12/2008 23:21:14
  mbam-log-2008-12-29 (23-21-14).txt
  
  Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|)
  Eléments examinés: 175599
  Temps écoulé: 1 hour(s), 38 minute(s), 7 second(s)
  
  Processus mémoire infecté(s): 0
  Module(s) mémoire infecté(s): 0
  Clé(s) du Registre infectée(s): 1
  Valeur(s) du Registre infectée(s): 0
  Elément(s) de données du Registre infecté(s): 0
  Dossier(s) infecté(s): 2
  Fichier(s) infecté(s): 130
  
  Processus mémoire infecté(s):
  (Aucun élément nuisible détecté)
  
  Module(s) mémoire infecté(s):
  (Aucun élément nuisible détecté)
  
  Clé(s) du Registre infectée(s):
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{d5792aa9-d373-4039-8670-2cdab6a71f15} (Trojan.Lop) -> Quarantined and deleted successfully.
  
  Valeur(s) du Registre infectée(s):
  (Aucun élément nuisible détecté)
  
  Elément(s) de données du Registre infecté(s):
  (Aucun élément nuisible détecté)
  
  Dossier(s) infecté(s):
  C:\Documents and Settings\Propriétaire\Application Data\m (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared (Trojan.Agent) -> Quarantined and deleted successfully.
  
  Fichier(s) infecté(s):
  C:\Documents and Settings\Propriétaire\Application Data\m\data.oct (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\list.oct (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\srvlist.oct (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\123 Photo Screensaver Builder 2.0.2.264.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\12Ghosts Replace 9.50.132.5502.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\190-533 - DOMINO.DOC SYSTEM ADMINISTRATION 3.0 Practice Test Questions 1.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\1st Screensaver Photo Studio Standard 2.0.2.292.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\30 Boxes Viewer Widget 1.00.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Active Whois 1.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Adriana Karembeu Screensaver3.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Advanced Email Locator 1.62.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Advanced System Cleaner 1.8.1.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Afree DVD to FLV MP4 iPhone iPod AVI WMV Ripper 5.1.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Andes.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\APOD - Astronomy Picture of the Day 2.72.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\ArtRage Starter Edition 2.5.20.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\As seen on TV.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Auqio Sound Studio 2.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\AutoClip 3.00.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\AVAST.pro.spanish.(BY.SHOSET).zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Bitdefender.Internet.Security.v10.0.FRENCH+Keygen.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Book Avis 1.4.2.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Bookkeeping for REALTORS 2.0.1.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Bytescout Watermarking PRO 1.50.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Chilkat BlackList C++ Library 8.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Clusty Search 1.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\ColorLab 2.8.13.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Cool Radio Recorder 3.1.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Copiks PhotoMapper 0.3.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\CountYourTime 1.8 Build 384.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\CPU-Control 1.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Crack.-.Avast!.Antivirus.All.Versions.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Cryptic Disk 2.5.6.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\DirectX End-User Runtime Web Installer November 2008 9.25.1476.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\DISKdata 3.5.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Dolphinz Screensaver.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Drewbuzz Alarm 1.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\DrWeb.key.alternative.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\e-Counter 4.10.2008.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\EA.Mobile.Orcs.And.Elves.v1.3.15.S60v2.J2ME.webpleasure.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Easy Spyware Scanner 1.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Emailchemy 1.9.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Encryption Program 1.50.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Entagged 0.35.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\EstimatesPlease 1.2.0.1.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\eWriter 0.Cg.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Eztoo DVD To WMV Converter 2.00.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Fast Video & Audio Converter 2.7.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\FileRescue for FAT 2.9 Build 455.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Finster the Fish 1.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Free Four Seasons Screensaver 1.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Google Page Rank Digger 1.2.8 Build 041212.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\GradeLog Deluxe 2.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\GtodayIs 1.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Hot Video to iPod Converter 2.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\How to Play the Guitar Vol2 5.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\HYPr StoryMaker 4.2.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\IBXExTrees Library 5.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Interactive Resume Builder 2004.6.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Jeep 301 - 400 Screen Saver 1.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\JMT Orchestrator 2.1.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Junior Icon Editor 3.10.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Karpesky.Personal.Antivirus.v5.0.227.+key.2007.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\LingvoSoft Dictionary 2007 English - Russian 4.0.22.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Linoleic Acid 1.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Lonely Sentinels-SS 1.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\LOWER 1.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Magic Cabin 1.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\MAGIX Xtreme Photo Designer 6.0.19.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\McAfee.Common.Management.Agent.CMA-3.6.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\MediaDB 1.2.1.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\METRO-DF 1.2.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Mobile Translator Aleman Esp.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Movie DVD HELLBOY Icons.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Mp3ListShellEx 2.1.1.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Multimedia Converter From Avi Or Divx To 3Gp For Umts Mobile Video Phone 6600 Or Any Nokia.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\MyRingToneServer 1.9.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Norton Antivirus for Handhelds (Pocket PC & Palm) 2004.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Octavius Chord Analyzer 1.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\omega123 toolbar for IE 4.5.131.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\OpenSebJ 0.41.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Panda Platinum 2005 Internet Security v9.00.00 Final - English.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\passwordTrickbox 1.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\PDF Manipulator 1.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\PDF Quick Viewer & Converter 4.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\PE Packer Decompression Benchmarker 2.01 alpha.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Personal Passworder 3.9.8.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Pink Calendar and Day Planner 7.1.9.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Play DVD 1.2.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Play Yan Video Maker 0.61.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Plopp 1.2.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\PolyVid Pro 2.1.4.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\PopCorn MKV AudioConverter 1.71.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\PuTTY 0.60.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\QuickMAN 0.9.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\QuikCalc Mortgage & Loan Manager Lite Edition 4.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Radio aus Bayern 3.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Random Videos 1.0.0.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Roar Font.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\ScheduleMaster 3.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Scorecard 1.4.2.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Screen Shot Creator 2.9.3.10.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Send2Page Control 1.0.159.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\SilverSoft Talent 2005.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Simple-X-Crypt 1.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Sm InfoMoto 1.4.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\SnapRecorder 1.1.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Snattei 0.10.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Sonic The Hedgehog-nokia.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\SpeedPDF Stamp 1.1.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Split'n'Stick 1.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Switch Miner 2.51.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\SWR Calculator 1.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Symantec.Antivirus.Corporate.Edition.v10.2.276.WinVista.Retail.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\TextTrimmer 1.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\TimeSentry 2.5.5.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\TOP - Vista Shutdown Control 2.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Traverso 0.42.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Tropical Fish ScreenSaver 1.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Tyle 1.0.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Video to Audio Converter 1.10.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Visual Menu Ex 1.20.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Webskape BackOffice 3.2.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\WHD 1.5.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\WidgetAvenue 1.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Wsnap 1.8.23.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\Xfire 1.101 Build 35044.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\YourSpell 1.06.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Propriétaire\Application Data\m\shared\ZipGenius 6.0.3.1150.zip (Trojan.Agent) -> Quarantined and deleted successfully.
  
  0
  
  Réagir
Réponse 18 / 45
g!rly Contributeur
;-(
tu as passé ot_move it ?

0

Réagir
1. blondie
  
  ========== PROCESSES ==========
  Process explorer.exe killed successfully.
  ========== SERVICES/DRIVERS ==========
  Unable to stop service McAfee Framework Service .
  Unable to stop service McAfeeFramework .
  ========== FILES ==========
  C:\Program Files\McAfee\Common Framework\0409 moved successfully.
  C:\Program Files\McAfee\Common Framework moved successfully.
  C:\Program Files\McAfee moved successfully.
  ========== COMMANDS ==========
  User's Temp folder emptied.
  User's Temporary Internet Files folder emptied.
  User's Internet Explorer cache folder emptied.
  Local Service Temp folder emptied.
  Local Service Temporary Internet Files folder emptied.
  Windows Temp folder emptied.
  Java cache emptied.
  Temp folders emptied.
  Explorer started successfully
  
  OTMoveIt3 by OldTimer - Version 1.0.7.2 log created on 12292008_195923
  
  hijackthis
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 20:19:37, on 29/12/2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16762)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
  C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
  C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
  C:\WINDOWS\System32\DLA\DLACTRLW.EXE
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
  C:\Program Files\Windows Live\Messenger\msnmsgr.exe
  C:\Program Files\e-Carte Bleue Caisse d'Epargne\ecbl-cnce.exe
  C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\Java\jre1.6.0_04\bin\jucheck.exe
  C:\Program Files\Windows Live\Messenger\usnsvc.exe
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q304&bd=pavilion&pf=desktop
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://outlook.live.com/owa/
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  R3 - Default URLSearchHook is missing
  O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
  O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
  O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
  O3 - Toolbar: Share Accelerator Toolbar - {f5c93451-2609-4723-a053-5c19516be1a8} - C:\Program Files\Share_Accelerator\tbShar.dll
  O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
  O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
  O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
  O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
  O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
  O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
  O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
  O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
  O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\System32\mstask.exe
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
  O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
  O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
  O4 - Global Startup: e-Carte Bleue Caisse d'Epargne.lnk = C:\Program Files\e-Carte Bleue Caisse d'Epargne\ecbl-cnce.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
  O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
  O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O15 - Trusted Zone: *.registration.sonystyle-europe.com (HKLM)
  O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
  O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase9563.cab
  O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://abonnement.aliceadsl.fr/configurateur/AccountHelper.cab
  O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
  O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://bmm.imgag.com/imgag/cp/install/crusher-fr.cab
  O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game10.zylom.com/activex/zylomgamesplayer.cab
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
  O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/player/install/installer.exe
  O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{400473F1-AC6C-491F-AFF5-6FCF91F01D42}: NameServer = 212.216.172.62,213.26.80.1
  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
  O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program Files\McAfee\Common Framework\FrameworkService.exe (file missing)
  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
  
  0
  
  Réagir
Réponse 19 / 45
g!rly Contributeur
ok

Télécharges OTMoveIt3 (de Old_Timer) sur ton Bureau.

http://oldtimer.geekstogo.com/OTMoveIt3.exe

En mode sans échec:

Double cliques sur "OTMoveIt3.exe" pour ouvrir le prg .
Puis copies ce qui se trouve en citation ci-dessous,

:Processes
explorer.exe

:Services
McAfee Framework Service
McAfeeFramework

:Files
C:\Program Files\McAfee

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

et colles le dans le cadre de gauche de OTMoveIt3 :
Paste Instructions for items to be moved.
(ne touche à rien d'autre !)

-> cliques sur MoveIt! pour lancer la suppression.
-> laisses travailler l'outil ...

( Note : ton bureau va disparaitre puis réapparaitre, c'est normal .)

-> une fois finis , un petite fenêtre s'ouvre : cliques sur " Yes " .

Ton PC va redémarrer de lui même ...

-->Postes le contenu du rapport qui se trouve dans le dossier "C:\_OTMoveIt\MovedFiles"
( " xxxx2008_xxxxxx.log " où les "x" correspondent au jour et à l'heure de l'utilisation ).

post un nouveau rapport hijack this avec ot_move it

une question > tu es en italie ?

@+

0

Réagir
1. blondie
  
  non en france.C est super long pour enlever tous ca c normal car j ai des logiciels qui beug maintenant.
  
  0
  
  Réagir
Réponse 20 / 45
g!rly Contributeur
ok

Nettoyage AD-Remover :

! Déconnecte toi et ferme toutes application en cours ( navigarteur compris ) !

* Relance "Ad-remover" : au menu principal choisis l'option "B" .

* A l'écran de sélection ( écran ) :

http://sd-1.archive-host.com/membres/up/16506160323759868/Capturer-ADR.JPG

tu coches les cases :

2, 4 et 6

Une fois la sélection faite, tape S puis [entrée] pour lancer la suppression .

--> le programme va travailler , ne touche à rien ...

* Poste le rapport qui apparait à la fin + un nouvel Hijackthis pour analyse ...

( le rapport est sauvegardé aussi sous C:\Ad-report.log )

/!\ Si le Bureau ne réapparait pas, presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tape explorer.exe et valide ) /!\

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Note :
"Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

post egalement un nouveau rapport hijack this stp

@+

0

Réagir
1. blondie
  
  Logfile of AD-Remover 1.0.7.7 by C_XX ---------
  
  *** Limited to ***
  
  Eorezo
  Funwebproduct/MyWay/MyWebsearch
  Sweetim
  
  ******************
  
  # START at: 19:15:27 | Lun 29/12/2008 | Microsoft® Windows XP™ (v5.1.2600)
  # BOOT MODE: Normal
  
  # OPTION: Clean | EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat
  
  # PC: SEBASTIEN | USER: krystel ( Current user is an administrator)
  
  # DRIVE(S):
  - C:\ (File System: NTFS)
  - D:\ (File System: FAT32)
  - E:\ (File System: UDF)
  
  # Internet Explorer v7.0.5730.11
  
  --------- [ RUNNING PROCESSES: 38 ] ---------
  
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  C:\Program Files\McAfee\Common Framework\FrameworkService.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
  C:\WINDOWS\System32\alg.exe
  C:\Program Files\Windows Live\Messenger\usnsvc.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
  C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
  C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
  C:\Program Files\SweetIM\Messenger\SweetIM.exe
  C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
  C:\WINDOWS\System32\DLA\DLACTRLW.EXE
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Windows Live\Messenger\msnmsgr.exe
  C:\Program Files\e-Carte Bleue Caisse d'Epargne\ecbl-cnce.exe
  C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
  C:\Program Files\Java\jre1.6.0_04\bin\jucheck.exe
  C:\WINDOWS\system32\ntvdm.exe
  
  -----------------------------------
  
  (!) ---- IE start pages reset
  
  +-----------------------| Eorezo Elements Deleted :
  
  "HKEY_CLASSES_ROOT\EoRezoBHO.EoBho"
  "HKEY_CLASSES_ROOT\EoRezoBHO.EoBho.1"
  "HKEY_CLASSES_ROOT\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}"
  "HKEY_CLASSES_ROOT\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}"
  "HKEY_CURRENT_USER\SOFTWARE\EoRezo"
  "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}"
  "HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350}"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run" /v "EoEngine"
  .
  [07/02/2008 19:55|d--------] C:\Program Files\EoRezo
  [07/02/2008 19:55|d--------] C:\Documents and Settings\krystel\Application Data\EoRezo
  [12/09/2008 18:43|--a------] C:\DOCUME~1\krystel\Cookies\KR268D~1.TXT
  
  +-----------------------| FunWebProducts/MyWay/MyWebSearch/MyGlobalSearch Elements Deleted :
  
  "HKEY_CLASSES_ROOT\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179}"
  .
  
  +-----------------------| Sweetim Elements Deleted :
  
  "HKEY_CLASSES_ROOT\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}"
  "HKEY_CLASSES_ROOT\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}"
  "HKEY_CLASSES_ROOT\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}"
  "HKEY_CLASSES_ROOT\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}"
  "HKEY_CLASSES_ROOT\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}"
  "HKEY_CLASSES_ROOT\Installer\Features\5D72AF385B5242D47B69FD47F2805AFC"
  "HKEY_CLASSES_ROOT\Installer\Features\428C9AFC877ABE7409DCBBD48BC23F84"
  "HKEY_CLASSES_ROOT\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0"
  "HKEY_CLASSES_ROOT\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632"
  "HKEY_CLASSES_ROOT\SWEETIE.IEToolbar"
  "HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1"
  "HKEY_CLASSES_ROOT\SWEETIE.SWEETIE"
  "HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.3"
  "HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook"
  "HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook.1"
  "HKEY_CLASSES_ROOT\Toolbar3.SWEETIE"
  "HKEY_CLASSES_ROOT\Toolbar3.SWEETIE.1"
  "HKEY_CLASSES_ROOT\Typelib\{EEE6C35E-6118-11DC-9C72-001320C79847}"
  "HKEY_CLASSES_ROOT\Typelib\{EEE6C35F-6118-11DC-9C72-001320C79847}"
  "HKEY_CLASSES_ROOT\MgMediaPlayer.GifAnimator"
  "HKEY_CLASSES_ROOT\MgMediaPlayer.GifAnimator.1"
  "HKEY_CURRENT_USER\SOFTWARE\SweetIM"
  "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks" /v "{EEE6C35D-6118-11DC-9C72-001320C79847}"
  "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}"
  "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\428C9AFC877ABE7409DCBBD48BC23F84"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\5D72AF385B5242D47B69FD47F2805AFC"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar" /v "{EEE6C35B-6118-11DC-9C72-001320C79847}"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run" /v "SweetIM"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CFA9C824-A778-47EB-90CD-BB4DB82CF348}"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{83FA27D5-25B5-4D24-B796-DF742F08A5CF}"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\02F47BF73B948514FAACADD8CBBDF37D"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\080D9F5E1E95FEE4794CE438E635239E"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1E264E0A5959A1C46BA9175A878B12EA"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2E6768B6932D112438F047C54D180635"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\351716A953E21214898904032EAE2E81"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A189D17A469616C4688D23E192996267"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4318DF19719275242801CBE292063A4C"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F754C503375A13344B22388E18DFE87E"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\5D72AF385B5242D47B69FD47F2805AFC"
  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\428C9AFC877ABE7409DCBBD48BC23F84"
  "HKEY_LOCAL_MACHINE\SOFTWARE\SweetIM"
  .
  /!\ NOT DELETED - [06/08/2008 13:20|d--------] C:\PROGRA~1\SweetIM
  /!\ NOT DELETED - [29/12/2008 19:16|d--------] C:\PROGRA~1\SweetIM\MESSEN~1
  /!\ NOT DELETED - [06/07/2008 12:31|-ra------] C:\PROGRA~1\SweetIM\MESSEN~1\MGADAP~1.DLL
  /!\ NOT DELETED - [11/07/2006 18:35|--a------] C:\PROGRA~1\SweetIM\MESSEN~1\msvcr71.dll
  [06/08/2008 13:21|d--------] C:\Documents and Settings\All Users\Application Data\SweetIM
  [09/08/2008 11:50|--a------] C:\DOCUME~1\krystel\Cookies\KR8BCD~1.TXT
  [12/12/2008 09:55|--a------] C:\DOCUME~1\krystel\Cookies\KREB8C~1.TXT
  [19/12/2008 11:49|--a------] C:\DOCUME~1\krystel\Cookies\KR5441~1.TXT
  
  (!) ---- Temp files deleted.
  (!) ---- Recycle bin emptied in all drives.
  
  ************* /!\ File(s)/Folder(s) Not Deleted /!\ *************
  
  "C:\Program Files\SweetIM\Messenger"
  "C:\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll"
  "C:\Program Files\SweetIM\Messenger\msvcr71.dll"
  
  Second run ...
  
  "C:\Program Files\SweetIM\Messenger" - RESIST !
  "C:\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll" - RESIST !
  "C:\Program Files\SweetIM\Messenger\msvcr71.dll" - RESIST !
  
  +-----------------------| ADDED SCAN :
  
  +--[HKEY_CURRENT_USER\..\Run]
  
  ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe
  H/PC Connection Agent REG_SZ "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
  msnmsgr REG_SZ "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
  LogitechSoftwareUpdate REG_SZ "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
  
  +--[HKEY_LOCAL_MACHINE\..\Run]
  
  WorksFUD REG_SZ C:\Program Files\Microsoft Works\wkfud.exe
  Microsoft Works Portfolio REG_SZ C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
  Microsoft Works Update Detection REG_SZ C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
  QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
  EoFlip REG_SZ
  Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  HPDJ Taskbar Utility REG_SZ C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
  Share-to-Web Namespace Daemon REG_SZ C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
  SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
  DLA REG_SZ C:\WINDOWS\System32\DLA\DLACTRLW.EXE
  avgnt REG_SZ "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
  
  +--[HKEY_USERS\.DEFAULT\..\Run]
  
  DWQueuedReporting REG_SZ "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t
  msnmsgr REG_SZ "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
  
  +--[HKEY_CURRENT_USER\..\Internet Explorer\MAIN]
  
  Start Page : hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
  
  +--[HKEY_LOCAL_MACHINE\..\Internet Explorer\MAIN]
  
  Start Page : hxxp://fr.msn.com/
  Start Page : hxxp://www.live.com/\0\0
  
  +---------------------------------------------------------------------------+
  
  - "C:\AD-report-Clean-29.12.2008.log" (~15773 bytes)
  
  - "C:\AD-report-Scan-29.12.2008.log" (~26580 bytes)
  
  # END at: 19:21:37 | 29/12/2008 - Time elapsed: 6 minutes, 9 seconds
  
  +---------------------------------------------------------------------------+
  +------------------------------- [ E.O.F - 205 lines ]
  +---------------------------------------------------------------------------+
  
  ET HIJACKTHIS
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 19:31:29, on 29/12/2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16762)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  C:\Program Files\McAfee\Common Framework\FrameworkService.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Windows Live\Messenger\usnsvc.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
  C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
  C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
  C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
  C:\WINDOWS\System32\DLA\DLACTRLW.EXE
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\e-Carte Bleue Caisse d'Epargne\ecbl-cnce.exe
  C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
  C:\Program Files\Java\jre1.6.0_04\bin\jucheck.exe
  C:\WINDOWS\explorer.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q304&bd=pavilion&pf=desktop
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://outlook.live.com/owa/
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  R3 - Default URLSearchHook is missing
  O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
  O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
  O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
  O3 - Toolbar: Share Accelerator Toolbar - {f5c93451-2609-4723-a053-5c19516be1a8} - C:\Program Files\Share_Accelerator\tbShar.dll
  O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
  O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
  O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
  O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
  O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
  O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
  O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
  O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
  O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\System32\mstask.exe
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
  O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
  O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
  O4 - Global Startup: e-Carte Bleue Caisse d'Epargne.lnk = C:\Program Files\e-Carte Bleue Caisse d'Epargne\ecbl-cnce.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
  O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
  O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O15 - Trusted Zone: *.registration.sonystyle-europe.com (HKLM)
  O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
  O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase9563.cab
  O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://abonnement.aliceadsl.fr/configurateur/AccountHelper.cab
  O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
  O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://bmm.imgag.com/imgag/cp/install/crusher-fr.cab
  O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game10.zylom.com/activex/zylomgamesplayer.cab
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
  O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/player/install/installer.exe
  O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{400473F1-AC6C-491F-AFF5-6FCF91F01D42}: NameServer = 212.216.172.62,213.26.80.1
  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
  O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
  
  0
  
  Réagir
- 1
- 2
- 3
Suivant

Probleme d anti virus

45 réponses

Discussions similaires

Newsletters