Spyware guard 2008

caro -

Bonjour à tous,
Débutant avec internet ai était infectée avec virus dont spyware guard 2008 impossible à éradiquer, comment faire?? merci d'avance.

Configuration: Windows XP
Firefox 2.0.0.20

Afficher la suite

A voir également

Spyware guard 2008
Spyware gratuit - Télécharger - Antivirus & Antimalwares
Spyware doctor - Télécharger - Antivirus & Antimalwares
Folder guard - Télécharger - Chiffrement
Spyware blaster - Télécharger - Antivirus & Antimalwares
Télécharger splitcam ancienne version 2008 - Télécharger - Messagerie

44 réponses

Résumé de la discussion

Infection par Spyware Guard 2008 sur Windows XP et Firefox 2.0.0.20 est le problème central, la personne débutante recherchant des méthodes efficaces pour éradiquer le malware. Des solutions proposent Malwarebytes, mise à jour et analyse complète, puis suppression des éléments détectés et redémarrage; d'autres outils comme ZHPDiag, SmitFraudFix ou HijackThis ont été suggérés selon le niveau de menace. En cas d'infection importante, certains évoquent des difficultés d'installation et l'impossibilité d'utiliser certains antivirus, mais la plupart conviennent que des outils dédiés comme Malwarebytes et des analyses restent des étapes clés. Une information est que certains rapports et résultats d'analyse nécessitent une vérification et que, même après suppression, une maintenance régulière et des scans répétés peuvent être nécessaires pour éviter une réinfection.

Réponse 1 / 44
V-X
Re,

On va faire autrement:

> Fais un scan en ligne avec Kaspersky : Kaspersky

N.B. : Le scan ne marche que sous Internet Explorer.

- Commence par connecter tout ton matériel de stockage à ton PC (clés USB, DD amovible...). Allume les si necessaire.

- Sous Démonstration en ligne, on t'explique la marche à suivre, et pour lancer le scan il faut sélectionner < Exécuter l'analyse en ligne >.

- On va te demander de télécharger un contrôle active x, accepte .

- Dans le menu < Choisissez la cible de l'analyse >, sélectionne < Poste de travail >. Le scan va commencer.

- Poste le rapport qui sera généré stp. (clique sur <enregistrer le rapport> puis sauvegarde-le sur ton bureau en choisissant "fichier texte (*.txt)" pour l'extension).
S'il y a un problème, assure toi que les contrôles active x sont bien configurés dans les options internet comme décrit sur ce lien : clic ici

Rappel : le scan est à faire sous Internet Explorer
Tuto ici si problème

NOTE : Si tu reçois le message "La licence de Kaspersky On-line Scanner est périmée", va dans Ajout/Suppression de programmes puis désinstalle On-Line Scanner, reconnecte toi sur le site de Kaspersky pour retenter le scan en ligne.
Pour le rapport Kaspersky il faut que tu choisisses "Afficher le rapport" puis que tu l'enregistres sur ton bureau sous forme de fichier texte (type de fichier "tous les fichiers").

0
Réponse 2 / 44
V-X
Re,

Redémarre ton pc et essai de relancer malwarebyte.

0
1. caro zzz
  
  Re MBAM ne veut pas se lancer. Dis moi tu penses qu'il se passe quoi avec mon pc? T'as une petite idée? Merci
  
  0
Réponse 3 / 44
caro zzz
Re, ai fait comme tu m'as indiqué. J'en tire cela:
========== PROCESSES ==========
Process explorer.exe killed successfully.
Error: Unable to interpret <:file > in the current context!
Error: Unable to interpret <C:\WINDOWS\System32\iepeers32.dll > in the current context!
Error: Unable to interpret <C:\WINDOWS\System32\vumer.dll > in the current context!
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\Dje\LOCALS~1\Temp\etilqs_pPy4tlS1MAiEZlfbg7Dk scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Dje\LOCALS~1\Temp\~DF3C90.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Dje\LOCALS~1\Temp\~DF3CA2.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Dje\LOCALS~1\Temp\~DF5380.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Dje\LOCALS~1\Temp\~DF5392.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_6bc.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\Dje\Local Settings\Application Data\Mozilla\Firefox\Profiles\kdda0e68.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Dje\Local Settings\Application Data\Mozilla\Firefox\Profiles\kdda0e68.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Dje\Local Settings\Application Data\Mozilla\Firefox\Profiles\kdda0e68.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Dje\Local Settings\Application Data\Mozilla\Firefox\Profiles\kdda0e68.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Dje\Local Settings\Application Data\Mozilla\Firefox\Profiles\kdda0e68.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Dje\Local Settings\Application Data\Mozilla\Firefox\Profiles\kdda0e68.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01262009_002505

Files moved on Reboot...
File C:\DOCUME~1\Dje\LOCALS~1\Temp\etilqs_pPy4tlS1MAiEZlfbg7Dk not found!
File C:\DOCUME~1\Dje\LOCALS~1\Temp\~DF3C90.tmp not found!
File C:\DOCUME~1\Dje\LOCALS~1\Temp\~DF3CA2.tmp not found!
File C:\DOCUME~1\Dje\LOCALS~1\Temp\~DF5380.tmp not found!
File C:\DOCUME~1\Dje\LOCALS~1\Temp\~DF5392.tmp not found!
File move failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\Perflib_Perfdata_6bc.dat scheduled to be moved on reboot.
C:\Documents and Settings\Dje\Local Settings\Application Data\Mozilla\Firefox\Profiles\kdda0e68.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\Dje\Local Settings\Application Data\Mozilla\Firefox\Profiles\kdda0e68.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\Dje\Local Settings\Application Data\Mozilla\Firefox\Profiles\kdda0e68.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\Dje\Local Settings\Application Data\Mozilla\Firefox\Profiles\kdda0e68.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\Dje\Local Settings\Application Data\Mozilla\Firefox\Profiles\kdda0e68.default\urlclassifier3.sqlite moved successfully.
C:\Documents and Settings\Dje\Local Settings\Application Data\Mozilla\Firefox\Profiles\kdda0e68.default\XUL.mfl moved successfully.

0
Réponse 4 / 44
V-X
Re,

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau :
http://oldtimer.geekstogo.com/OTMoveIt3.exe

---> Double-clique sur OTMoveIt3.exe afin de le lancer.

---> Copie (Ctrl+C) le texte suivant en gras ci-dessous :

:processes
explorer.exe

:file

C:\WINDOWS\System32\iepeers32.dll

C:\WINDOWS\System32\vumer.dll

:commands
[purity]
[emptytemp]
[start explorer]

---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log

0
Vous n’avez pas trouvé la réponse que vous recherchez ?

La communauté CCM répond en moyenne en moins de 2h.

Posez votre question
Réponse 5 / 44
V-X
Re,

Ne fait que sa:

Rends toi sur ce site :

https://www.virustotal.com/gui/

Clique sur parcourir et cherche ces fichiers :

=>C:\WINDOWS\system32\fabdbd.dll

=>C:\WINDOWS\System32\iepeers32.dll

=>C:\WINDOWS\System32\vumer.dll

Clique sur Send File.

Un rapport va s'élaborer ligne à ligne.

Attends la fin. Il doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note.

Copie le dans ta réponse.

Egalement le lien.

Merci

0
1. caro zzz
  
  Re, j'ai réussit à copier, là y'a tout je pense...As- tu quelque chose d'utile dans tout cela?
  
  Suomi | ihMdI | | עברית | | Slovenščina | Dansk | Русский | Română | Türkçe | Nederlands | Ελληνικά | Svenska | Português | Italiano | | | Magyar | Deutsch | Česky | Polski | Español | English
  Virus Total
  Virustotal est un service qui analyse les fichiers suspects et facilite la détection rapide des virus, vers, chevaux de Troie et toutes sortes de malwares détectés par les moteurs antivirus. Plus d'informations...
  Fichier vumer.dll reçu le 2009.01.25 21:18:36 (CET)
  Situation actuelle: terminé
  Résultat: 5/39 (12.82%)
  Formaté Formaté
  Impression des résultats Impression des résultats
  Antivirus Version Dernière mise à jour Résultat
  a-squared 4.0.0.73 2009.01.25 AdWare.Win32.BHO!IK
  AhnLab-V3 5.0.0.2 2009.01.25 -
  AntiVir 7.9.0.60 2009.01.25 -
  Authentium 5.1.0.4 2009.01.25 -
  Avast 4.8.1281.0 2009.01.25 -
  AVG 8.0.0.229 2009.01.25 -
  BitDefender 7.2 2009.01.25 -
  CAT-QuickHeal 10.00 2009.01.24 -
  ClamAV 0.94.1 2009.01.25 -
  Comodo 946 2009.01.25 -
  DrWeb 4.44.0.09170 2009.01.25 -
  eSafe 7.0.17.0 2009.01.25 -
  eTrust-Vet 31.6.6325 2009.01.24 -
  F-Prot 4.4.4.56 2009.01.25 -
  F-Secure 8.0.14470.0 2009.01.25 -
  Fortinet 3.117.0.0 2009.01.25 -
  GData 19 2009.01.25 -
  Ikarus T3.1.1.45.0 2009.01.25 AdWare.Win32.BHO
  K7AntiVirus 7.10.604 2009.01.24 Trojan.Win32.BHO.krr
  Kaspersky 7.0.0.125 2009.01.25 -
  McAfee 5506 2009.01.25 -
  McAfee+Artemis 5506 2009.01.25 -
  Microsoft 1.4205 2009.01.25 -
  NOD32 3798 2009.01.25 -
  Norman 5.93.01 2009.01.23 -
  nProtect 2009.1.8.0 2009.01.23 -
  Panda 9.5.1.2 2009.01.25 -
  PCTools 4.4.2.0 2009.01.25 -
  Prevx1 V2 2009.01.25 Malicious Software
  Rising 21.13.42.00 2009.01.23 -
  SecureWeb-Gateway 6.7.6 2009.01.25 -
  Sophos 4.37.0 2009.01.25 -
  Sunbelt 3.2.1835.2 2009.01.16 -
  Symantec 10 2009.01.25 -
  TheHacker 6.3.1.5.229 2009.01.25 -
  TrendMicro 8.700.0.1004 2009.01.24 -
  VBA32 3.12.8.11 2009.01.25 Trojan.Win32.BHO.krr
  ViRobot 2009.1.23.1576 2009.01.23 -
  VirusBuster 4.5.11.0 2009.01.25 -
  Information additionnelle
  File size: 200210 bytes
  MD5...: 0281d75abc1de634939a0689b2472dd2
  SHA1..: a0032c1e56b2f119c41f7d53d17d97e1b5bd2404
  SHA256: a192c9c6fc24529b3156033db7028d0382b7b5aca7aa625f5cbed5961ee23ec2
  SHA512: 20f3f758d523c511807db75d6e5acf11cd87c22ff7ef4a5a6abe20f682d8f3b9
  33a265f13645a8f0c374a5faef829adba06d070b0894f8136dfd58f6a30e5fdf
  ssdeep: 3072:mJ4ib2L9ZL5Daq23qp+RcviiopUm/zq7gk47/c/IOI:bibY9ZdDi9Rcv+Um
  /zq7gk5In
  PEiD..: Armadillo v1.xx - v2.xx
  TrID..: File type identification
  DirectShow filter (52.6%)
  Windows OCX File (32.2%)
  Win32 Executable MS Visual C++ (generic) (9.8%)
  Win32 Executable Generic (2.2%)
  Win32 Dynamic Link Library (generic) (1.9%)
  PEInfo: PE Structure information
  
  ( base data )
  entrypointaddress.: 0x1001f82d
  timedatestamp.....: 0x4978db09 (Thu Jan 22 20:46:01 2009)
  machinetype.......: 0x14c (I386)
  
  ( 5 sections )
  name viradd virsiz rawdsiz ntrpy md5
  .text 0x1000 0x22e96 0x23000 5.98 2fae090acf3888c2455aced07e0db62d
  .rdata 0x24000 0x9752 0x9800 5.96 e46c8e73c8412f7e3dc4225265506d92
  .data 0x2e000 0x8b8 0x800 3.83 7629422ca91d451ae47e49b64870b0ac
  .rsrc 0x2f000 0xe30 0x1000 4.06 40ee312243d3301a46fd3f887fac9b1f
  .reloc 0x30000 0x28e2 0x2a00 5.87 f003756e728c19aa04153dcce2b7ed38
  
  ( 9 imports )
  > KERNEL32.dll: GetCurrentProcess, FlushInstructionCache, lstrlenW, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InterlockedIncrement, InterlockedDecrement, InitializeCriticalSection, DisableThreadLibraryCalls, FormatMessageW, LocalAlloc, LocalFree, LoadLibraryW, GetProcAddress, lstrcpyA, lstrcmpW, WaitForMultipleObjects, lstrlenA, MultiByteToWideChar, WaitForSingleObject, CreateThread, Sleep, SetEvent, CloseHandle, ResetEvent, CreateEventW, GetLocaleInfoW, GetLastError, GetVersionExW, WideCharToMultiByte, lstrcpyW, GetModuleFileNameW, GetComputerNameW, lstrcpynW
  > ole32.dll: CoInitialize, CoUninitialize, CoCreateInstance
  > OLEAUT32.dll: -, -, -, -, -, -, -, -, -, -, -
  > SHLWAPI.dll: StrStrW, StrChrW, StrToIntW
  > ATL.DLL: -, -, -, -, -, -, -, -, -, -, -
  > MSVCP60.dll: __C@_1___Nullstr@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@CAPBDXZ@4DB, _assign@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@PBDI@Z, __Tidy@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@AAEX_N@Z, __1_Lockit@std@@QAE@XZ, __0_Lockit@std@@QAE@XZ, _assign@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z, _npos@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@2IB, _append@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@PBDI@Z, _append@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@ID@Z, _assign@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@PBD0@Z, __1_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@XZ
  > MSVCRT.dll: strchr, free, __dllonexit, _onexit, __1type_info@@UAE@XZ, _terminate@@YAXXZ, __0exception@@QAE@ABQBD@Z, malloc, _adjust_fdiv, time, __CxxFrameHandler, __2@YAPAXI@Z, __1exception@@UAE@XZ, __0exception@@QAE@ABV0@@Z, _except_handler3, strtol, printf, memset, memcmp, _purecall, memcpy, _CxxThrowException, _initterm, strlen
  > USER32.dll: wsprintfW, wsprintfA
  > ADVAPI32.dll: RegCloseKey, RegQueryInfoKeyW, RegEnumValueW, RegDeleteKeyW, RegSetValueExW, RegQueryValueExW, RegCreateKeyExW
  
  ( 4 exports )
  DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer
  Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=034CF1121208D6CB0E0F0353B47E5B00D2A30FA4
  
  ATENTION ATTENTION: VirusTotal est un service gratuit offert par Hispasec Sistemas. Il n'y a aucune garantie quant à la disponibilité et la continuité de ce service. Bien que le taux de détection permis par l'utilisation de multiples moteurs antivirus soit bien supérieur à celui offert par seulement un produit, ces résultats NE garantissent PAS qu'un fichier est sans danger. Il n'y a actuellement aucune solution qui offre un taux d'efficacité de 100% pour la détection des virus et malwares.
  
  Autre fichier
  VirusTotal © Hispasec Sistemas - Blog - Contact: info@virustotal.com - Terms of Service & Privacy Policy
  Virus Total
  Virustotal est un service qui analyse les fichiers suspects et facilite la détection rapide des virus, vers, chevaux de Troie et toutes sortes de malwares détectés par les moteurs antivirus. Plus d'informations...
  
  Suomi | ihMdI | | עברית | | Slovenščina | Dansk | Русский | Română | Türkçe | Nederlands | Ελληνικά | Svenska | Português | Italiano | | | Magyar | Deutsch | Česky | Polski | Español | English
  Virus Total
  Virustotal est un service qui analyse les fichiers suspects et facilite la détection rapide des virus, vers, chevaux de Troie et toutes sortes de malwares détectés par les moteurs antivirus. Plus d'informations...
  Fichier iepeers32.dll reçu le 2009.01.25 23:58:28 (CET)
  Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
  Résultat: 31/39 (79.49%)
  en train de charger les informations du serveur...
  Votre fichier est dans la file d'attente, en position: ___.
  L'heure estimée de démarrage est entre ___ et ___ .
  Ne fermez pas la fenêtre avant la fin de l'analyse.
  L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
  Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
  Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
  les résultats seront affichés au fur et à mesure de leur génération.
  Formaté Formaté
  Impression des résultats Impression des résultats
  Votre fichier a expiré ou n'existe pas.
  Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.
  
  Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
  Email:
  
  Antivirus Version Dernière mise à jour Résultat
  a-squared 4.0.0.73 2009.01.25 P2P-Worm.Win32.Nugg!IK
  AhnLab-V3 5.0.0.2 2009.01.25 Win32/Nugg.worm.135168
  AntiVir 7.9.0.60 2009.01.25 TR/Spy.Gen
  Authentium 5.1.0.4 2009.01.25 W32/Heuristic-KPP!Eldorado
  Avast 4.8.1281.0 2009.01.25 Win32:Spyware-gen
  AVG 8.0.0.229 2009.01.25 Agent.AUFU
  BitDefender 7.2 2009.01.25 Trojan.Generic.1323074
  CAT-QuickHeal 10.00 2009.01.24 I-Worm.Nugg.af
  ClamAV 0.94.1 2009.01.25 -
  Comodo 946 2009.01.25 Worm.Win32.P2P-Worm.Nugg.af
  DrWeb 4.44.0.09170 2009.01.25 Trojan.DownLoader.origin
  eSafe 7.0.17.0 2009.01.25 Win32.Downloader.bmn
  eTrust-Vet 31.6.6325 2009.01.24 Win32/Vundo.CAY
  F-Prot 4.4.4.56 2009.01.25 W32/Heuristic-KPP!Eldorado
  F-Secure 8.0.14470.0 2009.01.25 -
  Fortinet 3.117.0.0 2009.01.25 -
  GData 19 2009.01.25 Trojan.Generic.1323074
  Ikarus T3.1.1.45.0 2009.01.25 P2P-Worm.Win32.Nugg
  K7AntiVirus 7.10.604 2009.01.24 P2P-Worm.Win32.Nugg.af
  Kaspersky 7.0.0.125 2009.01.25 P2P-Worm.Win32.Nugg.af
  McAfee 5506 2009.01.25 Downloader-BMN
  McAfee+Artemis 5506 2009.01.25 Downloader-BMN
  Microsoft 1.4205 2009.01.25 TrojanDownloader:Win32/Tracur.A
  NOD32 3798 2009.01.25 a variant of Win32/Agent.OAF
  Norman 5.93.01 2009.01.23 W32/DLoader.MFPB
  nProtect 2009.1.8.0 2009.01.23 Worm/W32.Nugg.135168
  Panda 9.5.1.2 2009.01.25 Suspicious file
  PCTools 4.4.2.0 2009.01.25 P2P-Worm.Nugg!sd6
  Prevx1 V2 2009.01.25 Malicious Software
  Rising 21.13.42.00 2009.01.23 -
  SecureWeb-Gateway 6.7.6 2009.01.25 Trojan.Spy.Gen
  Sophos 4.37.0 2009.01.25 Troj/Agent-INP
  Sunbelt 3.2.1835.2 2009.01.16 -
  Symantec 10 2009.01.25 Backdoor.Trojan
  TheHacker 6.3.1.5.229 2009.01.25 -
  TrendMicro 8.700.0.1004 2009.01.24 WORM_NUGG.C
  VBA32 3.12.8.11 2009.01.25 P2P-Worm.Win32.Nugg.af
  ViRobot 2009.1.23.1576 2009.01.23 -
  VirusBuster 4.5.11.0 2009.01.25 -
  Information additionnelle
  File size: 135168 bytes
  MD5...: 19c6d27666e5dd4059b7ed8ecaf575d2
  SHA1..: c91f71ed73a970343e6db4d06af7786d36717583
  SHA256: 0690508af601b4097a7fcbc3424de3db7626a64fb1fc7296b591342c723c3e2f
  SHA512: 2160080c12fa4e7f435da8fe27935b8813a5469107e2e99d7d0d9694f98f483b
  7af259e1b54211fabb3b860c151f8718ce3832b14a531603ed661dd120835de5
  ssdeep: 3072:+DlMNMg4ObUna00gHgwTuAqFBALTBfCK2Wj5LGT:iMNyObUnaS8BALTBqtW
  j8T
  PEiD..: -
  TrID..: File type identification
  Win32 Executable Generic (42.3%)
  Win32 Dynamic Link Library (generic) (37.6%)
  Generic Win/DOS Executable (9.9%)
  DOS Executable Generic (9.9%)
  Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
  PEInfo: PE Structure information
  
  ( base data )
  entrypointaddress.: 0x10001ff0
  timedatestamp.....: 0x496ce10b (Tue Jan 13 18:44:27 2009)
  machinetype.......: 0x14c (I386)
  
  ( 4 sections )
  name viradd virsiz rawdsiz ntrpy md5
  .text 0x1000 0x157e0 0x16000 6.50 7ec3f05c14de664e4e0354fc46b20b21
  .rdata 0x17000 0x6429 0x7000 6.34 221fcf1f7c6529e613af6c8080782333
  .data 0x1e000 0x16a0 0x1000 2.10 a5115ed294fa2a609965b7ba32110070
  .reloc 0x20000 0x1b3a 0x2000 5.95 5d1821a17abf1e33309b58fe394e4411
  
  ( 11 imports )
  > ntdll.dll: _snprintf, strlen, _strnicmp, strstr, _stricmp, memcmp, atoi, _itoa, memcpy, _ultoa, tolower, memset, _chkstk, _allmul, _alldiv
  > msvcrt.dll: strtok
  > WS2_32.dll: -, WSASocketW, -, WSASend, -, WSAWaitForMultipleEvents, WSAIoctl, -, WSARecv, -, WSAGetOverlappedResult, -, -, -, -, -, WSACreateEvent, -
  > WININET.dll: HttpOpenRequestA, HttpSendRequestA, HttpQueryInfoA, InternetOpenA, InternetReadFile, InternetOpenUrlA, InternetCloseHandle, InternetConnectA, InternetSetOptionA, HttpAddRequestHeadersA
  > OLEAUT32.dll: -, -
  > SHLWAPI.dll: PathFileExistsA
  > KERNEL32.dll: WaitForMultipleObjects, GetWindowsDirectoryA, GetFileTime, GetVolumeInformationA, GetSystemDirectoryA, GetVersionExA, FindClose, RemoveDirectoryA, TransactNamedPipe, HeapSetInformation, HeapCreate, FindFirstFileA, HeapDestroy, HeapFree, WaitNamedPipeA, FindNextFileA, SetNamedPipeHandleState, HeapAlloc, FreeLibrary, OpenFileMappingA, UnmapViewOfFile, MapViewOfFile, CreateFileMappingA, ExitProcess, GetFileAttributesExA, SetFileAttributesA, CreateDirectoryA, InterlockedExchange, CreateEventA, TlsSetValue, TlsGetValue, TlsAlloc, ProcessIdToSessionId, Process32Next, Process32First, WriteProcessMemory, VirtualAllocEx, Thread32Next, GetModuleHandleA, Thread32First, CreateToolhelp32Snapshot, InterlockedIncrement, InterlockedDecrement, GetCurrentThreadId, GetProcAddress, CloseHandle, OpenThread, GetCurrentProcessId, GetFileSize, lstrcpyA, ReadFile, GetModuleFileNameA, GetModuleFileNameW, InitializeCriticalSection, ResetEvent, lstrcatA, GetLocalTime, WaitForSingleObject, OpenMutexA, InterlockedCompareExchange, lstrlenA, CreateMutexA, SetEvent, TerminateThread, Sleep, OutputDebugStringA, DuplicateHandle, GetExitCodeThread, FlushFileBuffers, ReleaseMutex, OpenEventA, SetUnhandledExceptionFilter, LeaveCriticalSection, GetCurrentThread, VirtualFree, GetLastError, GetFileInformationByHandle, SystemTimeToFileTime, lstrcmpiA, GetSystemTime, GetCurrentProcess, WriteFile, EnterCriticalSection, CreateFileA, CreateThread, VirtualFreeEx, DisconnectNamedPipe, CreateNamedPipeA, ConnectNamedPipe, PeekNamedPipe, lstrcmpA, SetFilePointer, SetEndOfFile, GetTempFileNameA, DeleteCriticalSection, GetTempPathA, VirtualQuery, VirtualAlloc, SuspendThread, ResumeThread, GetThreadContext, SetThreadContext, VirtualProtect, FlushInstructionCache, SetLastError, lstrcmpW, MultiByteToWideChar, DeleteFileA, CreateProcessA, GetTickCount, GetFileAttributesA, LoadLibraryA, CreateRemoteThread, OpenProcess
  > USER32.dll: SetForegroundWindow, ShowWindow, PeekMessageA, WaitForInputIdle, MsgWaitForMultipleObjects, GetSystemMetrics, wsprintfA, DispatchMessageA
  > ADVAPI32.dll: OpenSCManagerA, CloseServiceHandle, OpenServiceA, ControlService, ChangeServiceConfigA, RegDeleteKeyA, RegQueryValueExA, RegCreateKeyExA, RegQueryInfoKeyA, RegEnumKeyExA, RegSetValueExA, RegCloseKey, RegOpenKeyExA
  > SHELL32.dll: ShellExecuteA, SHGetFolderPathA
  > ole32.dll: CoUninitialize, CoInitializeEx, CoCreateInstance
  
  ( 2 exports )
  DllGetClassObject, EventStartup
  Prevx info: <a href='http://info.prevx.com/aboutprogramtext.asp?PX5=9CD9F31800CC00241063029B88A1310086BCC32F' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=9CD9F31800CC00241063029B88A1310086BCC32F</a>
  
  ATENTION ATTENTION: VirusTotal est un service gratuit offert par Hispasec Sistemas. Il n'y a aucune garantie quant à la disponibilité et la continuité de ce service. Bien que le taux de détection permis par l'utilisation de multiples moteurs antivirus soit bien supérieur à celui offert par seulement un produit, ces résultats NE garantissent PAS qu'un fichier est sans danger. Il n'y a actuellement aucune solution qui offre un taux d'efficacité de 100% pour la détection des virus et malwares.
  
  Autre fichier
  VirusTotal © Hispasec Sistemas - Blog - Contact: info@virustotal.com - Terms of Service & Privacy
  
  Policy
  0 bytes size received / Se ha recibido un archivo vacio
  
  0
Réponse 6 / 44
caro zzz
Re, c'est ca le lien? Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=034CF1121208D6CB0E0F0353B47E5B00D2A30FA4

0
Réponse 7 / 44
V-X
Re,

Poste que le lien.

merci

0
Réponse 8 / 44
caro zzz
Salut, contente que tu sois toujours partant pour m'aider. Je n'arrive pas à copier. Je dois mal m'y prendre.

0
Réponse 9 / 44
V-X
Re,

Peyt tu faire ce que je t'ai demander au poste:52.

merci

0
Réponse 10 / 44
V-X
Re,

Le rapport de virus total n'est pas complet.

Poste le lien du résultat.

merci

0
1. caro
  
  Bonsoir V-X, Désolée mais n'ai pas pu te répondre plus tôt je travaille même le dimanche.. Je te remercie de m'avoir répondu hier. En fait, je planche sur l'envoie du rapport de l'analyse des fichiers avec virus total.com que j'ai sous les yeux. Je n' arrive pas à copier ce rapport! J'ai des noms apparaissant en rouge. Ca m'a pas l'air bien tout ca... Ai 4 noms qui apparaissent( Adware.win 32.BHO!IK/ Adware.Win 32.BHO/ Troyan.Win 32.BHO.Krr par deux fois/ Malicious software) M'ont pas l'air sympa ceux là... Bref en conclusion suis bel et bien infectée, n'est-ce pas?
  
  0
Réponse 11 / 44
V-X
Re,

OK.

A demain et bonne nuit.

A++

0
1. caro
  
  Bonsoir,
  Hier c'était la grosse galère face à spyware...
  Suite à tes explications je pense qu'une partie de mon problème a été résolu seulement ai le net qui parfois refuse de se lancer et n'arrive pas à désinstaller avast comme tu me l'avais suggéré. Que puis je donc faire? Merci d'avance de ta réponse.
  
  0
2. caro
  
  @caroRe, ai fait virustotal.com. trouvé fichiers et téléchargé données:Cela servira t-il?
  Le fichier a déjà été analysé:
  MD5: 19c6d27666e5dd4059b7ed8ecaf575d2
  First received: 2009.01.16 16:31:42 (CET)
  Date 2009.01.23 17:52:05 (CET) [+1D]
  Résultats 28/35
  Permalink: analisis/e4a1acccc2db0ee5ddf31a1dc0a3a778
  
  0
Réponse 12 / 44
V-X
Re,

Rends toi sur ce site :

https://www.virustotal.com/gui/

Clique sur parcourir et cherche ces fichiers :

=>C:\WINDOWS\system32\fabdbd.dll

=>C:\WINDOWS\System32\iepeers32.dll

=>C:\WINDOWS\System32\vumer.dll

Clique sur Send File.

Un rapport va s'élaborer ligne à ligne.

Attends la fin. Il doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note.

Copie le dans ta réponse.

Egalement le lien.

Merci

0
1. caro
  
  Re, je rends les armes pour ce soir. Je tenterai demain. Merci pour tes conseils et ton aide!!!
  
  0
Réponse 13 / 44
V-X
Re,

Refait un log avec ZHP DIAG STP.

merci

0
1. caro
  
  Tiens voilaRapport de ZHPDiag v1.16 par Nicolas Coolman
  Enregistré le 24/01/2009 01:55:41
  Platform : Microsoft Windows XP (5.1.2600) Service Pack 3
  MSIE: Internet Explorer v7.0.5730.13
  MFIE: Mozilla Firefox (3.0.5)
  
  ---\\ Processus lancés
  C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  SOUNDMAN.EXE
  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  C:\Program Files\Winamp\winampa.exe
  C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
  C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
  C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
  C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
  C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
  C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\ati2sgag.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Alwil Software\Avast4\ashServ.exe
  C:\WINDOWS\system32\services.exe
  C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
  C:\WINDOWS\system32\lsass.exe
  C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\wdfmgr.exe
  
  ---\\ Pages de démarrage d'Internet Explorer (R0)
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
  
  ---\\ Pages de recherche d'Internet Explorer (R1)
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm
  
  ---\\ Browser Helper Objects de navigateur (O2)
  O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
  O2 - BHO: DDSMEkl - {2502BBD0-D73B-11DD-B4EC-CEBF56D89593} - C:\WINDOWS\system32\vumer.dll
  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
  
  ---\\ Internet Explorer Toolbars (O3)
  O3 - Toolbar: 1 - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
  
  ---\\ Applications démarrées automatiquement par le registre (O4)
  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
  O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
  O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
  O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
  O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  O4 - HKLM\..\policies\Explorer: [NoCDBurning] Data="1"
  O4 - HKLM\..\policies\Explorer: [NoDriveAutoRun] Data="67108863"
  O4 - HKLM\..\policies\Explorer: [NoDriveTypeAutoRun] Data="323"
  O4 - HKLM\..\policies\Explorer: [NoDrives] Data="0"
  
  ---\\ Lignes supplémentaires dans le menu contextuel d'Internet Explorer (O8)
  O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
  O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
  
  ---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O9 - Extra button: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O9 - Extra button: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe,302
  
  ---\\ Objets ActiveX (Downloaded Program Files)(O16)
  O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
  
  ---\\ Protocole additionnel et piratage de protocole (O18)
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
  
  ---\\ Valeur de registre AppInit_DLLs et sous-clés Winlogon Notify (O20)
  O20 - Winlogon Notify: EventStartup - C:\WINDOWS\System32\iepeers32.dll
  O20 - Winlogon Notify: AtiStartupEvent - C:\WINDOWS\System32\Ati2evxx.dll
  O20 - Winlogon Notify: WlDimsStartup - C:\WINDOWS\System32\%SystemRoot%\System32\dimsntfy.dll
  O20 - Winlogon Notify: sup - C:\WINDOWS\system32\fabdbd.dll
  
  O20 - AppInit_DLLs:C:\WINDOWS\System32\iepeers32.dll
  
  ---\\ Services NT non Microsoft et non désactivés (O23)
  O23 - Service: Ad-Aware 2007 Service (aawservice) - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  O23 - Service: (Ati HotKey Poller) - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: ATI Smart (ATI Smart) - C:\WINDOWS\system32\ati2sgag.exe
  O23 - Service: avast! Antivirus (avast! Antivirus) - C:\Program Files\Alwil Software\Avast4\ashServ.exe
  O23 - Service: Nero BackItUp Scheduler 3 (Nero BackItUp Scheduler 3) - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
  O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
  O23 - Service: Spouleur d'impression (Spooler) - C:\WINDOWS\system32\spoolsv.exe
  O23 - Service: Infrastructure de pilote-mode utilisateur Windows (UMWdf) - C:\WINDOWS\system32\wdfmgr.exe
  
  ---\\ Derniers fichiers modifiés ou crées sous System32 (O44)
  O44 - LFC:Last File Created - C:\WINDOWS\System32\BuzzingBee.wav -->18/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\CmdLineExt.dll -->15/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\FNTCACHE.DAT -->21/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\iepeers32.dll -->19/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\LoopyMusic.wav -->18/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\MRT.exe -->09/12/2008
  O44 - LFC:Last File Created - C:\WINDOWS\System32\mshtml.dll -->13/12/2008
  O44 - LFC:Last File Created - C:\WINDOWS\System32\perfc009.dat -->21/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\perfc00C.dat -->21/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\perfh009.dat -->21/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\perfh00C.dat -->21/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\PerfStringBackup.INI -->21/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\spupdwxp.log -->21/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\tmp.txt -->23/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\TZLog.log -->18/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\vumer.dll -->23/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\wpa.dbl -->21/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\drivers\fwdrv.err -->23/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\drivers\srv.sys -->11/12/2008
  
  ---\\ Derniers fichiers créés dans Windows Prefetcher (O45)
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\4.TMP-189A50F1.pf -->22/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\99CD2F7C9B7C1C8BA90C685BF6EBF-04929C3F.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\ALICEAGENT.EXE-0F752C2F.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\ASHAVAST.EXE-2A5C4076.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\ASHCHEST.EXE-27538E27.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\ASHDISP.EXE-350F01F0.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\ASHQUICK.EXE-2AC0DF0B.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\ASHSIMPL.EXE-2C5E5DC9.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\ATI2EVXX.EXE-3111ABE0.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\ATIPRBXX.EXE-04CF8AEE.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\ATIPTAXX.EXE-013E7A56.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\AVAST.SETUP-1A2F2DFF.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\BLASTCLN.EXE-098580DA.pf -->21/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\C8FE1FBB747F0945034305609CB2B-05D09B80.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\CHKNTFS.EXE-30D5EC49.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\CMD.EXE-137A0D53.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\CONTROL.EXE-01F9F0D0.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\CSCRIPT.EXE-1CE24927.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\CSRSS.EXE-09C6A444.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\CSWEG.EXE-05475D7C.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\CTFMON.EXE-084DB373.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\DEFRAG.EXE-10D9C910.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\DFRGNTFS.EXE-0F55FCE5.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\DIVXSM.EXE-1789326A.pf -->22/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\DOWNLOAD.EXE-3AB7B4DB.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\DPINST.EXE-316A2C46.pf -->21/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\DRWTSN32.EXE-140B1585.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\E57AA78FC5D68CEEF1B247DE375CB-31686C16.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\EMOTICONES3D.EXE-2BA6E40F.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\EXPLORER.EXE-05416907.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\FINAL_STEP.EXE-0178B919.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\FINAL_STEP.TMP-300A2E2C.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\FIND.EXE-0F127430.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\FINDSTR.EXE-0BE9F630.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\FINDYKILL.EXE-19F61F69.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\FIREFOX.EXE-00AE1314.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\FIREFOX.EXE-3495265E.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\FIXPATH.EXE-033773F7.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\HELPCTR.EXE-38BC4EC7.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\HELPER.EXE-0A5F5055.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\HELPSVC.EXE-281F45D0.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\HJTINSTALL(2).EXE-00285044.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\HJTINSTALL.EXE-38DBC1B8.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\IEDW.EXE-05BBB070.pf -->22/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\IEXPLORE.EXE-06887102.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\INSTALL_SPYBOTSD-1.6.1.41(2).-1B693451.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\ISADMIN.EXE-3A903DF1.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\JUSCHED.EXE-245B7676.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\KPF4GUI.EXE-0EDD1414.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\Layout.ini -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\LIMEWIRE.EXE-1E593349.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\LOGON.SCR-075DDDCD.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\LOGONUI.EXE-3164D1CB.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MDELK.EXE-28EE3AC4.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MISE-A-JOUR-LIVESEARCH.EXE-1E8D3C31.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MODE.COM-31B7A0C0.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MOFCOMP.EXE-011832D2.pf -->21/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MPLAYERC.EXE-15B65961.pf -->22/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MSCONFIG.EXE-1501BCEB.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MSDTC.EXE-0E0E8DC0.pf -->21/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MSIEXEC.EXE-0CCC6E74.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MSNMSGR.EXE-1A70C265.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MSNTBUP.EXE-1351DE45.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MSN_SL.EXE-1847F3F3.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\NBKEYSCAN.EXE-26BFA9C0.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\NEROCHECK.EXE-167EF170.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\NMBGMONITOR.EXE-27A0F02F.pf -->21/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\NMINDEXSTORESVR.EXE-0782B088.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\NOTEPAD.EXE-08F3A979.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\NOTIFICATION-LIVESEARCH.EXE-109E0725.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\NTOSBOOT-B00DFAAD.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\NTVDM.EXE-368D7CDA.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\O4PATCH.EXE-213FEA69.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\OSV.EXE-3A6CC53D.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\POLICIES.EXE-378B5C35.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\PROCS.EXE-180E94BB.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\READER_SL.EXE-2006AB7D.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\REG.EXE-0ECAB75D.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\REGEDIT.EXE-17A382F4.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\REGSVR32.EXE-10006695.pf -->21/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\ROOTER.EXE-1D6AD01D.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\RUNDLL32.EXE-2C5BE72E.pf -->21/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\RUNDLL32.EXE-2DD28D1D.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\RUNDLL32.EXE-33059776.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\RUNDLL32.EXE-3CB65546.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\RUNDLL32.EXE-3DCC3CBD.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\RUNDLL32.EXE-54D78476.pf -->22/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\RUNDLL32.EXE-57DC0BDA.pf -->21/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\RUNDLL32.EXE-5BC9F342.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\RUNDLL32.EXE-5BDA0295.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\RUNDLL32.EXE-6311D783.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SC.EXE-2A90AA5F.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SDFILES.EXE-1C1AD4AE.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SDFIX.EXE-34D0BA89.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SETPATH.EXE-1A3DD0A3.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SETUP50.EXE-313C0242.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SHMGRATE.EXE-04666141.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SHOWTIME.EXE-060053D0.pf -->22/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SMITFRAUDFIX.EXE-2D63DAF9.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SOUNDMAN.EXE-1C6229D6.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SPYBOTSD.EXE-05AEB822.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SPYBOTSD_INCLUDES.EXE-0F559F30.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SPYWAREGUARD.EXE-379B040E.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SVCHOST.EXE-072604B0.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SWREG.EXE-0558E653.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SWREG.EXE-35C4C32F.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SYSOCMGR.EXE-19D65F2D.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\TASKMGR.EXE-20E19D70.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\TEATIMER.EXE-26B5EC23.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\UNINSTALL.EXE-2627700A.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\UPDATE.EXE-0F7855C7.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\UPDATE.EXE-1A11315B.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\UPDATER.EXE-2FF07B07.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\USERINIT.EXE-19714419.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\USNSVC.EXE-13CC5607.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\VERCLSID.EXE-3B227142.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\VLC.EXE-2E8E9D94.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WINAMP.EXE-3784777C.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WINAMPA.EXE-26435A6B.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WINLOGON.EXE-201589E5.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WINSCENTER.EXE-1B7057F8.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WLLOGINPROXY.EXE-03B18000.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WLMAIL.EXE-056BC45E.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WMIADAP.EXE-307DE719.pf -->21/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WMIPRVSE.EXE-0E69CB0B.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WMPLAYER.EXE-3A528C54.pf -->22/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WMPLAYER.EXE-3A528C56.pf -->22/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WMPLAYER.EXE-3A528C57.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WSCRIPT.EXE-19DD6617.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WUAUCLT.EXE-12D8E25E.pf -->24/01/2009
  
  End of the scan:
  Rapport de ZHPDiag v1.16 par Nicolas Coolman
  Enregistré le 24/01/2009 01:55:41
  Platform : Microsoft Windows XP (5.1.2600) Service Pack 3
  MSIE: Internet Explorer v7.0.5730.13
  MFIE: Mozilla Firefox (3.0.5)
  
  ---\\ Processus lancés
  C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  SOUNDMAN.EXE
  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  C:\Program Files\Winamp\winampa.exe
  C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
  C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
  C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
  C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
  C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
  C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\ati2sgag.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Alwil Software\Avast4\ashServ.exe
  C:\WINDOWS\system32\services.exe
  C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
  C:\WINDOWS\system32\lsass.exe
  C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\wdfmgr.exe
  
  ---\\ Pages de démarrage d'Internet Explorer (R0)
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
  
  ---\\ Pages de recherche d'Internet Explorer (R1)
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm
  
  ---\\ Browser Helper Objects de navigateur (O2)
  O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
  O2 - BHO: DDSMEkl - {2502BBD0-D73B-11DD-B4EC-CEBF56D89593} - C:\WINDOWS\system32\vumer.dll
  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
  
  ---\\ Internet Explorer Toolbars (O3)
  O3 - Toolbar: 1 - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
  
  ---\\ Applications démarrées automatiquement par le registre (O4)
  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
  O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
  O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
  O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
  O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  O4 - HKLM\..\policies\Explorer: [NoCDBurning] Data="1"
  O4 - HKLM\..\policies\Explorer: [NoDriveAutoRun] Data="67108863"
  O4 - HKLM\..\policies\Explorer: [NoDriveTypeAutoRun] Data="323"
  O4 - HKLM\..\policies\Explorer: [NoDrives] Data="0"
  
  ---\\ Lignes supplémentaires dans le menu contextuel d'Internet Explorer (O8)
  O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
  O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
  
  ---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O9 - Extra button: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O9 - Extra button: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe,302
  
  ---\\ Objets ActiveX (Downloaded Program Files)(O16)
  O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
  
  ---\\ Protocole additionnel et piratage de protocole (O18)
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
  
  ---\\ Valeur de registre AppInit_DLLs et sous-clés Winlogon Notify (O20)
  O20 - Winlogon Notify: EventStartup - C:\WINDOWS\System32\iepeers32.dll
  O20 - Winlogon Notify: AtiStartupEvent - C:\WINDOWS\System32\Ati2evxx.dll
  O20 - Winlogon Notify: WlDimsStartup - C:\WINDOWS\System32\%SystemRoot%\System32\dimsntfy.dll
  O20 - Winlogon Notify: sup - C:\WINDOWS\system32\fabdbd.dll
  
  O20 - AppInit_DLLs:C:\WINDOWS\System32\iepeers32.dll
  
  ---\\ Services NT non Microsoft et non désactivés (O23)
  O23 - Service: Ad-Aware 2007 Service (aawservice) - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  O23 - Service: (Ati HotKey Poller) - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: ATI Smart (ATI Smart) - C:\WINDOWS\system32\ati2sgag.exe
  O23 - Service: avast! Antivirus (avast! Antivirus) - C:\Program Files\Alwil Software\Avast4\ashServ.exe
  O23 - Service: Nero BackItUp Scheduler 3 (Nero BackItUp Scheduler 3) - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
  O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
  O23 - Service: Spouleur d'impression (Spooler) - C:\WINDOWS\system32\spoolsv.exe
  O23 - Service: Infrastructure de pilote-mode utilisateur Windows (UMWdf) - C:\WINDOWS\system32\wdfmgr.exe
  
  ---\\ Derniers fichiers modifiés ou crées sous System32 (O44)
  O44 - LFC:Last File Created - C:\WINDOWS\System32\BuzzingBee.wav -->18/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\CmdLineExt.dll -->15/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\FNTCACHE.DAT -->21/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\iepeers32.dll -->19/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\LoopyMusic.wav -->18/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\MRT.exe -->09/12/2008
  O44 - LFC:Last File Created - C:\WINDOWS\System32\mshtml.dll -->13/12/2008
  O44 - LFC:Last File Created - C:\WINDOWS\System32\perfc009.dat -->21/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\perfc00C.dat -->21/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\perfh009.dat -->21/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\perfh00C.dat -->21/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\PerfStringBackup.INI -->21/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\spupdwxp.log -->21/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\tmp.txt -->23/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\TZLog.log -->18/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\vumer.dll -->23/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\wpa.dbl -->21/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\drivers\fwdrv.err -->23/01/2009
  O44 - LFC:Last File Created - C:\WINDOWS\System32\drivers\srv.sys -->11/12/2008
  
  ---\\ Derniers fichiers créés dans Windows Prefetcher (O45)
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\4.TMP-189A50F1.pf -->22/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\99CD2F7C9B7C1C8BA90C685BF6EBF-04929C3F.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\ALICEAGENT.EXE-0F752C2F.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\ASHAVAST.EXE-2A5C4076.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\ASHCHEST.EXE-27538E27.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\ASHDISP.EXE-350F01F0.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\ASHQUICK.EXE-2AC0DF0B.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\ASHSIMPL.EXE-2C5E5DC9.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\ATI2EVXX.EXE-3111ABE0.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\ATIPRBXX.EXE-04CF8AEE.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\ATIPTAXX.EXE-013E7A56.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\AVAST.SETUP-1A2F2DFF.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\BLASTCLN.EXE-098580DA.pf -->21/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\C8FE1FBB747F0945034305609CB2B-05D09B80.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\CHKNTFS.EXE-30D5EC49.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\CMD.EXE-137A0D53.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\CONTROL.EXE-01F9F0D0.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\CSCRIPT.EXE-1CE24927.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\CSRSS.EXE-09C6A444.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\CSWEG.EXE-05475D7C.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\CTFMON.EXE-084DB373.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\DEFRAG.EXE-10D9C910.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\DFRGNTFS.EXE-0F55FCE5.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\DIVXSM.EXE-1789326A.pf -->22/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\DOWNLOAD.EXE-3AB7B4DB.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\DPINST.EXE-316A2C46.pf -->21/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\DRWTSN32.EXE-140B1585.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\E57AA78FC5D68CEEF1B247DE375CB-31686C16.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\EMOTICONES3D.EXE-2BA6E40F.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\EXPLORER.EXE-05416907.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\FINAL_STEP.EXE-0178B919.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\FINAL_STEP.TMP-300A2E2C.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\FIND.EXE-0F127430.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\FINDSTR.EXE-0BE9F630.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\FINDYKILL.EXE-19F61F69.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\FIREFOX.EXE-00AE1314.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\FIREFOX.EXE-3495265E.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\FIXPATH.EXE-033773F7.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\HELPCTR.EXE-38BC4EC7.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\HELPER.EXE-0A5F5055.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\HELPSVC.EXE-281F45D0.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\HJTINSTALL(2).EXE-00285044.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\HJTINSTALL.EXE-38DBC1B8.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\IEDW.EXE-05BBB070.pf -->22/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\IEXPLORE.EXE-06887102.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\INSTALL_SPYBOTSD-1.6.1.41(2).-1B693451.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\ISADMIN.EXE-3A903DF1.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\JUSCHED.EXE-245B7676.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\KPF4GUI.EXE-0EDD1414.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\Layout.ini -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\LIMEWIRE.EXE-1E593349.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\LOGON.SCR-075DDDCD.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\LOGONUI.EXE-3164D1CB.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MDELK.EXE-28EE3AC4.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MISE-A-JOUR-LIVESEARCH.EXE-1E8D3C31.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MODE.COM-31B7A0C0.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MOFCOMP.EXE-011832D2.pf -->21/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MPLAYERC.EXE-15B65961.pf -->22/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MSCONFIG.EXE-1501BCEB.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MSDTC.EXE-0E0E8DC0.pf -->21/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MSIEXEC.EXE-0CCC6E74.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MSNMSGR.EXE-1A70C265.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MSNTBUP.EXE-1351DE45.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MSN_SL.EXE-1847F3F3.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\NBKEYSCAN.EXE-26BFA9C0.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\NEROCHECK.EXE-167EF170.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\NMBGMONITOR.EXE-27A0F02F.pf -->21/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\NMINDEXSTORESVR.EXE-0782B088.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\NOTEPAD.EXE-08F3A979.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\NOTIFICATION-LIVESEARCH.EXE-109E0725.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\NTOSBOOT-B00DFAAD.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\NTVDM.EXE-368D7CDA.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\O4PATCH.EXE-213FEA69.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\OSV.EXE-3A6CC53D.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\POLICIES.EXE-378B5C35.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\PROCS.EXE-180E94BB.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\READER_SL.EXE-2006AB7D.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\REG.EXE-0ECAB75D.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\REGEDIT.EXE-17A382F4.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\REGSVR32.EXE-10006695.pf -->21/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\ROOTER.EXE-1D6AD01D.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\RUNDLL32.EXE-2C5BE72E.pf -->21/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\RUNDLL32.EXE-2DD28D1D.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\RUNDLL32.EXE-33059776.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\RUNDLL32.EXE-3CB65546.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\RUNDLL32.EXE-3DCC3CBD.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\RUNDLL32.EXE-54D78476.pf -->22/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\RUNDLL32.EXE-57DC0BDA.pf -->21/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\RUNDLL32.EXE-5BC9F342.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\RUNDLL32.EXE-5BDA0295.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\RUNDLL32.EXE-6311D783.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SC.EXE-2A90AA5F.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SDFILES.EXE-1C1AD4AE.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SDFIX.EXE-34D0BA89.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SETPATH.EXE-1A3DD0A3.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SETUP50.EXE-313C0242.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SHMGRATE.EXE-04666141.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SHOWTIME.EXE-060053D0.pf -->22/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SMITFRAUDFIX.EXE-2D63DAF9.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SOUNDMAN.EXE-1C6229D6.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SPYBOTSD.EXE-05AEB822.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SPYBOTSD_INCLUDES.EXE-0F559F30.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SPYWAREGUARD.EXE-379B040E.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SVCHOST.EXE-072604B0.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SWREG.EXE-0558E653.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SWREG.EXE-35C4C32F.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SYSOCMGR.EXE-19D65F2D.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\TASKMGR.EXE-20E19D70.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\TEATIMER.EXE-26B5EC23.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\UNINSTALL.EXE-2627700A.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\UPDATE.EXE-0F7855C7.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\UPDATE.EXE-1A11315B.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\UPDATER.EXE-2FF07B07.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\USERINIT.EXE-19714419.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\USNSVC.EXE-13CC5607.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\VERCLSID.EXE-3B227142.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\VLC.EXE-2E8E9D94.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WINAMP.EXE-3784777C.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WINAMPA.EXE-26435A6B.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WINLOGON.EXE-201589E5.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WINSCENTER.EXE-1B7057F8.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WLLOGINPROXY.EXE-03B18000.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WLMAIL.EXE-056BC45E.pf -->24/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WMIADAP.EXE-307DE719.pf -->21/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WMIPRVSE.EXE-0E69CB0B.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WMPLAYER.EXE-3A528C54.pf -->22/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WMPLAYER.EXE-3A528C56.pf -->22/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WMPLAYER.EXE-3A528C57.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WSCRIPT.EXE-19DD6617.pf -->23/01/2009
  O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WUAUCLT.EXE-12D8E25E.pf -->24/01/2009
  
  End of the scan:
  
  0
Réponse 14 / 44
V-X
Re,

Fait comme destrio5 as dit tout à l'heure.

Désinstalle malwarebyte et réinstalle le.

Fait sa aussi:

▶ Télécharge CCleaner (N'installe pas la Yahoo Toolbar) :
CCLEANER

▶ Lance-le. Va dans "Options" puis "Avancé",

▶ Tu décoches la case "Effacer uniquement les fichiers etc...".

▶ Tu vas dans "Nettoyeur", tu fais "Analyse". Une fois terminé, tu lances le nettoyage.

▶ Tu vas dans "Registre", tu fais "Chercher des erreurs".

Une fois terminé, tu répares toutes les erreurs sans sauvegarder la base de registre.

▶ Un tuto ( aide )

0
1. caro
  
  Re, ai fait comme Destrio 5 a indiqué mais ca ne marche pas! bon encore le virus? ou un autre? T'en qu'à faire...
  
  0
Réponse 15 / 44
V-X
Re,

Ce n'est pas fini et poste le rapport de malwarebyte et ensuite on voit.

merci.

0
1. caro
  
  Hein.. Suis encore infectée? mbam ne répond pas!
  
  0
Réponse 16 / 44
V-X
Re,

Voir poste 42

0
1. caro
  
  Re, victoire!!! Aucun mouchard n'a été trouvé!
  La bête est vaincue! Le combat a été rude... Un " Hip Hip Hourra" à toi vengeur masqué tu as sauvé mon ordi!! merci pour tes conseils!!! Pour avast et le reste y arrive pas mais tenterai demain et si j'y arrive pas je demanderai conseil, il est tard et le boulot m'attend demain ça m'a crevée tout ca. Encore un énorme merci!!!
  
  0
Réponse 17 / 44
Destrio5 Modérateur
Réinstalle MBAM et essaie de le lancer.

0
Réponse 18 / 44
V-X
Re,

Bizarre :

▶ Démarre Spybot, clique sur Mode, coche Mode avancé

𥭪 gauche, clique sur Outils, puis sur Résident

▶ Décoche la case devant Résident "TeaTimer" :

http://apu.mabul.org/up/5/apu-5-gpdx9e06cwz2dypom2q7n6nc.jpg

▶Quitte Spybot
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

▶ Je te conseil de désinstaller AVAST comment le faire proprement

▶ D'installer cet Antivirus:

ANTIVIR

▶ Double-clique sur l'icône d'Antivir (Parapluie) dans la barre des tâches.

▶ Dans Antivir, choisis Outils puis Configuration.

▶ Coche Mode Expert et coche Rech. Rootkit au dém. de la recherche à droite dans Autres réglages.

Avast et Antivir : comparaisons, et passage à Antivir.

▶ Fait la mise à jour d'antivir et fait le scan en mode sans échec.

0

Destrio5 Modérateur

Ce n'était pas du Tibs mais une grosse infection quand même. Voici le rapport :

ComboFix 09-01-21.04 - Dje 2009-01-24  0:07:59.1 - NTFSx86
Microsoft Windows XP Professionnel  5.1.2600.3.1252.1.1036.18.959.408 [GMT 1:00]
Lancé depuis: c:\documents and settings\Dje\Bureau\ComboFix.exe
AV: avast! antivirus 4.7.1098 [VPS 071228-0] *On-access scanning disabled* (Outdated)
FW: Sunbelt Personal Firewall *disabled*
 * Un nouveau point de restauration a été créé
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\c.cgm
c:\documents and settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\ieModule.dll
c:\documents and settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\moduleie.dll
c:\documents and settings\antoine\Application Data\[u]0/u200000032dd8c49517C.manifest
c:\documents and settings\antoine\Application Data\[u]0/u200000032dd8c49517O.manifest
c:\documents and settings\antoine\Application Data\[u]0/u200000032dd8c49517P.manifest
c:\documents and settings\antoine\Application Data\[u]0/u200000032dd8c49517S.manifest
c:\documents and settings\Dje\Application Data\[u]0/u200000032dd8c49517C.manifest
c:\documents and settings\Dje\Application Data\[u]0/u200000032dd8c49517O.manifest
c:\documents and settings\Dje\Application Data\[u]0/u200000032dd8c49517P.manifest
c:\documents and settings\Dje\Application Data\[u]0/u200000032dd8c49517S.manifest
c:\documents and settings\Dje\Local Settings\Application Data\iucyoyi.dat
c:\documents and settings\Dje\Local Settings\Application Data\iucyoyi.exe
c:\documents and settings\Dje\Local Settings\Application Data\iucyoyi_nav.dat
c:\documents and settings\Dje\Local Settings\Application Data\iucyoyi_navps.dat
c:\documents and settings\Dje\Menu Démarrer\Programmes\Spyware Guard 2008
c:\documents and settings\Dje\Menu Démarrer\Programmes\Spyware Guard 2008\Spyware Guard 2008.lnk
c:\documents and settings\Dje\Menu Démarrer\Programmes\Spyware Guard 2008\Uninstall.lnk
c:\program files\Spyware Guard 2008
c:\program files\Spyware Guard 2008\conf.cfg
c:\program files\Spyware Guard 2008\mbase.vdb
c:\program files\Spyware Guard 2008\quarantine.vdb
c:\program files\Spyware Guard 2008\queue.vdb
c:\program files\Spyware Guard 2008\spywareguard.exe
c:\program files\Spyware Guard 2008\uninstall.exe
c:\program files\Spyware Guard 2008\vbase.vdb
c:\windows\GnuHashes.ini
c:\windows\reged.exe
c:\windows\spoolsystem.exe
c:\windows\sys.com
c:\windows\syscert.exe
c:\windows\sysexplorer.exe
c:\windows\system32\2.tmp
c:\windows\system32\3.tmp
c:\windows\system32\drivers\npf.sys
c:\windows\system32\GroupPolicy000.dat
c:\windows\system32\GroupPolicyManifest
c:\windows\system32\GroupPolicyManifest\32.crack.zip
c:\windows\system32\GroupPolicyManifest\32.crack.zip.kwd
c:\windows\system32\GroupPolicyManifest\33.video.zip
c:\windows\system32\GroupPolicyManifest\33.video.zip.kwd
c:\windows\system32\GroupPolicyManifest\34.setup.zip
c:\windows\system32\GroupPolicyManifest\34.setup.zip.kwd
c:\windows\system32\GroupPolicyManifest\35.unpack.zip
c:\windows\system32\GroupPolicyManifest\35.unpack.zip.kwd
c:\windows\system32\GroupPolicyManifest\36.keygen.zip
c:\windows\system32\GroupPolicyManifest\36.keygen.zip.kwd
c:\windows\system32\GroupPolicyManifest\37.serial.zip
c:\windows\system32\GroupPolicyManifest\37.serial.zip.kwd
c:\windows\system32\GroupPolicyManifest\39.music.mp3
c:\windows\system32\GroupPolicyManifest\39.music.mp3.kwd
c:\windows\system32\GroupPolicyManifest\40.mpgvideo.mpg
c:\windows\system32\GroupPolicyManifest\40.mpgvideo.mpg.kwd
c:\windows\system32\packet.dll
c:\windows\system32\tmp.reg
c:\windows\system32\winscenter.exe
c:\windows\system32\wpcap.dll
c:\windows\vmreg.dll
F:\Autorun.inf

.
(((((((((((((((((((((((((((((((((((((((   Pilotes/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Service_NPF


(((((((((((((((((((((((((((((   Fichiers créés du 2008-12-23 au 2009-01-23  ))))))))))))))))))))))))))))))))))))
.

2009-01-24 00:16 . 2009-01-24 00:17	<REP>	d--hs----	c:\windows\system32\GroupPolicyManifest
2009-01-23 23:29 . 2009-01-23 23:30	<REP>	d----c---	C:\r 1
2009-01-23 20:46 . 2009-01-23 21:19	<REP>	d----c---	C:\SDFix
2009-01-23 20:25 . 2009-01-23 20:28	<REP>	d----c---	C:\Rooter$
2009-01-23 20:02 . 2009-01-23 20:05	<REP>	d--------	c:\program files\FindyKill
2009-01-23 18:29 . 2009-01-23 18:51	782	--a------	c:\windows\wininit.ini
2009-01-23 18:01 . 2009-01-23 18:01	<REP>	d--------	c:\program files\Spybot - Search & Destroy
2009-01-23 18:01 . 2009-01-23 18:29	<REP>	d--------	c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-23 01:48 . 2009-01-23 01:48	277,521	---------	c:\windows\system32\f630e4c1af84c945ee7a3c50396e44a8.TMP
2009-01-23 01:48 . 2009-01-23 01:48	277,521	---------	c:\windows\system32\61d8c8b0bc5c08527085d186c0a5f0eb.TMP
2009-01-21 22:04 . 2004-08-19 15:09	221,184	--a------	c:\windows\system32\wmpns.dll
2009-01-21 21:41 . 2009-01-21 21:41	<REP>	d--------	c:\windows\system32\fr
2009-01-21 21:41 . 2009-01-21 21:41	<REP>	d--------	c:\windows\system32\bits
2009-01-21 21:41 . 2009-01-21 21:41	<REP>	d--------	c:\windows\l2schemas
2009-01-21 21:39 . 2009-01-21 21:39	<REP>	d--------	c:\windows\ServicePackFiles
2009-01-20 23:47 . 2009-01-23 13:17	<REP>	d--------	c:\documents and settings\Dje\Incomplete
2009-01-19 13:53 . 2009-01-19 13:53	135,168	--a------	c:\windows\system32\iepeers32.dll
2009-01-18 23:40 . 2009-01-18 23:44	<REP>	d--------	c:\program files\eMule
2009-01-18 20:43 . 2008-10-16 14:06	268,648	--a------	c:\windows\system32\mucltui.dll
2009-01-18 20:43 . 2008-10-16 14:06	208,744	--a------	c:\windows\system32\muweb.dll
2009-01-18 20:43 . 2008-10-16 14:06	27,496	--a------	c:\windows\system32\mucltui.dll.mui
2009-01-18 19:55 . 2009-01-18 20:06	<REP>	d--------	c:\documents and settings\antoine\Contacts
2009-01-18 19:37 . 2009-01-20 06:27	<REP>	d--------	c:\documents and settings\antoine\Application Data\EoRezo
2009-01-18 17:14 . 2009-01-21 19:39	<REP>	d--------	c:\documents and settings\Dje\Application Data\EoRezo
2009-01-18 12:41 . 2009-01-18 12:41	<REP>	d--------	c:\program files\Microsoft SQL Server Compact Edition
2009-01-18 12:40 . 2009-01-18 12:41	<REP>	d--------	c:\program files\Windows Live Toolbar
2009-01-18 12:40 . 2009-01-18 12:40	<REP>	d--------	c:\program files\Windows Live Favorites
2009-01-18 12:34 . 2009-01-18 12:35	<REP>	d--hsc---	c:\program files\Fichiers communs\WindowsLiveInstaller
2009-01-18 12:33 . 2009-01-18 21:37	<REP>	d--------	c:\program files\Windows Live
2009-01-18 12:33 . 2009-01-18 12:33	<REP>	d--------	c:\documents and settings\All Users\Application Data\WLInstaller
2009-01-18 12:31 . 2009-01-23 19:03	<REP>	d--------	c:\documents and settings\Dje\Application Data\LimeWire
2009-01-18 00:10 . 2009-01-18 00:10	<REP>	d--------	c:\windows\system32\Lang
2009-01-18 00:10 . 2009-01-18 00:10	940,794	--a------	c:\windows\system32\LoopyMusic.wav
2009-01-18 00:10 . 2009-01-18 00:10	146,650	--a------	c:\windows\system32\BuzzingBee.wav
2009-01-18 00:10 . 2009-01-18 00:10	60,416	--a------	c:\windows\ALCFDRTM.VER
2009-01-18 00:10 . 2009-01-18 00:10	60,416	--a------	c:\windows\ALCFDRTM.EXE
2009-01-17 23:07 . 2005-07-26 13:44	129,045	---------	c:\windows\system32\drivers\cxthsfs2.cty
2009-01-17 22:56 . 2008-06-14 18:33	272,768	---------	c:\windows\system32\drivers\bthport.sys
2009-01-17 22:56 . 2008-06-14 18:33	272,768	-----c---	c:\windows\system32\dllcache\bthport.sys
2009-01-17 22:55 . 2008-08-14 14:23	2,191,232	-----c---	c:\windows\system32\dllcache\ntoskrnl.exe
2009-01-17 22:55 . 2008-08-14 14:23	2,147,328	-----c---	c:\windows\system32\dllcache\ntkrnlmp.exe
2009-01-17 22:55 . 2008-08-14 14:23	2,068,096	-----c---	c:\windows\system32\dllcache\ntkrnlpa.exe
2009-01-17 22:55 . 2008-08-14 14:23	2,025,984	-----c---	c:\windows\system32\dllcache\ntkrpamp.exe
2009-01-17 22:55 . 2008-09-15 16:26	1,846,528	-----c---	c:\windows\system32\dllcache\win32k.sys
2009-01-17 22:55 . 2008-04-11 20:05	691,712	-----c---	c:\windows\system32\dllcache\inetcomm.dll
2009-01-17 22:55 . 2008-10-24 12:21	455,296	-----c---	c:\windows\system32\dllcache\mrxsmb.sys
2009-01-17 22:55 . 2008-10-15 17:35	337,408	-----c---	c:\windows\system32\dllcache\netapi32.dll
2009-01-17 22:55 . 2008-12-11 11:57	333,952	-----c---	c:\windows\system32\dllcache\srv.sys
2009-01-17 22:55 . 2008-05-08 15:02	203,136	-----c---	c:\windows\system32\dllcache\rmcast.sys
2009-01-17 18:01 . 2009-01-17 18:01	<REP>	d--------	c:\program files\LimeWire
2009-01-17 17:51 . 2009-01-17 17:51	<REP>	d--------	c:\program files\TechCity Solutions
2009-01-17 17:47 . 2009-01-17 17:51	<REP>	d--------	c:\program files\Alice
2009-01-15 18:21 . 2009-01-15 18:21	107,888	--a------	c:\windows\system32\CmdLineExt.dll
2009-01-15 18:15 . 2007-10-12 15:14	3,734,536	--a------	c:\windows\system32\d3dx9_36.dll
2009-01-15 18:15 . 2007-07-19 18:14	3,727,720	--a------	c:\windows\system32\d3dx9_35.dll
2009-01-15 18:15 . 2007-10-12 15:14	1,374,232	--a------	c:\windows\system32\D3DCompiler_36.dll
2009-01-15 18:15 . 2007-07-19 18:14	1,358,192	--a------	c:\windows\system32\D3DCompiler_35.dll
2009-01-15 18:15 . 2007-10-02 09:56	444,776	--a------	c:\windows\system32\d3dx10_36.dll
2009-01-15 18:15 . 2007-07-19 18:14	444,776	--a------	c:\windows\system32\d3dx10_35.dll
2009-01-15 18:15 . 2007-10-22 03:39	267,272	--a------	c:\windows\system32\xactengine2_10.dll
2009-01-15 18:15 . 2007-07-20 00:57	267,112	--a------	c:\windows\system32\xactengine2_9.dll

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-23 23:16	373,760	--sha-w	c:\windows\system32\2.tmp
2009-01-23 21:20	51,805	-c--a-w	c:\windows\system32\drivers\fwdrv.err
2009-01-22 23:57	200,210	----a-w	c:\windows\system32\vumer.dll
2009-01-21 20:26	---------	d-----w	c:\documents and settings\Dje\Application Data\OpenOffice.org2
2009-01-21 18:45	---------	d---a-w	c:\documents and settings\All Users\Application Data\TEMP
2009-01-17 16:51	---------	d--h--w	c:\program files\InstallShield Installation Information
2009-01-15 17:12	---------	d-----w	c:\program files\Larousse
2008-12-11 10:57	333,952	----a-w	c:\windows\system32\drivers\srv.sys
2008-10-23 12:36	286,720	----a-w	c:\windows\system32\gdi32.dll
2009-01-21 12:24	766,464	----a-w	c:\documents and settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\vuoptzgisc.dll
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2502BBD0-D73B-11DD-B4EC-CEBF56D89593}]
2009-01-23 00:57	200210	--a------	c:\windows\system32\vumer.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Nero\Lib\NMBgMonitor.exe" [2007-08-03 202024]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-12-17 2107224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 79224]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-10-13 344064]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2007-05-14 35328]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 132496]
"NeroFilterCheck"="c:\program files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 1828136]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"AliceSAV"="c:\program files\TechCity Solutions\AliceSAV\AliceAgent.exe" [2005-12-16 81408]
"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 172544]
"SoundMan"="SOUNDMAN.EXE" [2005-11-11 c:\windows\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nlsf"="move" [X]
"Config"="c:\windows\system32\run.cmd" [2006-02-14 248]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-19 44544]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoAutoUpdate"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoAutoUpdate"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\98ffa4a3517]
2009-01-19 13:53 135168 c:\windows\system32\iepeers32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fabdbd]
2005-06-12 02:21 277521 c:\windows\system32\fabdbd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\iepeers32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic]
--a------ 2008-07-08 17:41 2828184 c:\program files\Registry Mechanic\RegMech.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoftwareHelper]
--a------ 2008-12-09 10:13 368224 c:\documents and settings\Dje\Application Data\EoRezo\SoftwareUpdate\SoftwareUpdateHP.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

R0 m5287;m5287;c:\windows\system32\drivers\m5287.sys [2005-09-13 101120]
R1 fwdrv;Firewall Driver;c:\windows\system32\drivers\fwdrv.sys [2007-04-26 302000]
R1 khips;Kerio HIPS Driver;c:\windows\system32\drivers\khips.sys [2007-04-26 72624]
R3 ULI5261XP;ULi M526X Ethernet NT Driver;c:\windows\system32\drivers\ULILAN51.SYS [2007-08-16 28672]
R4 SPF4;Sunbelt Personal Firewall 4;c:\program files\Sunbelt Software\Personal Firewall\kpf4ss.exe [2007-04-26 1234480]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7ef27382-f376-11dc-b2b7-00138f95acc0}]
\Shell\AutoRun\command - setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c9cdf9b6-b898-11dc-b279-00138f95acc0}]
\Shell\AutoRun\command - setupSNK.exe
.
Contenu du dossier 'Tâches planifiées'

2009-01-23 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{C7B76B90-3455-4AE6-A752-EAC4D19689E5} - c:\program files\EoRezo\EoAdv\EoRezoBHO.dll
HKLM-Run-LogitechVideoRepair - c:\program files\Logitech\Video\ISStart.exe
HKLM-Run-spywareguard - c:\program files\Spyware Guard 2008\spywareguard.exe
MSConfigStartUp-EoEngine - c:\program files\EoRezo\EoEngine.exe
MSConfigStartUp-iucyoyi - c:\documents and settings\dje\local settings\application data\iucyoyi.exe
MSConfigStartUp-spywareguard - c:\program files\Spyware Guard 2008\spywareguard.exe


.
------- Examen supplémentaire -------
.
uInternet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1036
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
FF - ProfilePath - c:\documents and settings\Dje\Application Data\Mozilla\Firefox\Profiles\kdda0e68.default\
FF - prefs.js: browser.startup.homepage - 
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-24 00:16:21
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  AliceSAV = c:\program files\TechCity Solutions\AliceSAV\AliceAgent.exe???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? 

Recherche de fichiers cachés ... 


c:\windows\system32\33afcb336a7c0bad7594eb9e234c0675.sys 39936 bytes executable
c:\windows\system32\_33afcb336a7c0bad7594eb9e234c0675.sys_.vir 39936 bytes executable

Scan terminé avec succès
Fichiers cachés: 2

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\33afcb336a7c0bad7594eb9e234c0675]
"ImagePath"="system32\33afcb336a7c0bad7594eb9e234c0675.sys"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(772)
c:\windows\System32\iepeers32.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\fabdbd.dll

- - - - - - - > 'explorer.exe'(2252)
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\msls31.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Lavasoft\Ad-Aware 2007\aawservice.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\system32\WdfMgr.exe
c:\windows\system32\wscntfy.exe
c:\program files\Sunbelt Software\Personal Firewall\kpf4gui.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\Sunbelt Software\Personal Firewall\kpf4gui.exe
c:\program files\Fichiers communs\Nero\Lib\NMIndexingService.exe
c:\program files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
.
**************************************************************************
.
Heure de fin: 2009-01-24  0:20:35 - La machine a redémarré
ComboFix-quarantined-files.txt  2009-01-23 23:20:28

Avant-CF: 109 662 208 octets libres
Après-CF: 124,555,264 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

301

caro
Dis moi.C'est bon? C'est éradiquer??

0

Réponse 20 / 44
V-X
Re,

Il a fait le ménage.

Maintenant essai hijackthis et lance un scan complet après la mise à jour de malwarebyte.

Tu devrais pouvoir le faire maintenant.

0
1. caro
  
  RE, non ca marche pas...
  
  0
- 1
- 2
- 3
Suivant

Spyware guard 2008

44 réponses

Discussions similaires

Newsletters