virus bagle....

Question

Bonjour,

Je pensait m'être débarasser de ce virus... mais en utilisant mon antivirus, apparaissent ces 3 liens :

Trojan-Downloader.Win32.Bagle.ah

TrackingCookie.Doubleclick

TrackingCookie.Xiti

Quelqu'un peut m'aider ?

jlpjlp · Answer

slt;
colle un rapport avec findykill option 1

https://www.malekal.com/tutorial-findykill/

SgtMaximus · Answer

Salut, merci :)

le soucis c'est que findykill s'arrête ou alors il est très très lent.. a 60%.

ligne : 

Bagle : HKCU\Software\XYZ

SgtMaximus · Answer

voila le rapport , désolé , il suffisait d'attendre ^^

############################## | FindyKill V5.006 |

# User : User (Administrateurs) # PC-DE-USER
# Update on 14/08/09 by Chiquitine29
# Start at: 14:02:21 | 18/08/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html

# Intel(R) Core(TM)2 Duo CPU     T7100  @ 1.80GHz
# Microsoft® Windows Vista™ Édition Familiale Premium  (6.0.6001 32-bit) # Service Pack 1
# Internet Explorer 8.0.6001.18813
# Windows Firewall Status : Disabled
# FW : Pack Securite Plus 7.00[ Enabled ]7.00

# C:\ # Disque fixe local # 141,59 Go (40,39 Go free) # NTFS
# D:\ # Disque fixe local # 7,45 Go (2,3 Go free) [HP_RECOVERY] # NTFS
# E:\ # Disque CD-ROM

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32
vvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32undll32.exe
C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
C:\Program Files\Pack Securite\Common\FSMA32.EXE
C:\Program Files\Pack Securite\Anti-Virus\FSGK32.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Pack Securite\Common\FSMB32.EXE
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Pack Securite\Common\FCH32.EXE
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Pack Securite\Common\FAMEH32.EXE
C:\Program Files\Pack Securite\Anti-Virus\fsqh.exe
C:\Program Files\Pack Securite\FSPC\fspc.exe
C:\Program Files\Pack Securite\ORSP Client\fsorsp.exe
C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
C:\Program Files\Pack Securite\Anti-Virus\fssm32.exe
C:\Program Files\Pack Securite\FSAUA\program\fsus.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Program Files\Pack Securite\Common\FSM32.EXE
C:\WINDOWS\System32undll32.exe
C:\Program Files\Pack Securite\FSGUI\fsguidll.exe
C:\Program Files\Pack Securite\Anti-Virus\fsav32.exe
C:\Program Files\Pack Securite\FSGUI\scanwizard.exe
C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe

################## | C: |


################## | C:\Windows |


################## | C:\Windows\system32 |


################## | C:\Windows\system32\drivers |


################## | C:\Users\User\AppData\Roaming |


################## | C:\Users\User\Temporary Internet Files |


################## | Registre / Clés infectieuses |

Présent ! [HKLM\software\microsoft\security center] "UacDisableNotify" 0x1  

################## | Etat / Services / Informations |

# Affichage des fichiers cachés : OK
 
# Mode sans echec : OK

# (!) Uac = 0x0 
 
# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 ) 
# EapHost -> Start = 2 ( Good = 2 | Bad = 4 ) 
# Wlansvc -> Start = 2 ( Good = 2 | Bad = 4 ) 
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 ) 
# (!) windefend -> Start = 4 ( Good = 2 | Bad = 4 )  
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 ) 


################## | Cracks / Keygens / Serials |


################## | ! Fin du rapport # FindyKill V5.006 ! |

jlpjlp · Answer

ok fais l'option de nettoyage

puis


colle le rapport d'un scan en ligne
avec un des suivants:


bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html

Panda en ligne :
http://pandasoftware.fr

Kaspersky en ligne
https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

Anonyme · Answer

C koi ton antivirus?

jlpjlp · Answer

alors le rapport de nettoyage de findykill?

et le scan en ligne?

SgtMaximus · Answer

désolé, sa a prit du temps. Je sort a plus tard et merci. Je suis tes réponses :)

antivirus en ligne :

BitDefender Online Scanner - Rapport virus en temps réel
  
  
 
Généré à: Tue, Aug 18, 2009 - 17:14:29
 

--------------------------------------------------------------------------------

 
  
  
 
Info d'analyse
  
  
 
Fichiers scannés
 185435
 
Infectés Fichiers
 0
 
  
  
 
 
  
  
 
Virus Détectés
  
  
 
Aucun virus trouvé.
 
 
  
  
 
 
  
  
 
 

--------------------------------------------------------------------------------
  
  
 
Ce sommaire du processus d'analyse sera utilisé par les laboratoires Antivirus BitDefender pour créer des statistiques agréguées sur l'activité des virus dans le monde. 
  

___________
option nettoyage :

############################## | FindyKill V5.006 |

# User : User (Administrateurs) # PC-DE-USER
# Update on 14/08/09 by Chiquitine29
# Start at: 15:00:05 | 18/08/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html

# Intel(R) Core(TM)2 Duo CPU     T7100  @ 1.80GHz
# Microsoft® Windows Vista™ Édition Familiale Premium  (6.0.6001 32-bit) # Service Pack 1
# Internet Explorer 8.0.6001.18813
# Windows Firewall Status : Disabled
# FW : Pack Securite Plus 7.00[ Enabled ]7.00

# C:\ # Disque fixe local # 141,59 Go (40,58 Go free) # NTFS
# D:\ # Disque fixe local # 7,45 Go (2,3 Go free) [HP_RECOVERY] # NTFS
# E:\ # Disque CD-ROM

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32
vvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\LogonUI.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32undll32.exe
C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
C:\Program Files\Pack Securite\Common\FSMA32.EXE
C:\Program Files\Pack Securite\Anti-Virus\FSGK32.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Pack Securite\Common\FSMB32.EXE
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Pack Securite\Common\FCH32.EXE
C:\Program Files\Pack Securite\Anti-Virus\fsqh.exe
C:\Program Files\Pack Securite\FSGUI\fsstm.exe
C:\Program Files\Pack Securite\Common\FAMEH32.EXE
C:\Program Files\Pack Securite\FSPC\fspc.exe
C:\Program Files\Pack Securite\ORSP Client\fsorsp.exe
C:\Program Files\Pack Securite\Anti-Virus\fssm32.exe
C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe
C:\Windows\system32\userinit.exe
c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Pack Securite\FSAUA\program\fsus.exe
C:\Windows\system32unonce.exe
C:\Windows\system32\conime.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\wbem\wmiprvse.exe

################## | C: |


################## | C:\Windows |


################## | C:\Windows\system32 |


################## | C:\Windows\system32\drivers |


################## | C:\Users\User\AppData\Roaming |


################## | Autres ... |


################## | Temporary Internet Files |


################## | Registre / Clés infectieuses | 

Value ! [HKLM\software\microsoft\security center] "UacDisableNotify" -> Reset sucessfully !  

################## | Etat / Services / Informations |

# Mode sans echec : OK


# Affichage des fichiers cachés : OK

# Uac : OK 
 
# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 ) 
# EapHost -> Start = 2 ( Good = 2 | Bad = 4 ) 
# Wlansvc -> Start = 2 ( Good = 2 | Bad = 4 ) 
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 ) 
# windefend -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 ) 


################## | PEH ... |

Corrompu : C:\Program Files\Common Files\Roxio Shared\9.0\Roxio Central33\Audio\Launch.exe
[Offset = 000000EC - Valeur = 0x0001]

Corrompu : C:\Program Files\Common Files\Roxio Shared\9.0\Roxio Central33\Easy Archive\Launch.exe
[Offset = 000000DC - Valeur = 0x0001]

Corrompu : C:\SwSetup\Inetsec\FR\NAV\External\NORTON\APP\NavShcom.exe
[Offset = 000000F4 - Valeur = 0x0001]

Corrompu : C:\SwSetup\Inetsec\FR\NAV\External\NORTON\APP\NAVStub.exe
[Offset = 000000EC - Valeur = 0x0001]

Corrompu : C:\SwSetup\Inetsec\FR\NAV\External\NORTON\APP\Navw32.exe
[Offset = 0000010C - Valeur = 0x0001]

Corrompu : C:\SwSetup\Inetsec\FR\NAV\External\NORTON\APP\Navwnt.exe
[Offset = 000000EC - Valeur = 0x0001]

Corrompu : C:\SwSetup\Inetsec\FR\Setup\Setup\APP\isPwdSvc.exe
[Offset = 000000FC - Valeur = 0x0001]

Corrompu : C:\SwSetup\Inetsec\FR\Setup\Setup\APP\isUAC.exe
[Offset = 000000E4 - Valeur = 0x0001]

Corrompu : C:\SwSetup\Inetsec\FR\Setup\Setup\APP
isoptui.exe
[Offset = 000000FC - Valeur = 0x0001]

Corrompu : C:\SwSetup\Inetsec\FR\Setup\Setup\APP\osCheck.exe
[Offset = 000000FC - Valeur = 0x0001]

Corrompu : C:\SwSetup\Inetsec\FR\Support\AppCore\AppCore\AppSvc32.exe
[Offset = 00000104 - Valeur = 0x0001]

Corrompu : C:\SwSetup\Inetsec\FR\Support\ccCommon\ccCommon\ccApp.exe
[Offset = 000000E4 - Valeur = 0x0001]

Corrompu : C:\SwSetup\Inetsec\FR\Support\ccCommon\ccCommon\ccEvtMgr.exe
[Offset = 000000E4 - Valeur = 0x0001]

Corrompu : C:\SwSetup\Inetsec\FR\Support\ccCommon\ccCommon\ccSetMgr.exe
[Offset = 000000E4 - Valeur = 0x0001]

Corrompu : C:\SwSetup\Inetsec\FR\Support\ccCommon\ccCommon\ccSvcHst.exe
[Offset = 000000EC - Valeur = 0x0001]

Corrompu : C:\SwSetup\Inetsec\FR\Support\LUpdate\AUpdate.exe
[Offset = 0000010C - Valeur = 0x0001]

Corrompu : C:\SwSetup\Inetsec\FR\Support\LUpdate\LuAll.exe
[Offset = 0000011C - Valeur = 0x0001]

Corrompu : C:\SwSetup\Inetsec\FR\Support\LUpdate\LuCheck.exe
[Offset = 000000FC - Valeur = 0x0001]

Corrompu : C:\SwSetup\Inetsec\FR\Support\LUpdate\LuConfig.exe
[Offset = 0000011C - Valeur = 0x0001]

Corrompu : C:\SwSetup\Inetsec\FR\Support\LUpdate\LUInit.exe
[Offset = 000000EC - Valeur = 0x0001]

Corrompu : C:\SwSetup\Inetsec\FR\Support\LUpdate\NotifyHA.exe
[Offset = 000000F4 - Valeur = 0x0001]

Corrompu : C:\SwSetup\Inetsec\FR\Support\SymNet\SymNet\SNDSrvc.exe
[Offset = 000000F4 - Valeur = 0x0001]


################## | Cracks / Keygens / Serials |

"C:\Users\User\.housecall6.6\"patch.exe""  
22/12/2008 23:12 |Size 218736 |Crc32 12c79c8b |Md5 b9a80ba0083fb8196f8ca0bef053ea4e  
 

################## | ! Fin du rapport # FindyKill V5.006 ! |

SgtMaximus · Answer

Up, pour qu'on ne m'oublie pas..

jlpjlp · Answer

finis de virer norton :

http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20050414110429924


_____________________


réinstalle ROXIO


______________________

répares windows:

https://www.commentcamarche.net/informatique/windows/25-verifier-et-reparer-des-fichiers-systeme-avec-windows-10/

______________________

scan avec malwarebyte , fais un scan rapide et colle le rapport obtenu et vire ce qui est trouvé:


https://www.malekal.com/tutoriel-malwarebyte-anti-malware/­

______________________

Télécharge ici :

http://images.malwareremoval.com/random/RSIT.exe

random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.

Double-clique sur RSIT.exe afin de lancer RSIT.

Clique Continue à l'écran Disclaimer.

Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.

Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).

NB : Les rapports sont sauvegardés dans le dossier C:\rsit

SgtMaximus · Answer

ok, donc j'ai vista, je n'ai pas pu utiliser ce lien :

https://www.commentcamarche.net/informatique/windows/25-verifier-et-reparer-des-fichiers-systeme-avec-windows-10/­pu-ou-manquant 

j'espère que c'est bon pour ROXIO :

voila les rapports :

Malwarebytes' Anti-Malware 1.32
Version de la base de données: 1624
Windows 6.0.6001 Service Pack 1

18/08/2009 20:42:42
mbam-log-2009-08-18 (20-42-42).txt

Type de recherche: Examen rapide
Eléments examinés: 52063
Temps écoulé: 5 minute(s), 38 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)


______________


info.txt logfile of random's system information tool 1.06 2009-08-18 20:47:23

======Uninstall list======

-->"C:\Program Files\Pack Securite\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Anti-Spyware Scanner"
-->"C:\Program Files\Pack Securite\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Anti-Spyware"
-->"C:\Program Files\Pack Securite\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Anti-Virus Client Security Installer"
-->"C:\Program Files\Pack Securite\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Anti-Virus"
-->"C:\Program Files\Pack Securite\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Automatic Update Agent"
-->"C:\Program Files\Pack Securite\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure DAAS"
-->"C:\Program Files\Pack Securite\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure DAAS2"
-->"C:\Program Files\Pack Securite\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Diagnostics"
-->"C:\Program Files\Pack Securite\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure E-mail Scanning"
-->"C:\Program Files\Pack Securite\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure FWES"
-->"C:\Program Files\Pack Securite\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure GateKeeper Interface"
-->"C:\Program Files\Pack Securite\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Gemini"
-->"C:\Program Files\Pack Securite\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure GUI"
-->"C:\Program Files\Pack Securite\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Help"
-->"C:\Program Files\Pack Securite\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure HIPS"
-->"C:\Program Files\Pack Securite\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Internet Shield"
-->"C:\Program Files\Pack Securite\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure ISP News"
-->"C:\Program Files\Pack Securite\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Localization API"
-->"C:\Program Files\Pack Securite\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Management Agent"
-->"C:\Program Files\Pack Securite\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure ORSP Client"
-->"C:\Program Files\Pack Securite\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Pegasus Engine"
-->"C:\Program Files\Pack Securite\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Protocol Scanner"
-->"C:\Program Files\Pack Securite\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Spam Control"
-->"C:\Program Files\Pack Securite\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Spam Scanner"
-->"C:\Program Files\Pack Securite\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure TNB"
-->"C:\Program Files\Pack Securite\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Uninstall"
-->"C:\Program Files\Pack Securite\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Web Filter"
Adobe Flash Player ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 9 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A90000000001}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
AuthenTec Fingerprint Sensor Minimum Install-->MsiExec.exe /I{B61B6668-A674-4A06-8405-51944D5CCDDD}
Day of Defeat: Source Beta-->"C:\Program Files\Steam\steam.exe" steam://uninstall/302
Day of Defeat: Source-->MsiExec.exe /I{7E18C9F0-1262-4AF6-AC3D-9CB1EBF54772}
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter Mobile-->C:\Program Files\DivX\DivXConverterMeUninstall.exe /CONVERTERME
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
eMule-->"C:\Program Files\eMule\Uninstall.exe"
Eraser-->"C:\ProgramData\{A25FEDC1-F6D7-440C-BCE2-B71F595F6646}\EraserSetup32.exe" REMOVE=TRUE MODIFY=FALSE
Eraser-->C:\ProgramData\{A25FEDC1-F6D7-440C-BCE2-B71F595F6646}\EraserSetup32.exe
ESU for Microsoft Vista-->MsiExec.exe /X{DB3AE42A-AAED-49CC-9B87-55A181BCC868}
FindyKill-->C:\FindyKill\Uninstal.exe
Football Manager 98-->C:\Windows\IsUn040c.exe -fC:\SIERRA\FM98\Uninst.isu
Free Easy Burner V 3.8-->"C:\Program Files\Free Easy Burner\unins000.exe"
Heroes of Might and Magic V-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{20071984-5EB1-4881-8EDB-082532ACEC6D}\Setup.exe" -l0x40c 
Hewlett-Packard Active Check-->MsiExec.exe /X{254C37AA-6B72-4300-84F6-98A82419187E}
Hewlett-Packard Asset Agent-->MsiExec.exe /X{669D4A35-146B-4314-89F1-1AC3D7B88367}
HijackThis 2.0.2-->"C:\Program Files	rend micro\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
HP Active Support Library 32 bit components-->MsiExec.exe /I{FAB0C302-CB18-4A7A-BA03-C3DC23101A68}
HP Active Support Library-->C:\Program Files\InstallShield Installation Information\{290B83AA-093A-45BF-A917-D1C4A1E8D917}\setup.exe -runfromtemp -l0x0409
HP Customer Experience Enhancements-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AB5E289E-76BF-4251-9F3F-9B763F681AE0}\setup.exe" -l0x9  -removeonly
HP Doc Viewer-->MsiExec.exe /I{082702D5-5DD8-4600-BCE5-48B15174687F}
HP Easy Setup - Frontend-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{40F7AED3-0C7D-4582-99F6-484A515C73F2}\setup.exe" -l0x9  -removeonly
HP Help and Support-->MsiExec.exe /I{9061CEF2-51F5-42C9-8A70-9ED351C6597A}
HP Photosmart Essential 2.0-->C:\Program Files\HP\Digital Imaging\PhotoSmartEssential\hpzscr01.exe -datfile hpqbud13.dat
HP Quick Launch Buttons 6.20 B1-->C:\Program Files\InstallShield Installation Information\{34D2AB40-150D-475D-AE32-BD23FB5EE355}\setup.exe -runfromtemp -l0x040c uninst
HP QuickPlay 3.2-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{45D707E9-F3C4-11D9-A373-0050BAE317E1}\setup.exe"  -uninstall
HP Update-->MsiExec.exe /X{7059BDA7-E1DB-442C-B7A1-6144596720A4}
HP User Guides 0056-->MsiExec.exe /I{5AB56552-6938-4686-9F87-DB0ED8D1E06B}
HP Wireless Assistant-->MsiExec.exe /I{D32067CD-7409-4792-BFA0-1469BCD8F0C8}
INsanes Small HUD 7 Black-->C:\Program Files\Steam\SteamApps\sgtmaximus69\day of defeat source\dod\uninst INsanes Small HUD 7 Black.exe
Intel Matrix Storage Manager-->C:\Windows\system32\imsmudlg.exe -uninstall
Java(TM) 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java(TM) SE Runtime Environment 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160000}
K-Lite Mega Codec Pack 4.2.5-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
LG PC Suite II-->C:\Program Files\InstallShield Installation Information\{14DCD95A-EBA3-4BF0-B7EF-533852E99BE6}\setup.exe -runfromtemp -l0x040c -removeonly
LG USB Modem driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C3ABE126-2BB2-4246-BFE1-6797679B3579}\setup.exe" -l0x40c LG -removeonly
Logitech Gaming Software-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B9242864-2841-4ADE-86E0-8F90F91B04DD}\setup.exe" -l0x40c 
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 3.5 Language Pack SP1 - fra-->MsiExec.exe /I{3E31821C-7917-367E-938E-E65FC413EA31}
Microsoft .NET Framework 3.5 SP1-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Office 2000 Premium-->MsiExec.exe /I{0000040C-78E1-11D2-B60F-006097C998E7}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office Home and Student 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL
Microsoft Office Home and Student 2007-->MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Works-->MsiExec.exe /I{6B1CB38D-E2E4-4a30-933D-EFDEBA76AD9C}
Module linguistique Microsoft .NET Framework 3.5 SP1- fra-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\setup.exe
Motorola SM56 Data Fax Modem-->rundll32.exe sm56co6a.dll,SM56UnInstaller
MSCU for Microsoft Vista-->MsiExec.exe /X{336A609A-6ECC-4E05-B320-CCC085BF7EA7}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML4 Parser-->MsiExec.exe /I{01501EBA-EC35-4F9F-8889-3BE346E5DA13}
Mumble and Murmur-->C:\Program Files\Mumble\Uninstall.exe
NVIDIA Drivers-->C:\Windows\system32\NVUNINST.EXE UninstallGUI
OpenOffice.org Installer 1.0-->MsiExec.exe /X{3A2AF807-9F9F-43C9-A24A-17B617238B74}
Pack sécurité-->"C:\Program Files\Pack Securite\FSGUI\PostInstall.exe"  /tUnInstall
Packard Bell Software Suite-->C:\Program Files\Packard Bell\Packard Bell Software Suite\Uninstall.exe
PowerDVD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe"  -uninstall
QuickTime-->MsiExec.exe /I{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m
Roxio Activation Module-->MsiExec.exe /I{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}
Roxio Creator Audio-->MsiExec.exe /I{83FFCFC7-88C6-41c6-8752-958A45325C82}
Roxio Creator Basic v9-->MsiExec.exe /I{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}
Roxio Creator Copy-->MsiExec.exe /I{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}
Roxio Creator Data-->MsiExec.exe /I{0D397393-9B50-4c52-84D5-77E344289F87}
Roxio Creator EasyArchive-->MsiExec.exe /I{11F93B4B-48F0-4A4E-AE77-DFA96A99664B}
Roxio Creator Tools-->MsiExec.exe /I{0394CDC8-FABD-4ed8-B104-03393876DFDF}
Roxio Express Labeler 3-->MsiExec.exe /I{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
Roxio MyDVD Basic v9-->MsiExec.exe /I{33C65B6A-5D73-4E3E-A1F9-127C27BD3F72}
SFR - Kit de connexion-->C:\Program Files\SFR\Kit\uninstall.exe
Skype™ 4.0-->MsiExec.exe /X{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}
Steam(TM)-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
Team Fortress 2-->"C:\Program Files\Steam\steam.exe" steam://uninstall/440
TeamSpeak 2 RC2-->"C:\Program Files\Teamspeak2_RC2\unins000.exe"
TV sur PC-->C:\Program Files\Neuf\TV_PC\uninstall.exe
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
VeriSoft Access Manager-->rundll32.exe "c:\Program Files\Bioscrypt\VeriSoft\Bin\SetupHelper.dll",ExecMain /Uninstall {0ABA40AF-288D-41F1-B735-C5155692CD7D}
Windows Live Messenger-->MsiExec.exe /I{F6326B60-1B1D-4ABF-BFCD-7B7404F44411}

======Security center information======

FW: Pack Securite Plus 7.00
AS: Windows Defender

======System event log======

Computer Name: PC-de-User
Event Code: 1002
Message: Le bail de l'adresse IP 192.168.1.20 pour la carte réseau dont l'adresse réseau est 0013E8103513 a été refusé par le serveur DHCP 192.168.2.1 (celui-ci a envoyé un message DHCPNACK).
Record Number: 556930
Source Name: Microsoft-Windows-Dhcp-Client
Time Written: 20090818183447.000000-000
Event Type: Erreur
User: 

Computer Name: PC-de-User
Event Code: 7000
Message: Le service Parallel port driver n'a pas pu démarrer en raison de l'erreur : 
Le service ne peut pas être démarré parce qu'il est désactivé ou qu'aucun périphérique activé ne lui est associé.
Record Number: 556969
Source Name: Service Control Manager
Time Written: 20090818183448.000000-000
Event Type: Erreur
User: 

Computer Name: PC-de-User
Event Code: 15016
Message: Impossible d’initialiser le package de sécurité Kerberos pour l’authentification côté serveur. Le champ de données contient le numéro de l’erreur.
Record Number: 557002
Source Name: Microsoft-Windows-HttpEvent
Time Written: 20090818183445.490092-000
Event Type: Erreur
User: 

Computer Name: PC-de-User
Event Code: 1003
Message: 
Record Number: 557014
Source Name: Microsoft-Windows-Dhcp-Client
Time Written: 20090818183619.000000-000
Event Type: Avertissement
User: 

Computer Name: PC-de-User
Event Code: 1002
Message: Le bail de l'adresse IP 192.168.2.29 pour la carte réseau dont l'adresse réseau est 0013E8103513 a été refusé par le serveur DHCP 192.168.1.1 (celui-ci a envoyé un message DHCPNACK).
Record Number: 557015
Source Name: Microsoft-Windows-Dhcp-Client
Time Written: 20090818183619.000000-000
Event Type: Erreur
User: 

=====Application event log=====

Computer Name: PC-de-User
Event Code: 1000
Message: Application défaillante fsorsp.exe, version 1.0.3.208, horodatage 0x482038ec, module défaillant ntdll.dll, version 6.0.6001.18000, horodatage 0x4791a7a6, code d’exception 0xc0000005, décalage d’erreur 0x0006a8a9, ID du processus 0xf64, heure de début de l’application 0x01ca1c4e3e5b4997.
Record Number: 29558
Source Name: Application Error
Time Written: 20090813194252.000000-000
Event Type: Erreur
User: 

Computer Name: PC-de-User
Event Code: 103
Message: 1  2009-08-13  21:42:57+02:00  pc-de-user  PC-DE-USER\User  F-Secure Management Agent
 The module F-Secure ORSP Client monitored by F-Secure Management Agent has stopped responding or was terminated. An attempt to restart it will be made later. If you see this message frequently, contact the system administrator or reinstall F-Secure products.

Record Number: 29559
Source Name: FSecure-FSecure-F-Secure Management Agent
Time Written: 20090813194257.000000-000
Event Type: Erreur
User: 

Computer Name: PC-de-User
Event Code: 103
Message: 1  2009-08-15  10:39:43+02:00  pc-de-user  PC-de-User\User  F-Secure Anti-Virus
 Malicious code found in file C:\Program Files\Motorola\SMSERIAL\sm56hlpr.0xe. 
 Infection: Trojan-Downloader.Win32.Bagle.ahr 


Record Number: 29691
Source Name: FSecure-FSecure-F-Secure Anti-Virus
Time Written: 20090815083944.000000-000
Event Type: Erreur
User: 

Computer Name: PC-de-User
Event Code: 1000
Message: Application défaillante findstr.exe, version 6.0.6001.18000, horodatage 0x47918ac0, module défaillant findstr.exe, version 6.0.6001.18000, horodatage 0x47918ac0, code d’exception 0xc0000005, décalage d’erreur 0x0000465d, ID du processus 0x1388, heure de début de l’application 0x01ca1ffbc42c8d4a.
Record Number: 29970
Source Name: Application Error
Time Written: 20090818120534.000000-000
Event Type: Erreur
User: 

Computer Name: PC-de-User
Event Code: 1000
Message: Application défaillante findstr.exe, version 6.0.6001.18000, horodatage 0x47918ac0, module défaillant findstr.exe, version 6.0.6001.18000, horodatage 0x47918ac0, code d’exception 0xc0000005, décalage d’erreur 0x0000465d, ID du processus 0x9f4, heure de début de l’application 0x01ca2007d0f73fff.
Record Number: 29992
Source Name: Application Error
Time Written: 20090818133140.000000-000
Event Type: Erreur
User: 

=====Security event log=====

Computer Name: PC-de-User
Event Code: 5038
Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.

Nom du fichier :	\Device\HarddiskVolume1\Program Files\Pack Securite\Common\fswscs.exe	
Record Number: 892858
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090818184759.002492-000
Event Type: Échec de l'audit
User: 

Computer Name: PC-de-User
Event Code: 5038
Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.

Nom du fichier :	\Device\HarddiskVolume1\Program Files\Pack Securite\Common\fswscs.exe	
Record Number: 892859
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090818184809.075492-000
Event Type: Échec de l'audit
User: 

Computer Name: PC-de-User
Event Code: 5038
Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.

Nom du fichier :	\Device\HarddiskVolume1\Program Files\Pack Securite\Common\fswscs.exe	
Record Number: 892860
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090818184819.182492-000
Event Type: Échec de l'audit
User: 

Computer Name: PC-de-User
Event Code: 5038
Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.

Nom du fichier :	\Device\HarddiskVolume1\Program Files\Pack Securite\Common\fswscs.exe	
Record Number: 892861
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090818184829.227492-000
Event Type: Échec de l'audit
User: 

Computer Name: PC-de-User
Event Code: 5038
Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.

Nom du fichier :	\Device\HarddiskVolume1\Program Files\Pack Securite\Common\fswscs.exe	
Record Number: 892862
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090818184839.309492-000
Event Type: Échec de l'audit
User: 

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Common Files\Roxio Shared\DLLShared\;C:\Program Files\Common Files\Roxio Shared\DLLShared\;C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\;c:\Program Files\Bioscrypt\VeriSoft\bin;C:\Program Files\Samsung\Samsung PC Studio 3\;C:\Program Files\QuickTime\QTSystem\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel
"PROCESSOR_REVISION"=0f0d
"NUMBER_OF_PROCESSORS"=2
"PLATFORM"=MCD
"PCBRAND"=Pavilion
"OnlineServices"=Services en ligne
"RoxioCentral"=C:\Program Files\Common Files\Roxio Shared\9.0\Roxio Central33\
"USERPART"=E:
"CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip

-----------------EOF-----------------




fichier log :

Logfile of random's system information tool 1.06 (written by random/random)
Run by User at 2009-08-18 20:47:08
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 1
System drive C: has 50 GB (34%) free of 145 GB
Total RAM: 2046 MB (48% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:47:20, on 18/08/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe
C:\Windows\Explorer.EXE
C:\Program Files\Pack Securite\Common\FSM32.EXE
C:\WINDOWS\System32undll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Pack Securite\FSGUI\fsguidll.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe
C:\Program Files\Pack Securite\FSGUI\scanwizard.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\User\Pictures\RSIT.exe
C:\Program Files	rend micro\User.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://neufportail.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: VeriSoft Access Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - c:\Program Files\Bioscrypt\VeriSoft\Bin\ItIEAddIn.dll
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Pack Securite\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Pack Securite\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Parental... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Parental... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Pack Securite\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll
O20 - AppInit_DLLs: APSHook.dll
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Pack Securite\Common\FSMA32.EXE
O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files\Pack Securite\ORSP Client\fsorsp.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

jlpjlp · Answer

Télécharge OTM
http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/
 (de Old_Timer) sur ton Bureau.

double-clique sur OTM.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTM :Paste instruction for items to be moved.



:processes
explorer.exe
:files
C:\Windows	asks\At1.job
C:\Windows	asks\At2.job
C:\Windows	asks\At3.job
C:\Windows	asks\At4.job
C:\Windows	asks\At5.job
C:\Windows	asks\At6.job
C:\Windows	asks\At7.job
C:\Windows	asks\At8.job
C:\Windows	asks\At9.job 
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.0xe. 
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.0xe
:commands
[purity]
[emptytemp]
[start explorer]

clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTM\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.



_________________


lance tool cleaner : vire tout ce qui est trouvé et colle le rapport


https://www.commentcamarche.net/telecharger/securite/22061-toolscleaner/

____________________



- CCleaner https://www.ccleaner.com/ccleaner/download (FileHippo). Ce logiciel va permettre de supprimer tous les fichiers temporaires. Lance-le et clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures". Par la suite, laisse-le avec ses réglages par défaut.lance le programme et nettoie

_____________________

désactive ta restauration puis redemarre ton pc puis réactive la
http://service1.symantec.com/support/inter/tsgeninfointl.Nsf/fr_docid/20020830101856924

_____________________

encore des soucis????

SgtMaximus · Answer

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
C:\Windows	asks\At1.job moved successfully.
C:\Windows	asks\At2.job moved successfully.
C:\Windows	asks\At3.job moved successfully.
C:\Windows	asks\At4.job moved successfully.
C:\Windows	asks\At5.job moved successfully.
C:\Windows	asks\At6.job moved successfully.
C:\Windows	asks\At7.job moved successfully.
C:\Windows	asks\At8.job moved successfully.
C:\Windows	asks\At9.job moved successfully.
File/Folder C:\Program Files\Motorola\SMSERIAL\sm56hlpr.0xe. not found.
File/Folder C:\Program Files\Motorola\SMSERIAL\sm56hlpr.0xe not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
User: User
->Temp folder emptied: 94791832 bytes
->Temporary Internet Files folder emptied: 111326186 bytes
->Java cache emptied: 40930696 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 1266 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 235,61 mb
 
 
OTM by OldTimer - Version 3.0.0.6 log created on 08182009_221843

Files moved on Reboot...

Registry entries deleted on Reboot...


le pc rame pas mal j'attend pour les étapes suivantes.. dès que je lance toolcleaner, il met ne répond pas, et disque dur qui tourne a fond..

SgtMaximus · Answer

Merci.

Voila j'ai fait tout ce que tu m'as dit.

Bonne nuit.

Je reviendrait si j'ai encore le soucis ^^

PS : au démarrage 54 processus en court, 50% de mémoire physique utiliser sans rien faire.......

jlpjlp · Answer

télécharge combofix (par sUBs) ici :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

et enregistre le sur le bureau.

déconnecte toi d'internet et ferme toutes tes applications.

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)


double-clique sur combofix.exe et suis les instructions

à la fin, il va produire un rapport C:\ComboFix.txt

réactive ton parefeu, ton antivirus, la garde de ton antispyware

copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

Tu as un tutoriel complet ici :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

SgtMaximus · Answer

voila le rapport, merci jlpjlp :)


ComboFix 09-08-18.04 - User 19/08/2009 18:55.1.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium   6.0.6001.1.1252.33.1036.18.2046.1301 [GMT 2:00]
Running from: c:\users\User\Desktop\ComboFix.exe
FW: Pack Securite Plus 7.00 *enabled* {D4747503-0346-49EB-9262-997542F79BF4}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
 * Resident AV is active

.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Cursors\aero_link.cur

.
(((((((((((((((((((((((((   Files Created from 2009-07-19 to 2009-08-19  )))))))))))))))))))))))))))))))
.

2009-08-19 17:01 . 2009-08-19 17:01	--------	d-----w-	c:\users\Default\AppData\Local	emp
2009-08-19 17:01 . 2009-08-19 17:01	--------	d-----w-	c:\users\User\AppData\Local	emp
2009-08-18 20:30 . 2009-08-18 20:30	--------	d-----w-	c:\program files\CCleaner
2009-08-18 18:47 . 2009-08-18 20:29	--------	d-----w-	c:\program files	rend micro
2009-08-18 18:26 . 2009-08-18 18:26	--------	d-----w-	c:\programdata\NortonInstaller
2009-08-18 14:22 . 2009-08-18 15:14	--------	d-----w-	c:\windows\BDOSCAN8
2009-08-14 07:52 . 2009-07-17 14:35	71680	----a-w-	c:\windows\system32\atl.dll
2009-08-14 07:52 . 2009-06-10 12:12	160256	----a-w-	c:\windows\system32\wkssvc.dll
2009-08-14 07:52 . 2009-06-04 12:34	2066432	----a-w-	c:\windows\system32\mstscax.dll
2009-08-14 07:52 . 2009-06-10 12:07	91136	----a-w-	c:\windows\system32\avifil32.dll
2009-08-14 07:52 . 2009-07-14 13:00	313344	----a-w-	c:\windows\system32\wmpdxm.dll
2009-08-14 07:52 . 2009-07-14 12:58	7680	----a-w-	c:\windows\system32\spwmp.dll
2009-08-14 07:52 . 2009-07-14 12:59	4096	----a-w-	c:\windows\system32\dxmasf.dll
2009-08-14 07:52 . 2009-07-14 10:59	8147456	----a-w-	c:\windows\system32\wmploc.DLL
2009-08-04 11:00 . 2009-08-14 22:38	--------	d-----w-	c:\program files\TMbot
2009-07-29 16:20 . 2008-06-20 01:14	97800	----a-w-	c:\windows\system32\infocardapi.dll
2009-07-29 16:20 . 2008-06-20 01:14	105016	----a-w-	c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-07-29 16:19 . 2008-06-20 01:14	11264	----a-w-	c:\windows\system32\icardres.dll
2009-07-29 16:19 . 2008-06-20 01:14	622080	----a-w-	c:\windows\system32\icardagt.exe
2009-07-29 16:19 . 2008-06-20 01:14	43544	----a-w-	c:\windows\system32\PresentationHostProxy.dll
2009-07-29 16:19 . 2008-06-20 01:14	781344	----a-w-	c:\windows\system32\PresentationNative_v0300.dll
2009-07-29 16:19 . 2008-06-20 01:14	326160	----a-w-	c:\windows\system32\PresentationHost.exe

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-19 16:45 . 2009-06-18 09:35	--------	d-----w-	c:\users\User\AppData\Roaming\Skype
2009-08-19 16:33 . 2008-06-05 14:16	--------	d-----w-	c:\program files\Pack Securite
2009-08-19 15:31 . 2009-06-18 09:38	--------	d-----w-	c:\users\User\AppData\Roaming\skypePM
2009-08-18 18:31 . 2007-06-25 20:31	--------	d-----w-	c:\program files\Common Files\Sonic Shared
2009-08-18 13:00 . 2009-01-14 17:44	27744	----a-w-	c:\programdata
vModes.dat
2009-08-15 08:19 . 2006-11-02 11:18	--------	d-----w-	c:\program files\Windows Mail
2009-08-10 15:19 . 2006-11-02 15:48	685562	----a-w-	c:\windows\system32\perfh00C.dat
2009-08-10 15:19 . 2006-11-02 15:48	130738	----a-w-	c:\windows\system32\perfc00C.dat
2009-07-21 21:52 . 2009-07-29 01:58	915456	----a-w-	c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-07-29 01:58	109056	----a-w-	c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-07-29 01:58	71680	----a-w-	c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-07-29 01:58	133632	----a-w-	c:\windows\system32\ieUnatt.exe
2009-07-08 09:24 . 2009-04-03 18:22	33920	----a-w-	c:\windows\system32\drivers\fsbts.sys
2009-06-30 12:49 . 2007-06-25 20:15	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-06-30 12:49 . 2009-02-26 14:08	--------	d-----w-	c:\users\User\AppData\Roaming\Samsung
2009-06-29 15:21 . 2008-06-05 15:18	--------	d-----w-	c:\program files\Steam
2009-06-26 15:31 . 2008-06-05 15:27	--------	d-----w-	c:\program files\Common Files\Steam
2009-06-18 09:38 . 2009-06-18 09:38	56	---ha-w-	c:\windows\system32\ezsidmv.dat
2009-06-15 15:24 . 2009-07-14 21:24	156672	----a-w-	c:\windows\system32	2embed.dll
2009-06-15 15:20 . 2009-07-14 21:24	72704	----a-w-	c:\windows\system32\fontsub.dll
2009-06-15 15:20 . 2009-07-14 21:23	10240	----a-w-	c:\windows\system32\dciman32.dll
2009-06-15 12:52 . 2009-07-14 21:23	289792	----a-w-	c:\windows\system32\atmfd.dll
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 50696]
"F-Secure Manager"="c:\program files\Pack Securite\Common\FSM32.EXE" [2008-09-23 182936]
"F-Secure TNB"="c:\program files\Pack Securite\FSGUI\TNBUtil.exe" [2008-09-23 957024]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-04 13556256]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-04 92704]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-04-15 413696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"UacDisableNotify"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\APSHook.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages	REG_MULTI_SZ   	scecli ASWLNPkg

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk]
backup=c:\windows\pss\Microsoft Office.lnk.CommonStartup
backupExtension=.CommonStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun-]
"QlbCtrl"=c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3452074394-4280658064-1917393730-1000]
"EnableNotificationsRef"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{63E473AA-F42E-438A-967D-10594C088465}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{385886E8-F959-405D-AEA8-53E522F0198F}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{7F62BBC5-75E4-4939-B914-21991D03E0E3}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{77BE45C3-9CE5-46CF-866A-F628CA4E7CF2}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{57F8BBBF-005C-4CAD-94DA-B7C508017205}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"TCP Query User{7263A80E-9DD4-42E9-BB9B-76529D107D8B}c:\program files\emule\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{E2F8CB4C-6D96-4B4E-BDCB-7CB78F54813C}c:\program files\emule\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"{DC48655C-00B9-46DB-AA04-2FAB0F797E34}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{4401E2FE-24D5-46FB-A05E-962B1E8F310F}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{245D139A-19AB-497E-AA0A-86E9BFA3D73C}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{0A6A73ED-428B-4B7A-86E4-A50B5C9BD112}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{46E51793-9A99-4083-A938-6CEECCB0761A}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{A5B10159-0B87-4A9D-8233-6E08D7CE4BF4}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{B174C8C7-5D94-4757-A5AA-6A37721A6EB1}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{42E84864-B0AD-41CD-BE7A-46E3C9D25B5F}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{0DE272B3-414A-4809-9447-CB0DECEBECE9}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{33B281B3-3DCE-4965-8081-44E0FA71B253}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{43935D4B-A603-4677-B5DF-F13609E98F88}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{9D742C4A-D9A9-4D0B-9A37-14B12B81D46C}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{A95C9A77-8860-4FD3-A6D8-9E058D09CFBF}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{E3B84D1F-DBAA-4084-91F7-D0F418F286F3}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{5D1CDFED-32CA-4BE7-B11C-149C25FCE9AD}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{BECBD18D-1A4B-4F06-8EBA-5B41AC030B39}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{0871E991-83DC-4DE5-A4DA-9D6F23F37B63}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{472B58C8-CF65-41D6-8CD5-DC26914DE631}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{55F374D7-CE37-45F7-A0B0-CE0B3B08B64C}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{3640EE20-E24E-4F43-A8EE-83EAC22CBCE7}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{7F59B3E3-491B-4520-A1A6-FD47A74EAD32}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{8BAC5546-8A7F-4002-940F-9796C198B25D}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{31155BD9-2EC6-4DF6-82DD-CC71513A9FAA}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{63FCF60A-301E-4DA2-9FD6-FC28FCF316F8}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{F2969317-569B-4182-BAF1-20F2E71A775F}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{6E2A6D14-F4A9-4A73-87C9-FD729E1126E4}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{FE15199B-B948-4949-8D79-22BEE252B644}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{84A7A23A-8AA6-4752-AE16-CC82222029D5}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{C7B68742-B1A2-4CCE-8183-1D9F3021A0FC}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{97D612C5-4040-4D2D-B674-86165A7BE292}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{14A98513-DCA1-4377-A4CE-57082566322A}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{D25FC70A-79CB-4527-A067-5C712085CC4C}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{720DA9D2-71C6-464A-AF25-1B6A9A205F28}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{189E7AC3-DF6A-460D-9C87-08D34DC857EC}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{82BB4F48-B108-47BA-8085-FE1FED87D1DF}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{DBD0AEC2-5DD4-4323-802B-14F767CF7427}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{670439E8-0A6E-457F-91D2-D104A98F2DCF}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{DD521CE9-80E3-4B9C-BE8D-2C4B06335CB9}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{4CC8F31C-D973-49CA-B4A9-B91EE6E60E2C}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{416AFB9B-A980-4949-ACA5-ED7E94ACC50A}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{CB45B958-BF19-4CDF-B510-64C89C888D6F}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{DFE05D64-9297-49BC-B0EF-D87798E08FAF}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{F4AF5E94-0F25-43FE-9290-CDED9DFFE650}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{F162000B-6B31-4808-B58C-562011DB2092}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{C77289FD-CB90-4059-A7F6-5B47D9E45695}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{7C0EA224-30BE-4A03-80C4-735E52566CE5}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{53A53F78-3177-4063-B5A2-2E88BB0C5FA2}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{B681EF6D-9B2D-458F-96C7-BA31F63444DC}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{C8F7A5D5-C51E-4FF2-9291-245633CBA892}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{809A6DD3-4778-49EF-94B3-3D4BBDB89E41}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{6EBCBCE6-4E97-4E38-A6AF-E612FAED5ED3}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{EC276457-3E92-433E-965D-31B4C6A7224A}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{83FDC8F7-50D3-4B8E-85F2-612DE5517BCE}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{54B68504-9AEA-4D1F-AFE2-A39FCBC97ACA}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{9745D2AE-2D71-4B4E-88C4-F4373957831E}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{3A2BCB3D-8299-42FE-A60E-D2A7694A5392}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{A72CC27C-5FB2-4BD8-887E-B249115EB3B2}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{C0356CBD-A7AB-4B68-B4F6-0E78003B262A}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{27F1E4F4-2FA6-47FC-AD18-4C4C6566B592}"= c:\program files\Skype\Phone\Skype.exe:Skype

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R0 fsbts;fsbts;c:\windows\System32\drivers\fsbts.sys [03/04/2009 20:22 33920]
R1 F-Secure HIPS;F-Secure HIPS;c:\program files\Pack Securite\HIPS\drivers\fshs.sys [11/02/2009 22:34 66720]
R1 FSES;F-Secure Email Scanning Driver;c:\windows\System32\drivers\fses.sys [05/01/2009 00:44 35552]
R1 FSFW;F-Secure Firewall Driver;c:\windows\System32\drivers\fsdfw.sys [05/01/2009 00:44 70944]
R1 fsvista;F-Secure Vista Support Driver;c:\program files\Pack Securite\Anti-Virus\minifilter\fsvista.sys [05/01/2009 00:41 12384]
R2 ASBroker;Courtier de session de connexion;c:\windows\System32\svchost.exe -k Cognizance [08/06/2008 09:57 21504]
R2 ASChannel;Canal de communication local;c:\windows\System32\svchost.exe -k Cognizance [08/06/2008 09:57 21504]
R3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\System32\drivers\ATSwpWDF.sys [02/10/2008 18:42 482176]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\Pack Securite\Anti-Virus\minifilter\fsgk.sys [05/01/2009 00:41 99960]
R3 FSORSPClient;F-Secure ORSP Client;c:\program files\Pack Securite\ORSP Client\fsorsp.exe [11/02/2009 22:34 55904]
S4 F-Secure Filter;F-Secure File System Filter;c:\program files\Pack Securite\Anti-Virus\win2k\fsfilter.sys [05/01/2009 00:41 39776]
S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files\Pack Securite\Anti-Virus\win2k\fsrec.sys [05/01/2009 00:41 25184]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance	REG_MULTI_SZ   	ASBroker ASChannel

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32undll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-08-19 c:\windows\Tasks\User_Feed_Synchronization-{162FEC4D-AE5B-446E-97FB-DFDAC80A8182}.job
- c:\windows\system32\msfeedssync.exe [2009-07-29 20:13]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.neufportail.fr/
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
LSP: c:\program files\Pack Securite\FSPS\program\FSLSP.DLL
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-19 19:01
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...  

scanning hidden autostart entries ... 

scanning hidden files ...  

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1388)
c:\windows\system32\APSHook.dll

- - - - - - - > 'lsass.exe'(740)
c:\windows\system32\APSHook.dll
c:\program files\Bioscrypt\VeriSoft\bin\ASWLNPkg.dll
c:\program files\Bioscrypt\VeriSoft\bin\ItMsg.dll
.
Completion time: 2009-08-19 19:03
ComboFix-quarantined-files.txt  2009-08-19 17:03

Pre-Run: 72 067 653 632 octets libres
Post-Run: 72 028 741 632 octets libres

247	--- E O F ---	2009-08-19 08:17

SgtMaximus · Answer

Up..

Je lance mon antivirus, voir s'il détecte toujours bagle..

J'ai F-Secure de Sfr.

Sinon, j'ai un soucis, le disque dur tourne a fond.. et il se fige parfois.. Et lorsque que je lance une vérification des erreus, il se fige aussi..

jlpjlp · Answer

ok pas de bagle

pour virer ce qui a été utilisé et non utile:
https://www.commentcamarche.net/telecharger/securite/22061-toolscleaner/


_______________

si encore des soucis répare windows comme ceci ce qui ne supprimera pas tes données

http://www.vista-xp.fr/forum/topic428.html

Virus bagle....

17 réponses

Discussions similaires

Newsletters