Backdoor.Win32.IRCBot!IK impossible a supri

marjelyne -  
Bonjour,

ma cousine a chopé ce virus par ma faute est ce que quelqu'un peut l'aider

merci
Configuration: Windows XP
Internet Explorer 7.0

29 réponses

Résumé de la discussion

Une infection virale sur un ordinateur Windows est discutée, avec des symptômes affichés et des mesures proposées pour nettoyer un système infecté par des outils de sécurité et de détection. Des solutions de nettoyage sont présentées, notamment l’utilisation de ComboFix et l’analyse HijackThis, avec des consignes préliminaires comme déconnecter l’Internet et désactiver temporairement l’antivirus afin d’effectuer le scan. D'autres recommandations incluent l'obtention des rapports de scan, la sauvegarde des résultats sur le bureau, et la nécessité de redémarrer si nécessaire pour poursuivre le nettoyage. Plusieurs infections détectées amènent à une procédure en deux étapes incluant l’usage de ComboFix et l’analyse approfondie des résultats, puis une éventuelle reprise du processus si d’autres éléments apparaissent.

Bobot (l’IA à votre service)
  1. g!rly Contributeur
    réceptif !!

    une preuve :

    http://moe.mabul.org/up/moe/2009/04/26/img-0421110c291.jpg

    Bonne nuit

    Les engrenages ! les chadoks manquent à l´appel`

    Une nuit sans fantômes----je te souhaite...
    1. jess
      salut les filles,
      je vous remercie pour votre aide.
      j'ai fixé ce ke tu ma demandé g!rly ainsi téléchargé.
      j'ai fai ce ke tu ma dis avec toolscleanner mais il ne peu pas me donner le rapport.
      ve tu que je fasse un scanne avec le logiciel de d'habitude?voila biz
  2. g!rly Contributeur
    Tu voies encore des araignées à ton plafond ?
    Hoffman n´aurait il pas balayé le tout avant sa course à vélo ?
    1. Utilisateur anonyme
      Mouarf...
      [mdr]

      Vi je cherche encore mon bi-clown...

      Vais au lit, bon dodo. Kises Julie :]
  3. g!rly Contributeur
    Salut Jess

    Hijack this est installé sur ton pc; il s´installe avec rsit, regarde dans tes programmes files :)
    1. jess
      salut g!rly
      je l'avais trouvé mai le souci c'est que je ne peu pas m'en servir je peu juste le supprimer ou modifier
    2. Utilisateur anonyme
      @jessSalut vous deux.

      RSIT l'installe mais pas le raccourci dans le menu Démarrer si mes souvenirs sont bons.
      Vas dans : C:\Program Files\trend micro
      Puis clique sur 'TonName'.exe ou, à défaut, hijackthis.exe

      Sinon : lien de téléchargement si besoin est.

      Bon courage et bon weekend Jess.
      Julie, kiss et balance un bon son pour FDK : un des tes morceaux ambiant. Pas les vampires et chauves-souris^^

      A+
  4. g!rly Contributeur
    Salut Jess,

    A l´aide de hijack this coche et fix :

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R3 - Default URLSearchHook is missing
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

    comment fixer :

    Tutoriel d´utilisation (video) : (Merci a Balltrap34 pour cette réalisation)

    -> http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm

    pour plus de securité :

    spywareblaster :

    http://www.brightfort.com/spywareblaster.html

    c´est un resident, il suffit de le mettre a jour de temps en temps car la version gratuite ne le fait pas toute seul , une fois installé et mis a jour tu mets toutes les protections sur "enable"

    tuto : https://www.malekal.com/tutorial-spywareblaster/

    pour supprimer les outils utilisés :

    Télécharge ToolsCleaner sur ton bureau.
    --> http://www.commentcamarche.net/telecharger/telechargement 34055291 toolsclean(...)
    # Clique sur Recherche et laisse le scan agir ...
    # Clique sur Suppression pour finaliser.
    # Tu peux, si tu le souhaites, te servir des Options facultatives.
    # Clique sur Quitter pour obtenir le rapport.
    # Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

    Voila :)
    1. jess
      salut g!rly,
      j'ai bien le rapport de hijack this le souci c'est que je ne peu pas cocher é je n'ai pas ce ke montre la démo tu peu m'aider biz
  6. g!rly Contributeur
    Salut jess,

    excuse pour le retard...

    oui antivir a trouvé les processus des outils que nous avons utilisés > pas grave

    post un nouveau rapport hijack this et on termine :)

    @+
    1. jess
      salut g!rly,
      voici le rapport
      Logfile of random's system information tool 1.06 (written by random/random)
      Run by jessica et fabrice at 2009-04-22 09:45:29
      Microsoft® Windows Vista™ Édition Familiale Basique Service Pack 1
      System drive C: has 58 GB (60%) free of 96 GB
      Total RAM: 2038 MB (45% free)

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 09:45:38, on 22/04/2009
      Platform: Windows Vista SP1 (WinNT 6.00.1905)
      MSIE: Internet Explorer v7.00 (7.00.6001.18226)
      Boot mode: Normal

      Running processes:
      C:\Windows\system32\Dwm.exe
      C:\Windows\Explorer.EXE
      C:\Windows\system32\taskeng.exe
      C:\Windows\System32\hkcmd.exe
      C:\Windows\System32\igfxpers.exe
      C:\Windows\RtHDVCpl.exe
      C:\Program Files\Launch Manager\HotkeyApp.exe
      C:\Program Files\Synaptics\SynTP\SynTPStart.exe
      C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
      C:\Program Files\Java\jre6\bin\jusched.exe
      C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
      C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe
      C:\Program Files\Windows Live\Messenger\msnmsgr.exe
      C:\Program Files\Windows Media Player\wmpnscfg.exe
      C:\Users\jessica et fabrice\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
      C:\Windows\system32\igfxsrvc.exe
      C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
      C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      C:\Program Files\Windows Live\Contacts\wlcomm.exe
      C:\Windows\system32\taskeng.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\Users\jessica et fabrice\Downloads\RSIT.exe
      C:\Program Files\trend micro\jessica et fabrice.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
      R3 - Default URLSearchHook is missing
      O1 - Hosts: ::1 localhost
      O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
      O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
      O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
      O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
      O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
      O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
      O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
      O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
      O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
      O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
      O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
      O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
      O4 - HKLM\..\Run: [HotkeyApp] "C:\Program Files\Launch Manager\HotkeyApp.exe"
      O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
      O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
      O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
      O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe
      O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe
      O4 - HKLM\..\Run: [Wbutton] C:\Program Files\Launch Manager\WButton.exe
      O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
      O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
      O4 - HKCU\..\Run: [recinfo] c:\recinfo\recinfo.exe
      O4 - HKCU\..\Run: [ISUSPM] "C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
      O4 - HKUS\S-1-5-18\..\Run: [fsc-reg] C:\ProgramData\fsc-reg\fscreg.exe (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [fsc-reg] C:\ProgramData\fsc-reg\fscreg.exe (User 'Default user')
      O4 - Startup: Notification de cadeaux MSN.lnk = C:\Users\jessica et fabrice\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
      O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
      O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
      O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
      O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
      O13 - Gopher Prefix:
      O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
      O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
      O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
      O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
      O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
      O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe
      O23 - Service: WisLMSvc - Wistron Corp. - C:\Program Files\Launch Manager\WisLMSvc.exe
    2. jess
      salut g!rly
      voici le rapport
      Logfile of random's system information tool 1.06 (written by random/random)
      Run by jessica et fabrice at 2009-04-22 09:45:29
      Microsoft® Windows Vista™ Édition Familiale Basique Service Pack 1
      System drive C: has 58 GB (60%) free of 96 GB
      Total RAM: 2038 MB (45% free)

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 09:45:38, on 22/04/2009
      Platform: Windows Vista SP1 (WinNT 6.00.1905)
      MSIE: Internet Explorer v7.00 (7.00.6001.18226)
      Boot mode: Normal

      Running processes:
      C:\Windows\system32\Dwm.exe
      C:\Windows\Explorer.EXE
      C:\Windows\system32\taskeng.exe
      C:\Windows\System32\hkcmd.exe
      C:\Windows\System32\igfxpers.exe
      C:\Windows\RtHDVCpl.exe
      C:\Program Files\Launch Manager\HotkeyApp.exe
      C:\Program Files\Synaptics\SynTP\SynTPStart.exe
      C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
      C:\Program Files\Java\jre6\bin\jusched.exe
      C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
      C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe
      C:\Program Files\Windows Live\Messenger\msnmsgr.exe
      C:\Program Files\Windows Media Player\wmpnscfg.exe
      C:\Users\jessica et fabrice\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
      C:\Windows\system32\igfxsrvc.exe
      C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
      C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      C:\Program Files\Windows Live\Contacts\wlcomm.exe
      C:\Windows\system32\taskeng.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\Users\jessica et fabrice\Downloads\RSIT.exe
      C:\Program Files\trend micro\jessica et fabrice.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
      R3 - Default URLSearchHook is missing
      O1 - Hosts: ::1 localhost
      O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
      O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
      O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
      O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
      O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
      O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
      O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
      O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
      O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
      O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
      O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
      O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
      O4 - HKLM\..\Run: [HotkeyApp] "C:\Program Files\Launch Manager\HotkeyApp.exe"
      O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
      O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
      O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
      O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe
      O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe
      O4 - HKLM\..\Run: [Wbutton] C:\Program Files\Launch Manager\WButton.exe
      O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
      O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
      O4 - HKCU\..\Run: [recinfo] c:\recinfo\recinfo.exe
      O4 - HKCU\..\Run: [ISUSPM] "C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
      O4 - HKUS\S-1-5-18\..\Run: [fsc-reg] C:\ProgramData\fsc-reg\fscreg.exe (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [fsc-reg] C:\ProgramData\fsc-reg\fscreg.exe (User 'Default user')
      O4 - Startup: Notification de cadeaux MSN.lnk = C:\Users\jessica et fabrice\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
      O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
      O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
      O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
      O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
      O13 - Gopher Prefix:
      O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
      O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
      O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
      O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
      O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
      O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe
      O23 - Service: WisLMSvc - Wistron Corp. - C:\Program Files\Launch Manager\WisLMSvc.exe
  7. g!rly Contributeur
    supprime :)
    1. jess
      bonsoir g!rly,
      voici le rapport avec l'antivirus j'ai u 3 virus mais je les ai supprimés

      Avira AntiVir Personal
      Report file date: dimanche 19 avril 2009 10:54

      Scanning for 1356201 virus strains and unwanted programs.

      Licensee : Avira AntiVir Personal - FREE Antivirus
      Serial number : 0000149996-ADJIE-0000001
      Platform : Windows Vista
      Windows version : (Service Pack 1) [6.0.6001]
      Boot mode : Normally booted
      Username : SYSTEM
      Computer name : FAFA

      Version information:
      BUILD.DAT : 9.0.0.387 17962 Bytes 24/03/2009 11:04:00
      AVSCAN.EXE : 9.0.3.3 464641 Bytes 24/02/2009 10:13:26
      AVSCAN.DLL : 9.0.3.0 40705 Bytes 27/02/2009 08:58:24
      LUKE.DLL : 9.0.3.2 209665 Bytes 20/02/2009 09:35:49
      LUKERES.DLL : 9.0.2.0 12033 Bytes 27/02/2009 08:58:52
      ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 10:30:36
      ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 11/02/2009 18:33:26
      ANTIVIR2.VDF : 7.1.3.63 1588224 Bytes 16/04/2009 07:51:53
      ANTIVIR3.VDF : 7.1.3.73 25088 Bytes 18/04/2009 07:51:54
      Engineversion : 8.2.0.148
      AEVDF.DLL : 8.1.1.0 106868 Bytes 27/01/2009 15:36:42
      AESCRIPT.DLL : 8.1.1.75 373113 Bytes 19/04/2009 07:52:02
      AESCN.DLL : 8.1.1.10 127348 Bytes 19/04/2009 07:52:01
      AERDL.DLL : 8.1.1.3 438645 Bytes 29/10/2008 16:24:41
      AEPACK.DLL : 8.1.3.14 397685 Bytes 19/04/2009 07:52:01
      AEOFFICE.DLL : 8.1.0.36 196987 Bytes 26/02/2009 18:01:56
      AEHEUR.DLL : 8.1.0.119 1724791 Bytes 19/04/2009 07:52:00
      AEHELP.DLL : 8.1.2.2 119158 Bytes 26/02/2009 18:01:56
      AEGEN.DLL : 8.1.1.36 340341 Bytes 19/04/2009 07:51:56
      AEEMU.DLL : 8.1.0.9 393588 Bytes 09/10/2008 12:32:40
      AECORE.DLL : 8.1.6.9 176500 Bytes 19/04/2009 07:51:55
      AEBB.DLL : 8.1.0.3 53618 Bytes 09/10/2008 12:32:40
      AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 06:47:59
      AVPREF.DLL : 9.0.0.1 43777 Bytes 05/12/2008 08:32:15
      AVREP.DLL : 8.0.0.3 155905 Bytes 20/01/2009 12:34:28
      AVREG.DLL : 9.0.0.0 36609 Bytes 05/12/2008 08:32:09
      AVARKT.DLL : 9.0.0.1 292609 Bytes 09/02/2009 05:52:24
      AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 30/01/2009 08:37:08
      SQLITE3.DLL : 3.6.1.0 326401 Bytes 28/01/2009 13:03:49
      SMTPLIB.DLL : 9.2.0.25 28417 Bytes 02/02/2009 06:21:33
      NETNT.DLL : 9.0.0.0 11521 Bytes 05/12/2008 08:32:10
      RCIMAGE.DLL : 9.0.0.21 2438401 Bytes 09/02/2009 09:45:45
      RCTEXT.DLL : 9.0.35.0 87297 Bytes 11/03/2009 13:55:12

      Configuration settings for the scan:
      Jobname.............................: Complete system scan
      Configuration file..................: C:\program files\avira\antivir desktop\sysscan.avp
      Logging.............................: low
      Primary action......................: interactive
      Secondary action....................: ignore
      Scan master boot sector.............: on
      Scan boot sector....................: on
      Boot sectors........................: C:, D:,
      Process scan........................: on
      Scan registry.......................: on
      Search for rootkits.................: on
      Integrity checking of system files..: off
      Scan all files......................: All files
      Scan archives.......................: on
      Recursion depth.....................: 20
      Smart extensions....................: on
      Macro heuristic.....................: on
      File heuristic......................: medium
      Deviating risk categories...........: +APPL,+GAME,+JOKE,+PCK,+SPR,

      Start of the scan: dimanche 19 avril 2009 10:54

      Starting search for hidden objects.
      '74246' objects were checked, '0' hidden objects were found.

      The scan of running processes will be started
      Scan process 'avscan.exe' - '1' Module(s) have been scanned
      Scan process 'avscan.exe' - '1' Module(s) have been scanned
      Scan process 'notepad.exe' - '1' Module(s) have been scanned
      Scan process 'avcenter.exe' - '1' Module(s) have been scanned
      Scan process 'notepad.exe' - '1' Module(s) have been scanned
      Scan process 'avgnt.exe' - '1' Module(s) have been scanned
      Scan process 'sched.exe' - '1' Module(s) have been scanned
      Scan process 'avguard.exe' - '1' Module(s) have been scanned
      Scan process 'firefox.exe' - '1' Module(s) have been scanned
      Scan process 'taskeng.exe' - '1' Module(s) have been scanned
      Scan process 'taskeng.exe' - '1' Module(s) have been scanned
      Scan process 'GoogleDesktop.exe' - '1' Module(s) have been scanned
      Scan process 'WmiPrvSE.exe' - '1' Module(s) have been scanned
      Scan process 'WisLMSvc.exe' - '1' Module(s) have been scanned
      Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned
      Scan process 'wmpnetwk.exe' - '1' Module(s) have been scanned
      Scan process 'SearchIndexer.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'TestHandler.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'SeaPort.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'NBService.exe' - '1' Module(s) have been scanned
      Scan process 'igfxsrvc.exe' - '1' Module(s) have been scanned
      Scan process 'wmpnscfg.exe' - '1' Module(s) have been scanned
      Scan process 'lsnfier.exe' - '1' Module(s) have been scanned
      Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
      Scan process 'ISUSPM.exe' - '1' Module(s) have been scanned
      Scan process 'jusched.exe' - '1' Module(s) have been scanned
      Scan process 'GoogleDesktop.exe' - '1' Module(s) have been scanned
      Scan process 'SynTPStart.exe' - '1' Module(s) have been scanned
      Scan process 'HotkeyApp.exe' - '1' Module(s) have been scanned
      Scan process 'RtHDVCpl.exe' - '1' Module(s) have been scanned
      Scan process 'igfxpers.exe' - '1' Module(s) have been scanned
      Scan process 'hkcmd.exe' - '1' Module(s) have been scanned
      Scan process 'explorer.exe' - '1' Module(s) have been scanned
      Scan process 'taskeng.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'dwm.exe' - '1' Module(s) have been scanned
      Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'SLsvc.exe' - '1' Module(s) have been scanned
      Scan process 'audiodg.exe' - '0' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'winlogon.exe' - '1' Module(s) have been scanned
      Scan process 'lsm.exe' - '1' Module(s) have been scanned
      Scan process 'lsass.exe' - '1' Module(s) have been scanned
      Scan process 'services.exe' - '1' Module(s) have been scanned
      Scan process 'csrss.exe' - '1' Module(s) have been scanned
      Scan process 'wininit.exe' - '1' Module(s) have been scanned
      Scan process 'csrss.exe' - '1' Module(s) have been scanned
      Scan process 'smss.exe' - '1' Module(s) have been scanned
      57 processes with 57 modules were scanned

      Starting master boot sector scan:

      Start scanning boot sectors:

      Starting to scan executable files (registry).
      The registry was scanned ( '45' files ).

      Starting the file scan:

      Begin scan in 'C:\' <SYSTEM>
      C:\hiberfil.sys
      [WARNING] The file could not be opened!
      [NOTE] This file is a Windows system file.
      [NOTE] This file cannot be opened for scanning.
      C:\pagefile.sys
      [WARNING] The file could not be opened!
      [NOTE] This file is a Windows system file.
      [NOTE] This file cannot be opened for scanning.
      C:\Program Files\Ad-remover\TOOLS\cmdow.exe
      [DETECTION] Contains recognition pattern of the APPL/HideWindows.31232.1 application
      C:\Users\jessica et fabrice\Downloads\ComboFix(2).exe
      [0] Archive type: RAR SFX (self extracting)
      --> 32788R22FWJFW\psexec.cfexe
      [1] Archive type: RSRC
      --> Object
      [DETECTION] Contains recognition pattern of the APPL/PsExec.E application
      C:\Users\jessica et fabrice\Downloads\ComboFix.exe
      [0] Archive type: RAR SFX (self extracting)
      --> 32788R22FWJFW\psexec.cfexe
      [1] Archive type: RSRC
      --> Object
      [DETECTION] Contains recognition pattern of the APPL/PsExec.E application
      Begin scan in 'D:\' <DATA>

      Beginning disinfection:
      C:\Program Files\Ad-remover\TOOLS\cmdow.exe
      [DETECTION] Contains recognition pattern of the APPL/HideWindows.31232.1 application
      [WARNING] The file was ignored!
      C:\Users\jessica et fabrice\Downloads\ComboFix(2).exe
      [WARNING] The file was ignored!
      C:\Users\jessica et fabrice\Downloads\ComboFix.exe
      [WARNING] The file was ignored!

      End of the scan: dimanche 19 avril 2009 11:28
      Used time: 33:52 Minute(s)

      The scan has been done completely.

      12919 Scanned directories
      326779 Files were scanned
      3 Viruses and/or unwanted programs were found
      0 Files were classified as suspicious
      0 files were deleted
      0 Viruses and unwanted programs were repaired
      0 Files were moved to quarantine
      0 Files were renamed
      2 Files cannot be scanned
      326774 Files not concerned
      2760 Archives were scanned
      5 Warnings
      2 Notes
      74246 Objects were scanned with rootkit scan
      0 Hidden objects were found
    2. jess
      @jessje viens de refaire un scanne avec l'antivirus il me trouve encore 3 virus et il me dis que c'est combofix jte laisse le rapport j'ai supprimé ce qu'il a trouvé bisous bonne soirée

      Avira AntiVir Personal
      Report file date: dimanche 19 avril 2009 21:27

      Scanning for 1356201 virus strains and unwanted programs.

      Licensee : Avira AntiVir Personal - FREE Antivirus
      Serial number : 0000149996-ADJIE-0000001
      Platform : Windows Vista
      Windows version : (Service Pack 1) [6.0.6001]
      Boot mode : Normally booted
      Username : SYSTEM
      Computer name : FAFA

      Version information:
      BUILD.DAT : 9.0.0.387 17962 Bytes 24/03/2009 11:04:00
      AVSCAN.EXE : 9.0.3.3 464641 Bytes 24/02/2009 10:13:26
      AVSCAN.DLL : 9.0.3.0 40705 Bytes 27/02/2009 08:58:24
      LUKE.DLL : 9.0.3.2 209665 Bytes 20/02/2009 09:35:49
      LUKERES.DLL : 9.0.2.0 12033 Bytes 27/02/2009 08:58:52
      ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 10:30:36
      ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 11/02/2009 18:33:26
      ANTIVIR2.VDF : 7.1.3.63 1588224 Bytes 16/04/2009 07:51:53
      ANTIVIR3.VDF : 7.1.3.73 25088 Bytes 18/04/2009 07:51:54
      Engineversion : 8.2.0.148
      AEVDF.DLL : 8.1.1.0 106868 Bytes 27/01/2009 15:36:42
      AESCRIPT.DLL : 8.1.1.75 373113 Bytes 19/04/2009 07:52:02
      AESCN.DLL : 8.1.1.10 127348 Bytes 19/04/2009 07:52:01
      AERDL.DLL : 8.1.1.3 438645 Bytes 29/10/2008 16:24:41
      AEPACK.DLL : 8.1.3.14 397685 Bytes 19/04/2009 07:52:01
      AEOFFICE.DLL : 8.1.0.36 196987 Bytes 26/02/2009 18:01:56
      AEHEUR.DLL : 8.1.0.119 1724791 Bytes 19/04/2009 07:52:00
      AEHELP.DLL : 8.1.2.2 119158 Bytes 26/02/2009 18:01:56
      AEGEN.DLL : 8.1.1.36 340341 Bytes 19/04/2009 07:51:56
      AEEMU.DLL : 8.1.0.9 393588 Bytes 09/10/2008 12:32:40
      AECORE.DLL : 8.1.6.9 176500 Bytes 19/04/2009 07:51:55
      AEBB.DLL : 8.1.0.3 53618 Bytes 09/10/2008 12:32:40
      AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 06:47:59
      AVPREF.DLL : 9.0.0.1 43777 Bytes 05/12/2008 08:32:15
      AVREP.DLL : 8.0.0.3 155905 Bytes 20/01/2009 12:34:28
      AVREG.DLL : 9.0.0.0 36609 Bytes 05/12/2008 08:32:09
      AVARKT.DLL : 9.0.0.1 292609 Bytes 09/02/2009 05:52:24
      AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 30/01/2009 08:37:08
      SQLITE3.DLL : 3.6.1.0 326401 Bytes 28/01/2009 13:03:49
      SMTPLIB.DLL : 9.2.0.25 28417 Bytes 02/02/2009 06:21:33
      NETNT.DLL : 9.0.0.0 11521 Bytes 05/12/2008 08:32:10
      RCIMAGE.DLL : 9.0.0.21 2438401 Bytes 09/02/2009 09:45:45
      RCTEXT.DLL : 9.0.35.0 87297 Bytes 11/03/2009 13:55:12

      Configuration settings for the scan:
      Jobname.............................: Complete system scan
      Configuration file..................: C:\program files\avira\antivir desktop\sysscan.avp
      Logging.............................: low
      Primary action......................: interactive
      Secondary action....................: ignore
      Scan master boot sector.............: on
      Scan boot sector....................: on
      Boot sectors........................: C:, D:,
      Process scan........................: on
      Scan registry.......................: on
      Search for rootkits.................: on
      Integrity checking of system files..: off
      Scan all files......................: All files
      Scan archives.......................: on
      Recursion depth.....................: 20
      Smart extensions....................: on
      Macro heuristic.....................: on
      File heuristic......................: medium
      Deviating risk categories...........: +APPL,+GAME,+JOKE,+PCK,+SPR,

      Start of the scan: dimanche 19 avril 2009 21:27

      Starting search for hidden objects.
      '74281' objects were checked, '0' hidden objects were found.

      The scan of running processes will be started
      Scan process 'avscan.exe' - '1' Module(s) have been scanned
      Scan process 'avscan.exe' - '1' Module(s) have been scanned
      Scan process 'taskeng.exe' - '1' Module(s) have been scanned
      Scan process 'avcenter.exe' - '1' Module(s) have been scanned
      Scan process 'avgnt.exe' - '1' Module(s) have been scanned
      Scan process 'sched.exe' - '1' Module(s) have been scanned
      Scan process 'avguard.exe' - '1' Module(s) have been scanned
      Scan process 'taskeng.exe' - '1' Module(s) have been scanned
      Scan process 'GoogleDesktop.exe' - '1' Module(s) have been scanned
      Scan process 'WmiPrvSE.exe' - '1' Module(s) have been scanned
      Scan process 'WisLMSvc.exe' - '1' Module(s) have been scanned
      Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned
      Scan process 'wmpnetwk.exe' - '1' Module(s) have been scanned
      Scan process 'SearchIndexer.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'TestHandler.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'SeaPort.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'NBService.exe' - '1' Module(s) have been scanned
      Scan process 'igfxsrvc.exe' - '1' Module(s) have been scanned
      Scan process 'wmpnscfg.exe' - '1' Module(s) have been scanned
      Scan process 'lsnfier.exe' - '1' Module(s) have been scanned
      Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
      Scan process 'ISUSPM.exe' - '1' Module(s) have been scanned
      Scan process 'jusched.exe' - '1' Module(s) have been scanned
      Scan process 'GoogleDesktop.exe' - '1' Module(s) have been scanned
      Scan process 'SynTPStart.exe' - '1' Module(s) have been scanned
      Scan process 'HotkeyApp.exe' - '1' Module(s) have been scanned
      Scan process 'RtHDVCpl.exe' - '1' Module(s) have been scanned
      Scan process 'igfxpers.exe' - '1' Module(s) have been scanned
      Scan process 'hkcmd.exe' - '1' Module(s) have been scanned
      Scan process 'explorer.exe' - '1' Module(s) have been scanned
      Scan process 'taskeng.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'dwm.exe' - '1' Module(s) have been scanned
      Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'SLsvc.exe' - '1' Module(s) have been scanned
      Scan process 'audiodg.exe' - '0' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'winlogon.exe' - '1' Module(s) have been scanned
      Scan process 'lsm.exe' - '1' Module(s) have been scanned
      Scan process 'lsass.exe' - '1' Module(s) have been scanned
      Scan process 'services.exe' - '1' Module(s) have been scanned
      Scan process 'csrss.exe' - '1' Module(s) have been scanned
      Scan process 'wininit.exe' - '1' Module(s) have been scanned
      Scan process 'csrss.exe' - '1' Module(s) have been scanned
      Scan process 'smss.exe' - '1' Module(s) have been scanned
      54 processes with 54 modules were scanned

      Starting master boot sector scan:

      Start scanning boot sectors:

      Starting to scan executable files (registry).
      The registry was scanned ( '45' files ).

      Starting the file scan:

      Begin scan in 'C:\' <SYSTEM>
      C:\hiberfil.sys
      [WARNING] The file could not be opened!
      [NOTE] This file is a Windows system file.
      [NOTE] This file cannot be opened for scanning.
      C:\pagefile.sys
      [WARNING] The file could not be opened!
      [NOTE] This file is a Windows system file.
      [NOTE] This file cannot be opened for scanning.
      C:\Program Files\Ad-remover\TOOLS\cmdow.exe
      [DETECTION] Contains recognition pattern of the APPL/HideWindows.31232.1 application
      C:\Users\jessica et fabrice\Downloads\ComboFix(2).exe
      [0] Archive type: RAR SFX (self extracting)
      --> 32788R22FWJFW\psexec.cfexe
      [1] Archive type: RSRC
      --> Object
      [DETECTION] Contains recognition pattern of the APPL/PsExec.E application
      C:\Users\jessica et fabrice\Downloads\ComboFix.exe
      [0] Archive type: RAR SFX (self extracting)
      --> 32788R22FWJFW\psexec.cfexe
      [1] Archive type: RSRC
      --> Object
      [DETECTION] Contains recognition pattern of the APPL/PsExec.E application
      Begin scan in 'D:\' <DATA>

      Beginning disinfection:
      C:\Program Files\Ad-remover\TOOLS\cmdow.exe
      [DETECTION] Contains recognition pattern of the APPL/HideWindows.31232.1 application
      [NOTE] The file was moved to '4a4f8334.qua'!
      C:\Users\jessica et fabrice\Downloads\ComboFix(2).exe
      [NOTE] The file was moved to '4a588336.qua'!
      C:\Users\jessica et fabrice\Downloads\ComboFix.exe
      [NOTE] The file was moved to '4a588337.qua'!

      End of the scan: dimanche 19 avril 2009 22:00
      Used time: 32:13 Minute(s)

      The scan has been done completely.

      12925 Scanned directories
      326806 Files were scanned
      3 Viruses and/or unwanted programs were found
      0 Files were classified as suspicious
      0 files were deleted
      0 Viruses and unwanted programs were repaired
      3 Files were moved to quarantine
      0 Files were renamed
      2 Files cannot be scanned
      326801 Files not concerned
      2763 Archives were scanned
      2 Warnings
      5 Notes
      74281 Objects were scanned with rootkit scan
      0 Hidden objects were found
    3. jess
      @jessbonjour g!rly,
      j'ai testé msn hier j'ai pas été bloqué on a du réussir a détruire ce maudit virus je tiens a te remercier pour ton aide é ta patience si ya kelke chose a faire en plus tu me le dis ok bisou é encore merci
  8. g!rly Contributeur
    Salut Jess,

    y a pas de mal :)

    désinstalles ce programme :

    C:\Program Files\Shareware.Pro-FR

    désinstalles aussi ton antivirus (norman) et installes antivir à la place

    C:\Program Files\Norman

    Antivir :

    Telecharge et instales l'antivirus Antivir Personal Edition Classic :

    ->https://www.malekal.com/avira-free-security-antivirus-gratuit/

    https://www.avira.com/en/prime

    En francais :

    https://www.avira.com/

    Reglages :

    en image :

    http://speedweb1.free.fr/frames2.php?page=tuto5

    une fois installé fais un scan complet de ton pc et post le rapport stp

    bon week end ;-)

    @+
    1. jess
      bonsoir g!rly,
      une fois l'antivirus que tu ma dis installer je fais un scanne de mon pc avec et si il me demande de supprimer des fichiers je dis oui ou je met sou quarantaine? merci pour ton aide bisous bon week end
  9. g!rly Contributeur
    salut jess,

    si tu avais su faire fonctionner le script de combofix ou celui de ot_move it nous ne serions pas obliger d´utiliser tout ces outils...

    toujours avec l´uac desactivé

    passe l´option 2 de toolbar sd et post son rapport ainsi qu´un nouveau rapport hijack this

    @+
    1. jess
      salut g!rly,
      tout d'abord je tiens à m'excuser tu as pris le message pour toi alors kil ne le fallai pa je c que tu ni é pour rien c seulement que j'étais en train de démoraliser vu que je n'arrive pas a tout fair comme tu me dis je ny connai rien en ordi.encore désolé si tu a pris le message pour toi. voici les rapports que tu m'as demandé

      -----------\\ ToolBar S&D 1.2.8 XP/Vista

      Microsoft® Windows Vista™ Édition Familiale Basique ( v6.0.6001 ) Service Pack 1
      X86-based PC ( Multiprocessor Free : Intel(R) Celeron(R) CPU 540 @ 1.86GHz )
      BIOS : Ver 1.00PARTTBLM
      USER : jessica et fabrice ( Administrator )
      BOOT : Normal boot
      Antivirus : Norman Security Suite ver. 7.00 7.00 (Not Activated)
      C:\ (Local Disk) - NTFS - Total:94 Go (Free:57 Go)
      D:\ (Local Disk) - NTFS - Total:46 Go (Free:46 Go)
      E:\ (CD or DVD)

      "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
      Option : [2] ( 16/04/2009|20:54 )

      [ UAC => 0 ]

      Aucune autre infection trouvée !

      [ UAC => 1 ]

      1 - "C:\ToolBar SD\TB_1.txt" - 15/04/2009|21:11 - Option : [1]
      2 - "C:\ToolBar SD\TB_2.txt" - 17/04/2009|11:05 - Option : [2]

      -----------\\ Fin du rapport a 11:05:31,79

      voici l'autre
      Logfile of random's system information tool 1.06 (written by random/random)
      Run by jessica et fabrice at 2009-04-17 11:06:35
      Microsoft® Windows Vista™ Édition Familiale Basique Service Pack 1
      System drive C: has 58 GB (60%) free of 96 GB
      Total RAM: 2038 MB (56% free)

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 11:06:38, on 17/04/2009
      Platform: Windows Vista SP1 (WinNT 6.00.1905)
      MSIE: Internet Explorer v7.00 (7.00.6001.18000)
      Boot mode: Normal

      Running processes:
      C:\Windows\system32\Dwm.exe
      C:\Windows\Explorer.EXE
      C:\Windows\system32\taskeng.exe
      C:\Windows\System32\hkcmd.exe
      C:\Windows\System32\igfxpers.exe
      C:\Windows\RtHDVCpl.exe
      C:\Program Files\Launch Manager\HotkeyApp.exe
      C:\Program Files\Synaptics\SynTP\SynTPStart.exe
      C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
      C:\Program Files\Norman\Npm\Bin\Zlh.exe
      C:\Program Files\Java\jre6\bin\jusched.exe
      C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe
      C:\Program Files\Windows Live\Messenger\msnmsgr.exe
      C:\Users\jessica et fabrice\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
      C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      C:\Windows\system32\igfxsrvc.exe
      C:\Program Files\Windows Media Player\wmpnscfg.exe
      C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
      C:\Windows\system32\cmd.exe
      C:\Windows\system32\conime.exe
      C:\Program Files\Java\jre6\bin\jucheck.exe
      C:\Windows\system32\wuauclt.exe
      C:\Windows\system32\NOTEPAD.EXE
      C:\Users\jessica et fabrice\Downloads\RSIT.exe
      C:\Program Files\trend micro\jessica et fabrice.exe

      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
      R3 - Default URLSearchHook is missing
      O1 - Hosts: ::1 localhost
      O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
      O2 - BHO: Shareware.Pro-FR Toolbar - {280b5d37-4a76-467a-b3d6-942fca90acde} - C:\Program Files\Shareware.Pro-FR\tbShar.dll
      O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
      O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
      O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
      O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
      O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
      O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
      O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
      O3 - Toolbar: Shareware.Pro-FR Toolbar - {280b5d37-4a76-467a-b3d6-942fca90acde} - C:\Program Files\Shareware.Pro-FR\tbShar.dll
      O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
      O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
      O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
      O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
      O4 - HKLM\..\Run: [HotkeyApp] "C:\Program Files\Launch Manager\HotkeyApp.exe"
      O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
      O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
      O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
      O4 - HKLM\..\Run: [Norman ZANDA] "C:\Program Files\Norman\Npm\Bin\ZLH.EXE" /LOAD /SPLASH
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
      O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe
      O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe
      O4 - HKLM\..\Run: [Wbutton] C:\Program Files\Launch Manager\WButton.exe
      O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
      O4 - HKCU\..\Run: [recinfo] c:\recinfo\recinfo.exe
      O4 - HKCU\..\Run: [ISUSPM] "C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
      O4 - HKUS\S-1-5-18\..\Run: [fsc-reg] C:\ProgramData\fsc-reg\fscreg.exe (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [fsc-reg] C:\ProgramData\fsc-reg\fscreg.exe (User 'Default user')
      O4 - Startup: Notification de cadeaux MSN.lnk = C:\Users\jessica et fabrice\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
      O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
      O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
      O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
      O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
      O13 - Gopher Prefix:
      O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
      O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Program Files\Norman\Npm\Bin\Elogsvc.exe
      O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
      O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
      O23 - Service: Norman NJeeves - Norman ASA - C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
      O23 - Service: Norman ZANDA - Norman ASA - C:\Program Files\Norman\Npm\Bin\Zanda.exe
      O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
      O23 - Service: Norman's Very Own supplY of resources (NVOY) - Norman ASA - C:\Program Files\Norman\npm\bin\nvoy.exe
      O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe
      O23 - Service: WisLMSvc - Wistron Corp. - C:\Program Files\Launch Manager\WisLMSvc.exe
  10. g!rly Contributeur
    ok jess

    la suite

    Télécharge Toolbar-S&D de Eric_71 :
    https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2
    Sur ton bureau, impératif.

    **Recherche**

    Double clique sur le fichier ToolBar SD.exe, avec élévation des privilèges sous Vista.
    https://i45.servimg.com/u/f45/11/05/93/83/tb110.jpg
    Coche la case "Je suis d'accord...ci-dessus", accepter la création du répertoire par Oui, puis Suivant et Quitter
    Une icône sera crée sur le bureau ToolBar SD
    https://i45.servimg.com/u/f45/11/05/93/83/tb210.jpg
    Sous Vista, faire un clic droit et Exécuter en tant qu'administrateur (Elévation des privilèges.), puis Continuer.
    Dans la fenêtre DOS bleue, Tape F, Entrer.
    Ensuite tape 1 et Entrer.
    Le système va redémarrer et le scan prendra quelques minutes.
    Une fois terminé un rapport TB.txt va s'ouvrir.
    Tu cliques dessus et tu fais :
    CTRL+A pour tout sélectionner
    CTRL+C pour tout mettre dans le presse-papier
    Tu ouvres une réponse sur le forum et tu fais :
    CTRL+V pour coller le rapport dans cette réponse.
    Tu fermes le rapport sur ton bureau et tu attends les résultats de l'analyse.
    Ce rapport sera enregistré à la racine du système : C:\TB.txt

    @+
    1. jess
      bonsoir g!rly
      voici le rapport

      -----------\\ ToolBar S&D 1.2.8 XP/Vista

      Microsoft® Windows Vista™ Édition Familiale Basique ( v6.0.6001 ) Service Pack 1
      X86-based PC ( Multiprocessor Free : Intel(R) Celeron(R) CPU 540 @ 1.86GHz )
      BIOS : Ver 1.00PARTTBLM
      USER : jessica et fabrice ( Administrator )
      BOOT : Normal boot
      Antivirus : Norman Security Suite ver. 7.00 7.00 (Not Activated)
      C:\ (Local Disk) - NTFS - Total:94 Go (Free:55 Go)
      D:\ (Local Disk) - NTFS - Total:46 Go (Free:46 Go)
      E:\ (CD or DVD)

      "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
      Option : [1] ( 15/04/2009|10:53 )

      [ UAC => 0 ]

      -----------\\ Recherche de Fichiers / Dossiers ...

      C:\Program Files\AskSBar
      C:\Program Files\AskSBar\bar
      C:\Program Files\AskSBar\SrchAstt
      C:\Program Files\AskSBar\bar\1.bin
      C:\Program Files\AskSBar\bar\1.bin\A2FFXTBR.JAR
      C:\Program Files\AskSBar\bar\1.bin\A2FFXTBR.MANIFEST
      C:\Program Files\AskSBar\bar\1.bin\A2HIGHIN.EXE
      C:\Program Files\AskSBar\bar\1.bin\A2NTSTBR.JAR
      C:\Program Files\AskSBar\bar\1.bin\A2NTSTBR.MANIFEST
      C:\Program Files\AskSBar\bar\1.bin\A2PLUGIN.DLL
      C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
      C:\Program Files\AskSBar\bar\1.bin\NPASKSBR.DLL
      C:\Program Files\AskSBar\bar\1.bin\V2RSSMNU.DLL
      C:\Program Files\AskSBar\SrchAstt\1.bin
      C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
      C:\Program Files\Mozilla Firefox\plugins\NPAskSBr.dll

      -----------\\ [..\Internet Explorer\Main]

      [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
      "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
      "Local Page"="C:\\Windows\\system32\\blank.htm"
      "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
      "Default_Search_URL"="http://www.google.com/toolbar/ie8/sidebar.html"
      "Url"="https://www.msn.com/fr-fr/actualite/"

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
      "Start Page"="https://www.msn.com/fr-fr"
      "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
      "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
      "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"

      --------------------\\ Recherche d'autres infections

      Aucune autre infection trouvée !

      [ UAC => 1 ]

      1 - "C:\ToolBar SD\TB_1.txt" - 15/04/2009|21:11 - Option : [1]

      -----------\\ Fin du rapport a 21:11:10,91
    2. jess
      @jessj'ai pas eu la case à cocher donc je ne c pas si le rapport c'est ce que tu voulais. j'ai bien eu la fenêtre bleue.
      tu crois qu'on va réussir a le détruire ce maudit virus je commence à désespérer. bonne soirée bisous
  12. g!rly Contributeur
    bisous :)
    1. Utilisateur anonyme
      Kisses même.
      Ca faisait longtemps Julie ;)

      Salutations vous deux.
  13. g!rly Contributeur
    Salut Jess,

    dure dure de trouver les rapports ? !

    pas grave...

    Fais un scan avec cet antispyware :

    Telecharge malwarebytes + tutoriel :

    -> https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

    Tu l´instale; le programme va se mettre automatiquement a jour.

    Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".

    Click maintenant sur l´onglet recherche et coche la case : "executer un examun complet".

    Puis click sur "rechercher".

    Laisse le scanner le pc...

    Si des elements on ete trouvés > click sur supprimer la selection.

    si il t´es demandé de redemarrer > click sur "yes".

    A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.

    Copie et colle le rapport stp.

    @+
    1. JESS
      voici le rapport
      Malwarebytes' Anti-Malware 1.36
      Version de la base de données: 1966
      Windows 6.0.6001 Service Pack 1

      11/04/2009 13:06:24
      mbam-log-2009-04-11 (13-06-24).txt

      Type de recherche: Examen complet (C:\|D:\|)
      Eléments examinés: 151539
      Temps écoulé: 45 minute(s), 1 second(s)

      Processus mémoire infecté(s): 0
      Module(s) mémoire infecté(s): 0
      Clé(s) du Registre infectée(s): 1
      Valeur(s) du Registre infectée(s): 0
      Elément(s) de données du Registre infecté(s): 0
      Dossier(s) infecté(s): 0
      Fichier(s) infecté(s): 1

      Processus mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Module(s) mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Clé(s) du Registre infectée(s):
      HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo (Rogue.Eorezo) -> Quarantined and deleted successfully.

      Valeur(s) du Registre infectée(s):
      (Aucun élément nuisible détecté)

      Elément(s) de données du Registre infecté(s):
      (Aucun élément nuisible détecté)

      Dossier(s) infecté(s):
      (Aucun élément nuisible détecté)

      Fichier(s) infecté(s):
      C:\Program Files\EoRezo (Rogue.Eorezo) -> Delete on reboot.
    2. JESS
      @JESSvoila mon ordi c'est éteint é rallumé sa effacé les 2 fichiers infectés en se rallumant jte di ce ki été marqué je dois partir j'espere que cette fois ci sa a marché encore merci biz
    3. g!rly Contributeur
      @JESScool
      post un nouveau rapport hijack this pour voir à ton retour :)
      bizes`
    4. jess
      @g!rlybonjour g!rly,
      sa va je t'envoie le rapport je c pas si c'est celui la que tu voulais désolé hier j'ai pas eu le temps de le faire
      Logfile of random's system information tool 1.06 (written by random/random)
      Run by jessica et fabrice at 2009-04-13 10:32:13
      Microsoft® Windows Vista™ Édition Familiale Basique Service Pack 1
      System drive C: has 58 GB (60%) free of 96 GB
      Total RAM: 2038 MB (51% free)

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 10:32:14, on 13/04/2009
      Platform: Windows Vista SP1 (WinNT 6.00.1905)
      MSIE: Internet Explorer v7.00 (7.00.6001.18000)
      Boot mode: Normal

      Running processes:
      C:\Windows\system32\Dwm.exe
      C:\Windows\Explorer.EXE
      C:\Windows\system32\taskeng.exe
      C:\Windows\System32\hkcmd.exe
      C:\Windows\System32\igfxpers.exe
      C:\Windows\RtHDVCpl.exe
      C:\Program Files\Launch Manager\HotkeyApp.exe
      C:\Program Files\Synaptics\SynTP\SynTPStart.exe
      C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
      C:\Program Files\Norman\Npm\Bin\Zlh.exe
      C:\Program Files\Java\jre6\bin\jusched.exe
      C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe
      C:\Program Files\Windows Live\Messenger\msnmsgr.exe
      C:\Users\jessica et fabrice\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
      C:\Windows\system32\igfxsrvc.exe
      C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      C:\Program Files\Windows Media Player\wmpnscfg.exe
      C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\Windows\system32\taskeng.exe
      C:\Users\jessica et fabrice\Downloads\RSIT.exe
      C:\Program Files\trend micro\jessica et fabrice.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
      R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
      O1 - Hosts: ::1 localhost
      O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
      O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
      O2 - BHO: Shareware.Pro-FR Toolbar - {280b5d37-4a76-467a-b3d6-942fca90acde} - C:\Program Files\Shareware.Pro-FR\tbShar.dll
      O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
      O2 - BHO: EoBho - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll
      O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
      O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
      O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
      O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
      O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
      O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
      O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
      O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
      O3 - Toolbar: Shareware.Pro-FR Toolbar - {280b5d37-4a76-467a-b3d6-942fca90acde} - C:\Program Files\Shareware.Pro-FR\tbShar.dll
      O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
      O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
      O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
      O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
      O4 - HKLM\..\Run: [HotkeyApp] "C:\Program Files\Launch Manager\HotkeyApp.exe"
      O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
      O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
      O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
      O4 - HKLM\..\Run: [Norman ZANDA] "C:\Program Files\Norman\Npm\Bin\ZLH.EXE" /LOAD /SPLASH
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
      O4 - HKLM\..\Run: [EoEngine] "C:\Program Files\EoRezo\EoEngine.exe"
      O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
      O4 - HKCU\..\Run: [recinfo] c:\recinfo\recinfo.exe
      O4 - HKCU\..\Run: [ISUSPM] "C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
      O4 - HKUS\S-1-5-18\..\Run: [fsc-reg] C:\ProgramData\fsc-reg\fscreg.exe (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [fsc-reg] C:\ProgramData\fsc-reg\fscreg.exe (User 'Default user')
      O4 - Startup: Notification de cadeaux MSN.lnk = C:\Users\jessica et fabrice\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
      O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
      O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
      O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
      O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
      O13 - Gopher Prefix:
      O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
      O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Program Files\Norman\Npm\Bin\Elogsvc.exe
      O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
      O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
      O23 - Service: Norman NJeeves - Norman ASA - C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
      O23 - Service: Norman ZANDA - Norman ASA - C:\Program Files\Norman\Npm\Bin\Zanda.exe
      O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
      O23 - Service: Norman's Very Own supplY of resources (NVOY) - Norman ASA - C:\Program Files\Norman\npm\bin\nvoy.exe
      O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe
      O23 - Service: WisLMSvc - Wistron Corp. - C:\Program Files\Launch Manager\WisLMSvc.exe
    5. jess
      @jessg!rly tu me conseil quoi comme antivirus car j'en ai pas et je voudrais m'en mettre un bisou
  14. g!rly Contributeur
    Jess,

    Ça ne l´a pas fait...

    On va faire comme ça :

    Télécharges OTMoveIt3 (de Old_Timer) sur ton Bureau.

    http://oldtimer.geekstogo.com/OTMoveIt3.exe

    Double cliques sur "OTMoveIt3.exe" pour ouvrir le prg .
    Puis copies ce qui se trouve en citation ci-dessous,

    :Processes
    explorer.exe

    :Reg
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2}"=-
    "{280b5d37-4a76-467a-b3d6-942fca90acde}"=-
    [-HKEY_CLASSES_ROOT\clsid\{0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2}]
    [-HKEY_CLASSES_ROOT\clsid\{280b5d37-4a76-467a-b3d6-942fca90acde}]
    [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]
    [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{280b5d37-4a76-467a-b3d6-942fca90acde}]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{280b5d37-4a76-467a-b3d6-942fca90acde}"=-
    [-HKEY_CLASSES_ROOT\clsid\{280b5d37-4a76-467a-b3d6-942fca90acde}]
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
    "{280B5D37-4A76-467A-B3D6-942FCA90ACDE}"=-
    [-HKEY_CLASSES_ROOT\clsid\{280b5d37-4a76-467a-b3d6-942fca90acde}]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "EoEngine"=-

    :Files
    c:\windows\System32\Uninstall.ico
    c:\program files\AxBx
    c:\program files\Conduit
    c:\program files\Shareware.Pro-FR
    c:\program files\AskSBar
    c:\program files\EoRezo

    :Commands
    [emptytemp]
    [start explorer]
    [Reboot]

    et colles le dans le cadre de gauche de OTMoveIt3 :
    Paste Instructions for items to be moved.
    (ne touche à rien d'autre !)

    -> cliques sur MoveIt! pour lancer la suppression.
    -> laisses travailler l'outil ...

    ( Note : ton bureau va disparaitre puis réapparaitre, c'est normal .)

    -> une fois finis , un petite fenêtre s'ouvre : cliques sur " Yes " .

    Ton PC va redémarrer de lui même ...

    -->Postes le contenu du rapport qui se trouve dans le dossier "C:\_OTMoveIt\MovedFiles"
    ( " xxxx2008_xxxxxx.log " où les "x" correspondent au jour et à l'heure de l'utilisation ).

    De rien pour l´aide :)

    @+ plus tard

    Biz `
    1. JESS
      bonjour g!rly,
      sa va bien g fais ce que tu ma dis mon ordi c'est bien éteint et rallumé tout seul j'ai l'icône de msn qui est revenu ainsi que d'autre qui avait disparu hier mais je ne trouve pas le rapport que tu me demande je peu le trouver ou biz
  15. g!rly Contributeur
    Prends le fichier ici et dezip le sur ton bureau
    http://sd-1.archive-host.com/membres/up/1366464061/CFScript_73.rar
    si tu ne sais pas comment deziper :
    http://www.tutopat.com/viewtopic.php?t=933&sid=34215b238376bfb22ef9e8eca9995914
    ps : je vais m´absenter un moment je repasse tout a l´heure
    @+
    1. JESS
      voila le bloc note ke g recu
      ComboFix 09-04-04.01 - jessica et fabrice 2009-04-10 16:34:44.2 - NTFSx86
      Microsoft® Windows Vista™ Édition Familiale Basique 6.0.6001.1.1252.1.1036.18.2038.1001 [GMT 2:00]
      Lancé depuis: c:\users\jessica et fabrice\Downloads\ComboFix.exe
      Commutateurs utilisés :: c:\users\jessica et fabrice\Desktop\CFScript_73.rar
      AV: Norman Security Suite ver. 7.00 *On-access scanning disabled* (Updated)
      * Un nouveau point de restauration a été créé
      .

      ((((((((((((((((((((((((((((( Fichiers créés du 2009-03-10 au 2009-04-10 ))))))))))))))))))))))))))))))))))))
      .

      2009-04-10 13:00 . 2009-04-10 13:00 <REP> d-------- C:\rsit
      2009-04-10 13:00 . 2009-04-10 14:37 <REP> d-------- c:\program files\trend micro
      2009-04-10 10:14 . 2009-04-10 10:14 <REP> d-------- c:\program files\AxBx
      2009-04-01 15:50 . 2009-04-01 15:50 <REP> d-------- c:\users\jessica et fabrice\AppData\Roaming\Samsung
      2009-04-01 15:47 . 2003-02-21 18:42 348,160 --a------ c:\windows\System32\msvcr71.dll
      2009-04-01 15:44 . 2009-04-01 15:47 <REP> d-------- c:\windows\LastGood
      2009-04-01 15:43 . 2009-04-01 15:46 <REP> d-------- c:\windows\System32\Samsung_USB_Drivers
      2009-04-01 15:43 . 2009-04-01 15:43 <REP> d-------- c:\program files\Samsung
      2009-04-01 15:43 . 2006-07-24 16:05 5,632 --a------ c:\windows\System32\drivers\StarOpen.sys
      2009-04-01 15:43 . 2005-08-28 20:51 766 --a------ c:\windows\System32\Uninstall.ico
      2009-03-23 14:42 . 2009-03-23 14:42 <REP> d-------- c:\windows\System32\IOSUBSYS
      2009-03-23 14:42 . 2009-03-23 14:42 <REP> d-------- c:\program files\Common Files\PX Storage Engine
      2009-03-23 10:36 . 2009-03-23 10:36 <REP> d-------- c:\program files\Shareware.Pro-FR
      2009-03-23 10:36 . 2009-03-23 10:36 <REP> d-------- c:\program files\Conduit
      2009-03-11 12:00 . 2008-12-16 05:29 8,147,456 --a------ c:\windows\System32\wmploc.DLL
      2009-03-11 12:00 . 2009-02-09 05:10 2,033,152 --a------ c:\windows\System32\win32k.sys
      2009-03-11 12:00 . 2008-11-27 06:43 268,288 --a------ c:\windows\System32\schannel.dll
      2009-03-11 12:00 . 2008-12-16 07:31 7,680 --a------ c:\windows\System32\spwmp.dll
      2009-03-11 12:00 . 2008-12-16 07:31 4,096 --a------ c:\windows\System32\msdxm.ocx
      2009-03-11 12:00 . 2008-12-16 07:31 4,096 --a------ c:\windows\System32\dxmasf.dll

      .
      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2009-04-10 13:54 --------- d-----w c:\users\jessica et fabrice\AppData\Roaming\Azureus
      2009-04-09 12:37 --------- d-----w c:\program files\eMule
      2009-04-09 12:35 --------- d-----w c:\program files\Windows Live
      2009-04-03 13:24 --------- d-----w c:\users\jessica et fabrice\AppData\Roaming\LimeWire
      2009-04-01 13:43 --------- d--h--w c:\program files\InstallShield Installation Information
      2009-03-31 10:27 --------- d-----w c:\users\jessica et fabrice\AppData\Roaming\EoRezo
      2009-03-23 12:42 --------- d-----w c:\program files\Google
      2009-03-23 08:44 --------- d-----w c:\program files\LimeWire
      2009-03-20 15:01 --------- d-----w c:\program files\Norman
      2009-03-20 09:44 1,650 ----a-w c:\users\jessica et fabrice\AppData\Roaming\wklnhst.dat
      2009-03-12 09:47 --------- d-----w c:\program files\Windows Mail
      2009-02-26 18:28 --------- d-----w c:\program files\Microsoft Silverlight
      2009-02-16 10:45 --------- d-----w c:\program files\Microsoft Sync Framework
      2009-02-16 10:45 --------- d-----w c:\program files\Microsoft
      2009-02-16 10:41 --------- d-----w c:\program files\Windows Live SkyDrive
      2009-02-16 10:31 --------- d-----w c:\program files\Common Files\Windows Live
      2009-02-06 18:39 308,600 ----a-w c:\windows\WLXPGSS.SCR
      2009-02-06 17:52 49,504 ----a-w c:\windows\System32\sirenacm.dll
      2009-01-15 06:11 827,392 ----a-w c:\windows\System32\wininet.dll
      2008-01-21 02:57 174 --sha-w c:\program files\desktop.ini
      2008-10-29 17:32 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
      2008-10-29 17:32 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
      2008-10-29 17:32 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
      2008-09-04 17:44 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012008090420080905\index.dat
      .

      ((((((((((((((((((((((((((((( SnapShot@2009-04-10_14.56.36,78 )))))))))))))))))))))))))))))))))))))))))
      .
      - 2009-03-23 12:42:34 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
      + 2009-04-10 12:56:21 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
      .
      ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
      REGEDIT4

      [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
      "{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2}"= "c:\program files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL" [2008-11-09 66912]
      "{280b5d37-4a76-467a-b3d6-942fca90acde}"= "c:\program files\Shareware.Pro-FR\tbShar.dll" [2009-02-16 1882136]

      [HKEY_CLASSES_ROOT\clsid\{0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2}]

      [HKEY_CLASSES_ROOT\clsid\{280b5d37-4a76-467a-b3d6-942fca90acde}]

      [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]
      2008-11-09 01:04 66912 --a------ c:\program files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL

      [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{280b5d37-4a76-467a-b3d6-942fca90acde}]
      2009-02-16 16:44 1882136 --a------ c:\program files\Shareware.Pro-FR\tbShar.dll

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
      "{280b5d37-4a76-467a-b3d6-942fca90acde}"= "c:\program files\Shareware.Pro-FR\tbShar.dll" [2009-02-16 1882136]

      [HKEY_CLASSES_ROOT\clsid\{280b5d37-4a76-467a-b3d6-942fca90acde}]

      [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
      "{280B5D37-4A76-467A-B3D6-942FCA90ACDE}"= "c:\program files\Shareware.Pro-FR\tbShar.dll" [2009-02-16 1882136]

      [HKEY_CLASSES_ROOT\clsid\{280b5d37-4a76-467a-b3d6-942fca90acde}]

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "recinfo"="c:\recinfo\recinfo.exe" [2008-02-13 52224]
      "ISUSPM"="c:\programdata\Macrovision\FLEXnet Connect\6\ISUSPM.exe" [2007-03-29 222128]
      "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-06 3885408]
      "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
      "WindowsWelcomeCenter"="oobefldr.dll" [2008-01-21 c:\windows\System32\oobefldr.dll]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-06-06 142104]
      "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-06-06 154392]
      "Persistence"="c:\windows\system32\igfxpers.exe" [2007-06-06 138008]
      "HotkeyApp"="c:\program files\Launch Manager\HotkeyApp.exe" [2007-07-26 192512]
      "SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-08-17 102400]
      "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
      "NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
      "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-09-20 29744]
      "Norman ZANDA"="c:\program files\Norman\Npm\Bin\ZLH.EXE" [2008-06-02 277616]
      "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-09 136600]
      "EoEngine"="c:\program files\EoRezo\EoEngine.exe" [2008-11-01 472912]
      "RtHDVCpl"="RtHDVCpl.exe" [2007-07-06 c:\windows\RtHDVCpl.exe]

      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
      "fsc-reg"="c:\programdata\fsc-reg\fscreg.exe" [2007-11-08 533264]

      c:\users\jessica et fabrice\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
      Notification de cadeaux MSN.lnk - c:\users\jessica et fabrice\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe [2009-03-24 135680]

      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
      "EnableUIADesktopToggle"= 0 (0x0)

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
      "AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GOEC62~1.DLL

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
      "{D00C1755-2354-46A1-B737-B046ABB47943}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
      "{C78E3E32-608E-4AD9-9C79-4F069DCDC35F}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
      "TCP Query User{1D8D7EBB-DA94-4DA5-A235-65A0F6596A1A}c:\\program files\\azureus\\azureus.exe"= UDP:c:\program files\azureus\azureus.exe:Azureus
      "UDP Query User{ABAAA5E3-3E50-4632-BC45-A847B598B85A}c:\\program files\\azureus\\azureus.exe"= TCP:c:\program files\azureus\azureus.exe:Azureus
      "TCP Query User{BE4570FE-FF0F-4BB3-A72B-6415EB4F142A}c:\\program files\\azureus\\azureus.exe"= UDP:c:\program files\azureus\azureus.exe:Azureus
      "UDP Query User{45ABDC46-3A77-4F13-BCBD-D1242EC446D2}c:\\program files\\azureus\\azureus.exe"= TCP:c:\program files\azureus\azureus.exe:Azureus
      "{DF6F215B-C5B2-4716-AD83-475A9F386384}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
      "{FE3BD723-D223-4AD5-972E-27FDB3902ADE}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire

      R1 Hotkey;Hotkey;c:\windows\System32\drivers\HOTKEY.sys [2008-05-26 9867]
      R2 NVOY;Norman's Very Own supplY of resources;c:\program files\Norman\Npm\Bin\nvoy.exe [2008-09-04 121912]
      R2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]
      R3 NVCScheduler;Norman Virus Control Scheduler;c:\program files\Norman\Npm\Bin\nvcsched.exe [2008-09-04 154680]
      R3 WisLMSvc;WisLMSvc;c:\program files\Launch Manager\WisLMSvc.exe [2008-05-26 118784]
      S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [2009-02-16 55280]
      S3 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [2009-02-06 533360]
      S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2008-09-04 29744]

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
      LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
      \shell\AutoRun\command - F:\StartVMCLite.exe

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3dceaa52-c86c-11dd-b807-001f1600642e}]
      \shell\Auto\command - cmd /C launch.bat
      \shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL cmd /C launch.bat

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{83761f21-7a9e-11dd-bf98-001f1600642e}]
      \shell\AutoRun\command - F:\StartVMCLite.exe

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{83761f28-7a9e-11dd-bf98-001f1600642e}]
      \shell\AutoRun\command - F:\StartVMCLite.exe

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95957aa0-840f-11dd-afc8-001f1600642e}]
      \shell\AutoRun\command - F:\StartVMCLite.exe

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95957aa1-840f-11dd-afc8-001f1600642e}]
      \shell\AutoRun\command - F:\StartVMCLite.exe

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c288c672-83f0-11dd-82f2-001f1600642e}]
      \shell\AutoRun\command - F:\StartVMCLite.exe

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c288c673-83f0-11dd-82f2-001f1600642e}]
      \shell\AutoRun\command - F:\StartVMCLite.exe

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c288c676-83f0-11dd-82f2-001f1600642e}]
      \shell\AutoRun\command - F:\StartVMCLite.exe

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c288c677-83f0-11dd-82f2-001f1600642e}]
      \shell\AutoRun\command - F:\StartVMCLite.exe
      .
      Contenu du dossier 'Tâches planifiées'

      2009-04-10 c:\windows\Tasks\User_Feed_Synchronization-{94FFC1C2-2F80-4AFF-BA7D-135088EF8A43}.job
      - c:\windows\system32\msfeedssync.exe [2008-01-21 04:34]
      .
      .
      ------- Examen supplémentaire -------
      .
      uDefault_Search_URL = hxxp://www.google.com/ie
      mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD
      uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
      IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
      IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
      FF - ProfilePath -
      .

      **************************************************************************

      catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2009-04-10 16:36:14
      Windows 6.0.6001 Service Pack 1 NTFS

      Recherche de processus cachés ...

      Recherche d'éléments en démarrage automatique cachés ...

      Recherche de fichiers cachés ...

      Scan terminé avec succès
      Fichiers cachés: 0

      **************************************************************************
      .
      Heure de fin: 2009-04-10 16:38:11
      ComboFix-quarantined-files.txt 2009-04-10 14:38:08
      ComboFix2.txt 2009-04-10 12:58:10

      Avant-CF: 61 206 274 048 octets libres
      Après-CF: 61,192,478,720 octets libres

      180 --- E O F --- 2009-04-07 06:55:33

      j'espere que c sa kil fallai faire
    2. JESS
      je t'es envoyé le bloc note que j'ai reçu je sai pa si ya d'autre manipulation a faire mai je dois m'absenter on reprendra lé manip si ya besoin plutard si tu ve bien jte remercie énormément de ton aide c'est tré gentille de ta part a biento biz
  17. g!rly Contributeur
    Que diable !
    Le truc c´est qu´une première fois déja tu l´as enregistrer quelque part sur ton pc...
    Fais une recherche windows pour le trouver.
    Puis glisse le fichier .txt dessus
    @+
    2. g!rly Contributeur
      reprend le ici :
      -> http://download.bleepingcomputer.com/sUBs/ComboFix.exe
      enregistre le sur ton bureau
      1. JESS
        je ny arrive pas
    3. g!rly Contributeur
      Il doit être sur ton bureau...
      tu l´as téléchargé tout à l´heure.
      c´est une icône rouge avec dessus, une tête de lion qui rugi...
      1. JESS
        je ne le trouve pas je sui vraimen nul avec les ordi
    • 1
    • 2

    Discussions similaires

    Message distribué dans messenger
    Nicolas

    10 réponses
    Message sur facebook messenger "envoyé" mais non "reçu"
    haileed

    15 réponses
    Messenger message envoyer / distribuer
    CygneCruel44

    1 réponse
    Bloqué : Mes messages sont-ils quand même distribués ?
    gnafron

    68 réponses
    Comment supprimer un virus backdoor.Win32
    Aryana35

    32 réponses