Malware indesirable

bugs35 -

Bonjour,je suis embeté par un anti malware qui apparait sans cesse et je n'arrive pas a m'en débarrasser, pouvez vous m'aider.merci
en consultant le forum , j'ai fait une analyse avec rsit et voici le resultat ,les deux rapports seront séparés

======Uninstall list======

-->C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
-->C:\WINNT\UNNeroVision.exe /UNINSTALL
25000 Sudoku-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3B9F6E77-C77B-4FAD-B873-DDA2345F8221}\setup.exe" -l0x40c
35 Card Solitaire 1.02-->"C:\Program Files\NZP\35 Card Solitaire\uninstall.exe"
Adobe Flash Player 10 ActiveX-->C:\WINNT\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8.1.7 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81300000003}
AFPL Ghostscript 8.54-->C:\Program Files\gs\uninstgs.exe "C:\Program Files\gs\gs8.54\uninstal.txt"
AFPL Ghostscript Fonts-->C:\Program Files\gs\uninstgs.exe "C:\Program Files\gs\fonts\uninstal.txt"
AI RoboForm (All Users)-->"C:\Program Files\Siber Systems\AI RoboForm\rfwipeout.exe"
Amanita Muscaria Memory-->MsiExec.exe /I{4E2D85BF-F785-490C-9182-AE6DABE11D0A}
AMI-CW52 V.92 PCI Modem-->C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_14F1&DEV_2F01&SUBSYS_900616EF\HXFSETUP.EXE -U -IVEN_14F1&DEV_2F01&SUBSYS_900616EF
Analyseur et SDK XML Microsoft-->MsiExec.exe /I{3E908702-AF35-4611-9518-955DA24B7E07}
Architecture d'intérieur 3D 2004-->"C:\Program Files\Anuman Interactive\Architecture d'intérieur 3D 2004\unins000.exe"
ArcSoft Camera Suite-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AD708DF0-9F04-4CB3-821A-85804A833B4D}\SETUP.EXE" -l0x40c -uninst
ArcSoft PhotoStudio 2000-->C:\WINNT\IsUn040c.exe -f"C:\Program Files\ArcSoft\PhotoStudio 2000\Uninst.isu"
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
Canon Camera TWAIN Driver 6.0-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{275E6655-7CB0-4B9E-A89D-2EE640B37899}
Canon Internet Library for ZoomBrowser EX-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{9E75AF24-815C-4BD1-9A05-F96866CC6005}
Canon PhotoRecord-->C:\WINNT\IsUn040c.exe -fC:\PROGRA~1\Canon\PhotoRecord\Uninst.isu -c"C:\PROGRA~1\Canon\PhotoRecord\Program\uninstdll.dll"
Canon Utilities File Viewer Utility 1.2-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{755D3B4E-D3A3-4D05-99D8-FC35E26A331C}
Canon Utilities PhotoStitch 3.1-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{F11A403B-0DE9-4953-B790-7A2F014FBB2B}
Canon Utilities RemoteCapture 2.7-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{AB3AC39D-9915-435D-ACC4-9881E75326BC}
Canon Utilities ZoomBrowser EX-->MsiExec.exe /X{C1D76D7A-F3BB-47EA-A746-5B1E2FFC1DF2}
CDDC-Mahjongg (Supprimer uniquement)-->C:\Program Files\CDDC-MahJongg\Uninst.exe
Codeur Windows Media Série 9-->msiexec.exe /I {E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
Codeur Windows Media Série 9-->MsiExec.exe /I{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
Cool Nestor-->C:\WINNT\unin040c.exe -f"C:\Program Files\Cool Nestor\DeIsL1.isu" -c"C:\Program Files\Cool Nestor\_ISREG32.DLL"
Correctif cumulatif 1 pour Windows 2000 SP4-->"C:\WINNT\$NtUpdateRollupPackUninstall$\spuninst\spuninst.exe"
Correctif Lecteur Windows Media 9 [Voir KB885492 pour plus d'informations]-->C:\WINNT\$NtUninstallKB885492$\spuninst\spuninst.exe
Correctif pour le Lecteur Windows Media [Voir Q828026 pour plus d'informations]-->C:\WINNT\$NtUninstallQ828026$\spuninst\spuninst.exe
Correctif Windows 2000 - Article Base de Connaissances 834707-->C:\WINNT\$NtUninstallKB834707-IE6SP1-20040929.091901$\spuninst\spuninst.exe
Correctif Windows 2000 - KB842773-->C:\WINNT\$NtUninstallKB842773$\spuninst\spuninst.exe
Correctif Windows 2000 - KB867282-->C:\WINNT\$NtUninstallKB867282-IE6SP1-20050127.163319$\spuninst\spuninst.exe
Correctif Windows 2000 - KB883939-->"C:\WINNT\$NtUninstallKB883939-IE6SP1-20050428.125228$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB889293-->C:\WINNT\$NtUninstallKB889293-IE6SP1-20041111.235619$\spuninst\spuninst.exe
Correctif Windows 2000 - KB890046-->"C:\WINNT\$NtUninstallKB890046$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB890923-->"C:\WINNT\$NtUninstallKB890923-IE6SP1-20050225.103456$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB893756-->"C:\WINNT\$NtUninstallKB893756$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB894320-->"C:\WINNT\$NtUninstallKB894320$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB896358-->"C:\WINNT\$NtUninstallKB896358$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB896422-->"C:\WINNT\$NtUninstallKB896422$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB896423-->"C:\WINNT\$NtUninstallKB896423$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB896424-->"C:\WINNT\$NtUninstallKB896424$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB896688-->"C:\WINNT\$NtUninstallKB896688-IE6SP1-20051004.130236$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB896727-->"C:\WINNT\$NtUninstallKB896727-IE6SP1-20050719.165959$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB897715-->"C:\WINNT\$NtUninstallKB897715-OE6SP1-20050503.210336$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB899587-->"C:\WINNT\$NtUninstallKB899587$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB899588-->"C:\WINNT\$NtUninstallKB899588$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB899589-->"C:\WINNT\$NtUninstallKB899589$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB900725-->"C:\WINNT\$NtUninstallKB900725$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB901017-->"C:\WINNT\$NtUninstallKB901017$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB901214-->"C:\WINNT\$NtUninstallKB901214$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB902400-->"C:\WINNT\$NtUninstallKB902400$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB905414-->"C:\WINNT\$NtUninstallKB905414$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB905495-->"C:\WINNT\$NtUninstallKB905495-IE6SP1-20050805.184113$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB905749-->"C:\WINNT\$NtUninstallKB905749$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB905915-->"C:\WINNT\$NtUninstallKB905915-IE6SP1-20051122.175908$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB908519-->"C:\WINNT\$NtUninstallKB908519$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB908523-->"C:\WINNT\$NtUninstallKB908523$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB908531-->"C:\WINNT\$NtUninstallKB908531$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB911280-->"C:\WINNT\$NtUninstallKB911280$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB911567-->"C:\WINNT\$NtUninstallKB911567-OE6SP1-20060316.165634$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB912812-->"C:\WINNT\$NtUninstallKB912812-IE6SP1-20060322.182418$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB912919-->"C:\WINNT\$NtUninstallKB912919$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB913580-->"C:\WINNT\$NtUninstallKB913580$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB914388-->"C:\WINNT\$NtUninstallKB914388$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB914389-->"C:\WINNT\$NtUninstallKB914389$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB916281-->"C:\WINNT\$NtUninstallKB916281-IE6SP1-20060526.162249$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB917008-->"C:\WINNT\$NtUninstallKB917008$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB917159-->"C:\WINNT\$NtUninstallKB917159$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB917422-->"C:\WINNT\$NtUninstallKB917422$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB917537-->"C:\WINNT\$NtUninstallKB917537$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB917736-->"C:\WINNT\$NtUninstallKB917736$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB917953-->"C:\WINNT\$NtUninstallKB917953$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB918118-->"C:\WINNT\$NtUninstallKB918118$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB918899-->"C:\WINNT\$NtUninstallKB918899-IE6SP1-20060725.123917$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB920213-->"C:\WINNT\$NtUninstallKB920213$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB920670-->"C:\WINNT\$NtUninstallKB920670$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB920683-->"C:\WINNT\$NtUninstallKB920683$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB920685-->"C:\WINNT\$NtUninstallKB920685$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB920958-->"C:\WINNT\$NtUninstallKB920958$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB921398-->"C:\WINNT\$NtUninstallKB921398$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB921503-->"C:\WINNT\$NtUninstallKB921503$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB921883-->"C:\WINNT\$NtUninstallKB921883$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB922582-->"C:\WINNT\$NtUninstallKB922582$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB922616-->"C:\WINNT\$NtUninstallKB922616$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB922760-->"C:\WINNT\$NtUninstallKB922760-IE6SP1-20061018.120000$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB923191-->"C:\WINNT\$NtUninstallKB923191$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB923414-->"C:\WINNT\$NtUninstallKB923414$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB923561-->"C:\WINNT\$NtUninstallKB923561$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB923694-->"C:\WINNT\$NtUninstallKB923694-OE6SP1-20061106.120000$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB923810-->"C:\WINNT\$NtUninstallKB923810$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB923980-->"C:\WINNT\$NtUninstallKB923980$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB924191-->"C:\WINNT\$NtUninstallKB924191$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB924270-->"C:\WINNT\$NtUninstallKB924270$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB924667-->"C:\WINNT\$NtUninstallKB924667$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB925454-->"C:\WINNT\$NtUninstallKB925454-IE6SP1-20061116.120000$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB925486-->"C:\WINNT\$NtUninstallKB925486-IE6SP1-20060918.120000$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB925902-->"C:\WINNT\$NtUninstallKB925902$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB926122-->"C:\WINNT\$NtUninstallKB926122$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB926436-->"C:\WINNT\$NtUninstallKB926436$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB927891-->"C:\WINNT\$NtUninstallKB927891$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB928090-->"C:\WINNT\$NtUninstallKB928090-IE6SP1-20070125.120000$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB928843-->"C:\WINNT\$NtUninstallKB928843$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB929969-->"C:\WINNT\$NtUninstallKB929969-IE6SP1-20061220.120000$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB930178-->"C:\WINNT\$NtUninstallKB930178$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB931768-->"C:\WINNT\$NtUninstallKB931768-IE6SP1-20070219.120000$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB931784-->"C:\WINNT\$NtUninstallKB931784$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB932168-->"C:\WINNT\$NtUninstallKB932168$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB933566-->"C:\WINNT\$NtUninstallKB933566-IE6SP1-20070417.120000$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB933729-->"C:\WINNT\$NtUninstallKB933729$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB935839-->"C:\WINNT\$NtUninstallKB935839$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB935840-->"C:\WINNT\$NtUninstallKB935840$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB936021-->"C:\WINNT\$NtUninstallKB936021$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB937143-->"C:\WINNT\$NtUninstallKB937143-IE6SP1-20070717.120000$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB937894-->"C:\WINNT\$NtUninstallKB937894$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB938127-->"C:\WINNT\$NtUninstallKB938127-IE6SP1-20070626.120000$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB938464-->"C:\WINNT\$NtUninstallKB938464-IE6SP1-20080429.120000$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB938827-->"C:\WINNT\$NtUninstallKB938827$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB938829-->"C:\WINNT\$NtUninstallKB938829$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB939653-->"C:\WINNT\$NtUninstallKB939653-IE6SP1-20070817.120000$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB941202-->"C:\WINNT\$NtUninstallKB941202-OE6SP1-20070820.120000$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB941644-->"C:\WINNT\$NtUninstallKB941644$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB941693-->"C:\WINNT\$NtUninstallKB941693$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB942615-->"C:\WINNT\$NtUninstallKB942615-IE6SP1-20071029.120000$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB943055-->"C:\WINNT\$NtUninstallKB943055$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB943485-->"C:\WINNT\$NtUninstallKB943485$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB944338-->"C:\WINNT\$NtUninstallKB944338$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB944533-->"C:\WINNT\$NtUninstallKB944533-IE6SP1-20071210.120000$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB945553-->"C:\WINNT\$NtUninstallKB945553$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB947864-->"C:\WINNT\$NtUninstallKB947864-IE6SP1-20080215.120000$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB948590-->"C:\WINNT\$NtUninstallKB948590$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB948881-->"C:\WINNT\$NtUninstallKB948881-IE6SP1-20080313.120000$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB950749-->"C:\WINNT\$NtUninstallKB950749$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB950974-->"C:\WINNT\$NtUninstallKB950974$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB951066-->"C:\WINNT\$NtUninstallKB951066-OE6SP1-20080625.120000$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB951748-->"C:\WINNT\$NtUninstallKB951748$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB952004-->"C:\WINNT\$NtUninstallKB952004$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB952954-->"C:\WINNT\$NtUninstallKB952954$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB953838-->"C:\WINNT\$NtUninstallKB953838-IE6SP1-20080620.120000$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB953839-->"C:\WINNT\$NtUninstallKB953839$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB954211-->"C:\WINNT\$NtUninstallKB954211$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB955069-->"C:\WINNT\$NtUninstallKB955069$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB956390-->"C:\WINNT\$NtUninstallKB956390-IE6SP1-20080820.120000$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB956391-->"C:\WINNT\$NtUninstallKB956391$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB956802-->"C:\WINNT\$NtUninstallKB956802$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB956844-->"C:\WINNT\$NtUninstallKB956844$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB957095-->"C:\WINNT\$NtUninstallKB957095$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB957097-->"C:\WINNT\$NtUninstallKB957097$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB958215-->"C:\WINNT\$NtUninstallKB958215-IE6SP1-20081016.120000$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB958470-->"C:\WINNT\$NtUninstallKB958470$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB958644-->"C:\WINNT\$NtUninstallKB958644$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB958687-->"C:\WINNT\$NtUninstallKB958687$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB958690-->"C:\WINNT\$NtUninstallKB958690$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB958869-->"C:\WINNT\$NtUninstallKB958869-IE6SP1-20090818.120000$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB959426-->"C:\WINNT\$NtUninstallKB959426$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB960225-->"C:\WINNT\$NtUninstallKB960225$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB960714-->"C:\WINNT\$NtUninstallKB960714-IE6SP1-20081211.120000$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB960715-->"C:\WINNT\$NtUninstallKB960715$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB960803-->"C:\WINNT\$NtUninstallKB960803$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB960859-->"C:\WINNT\$NtUninstallKB960859$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB961371-V2-->"C:\WINNT\$NtUninstallKB961371-V2$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB961501-->"C:\WINNT\$NtUninstallKB961501$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB963027-->"C:\WINNT\$NtUninstallKB963027-IE6SP1-20090303.120000$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB967715-->"C:\WINNT\$NtUninstallKB967715$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB968537-->"C:\WINNT\$NtUninstallKB968537$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB969059-->"C:\WINNT\$NtUninstallKB969059$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB970238-->"C:\WINNT\$NtUninstallKB970238$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB971486-->"C:\WINNT\$NtUninstallKB971486$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB971557-->"C:\WINNT\$NtUninstallKB971557$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB971961-->"C:\WINNT\$NtUninstallKB971961$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB973354-->"C:\WINNT\$NtUninstallKB973354-OE6SP1-20090710.120000$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB973507-->"C:\WINNT\$NtUninstallKB973507$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB973525-->"C:\WINNT\$NtUninstallKB973525$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB973869-->"C:\WINNT\$NtUninstallKB973869$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB974455-->"C:\WINNT\$NtUninstallKB974455-IE6SP1-20090925.120000$\spuninst\spuninst.exe"
Correctif Windows 2000 - KB974571-->"C:\WINNT\$NtUninstallKB974571$\spuninst\spuninst.exe"
Digital MultiCam Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2431A4F3-B267-401E-BD8C-EB2FB27A9583}\Setup.exe" -l0x9
DivxToDVD 0.5.2-->"C:\Program Files\vso\DivxToDVD\unins000.exe"
Dream Chronicles 2-->"C:\Program Files\Dream Chronicles 2\ReflexiveArcade\unins000.exe"
DVD5R-->"C:\Program Files\InstallShield Installation Information\{0B168FED-B9EC-4DA8-AC17-9A41F284640B}\setup.exe" REMOVEALL
DX-Ball 1.09-->C:\PROGRA~1\DX-Ball\UNWISE.EXE C:\PROGRA~1\DX-Ball\INSTALL.LOG
Easy CD Creator 5 Platinum-->MsiExec.exe /I{8851E12C-0EF9-11D4-A788-009027ABA5D0}
EAX Unified-->C:\WINNT\IsUninst.exe -f"C:\Program Files\Creative\EAX Unified\Uninst.isu"
EPSON Logiciel imprimante-->C:\WINNT\system32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /r
Far Cry-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{D6DBDC2A-E72C-4284-B6AD-6B3B61B4DABC} /l1036
Fenêtre d'appareil photo Canon pour ZoomBrowser EX-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{5ADA9741-0570-4096-B5FE-1D55E57537D4}
FlashNG pour Windows-->c:\FlashNG\Uninstal.exe
GdiplusUpgrade-->MsiExec.exe /I{5421155F-B033-49DB-9B33-8F80F233D4D5}
Gestionnaire Internet-->C:\PROGRA~1\Wanadoo\uninstall.exe
Google Earth-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3DE5E7D4-7B88-403C-A3FD-2017A8240C5B}\setup.exe" -l0x9 -removeonly
Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar4.dll"
Half-Life: Blue Shift-->C:\SIERRA\BLUE-S~1\bshift\UNWISE.EXE C:\SIERRA\BLUE-S~1\bshift\install.log
Half-Life: Opposing Force-->C:\SIERRA\HALF-L~1\UNWISE.EXE C:\SIERRA\HALF-L~1\OPFOR.LOG
Hercules WebCam Station-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D208F4A7-6B73-4C2A-8B1E-8756FCBA831E}\Setup.exe" -l0x40c
Hercules Webcam-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A250D351-A07F-4D5D-AB6C-693C69B9BFAF}\Setup.exe" -l0x40c
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
HP Image Zone 3.5-->C:\Program Files\HP\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat
HP PSC & OfficeJet 3.5-->"C:\Program Files\HP\Digital Imaging\{0FABD3D7-3036-4e78-B29D-58957ADB0A12}\setup\hpzscr01.exe" -datfile hposcr03.dat
HP Software Update-->MsiExec.exe /X{15EE79F4-4ED1-4267-9B0F-351009325D7D}
Infinite Patience v2.2-->"C:\WINNT\UNISTB32.EXE" /U "C:\Games\Patience\UNINST0.000" "C:\Games\Patience\UNINST1.000"
Internet Explorer Q903235-->C:\WINNT\ieuninst.exe C:\WINNT\INF\Q903235.inf
J2SE Runtime Environment 5.0-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150000}
Java 2 Runtime Environment, SE v1.4.2-->MsiExec.exe /I{7148F0A8-6813-11D6-A77B-00B0D0142000}
Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java(TM) SE Runtime Environment 6 Update 1-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
Kikoo-->C:\Program Files\Kikoo\Uninstal.exe
LimeWire 5.1.3-->"C:\Program Files\LimeWire\uninstall.exe"
livebox-->C:\Program Files\InstallShield Installation Information\{17342E3B-0818-4A6F-BFF8-99476605ADD6}\Setup.exe -runfromtemp -l0x040c -removeonly
Macrogaming SweetIM 2.0-->MsiExec.exe /X{D9BBFA60-4514-4F08-A78F-91957F957495}
Memories Disc Creator 2.0-->MsiExec.exe /X{2E132061-C78A-48D4-A899-1D13B9D189FA}
Messenger Plus! 3-->"C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /Remove
Micro Application - Architecte 3D Classic-->C:\WINNT\IsUn040c.exe -f"C:\Program Files\Micro Application\Architecte 3D Classic\Uninst.isu"
Micrografx Windows Draw 6 LE-->C:\WINNT\MGXCLEAN.EXE DRAWLE.APP FONTS.APP
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINNT\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINNT\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1 Security Update (KB971108)-->"C:\WINNT\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINNT\Microsoft.NET\Framework\v1.1.4322\Updates\M971108\M971108Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Casino-->"C:\Program Files\Microsoft Games\Microsoft Casino\UNINSTAL.EXE" /runtemp /addremove
Microsoft Midtown Madness 2-->"C:\Program Files\Microsoft Games\Midtown Madness 2\UNINSTAL.EXE" /runtemp /addremove
Microsoft Motocross Madness 2-->"C:\Program Files\Microsoft Games\Motocross Madness 2\Uninstal.exe" /runtemp /addremove
Microsoft Motocross Madness-->"E:\Program Files\Microsoft Games\Motocross Madness\Uninstal.exe" /runtemp
Microsoft Office XP Professional-->MsiExec.exe /I{9011040C-6000-11D3-8CFE-0050048383C9}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Works 2000-->MsiExec.exe /I{A3088CD2-612B-11D3-AF43-00C04F443448}
Mise à jour de sécurité for DirectX 9 (KB941568)-->"C:\WINNT\$NtUninstallKB941568_DX9$\spuninst\spuninst.exe"
Mise à jour de sécurité for DirectX 9 (KB951698)-->"C:\WINNT\$NtUninstallKB951698_DX9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour DirectX 9.0 (KB971633)-->"C:\WINNT\$NtUninstallKB971633_DX9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour DirectX 9.0b (KB961373)-->"C:\WINNT\$NtUninstallKB961373_DX9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour le Codeur Windows Media (KB954156)-->"C:\WINNT\$NtUninstallKB954156_WM9L$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB911564)-->"C:\WINNT\$NtUninstallKB911564$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINNT\$NtUninstallKB952069_WM71$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB954155)-->"C:\WINNT\$NtUninstallKB954155_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB968816)-->"C:\WINNT\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB975025)-->"C:\WINNT\$NtUninstallKB975025_WM8$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 6.4 (KB925398)-->"C:\WINNT\$NtUninstallKB925398_WMP64$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 6.4 (KB954600)-->"C:\WINNT\$NtUninstallKB954600_WM41$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 6.4 (KB974112)-->"C:\WINNT\$NtUninstallKB974112_WM41$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 9 (KB911565)-->"C:\WINNT\$NtUninstallKB911565$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 9 (KB917734)-->"C:\WINNT\$NtUninstallKB917734_WMP9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 9 (KB936782)-->"C:\WINNT\$NtUninstallKB936782_WMP9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 9 (KB973540)-->"C:\WINNT\$NtUninstallKB973540_WM9L$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows 2000 (KB904706)-->"C:\WINNT\$NtUninstallKB904706$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows 2000 (KB923689)-->"C:\WINNT\$NtUninstallKB923689$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows 2000 (KB941569)-->"C:\WINNT\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour système du Lecteur Windows Media (Série 9)-->C:\PROGRA~1\WINDOW~2\setup_wm.exe /Uninstall
Moto Racer-->C:\WINNT\unin040c.exe -f"C:\Program Files\MotoRacer\DeIsL1.isu"
MOX PC 1.0 (Fr)-->"C:\Program Files\MOX PC\unins000.exe"
Mozilla Firefox (2.0.0.4)-->C:\Program Files\Nomad-Agri\firefox\uninstall\helper.exe
Mozilla Firefox (3.0.15)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSN Messenger 7.0-->MsiExec.exe /I{ABEB838C-A1A7-4C5D-B7E1-8B4314600820}
MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
Navigateur Orange-->C:\PROGRA~1\Wanadoo\Shell.exe inst\uninst_FTBrowser.shl
Need For Speed poursuite infernale 2-->C:\Program Files\EA Games\Need For Speed poursuite infernale 2\EAUninstall.exe
Nero Suite-->C:\Program Files\Fichiers communs\Ahead\Uninstall\setup.exe /uninstall
Nomad-Agri-->C:\Program Files\Nomad-Agri\uninstall.exe
NoSpam 0.5.32-->"C:\Program Files\StofWare\NoSpam\unins000.exe"
NVIDIA Drivers-->C:\WINNT\system32\nvudisp.exe UninstallGUI
OmniPage Pro 9.0-->C:\Program Files\Caere\OmniPagePro90\Deinstall.exe "C:\Program Files\Caere\OmniPagePro90\uninstall.exe -f'C:\Program Files\Caere\OmniPagePro90\DeIsL1.isu'"
Outil de connexion Wanadoo-->C:\PROGRA~1\Wanadoo\MessageDesinstallation.exe Wanadoo
overland-->MsiExec.exe /I{766273C1-A39B-47EB-ACE8-DEBDD8094BCC}
P2P Networking-->C:\WINNT\system32\P2P Networking\P2P Networking.exe /UNINSTALL
PC Inspector File Recovery-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0DD140D3-9563-481E-AA75-BA457CBDAEF2}\Setup.exe" -l0x40c
PowerArchiver-->C:\Program Files\PowerArchiver\UNINST.EXE
PowerISO-->"E:\Power ISO 3\PowerISO\uninstall.exe"
QSuite 1.0-->"C:\Program Files\QSuite\unins000.exe"
Quick Zip 4.60.016-->"C:\Program Files\QuickZip4\unins000.exe"
QuickTime-->C:\WINNT\unvise32qt.exe C:\WINNT\system32\QuickTime\Uninstall.log
rayman2-->C:\WINNT\UbiSoft\SetupUbi.exe -uninstall rayman2
Realtek AC'97 Audio-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" REMOVE
Scan Manager 5.2-->MsiExec.exe /I{E0A1559B-9886-11D4-8D06-0050DA284A39}
SIM editor 4.0-->C:\Program Files\SIM editor\uninst.exe
SimTractor 3.51 Machinery Addons I-->MsiExec.exe /I{C2274406-8C1F-4E31-885C-7E4BDCE11FBB}
SiS 900 PCI Fast Ethernet Adapter Driver-->C:\Progra~1\SiSLan\Uninst.exe
Spybot - Search & Destroy 1.4-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
SweetIM For Internet Explorer 3.0b-->MsiExec.exe /X{F6D63A65-BD23-46F3-B9A3-87

voici le 2eme rapport

Run by Administrateur at 2009-12-07 12:24:50
Microsoft Windows 2000 Professionnel Service Pack 4
System drive C: has 13 GB (34%) free of 39 GB
Total RAM: 1023 MB (65% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:24:53, on 07/12/2009
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\FTRTSVC.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\HPZipm12.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Nomad-Agri\apache2\bin\Apache.exe
C:\Program Files\Nomad-Agri\mysql\bin\mysqld-nt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\faxsvc.exe
C:\Program Files\Nomad-Agri\apache2\bin\Apache.exe
C:\WINNT\Explorer.EXE
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\WINNT\system32\ctfmon.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\richtx64.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINNT\system32\wuauclt.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\Wanadoo\GestionnaireInternet.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINNT\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Wanadoo\Watch.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrateur\Bureau\RSIT.exe
C:\Program Files\trend micro\Administrateur.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yoower.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [richtx64.exe] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\richtx64.exe
O4 - HKCU\..\Run: [AntiMalware] "C:\Program Files\AntiMalware\antimalware.exe" -noscan
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINNT\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINNT\bdoscandel.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-18.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6DB731A3-B074-4118-8B1C-32511C65D836} (FotovistaPhotoUploader.ctrFpu) - http://www.mypixmania.com/fr/fr/tools/activex/fpu.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.girafoto.fr/uploaders/ImageUploader3.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.5.0) - https://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINNT\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: wampapache - Apache Software Foundation - C:\Program Files\Nomad-Agri\apache2\bin\Apache.exe
O23 - Service: wampmysqld - Unknown owner - C:\Program Files\Nomad-Agri\mysql\bin\mysqld-nt.exe

--
End of file - 9800 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Aide pour le lien d'Adobe PDF Reader - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A}]
SWEETIE Class - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll [2006-11-05 548992]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2005-05-31 853672]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{724d43a9-0d85-11d4-9908-00400523e39a}]
C:\Program Files\Siber Systems\AI RoboForm\roboform.dll [2007-08-11 5645104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll [2008-02-22 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - c:\program files\google\googletoolbar4.dll [2007-01-19 2436160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E718888-423F-11D2-876E-00A0C9082467} - &Radio - C:\WINNT\System32\msdxm.ocx [2005-06-03 848656]
{724d43a0-0d85-11d4-9908-00400523e39a} - &RoboForm - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll [2007-08-11 5645104]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar4.dll [2007-01-19 2436160]
{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - SweetIM For Internet Explorer - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll [2006-11-05 548992]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINNT\system32\NvCpl.dll [2004-07-15 4112384]
"Synchronization Manager"=mobsync.exe /logon []
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2004-04-30 77824]
"MessengerPlus3"=C:\Program Files\MessengerPlus! 3\MsgPlus.exe [2008-04-28 190024]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2009-10-03 39792]
"Adobe ARM"=C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MessengerPlus3"=C:\Program Files\MessengerPlus! 3\MsgPlus.exe [2008-04-28 190024]
"ctfmon.exe"=C:\WINNT\system32\ctfmon.exe [2001-02-20 8192]
"richtx64.exe"=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\richtx64.exe [2009-12-05 1187840]
"AntiMalware"=C:\Program Files\AntiMalware\antimalware.exe -noscan []
"msnmsgr"=C:\Program Files\MSN Messenger\msnmsgr.exe [2007-09-04 6856704]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe [2002-07-31 684032]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CreateCD50]
C:\Program Files\Fichiers communs\Adaptec Shared\CreateCD\CreateCD50.exe [2002-07-31 131157]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINNT\system32\ctfmon.exe [2001-02-20 8192]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [2003-12-22 241664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\HP\HP Software Update\HPWuSchd.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\internat.exe]
C:\WINNT\system32\internat.exe [2000-08-09 20752]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\m6]
C:\Program Files\M6 Video\M6video.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msbb]
C:\PROGRA~1\KAZAAS~1\msbb.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
C:\WINNT\system32\NvCpl.dll [2004-07-15 4112384]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
C:\WINNT\system32\NvMcTray.dll [2004-07-15 81920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P2P Networking]
C:\WINNT\system32\P2P Networking\P2P Networking.exe /AUTOSTART []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
E:\Power ISO 3\PowerISO\PWRISOVM.EXE [2006-03-18 184320]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe [2004-04-30 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\slenehwr]
C:\WINNT\slenehwr.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
C:\WINNT\SOUNDMAN.EXE [2003-05-14 55296]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Synchronization Manager]
mobsync.exe /logon []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\webHancer Agent]
C:\Program Files\webHancer\Programs\whAgent.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\webHancer Survey Companion]
C:\Program Files\webHancer\Programs\whSurvey.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Contrôleur de calendrier Ulead.lnk]
C:\PROGRA~1\ULEADS~1\ULEADP~1.0SE\CalCheck.exe [2002-05-03 69632]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
C:\PROGRA~1\HP\DIGITA~1\bin\hpqtra08.exe [2003-09-16 237568]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
C:\PROGRA~1\MICROS~2\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Rappels du Calendrier Microsoft Works.lnk]
C:\PROGRA~1\FICHIE~1\MICROS~1\WORKSS~1\wkcalrem.exe [1999-08-06 53317]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SYMTDI]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=95000000

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======List of files/folders created in the last 1 months======

2009-12-07 08:48:17 ----D---- C:\Program Files\trend micro
2009-12-07 08:48:16 ----D---- C:\rsit
2009-12-05 20:54:32 ----D---- C:\Program Files\AntiMalware

======List of files/folders modified in the last 1 months======

2009-12-07 12:21:13 ----AD---- C:\Program Files\Wanadoo
2009-12-07 08:48:17 ----AD---- C:\WINNT\system32
2009-12-07 08:48:17 ----AD---- C:\Program Files
2009-12-07 08:27:30 ----AD---- C:\WINNT\Temp
2009-12-07 08:20:10 ----AD---- C:\WINNT\security
2009-12-07 08:14:34 ----D---- C:\WINNT\system32\NtmsData
2009-12-07 08:14:33 ----AD---- C:\WINNT\Debug
2009-12-07 08:14:06 ----A---- C:\WINNT\ModemLog_AMI-CW52 V.92 PCI Modem.txt
2009-12-06 18:51:54 ----A---- C:\WINNT\SchedLgU.Txt
2009-12-06 13:33:49 ----D---- C:\Program Files\AntiVir PersonalEdition Classic
2009-12-06 13:33:48 ----AD---- C:\Documents and Settings\All Users\Application Data\AntiVir PersonalEdition Classic
2009-12-06 09:59:07 ----D---- C:\Program Files\Mozilla Firefox
2009-12-06 09:50:12 ----AD---- C:\WINNT\Help
2009-12-02 15:45:18 ----AD---- C:\WINNT
2009-12-02 15:45:17 ----SHD---- C:\WINNT\Installer
2009-12-02 15:38:21 ----D---- C:\Documents and Settings
2009-11-16 13:25:33 ----A---- C:\WINNT\MSVCR71.DLL
2009-11-16 13:25:33 ----A---- C:\WINNT\MFC71.DLL
2009-11-12 03:54:08 ----HD---- C:\WINNT\inf

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AFS2K;AFS2k; C:\WINNT\system32\drivers\AFS2K.sys [2006-02-03 43672]
R1 avgio;avgio; \??\C:\Program Files\AntiVir PersonalEdition Classic\avgio.sys []
R1 avipbb;avipbb; C:\WINNT\system32\DRIVERS\avipbb.sys [2009-05-27 75096]
R1 Cdr4_2K;Cdr4_2K; C:\WINNT\system32\drivers\Cdr4_2K.sys [2004-06-04 58000]
R1 Cdralw2k;Cdralw2k; C:\WINNT\system32\drivers\Cdralw2k.sys [2004-06-04 23420]
R1 cdudf;cdudf; C:\WINNT\system32\drivers\cdudf.sys [2002-07-31 362083]
R1 prodrv06;StarForce Protection Environment Driver v6; C:\WINNT\System32\drivers\prodrv06.sys [2003-10-10 52128]
R1 pwd_2k;pwd_2k; C:\WINNT\system32\drivers\pwd_2k.sys [2002-07-31 132058]
R1 SCDEmu;SCDEmu; C:\WINNT\system32\drivers\SCDEmu.sys [2006-03-18 26844]
R1 ssmdrv;ssmdrv; C:\WINNT\system32\DRIVERS\ssmdrv.sys [2007-03-01 28352]
R1 UdfReadr;UdfReadr; C:\WINNT\system32\drivers\UdfReadr.sys [2002-07-31 227266]
R2 enodpl;enodpl; C:\WINNT\System32\drivers\enodpl.sys [2003-03-02 7552]
R2 Fallback;Fallback; C:\WINNT\System32\DRIVERS\fallback.sys [2001-05-01 310835]
R2 Fsks;Fsks; C:\WINNT\System32\DRIVERS\fsksnt.sys [2001-05-01 127341]
R2 K56;K56; C:\WINNT\System32\DRIVERS\k56nt.sys [2001-05-01 426271]
R2 Secdrv;Secdrv; \??\C:\WINNT\System32\drivers\SECDRV.SYS []
R2 SoftFax;SoftFax; C:\WINNT\System32\DRIVERS\faxnt.sys [2001-05-01 216955]
R2 tandpl;tandpl; C:\WINNT\System32\drivers\tandpl.sys [2003-04-19 4736]
R2 Tones;Tones; C:\WINNT\System32\DRIVERS\tonesnt.sys [2001-05-01 56575]
R2 V124;V124; C:\WINNT\System32\DRIVERS\v124nt.sys [2001-05-24 533613]
R3 Afc;PPdus ASPI Shell; C:\WINNT\system32\drivers\Afc.sys [2005-02-23 11776]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINNT\system32\drivers\ALCXWDM.SYS [2003-05-14 740044]
R3 avgntflt;avgntflt; \??\C:\Program Files\AntiVir PersonalEdition Classic\avgntflt.sys []
R3 basic2;basic2; C:\WINNT\System32\DRIVERS\basic2.sys [2001-05-23 76914]
R3 dvd_2K;dvd_2K; C:\WINNT\system32\drivers\dvd_2K.sys [2002-07-31 25578]
R3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINNT\system32\DRIVERS\HPZid412.sys [2004-01-05 51056]
R3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINNT\system32\DRIVERS\HPZipr12.sys [2004-01-05 16496]
R3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINNT\system32\DRIVERS\HPZius12.sys [2004-01-05 21488]
R3 mmc_2K;mmc_2K; C:\WINNT\system32\drivers\mmc_2K.sys [2002-07-31 30246]
R3 MODEMCSA;Périphérique de filtrage de flux Unimodem; C:\WINNT\system32\drivers\MODEMCSA.sys [1999-09-25 16144]
R3 ms_mpu401;Pilote UART MIDI MPU-401 Microsoft; C:\WINNT\system32\drivers\msmpu401.sys [1999-09-25 2832]
R3 nv;nv; C:\WINNT\System32\DRIVERS\nv4_mini.sys [2004-07-15 2459712]
R3 openhci;Pilote de contrôleur hôte ouvert USB Microsoft; C:\WINNT\System32\DRIVERS\openhci.sys [2003-06-19 24784]
R3 PCANDIS5;PCANDIS5 NDIS Protocol Driver; \??\C:\WINNT\system32\PCANDIS5.SYS []
R3 Rksample;Rksample; C:\WINNT\System32\DRIVERS\rksample.sys [2001-05-23 68374]
R3 SISNIC;SiS PCI Fast Ethernet Adapter Driver; C:\WINNT\System32\DRIVERS\sisnic.sys [2002-08-02 35427]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINNT\System32\DRIVERS\usbehci.sys [2003-06-19 19728]
R3 usbhub;Pilote de concentrateur standard USB Microsoft; C:\WINNT\System32\DRIVERS\usbhub.sys [2003-06-19 40176]
R3 usbhub20;USB 2.0 Root Hub Support; C:\WINNT\System32\DRIVERS\usbhub20.sys [2003-06-19 49776]
R3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINNT\System32\DRIVERS\usbprint.sys [2003-06-19 21872]
R3 usbscan;Pilote de scanneur USB; C:\WINNT\System32\DRIVERS\usbscan.sys [2003-06-19 12592]
R3 USBSTOR;Pilote de stockage de masse USB; C:\WINNT\System32\DRIVERS\USBSTOR.SYS [2003-06-19 21552]
R3 winachsf;winachsf; C:\WINNT\System32\DRIVERS\HSF_CNXT.sys [2001-05-23 583744]
S2 HidUsb;Pilote de classe HID Microsoft; C:\WINNT\System32\DRIVERS\hidusb.sys [1999-10-04 13904]
S3 aaudstum;aaudstum; \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\aaudstum.sys []
S3 CCDECODE;Closed Caption Decoder; C:\WINNT\System32\DRIVERS\CCDECODE.sys [2004-07-09 16384]
S3 CnxEtP;ZTE ZXDSL852 Adapter Filter Driver; C:\WINNT\system32\DRIVERS\CnxEtP.sys [2005-05-20 131072]
S3 CnxEtU;ZTE ZXDSL852 Interface Device Driver; C:\WINNT\system32\DRIVERS\CnxEtU.sys [2005-05-20 618112]
S3 CnxTgNW;ZTE ZXDSL852 WAN PPPoA Adapter Driver; C:\WINNT\system32\DRIVERS\CnxTgNW.sys [2005-05-20 52736]
S3 foghorn;Compatible Windows Sound System (WDM); C:\WINNT\system32\drivers\foghorn.sys [1999-10-06 21008]
S3 GMSIPCI;GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS []
S3 hidgame;Activateur de port HID à manette de jeu Microsoft; C:\WINNT\System32\DRIVERS\hidgame.sys [1999-10-21 8720]
S3 moufiltr;Mouse Filter Driver; C:\WINNT\system32\DRIVERS\moufiltr.sys [2005-03-21 62592]
S3 mouhid;Pilote HID de souris; C:\WINNT\System32\DRIVERS\mouhid.sys [2003-06-19 11824]
S3 MPE;BDA MPE Filter; C:\WINNT\System32\DRIVERS\MPE.sys [2004-07-09 15104]
S3 msgame;Activateur de port HID à manette de jeu Sidewinder; C:\WINNT\System32\DRIVERS\msgame.sys [1999-10-26 35440]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINNT\system32\drivers\MSTEE.sys [2002-12-12 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINNT\System32\DRIVERS\NABTSFEC.sys [2004-07-09 83968]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINNT\system32\DRIVERS\NdisIP.sys [2004-07-09 10112]
S3 NTACCESS;NTACCESS; \??\D:\NTACCESS.sys []
S3 ovt530;Webcam Deluxe; C:\WINNT\System32\Drivers\ov530vid.sys [2005-03-15 161792]
S3 PCAMPR5;PCAMPR5 NDIS Protocol Driver; \??\C:\WINNT\system32\PCAMPR5.SYS []
S3 SANDRA;SANDRA; \??\C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR3\Sandra.sys []
S3 SetupNTGLM7X;SetupNTGLM7X; \??\D:\NTGLM7X.sys []
S3 SLIP;BDA Slip De-Framer; C:\WINNT\System32\DRIVERS\SLIP.sys [2004-07-09 10880]
S3 streamip;BDA IPSink; C:\WINNT\System32\DRIVERS\StreamIP.sys [2004-07-09 14976]
S3 usbaudio;Pilote USB audio (WDM); C:\WINNT\system32\drivers\usbaudio.sys [1999-10-12 68912]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINNT\System32\DRIVERS\WSTCODEC.SYS [2004-07-09 18688]
S4 IntelIde;IntelIde; C:\WINNT\system32\drivers\IntelIde.sys []
S4 WS2IFSL;Environnement de prise en charge de Fournisseur de services non-IFS Windows Sockets 2.0; C:\WINNT\System32\drivers\ws2ifsl.sys [2000-08-09 12016]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirScheduler;AntiVir PersonalEdition Classic Scheduler; C:\Program Files\AntiVir PersonalEdition Classic\sched.exe [2008-10-23 68865]
R2 AntiVirService;AntiVir PersonalEdition Classic Guard; C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe [2008-10-23 151297]
R2 FTRTSVC;France Telecom Routing Table Service; C:\WINNT\System32\FTRTSVC.exe [2004-08-23 40960]
R2 MDM;Machine Debug Manager; C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe [2001-02-23 270336]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINNT\system32\nvsvc32.exe [2004-07-15 114755]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINNT\system32\HPZipm12.exe [2004-01-05 65795]
R2 StiSvc;Still Image Service; C:\WINNT\system32\stisvc.exe [2003-06-19 62224]
R2 wampapache;wampapache; C:\Program Files\Nomad-Agri\apache2\bin\Apache.exe [2006-07-27 20541]
R2 wampmysqld;wampmysqld; C:\Program Files\Nomad-Agri\mysql\bin\mysqld-nt.exe [2006-10-22 4493312]
S3 aspnet_state;Service d'état ASP.NET; C:\WINNT\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-15 32768]
S3 Boonty Games;Boonty Games; C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe [2008-03-21 69120]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-26 138168]
S3 WmdmPmSN;Service de numéro de série du lecteur multimédia portable; C:\WINNT\System32\svchost.exe [2000-08-09 7952]

-----------------EOF-----------------

Configuration: Windows 2000 Internet Explorer 6.0

Afficher la suite

A voir également

Malware indesirable
Malwarebytes anti-malware - Télécharger - Antivirus & Antimalwares
Courrier indésirable - Accueil - Mail
Supprimer malware - Guide
Malware cleaner - Télécharger - Antivirus & Antimalwares
Onestart malware ✓ - Forum Navigateur

19 réponses

Résumé de la discussion

Une personne signale une nuisance récurrente d'un anti-malware et transmet deux rapports RSIT et HijackThis détaillant de nombreuses entrées d'installation et de suppression sous Windows 2000. Les rapports listent des programmes à désinstaller et des entrées système, avec des chemins problématiques et des composants suspects comme SweetIM et des BHO, sur un Windows 2000 SP4. D'autres éléments évoquent des outils d'installation et des barres d'outils, des plugins et des pilotes, reflétant une contamination complexe multi-logicielle. En cas de contexte, le fil date de 2009 et montre l'utilisation d'outils d'analyse sur Windows 2000 SP4, avec des éléments liés à Wanadoo et à des applications obsolètes.

Réponse 1 / 19
moment de grace Contributeur sécurité
un classique !

en fait il sert à supprimer tous les outils utilisés ainsi que les dossiers rapport sur C

tu es donc de corvée à le faire toi même à la main

gardes MalwareByte's à passer de temps à autre, le reste poubelle

1

Réagir
1. bugs35
  
  ben , je vais m'y coller a la main ...
  il me reste a te dire MERCI encore et encore, quelle patience et quelle ténacité.....comme tu le dis si bien , tu cherches , et tu trouves !!!
  cordialement
  philippe
  
  0
  
  Réagir
Réponse 2 / 19
moment de grace Contributeur sécurité
win 2000 !

laisses, cela n'a pas de conséquences pour ton pc

Cherches et cliques sur C:\Program Files\trend micro\Administrateur.exe
Au menu principal, choisir do a scan only, puis cocher la case devant les lignes suivantes à corriger et cliquer en bas sur Fix Checked
R3 - URLSearchHook: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User 'Default user')

……………………………………………………

▶---> Télécharge ToolsCleaner2sur ton Bureau. (si compatible 2000)
https://www.commentcamarche.net/telecharger/securite/22061-toolscleaner/

* Double-clique (clic droit "en tant qu'administrateur" pour Vista) sur ToolsCleaner2.exe pour le lancer.
* Clique sur Recherche et laisse le scan agir.
* Clique sur Suppression pour finaliser.
* Tu peux, si tu le souhaites, te servir des Options Facultatives.
* Clique sur Quitter pour obtenir le rapport.
* Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

………………………………………………..

Mettre à jour internet explorer

https://support.microsoft.com/fr-fr/allproducts

……………………………………………….

Si tout est ok

tu peux mettre le topic en resolu
https://www.commentcamarche.net/infos/25917-marquer-un-fil-de-discussion-comme-etant-resolu/

Bonne continuation et surtout , prudence et bon surf :)

0

Réagir
1. bugs35
  
  evidement tool...ne demarre pas...
  
  0
  
  Réagir
Réponse 3 / 19
moment de grace Contributeur sécurité
quelques petites choses à suppprimer

(j'espère compatible 2000)

▶ Télécharge OTM (OldTimer) sur ton Bureau :
http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/
▶ Double-clique sur OTM.exe afin de le lancer.
▶ Copie (Ctrl+C) le texte suivant ci-dessous :

:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe
web mess.exe

:Reg
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P2P Networking]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\slenehwr]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\webHancer Agent]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\webHancer Survey Companion]

:files

:commands
[emptytemp]
[start explorer]
[reboot]

▶ Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.
▶ Clique maintenant sur le bouton MoveIt! puis ferme OTM
Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.

▶ Poste le rapport situé dans ce dossier : C:\_OTM\MovedFiles\

*Le nom du rapport correspond au moment de sa création : date_heure.log

0

Réagir
1. bugs35
  
  je viens d'essayer OTM, mais il ne veux pas démarrer....
  
  0
  
  Réagir
Réponse 4 / 19
moment de grace Contributeur sécurité
ok pas de script

repasses MalwareByte' en complet, qu'il efface les dernières petites cochonneries et postes moi le rapport stp

ensuite (demain) je te préparerai le nettoyage final

0

Réagir
1. bugs35
  
  je crois que l'on tient le bon bout !!!
  
  Malwarebytes' Anti-Malware 1.42
  Version de la base de données: 3328
  Windows 5.0.2195 Service Pack 4
  Internet Explorer 6.0.2800.1106
  
  16/12/2009 15:38:58
  mbam-log-2009-12-16 (15-38-58).txt
  
  Type de recherche: Examen complet (C:\|E:\|)
  Eléments examinés: 207845
  Temps écoulé: 4 hour(s), 13 minute(s), 56 second(s)
  
  Processus mémoire infecté(s): 0
  Module(s) mémoire infecté(s): 0
  Clé(s) du Registre infectée(s): 0
  Valeur(s) du Registre infectée(s): 0
  Elément(s) de données du Registre infecté(s): 0
  Dossier(s) infecté(s): 0
  Fichier(s) infecté(s): 0
  
  Processus mémoire infecté(s):
  (Aucun élément nuisible détecté)
  
  Module(s) mémoire infecté(s):
  (Aucun élément nuisible détecté)
  
  Clé(s) du Registre infectée(s):
  (Aucun élément nuisible détecté)
  
  Valeur(s) du Registre infectée(s):
  (Aucun élément nuisible détecté)
  
  Elément(s) de données du Registre infecté(s):
  (Aucun élément nuisible détecté)
  
  Dossier(s) infecté(s):
  (Aucun élément nuisible détecté)
  
  Fichier(s) infecté(s):
  (Aucun élément nuisible détecté)
  
  0
  
  Réagir
Vous n’avez pas trouvé la réponse que vous recherchez ?

La communauté CCM répond en moyenne en moins de 2h.

Posez votre question
Réponse 5 / 19
moment de grace Contributeur sécurité
je te prépare dès que possible la fin...

j"attends une validation de script, je te tiens au courant

0

Réagir
Réponse 6 / 19
moment de grace Contributeur sécurité
comment va le pc ?

0

Réagir
1. bugs35
  
  bonsoir,
  et bien; a priori il va tres bien ,je n'ai plus de fenetres intempestives, et tout marche bien , a part une lenteur pour visionner les vidéos style youtube( videos saccadées), ce que je n'avais pas il y a 6 mois.
  quels sont les programmes de nettoyage que je dois conserver et ceux que je dois effacer?
  j'utilise Antivir (gratuit) dois-je changer?quelles sont les protections a mettre en place pour ne plus etre emm...?
  voila plein de questions .....
  cordialement
  
  0
  
  Réagir
Réponse 7 / 19
moment de grace Contributeur sécurité
peux tu faire un nouveau RSIT et poster le rapport log stp

0

Réagir
1. bugs35
  
  voila ,voila!!!
  
  Logfile of random's system information tool 1.06 (written by random/random)
  Run by Administrateur at 2009-12-15 16:18:58
  Microsoft Windows 2000 Professionnel Service Pack 4
  System drive C: has 14 GB (35%) free of 39 GB
  Total RAM: 1023 MB (69% free)
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 16:19:08, on 15/12/2009
  Platform: Windows 2000 SP4 (WinNT 5.00.2195)
  MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
  Boot mode: Normal
  
  Running processes:
  C:\WINNT\System32\smss.exe
  C:\WINNT\system32\winlogon.exe
  C:\WINNT\system32\services.exe
  C:\WINNT\system32\lsass.exe
  C:\WINNT\system32\svchost.exe
  C:\WINNT\system32\spoolsv.exe
  C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
  C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
  C:\WINNT\System32\svchost.exe
  C:\WINNT\System32\FTRTSVC.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
  C:\WINNT\system32\nvsvc32.exe
  C:\WINNT\system32\HPZipm12.exe
  C:\WINNT\system32\regsvc.exe
  C:\WINNT\system32\MSTask.exe
  C:\WINNT\system32\stisvc.exe
  C:\Program Files\Nomad-Agri\apache2\bin\Apache.exe
  C:\WINNT\Explorer.EXE
  C:\Program Files\Nomad-Agri\mysql\bin\mysqld-nt.exe
  C:\WINNT\System32\WBEM\WinMgmt.exe
  C:\WINNT\system32\svchost.exe
  C:\WINNT\system32\faxsvc.exe
  C:\Program Files\MessengerPlus! 3\MsgPlus.exe
  C:\WINNT\system32\ctfmon.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\Program Files\Nomad-Agri\apache2\bin\Apache.exe
  C:\WINNT\System32\svchost.exe
  C:\WINNT\system32\wuauclt.exe
  C:\Program Files\Microsoft Office\Office10\EXCEL.EXE
  C:\Documents and Settings\Administrateur\Bureau\RSIT.exe
  C:\Program Files\trend micro\Administrateur.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://webmail1e.orange.fr/webmail/fr_FR/inbox.html?FromSubmit=true&dub=1
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yoower.com/
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  R3 - URLSearchHook: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
  R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
  O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
  O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
  O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
  O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
  O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')
  O4 - HKUS\.DEFAULT\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User 'Default user')
  O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
  O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
  O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
  O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
  O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
  O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
  O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
  O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
  O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
  O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINNT\bdoscandel.exe
  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINNT\bdoscandel.exe
  O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
  O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
  O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
  O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
  O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-18.cab
  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
  O16 - DPF: {6DB731A3-B074-4118-8B1C-32511C65D836} (FotovistaPhotoUploader.ctrFpu) - http://www.mypixmania.com/fr/fr/tools/activex/fpu.cab
  O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.girafoto.fr/uploaders/ImageUploader3.cab
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.5.0) - https://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
  O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
  O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
  O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
  O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
  O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINNT\System32\FTRTSVC.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
  O23 - Service: wampapache - Apache Software Foundation - C:\Program Files\Nomad-Agri\apache2\bin\Apache.exe
  O23 - Service: wampmysqld - Unknown owner - C:\Program Files\Nomad-Agri\mysql\bin\mysqld-nt.exe
  
  0
  
  Réagir
Réponse 8 / 19
moment de grace Contributeur sécurité
▶ Téléchargez Dr.Web CureIt! sur ton Bureau : (WIN2000 ??)
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

▶ Double-cliquez sur drweb-cureit.exe et cliquez sur Commencer le scan.
▶ Ce scan rapide permet l'analyse des processus chargés en mémoire; s'il trouve des processus infectés, cliquez sur le bouton Oui pour Tout à l'invite.
▶ Lorsque le scan rapide est terminé, cliquez sur Options > Changer la configuration.
▶ Choisissez l'onglet Scanner, et décochez Analyse heuristique.
▶ De retour à la fenêtre principale : choisissez Analyse complète.
▶ Cliquez la flèche verte sur la droite et le scan débutera. Une publicité apparaît quelquefois, fermez-la.
▶ Cliquez Oui pour Tout si un fichier est détecté.
▶ A la fin du scan, si des infections sont trouvées, cliquez sur Tout sélectionner, puis sur Désinfecter. Si la désinfection est impossible, cliquez sur Quarantaine.
▶ Au menu principal de l'outil, en haut à gauche, cliquez sur le menu Fichier et choisissez Enregistrer le rapport.
▶ Sauvegardez le rapport sur votre Bureau. Ce dernier se nommera DrWeb.csv.
▶ Fermez Dr.Web CureIt!
▶ Redémarrez votre ordinateur (très important) car certains fichiers peuvent être déplacés/réparés au redémarrage.
▶ Postez (Copiez/Collez) le contenu du rapport de l'outil Dr.Web dans un bloc note

Ensuite :

▶ Rendez-vous à cette adresse d'hébergement gratuit : http://www.cijoint.fr/
▶ Cliquez sur parcourir, chercher rapport DrWeb.txt puis sur cliquez ici pour déposer le fichier
▶ Une fois le lien crée, faite un clique droit dessus et copier l'adresse du lien pour venir le coller dans votre réponse

0

Réagir
1. bugs35
  
  bonjour , voici le lien...http://www.cijoint.fr/cjlink.php?file=cj200912/cijeiSstHO.txt
  
  cordialement
  
  0
  
  Réagir
Réponse 9 / 19
moment de grace Contributeur sécurité
(soupir...)

il va bien falloir qu'on y arrive

/!\ Il faut impérativement désactiver tous tes logiciels de protection pour utiliser ce programme/!\

▶ Télécharge : Gmer (by Przemyslaw Gmerek)

http://www.gmer.net/

▶ Dezippe gmer ,cliques sur l'onglet rootkit,lances le scan,des lignes rouges vont apparaitre.

▶ Les lignes rouges indiquent la presence d'un rootkit.Postes moi le rapport gmer (cliques sur copy,puis vas dans demarrer ,puis ouvres le bloc note,vas dans edition et cliques sur coller,le rapport gmer va apparaitre,postes moi le)

Ensuite

▶ sur les lignes rouge:

▶ Services:cliques droit delete service
▶ Process:cliques droit kill process
▶ Adl ,file:cliques droit delete files

0

Réagir
1. bugs35
  
  dur!dur!!, GMER a travaillé mais pas de lignes rouges , voici le rapport
  
  GMER 1.0.15.15273 - http://www.gmer.net
  Rootkit scan 2009-12-11 12:55:22
  Windows 5.0.2195 Service Pack 4
  Running: u6g15d29.exe; Driver: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ugqoafog.sys
  
  ---- System - GMER 1.0.15 ----
  
  SSDT 85ADC7FC ZwCreateThread
  SSDT 85ADC7E8 ZwOpenProcess
  SSDT 85ADC7ED ZwOpenThread
  SSDT 85ADC7F7 ZwTerminateProcess
  SSDT 85ADC7F2 ZwWriteVirtualMemory
  
  ---- Kernel code sections - GMER 1.0.15 ----
  
  pnidata C:\WINNT\System32\drivers\SECDRV.SYS unknown last section [0xBCCFBF00, 0x24000, 0x48000000]
  ? C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\catchme.sys Le fichier spécifié est introuvable. !
  
  ---- User code sections - GMER 1.0.15 ----
  
  .text C:\Program Files\MSN Messenger\msnmsgr.exe[1064] WS2_32.dll!closesocket 74FB145E 14 Bytes JMP 015B4408 C:\Program Files\MessengerPlus! 3\MsgPlusH.dll (Messenger Plus! Hook DLL/Patchou)
  .text C:\Program Files\MSN Messenger\msnmsgr.exe[1064] WS2_32.dll!send 74FB1BCC 6 Bytes JMP 015B48E8 C:\Program Files\MessengerPlus! 3\MsgPlusH.dll (Messenger Plus! Hook DLL/Patchou)
  .text C:\Program Files\MSN Messenger\msnmsgr.exe[1064] WS2_32.dll!recv 74FBA101 6 Bytes JMP 015B48A6 C:\Program Files\MessengerPlus! 3\MsgPlusH.dll (Messenger Plus! Hook DLL/Patchou)
  .text C:\Program Files\MSN Messenger\msnmsgr.exe[1064] SHELL32.dll!Shell_NotifyIcon 7CEA825C 9 Bytes JMP 015B1163 C:\Program Files\MessengerPlus! 3\MsgPlusH.dll (Messenger Plus! Hook DLL/Patchou)
  .text C:\Program Files\Internet Explorer\iexplore.exe[2436] ole32.dll!OleLoadFromStream 7CD60C22 6 Bytes JMP 7179F169 C:\WINNT\system32\SHDOCVW.dll (Bibliothèque d'objets et de contrôles de documents de l'environnement/Microsoft Corporation)
  
  ---- User IAT/EAT - GMER 1.0.15 ----
  
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\Explorer.EXE [KERNEL32.DLL!CreateProcessW] [230214FD] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\Explorer.EXE [KERNEL32.DLL!LoadLibraryW] [7788786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\Explorer.EXE [KERNEL32.DLL!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\Explorer.EXE [KERNEL32.DLL!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\Explorer.EXE [KERNEL32.DLL!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!LoadLibraryExW] [77887955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!CreateProcessA] [23021346] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!CreateProcessW] [230214FD] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!LoadLibraryW] [7788786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [7788786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\GDI32.DLL [KERNEL32.dll!LoadLibraryExW] [77887955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\GDI32.DLL [KERNEL32.dll!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\GDI32.DLL [KERNEL32.dll!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\GDI32.DLL [KERNEL32.dll!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\GDI32.DLL [KERNEL32.dll!LoadLibraryW] [7788786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [77887955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!CreateProcessW] [230214FD] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [7788786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!LoadLibraryExA] [778878DE] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!LoadLibraryExW] [77887955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!LoadLibraryW] [7788786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!CreateProcessA] [23021346] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!CreateProcessW] [230214FD] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!CreateProcessA] [23021346] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!CreateProcessW] [230214FD] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [77887955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!CreateProcessW] [230214FD] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [7788786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!LoadLibraryW] [7788786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!LoadLibraryExW] [77887955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!CreateProcessW] [230214FD] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!LoadLibraryW] [7788786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!LoadLibraryExW] [77887955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!CreateProcessW] [230214FD] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\WININET.DLL [KERNEL32.dll!LoadLibraryW] [7788786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\WININET.DLL [KERNEL32.dll!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\WININET.DLL [KERNEL32.dll!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\WININET.DLL [KERNEL32.dll!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExW] [77887955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExA] [778878DE] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\WS2_32.dll [KERNEL32.DLL!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\WS2_32.dll [KERNEL32.DLL!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\WS2_32.dll [KERNEL32.DLL!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\WS2HELP.DLL [KERNEL32.DLL!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\WS2HELP.DLL [KERNEL32.DLL!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\WS2HELP.DLL [KERNEL32.DLL!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\netapi32.dll [KERNEL32.dll!LoadLibraryW] [7788786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\netapi32.dll [KERNEL32.dll!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\netapi32.dll [KERNEL32.dll!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW] [7788786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  
  ---- Devices - GMER 1.0.15 ----
  
  Device \Driver\prodrv06 \Device\ProDrv06 E16D5008
  Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-2 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
  Device \Driver\atapi \Device\Ide\IdePort0 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
  Device \Driver\atapi \Device\Ide\IdePort1 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
  Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-a prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
  Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-1c prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
  Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-14 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
  Device \Driver\USBSTOR \Device\0000002f sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
  Device \Driver\prohlp02 \Device\ProHlp02 E14FE688
  Device \Driver\USBSTOR \Device\00000031 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
  
  AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
  
  ---- EOF - GMER 1.0.15 ----
  GMER 1.0.15.15273 - http://www.gmer.net
  Rootkit scan 2009-12-11 12:55:22
  Windows 5.0.2195 Service Pack 4
  Running: u6g15d29.exe; Driver: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ugqoafog.sys
  
  ---- System - GMER 1.0.15 ----
  
  SSDT 85ADC7FC ZwCreateThread
  SSDT 85ADC7E8 ZwOpenProcess
  SSDT 85ADC7ED ZwOpenThread
  SSDT 85ADC7F7 ZwTerminateProcess
  SSDT 85ADC7F2 ZwWriteVirtualMemory
  
  ---- Kernel code sections - GMER 1.0.15 ----
  
  pnidata C:\WINNT\System32\drivers\SECDRV.SYS unknown last section [0xBCCFBF00, 0x24000, 0x48000000]
  ? C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\catchme.sys Le fichier spécifié est introuvable. !
  
  ---- User code sections - GMER 1.0.15 ----
  
  .text C:\Program Files\MSN Messenger\msnmsgr.exe[1064] WS2_32.dll!closesocket 74FB145E 14 Bytes JMP 015B4408 C:\Program Files\MessengerPlus! 3\MsgPlusH.dll (Messenger Plus! Hook DLL/Patchou)
  .text C:\Program Files\MSN Messenger\msnmsgr.exe[1064] WS2_32.dll!send 74FB1BCC 6 Bytes JMP 015B48E8 C:\Program Files\MessengerPlus! 3\MsgPlusH.dll (Messenger Plus! Hook DLL/Patchou)
  .text C:\Program Files\MSN Messenger\msnmsgr.exe[1064] WS2_32.dll!recv 74FBA101 6 Bytes JMP 015B48A6 C:\Program Files\MessengerPlus! 3\MsgPlusH.dll (Messenger Plus! Hook DLL/Patchou)
  .text C:\Program Files\MSN Messenger\msnmsgr.exe[1064] SHELL32.dll!Shell_NotifyIcon 7CEA825C 9 Bytes JMP 015B1163 C:\Program Files\MessengerPlus! 3\MsgPlusH.dll (Messenger Plus! Hook DLL/Patchou)
  .text C:\Program Files\Internet Explorer\iexplore.exe[2436] ole32.dll!OleLoadFromStream 7CD60C22 6 Bytes JMP 7179F169 C:\WINNT\system32\SHDOCVW.dll (Bibliothèque d'objets et de contrôles de documents de l'environnement/Microsoft Corporation)
  
  ---- User IAT/EAT - GMER 1.0.15 ----
  
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\Explorer.EXE [KERNEL32.DLL!CreateProcessW] [230214FD] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\Explorer.EXE [KERNEL32.DLL!LoadLibraryW] [7788786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\Explorer.EXE [KERNEL32.DLL!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\Explorer.EXE [KERNEL32.DLL!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\Explorer.EXE [KERNEL32.DLL!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!LoadLibraryExW] [77887955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!CreateProcessA] [23021346] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!CreateProcessW] [230214FD] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!LoadLibraryW] [7788786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [7788786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\GDI32.DLL [KERNEL32.dll!LoadLibraryExW] [77887955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\GDI32.DLL [KERNEL32.dll!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\GDI32.DLL [KERNEL32.dll!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\GDI32.DLL [KERNEL32.dll!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\GDI32.DLL [KERNEL32.dll!LoadLibraryW] [7788786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [77887955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!CreateProcessW] [230214FD] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [7788786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!LoadLibraryExA] [778878DE] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!LoadLibraryExW] [77887955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!LoadLibraryW] [7788786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!CreateProcessA] [23021346] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!CreateProcessW] [230214FD] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!CreateProcessA] [23021346] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!CreateProcessW] [230214FD] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [77887955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!CreateProcessW] [230214FD] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [7788786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!LoadLibraryW] [7788786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!LoadLibraryExW] [77887955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!CreateProcessW] [230214FD] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!LoadLibraryW] [7788786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!LoadLibraryExW] [77887955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!CreateProcessW] [230214FD] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\WININET.DLL [KERNEL32.dll!LoadLibraryW] [7788786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\WININET.DLL [KERNEL32.dll!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\WININET.DLL [KERNEL32.dll!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\WININET.DLL [KERNEL32.dll!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExW] [77887955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExA] [778878DE] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\WS2_32.dll [KERNEL32.DLL!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\WS2_32.dll [KERNEL32.DLL!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\WS2_32.dll [KERNEL32.DLL!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\WS2HELP.DLL [KERNEL32.DLL!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\WS2HELP.DLL [KERNEL32.DLL!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\WS2HELP.DLL [KERNEL32.DLL!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\netapi32.dll [KERNEL32.dll!LoadLibraryW] [7788786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\netapi32.dll [KERNEL32.dll!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\netapi32.dll [KERNEL32.dll!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] [77887800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW] [7788786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [7788771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  IAT C:\WINNT\Explorer.EXE[948] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!FreeLibrary] [77887A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
  
  ---- Devices - GMER 1.0.15 ----
  
  Device \Driver\prodrv06 \Device\ProDrv06 E16D5008
  Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-2 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
  Device \Driver\atapi \Device\Ide\IdePort0 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
  Device \Driver\atapi \Device\Ide\IdePort1 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
  Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-a prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
  Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-1c prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
  Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-14 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
  Device \Driver\USBSTOR \Device\0000002f sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
  Device \Driver\prohlp02 \Device\ProHlp02 E14FE688
  Device \Driver\USBSTOR \Device\00000031 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
  
  AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
  
  ---- EOF - GMER 1.0.15 ----
  
  0
  
  Réagir
Réponse 10 / 19
moment de grace Contributeur sécurité
- désinstalles et supprimes le dossier correspondant

C:\Program Files\webHancer
C:\WINNT\system32\P2P Networking

ensuite fais un nouveau RSIT stp

0

Réagir
1. bugs35
  
  j'ai recherché ces deux elements , mais je ne les trouve pas , ni en recherchant "recherche" ni par "ajout suppression de programmes "
  
  0
  
  Réagir
Réponse 11 / 19
moment de grace Contributeur sécurité
voilà, j'en ai trouvé un compatible 2000 (normalement)
sera t il efficace..?

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié dans C:\
• Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
1)Redémarre ton ordinateur
2) Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
3)A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
4)Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
5)Choisis ton compte.

Déroule la liste des instructions ci-dessous :
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
• Appuie sur Y pour commencer le processus de nettoyage.
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
• Appuie sur une touche pour redémarrer le PC.
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
• Appuie sur une touche pour finir l'exécution du scrïpt et charger les icônes de ton Bureau.
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum

Tuto pour t’aider
https://www.tayo.fr/sdfix-tutoriel.php

0

Réagir
1. bugs35
  
  bonjour, OUF !!! un programme adapté, bravo .....voici le rapport
  
  [b]SDFix: Version 1.240 [/b]
  Run by Administrateur on jeu. 10/12/2009 at 17:19
  
  Microsoft Windows 2000 [Version 5.00.2195]
  Running From: C:\SDFix
  
  [b]Checking Services [/b]:
  
  Restoring Default Security Values
  Restoring Default Hosts File
  
  Rebooting
  
  [b]Checking Files [/b]:
  
  Trojan Files Found:
  
  C:\WINNT\TMLPWIN.EXE - Deleted
  C:\Documents and Settings\Administrateur\Administrateur.bak\Local Settings\Temp\tmp2BC.tmp.exe - Deleted
  C:\WINNT\system32\TFTP1288 - Deleted
  
  Removing Temp Files
  
  [b]ADS Check [/b]:
  
  [b]Final Check [/b]:
  
  catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2009-12-10 19:00:13
  Windows 5.0.2195 Service Pack 4 NTFS
  
  scanning hidden processes ...
  
  scanning hidden services & system hive ...
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_05a9&Pid_4519&Mi_01\6&1110c199&0&1\Device Parameters]
  "HWRevision?U\x2039ì\x81ìÌ?"="100"
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_05a9&Pid_4519&Mi_01\6&1fbf2923&0&1\Device Parameters]
  "HWRevision?U\x2039ì\x81ìÌ?"="100"
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_05a9&Pid_4519&Mi_01\6&1fbf2923&1&1\Device Parameters]
  "HWRevision?U\x2039ì\x81ìÌ?"="100"
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_05a9&Pid_4519&Mi_01\6&1fbf2923&2&1\Device Parameters]
  "HWRevision?U\x2039ì\x81ìÌ?"="100"
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\USB\Vid_05a9&Pid_4519&Mi_01\6&1110c199&0&1\Device Parameters]
  "HWRevision?U\x2039ì\x81ìÌ?"="100"
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\USB\Vid_05a9&Pid_4519&Mi_01\6&1fbf2923&0&1\Device Parameters]
  "HWRevision?U\x2039ì\x81ìÌ?"="100"
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\USB\Vid_05a9&Pid_4519&Mi_01\6&1fbf2923&1&1\Device Parameters]
  "HWRevision?U\x2039ì\x81ìÌ?"="100"
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\USB\Vid_05a9&Pid_4519&Mi_01\6&1fbf2923&2&1\Device Parameters]
  "HWRevision?U\x2039ì\x81ìÌ?"="100"
  
  scanning hidden registry entries ...
  
  scanning hidden files ...
  
  scan completed successfully
  hidden processes: 0
  hidden services: 0
  hidden files: 0
  
  [b]Remaining Services [/b]:
  
  [b]Remaining Files [/b]:
  
  File Backups: - C:\SDFix\backups\backups.zip
  
  [b]Files with Hidden Attributes [/b]:
  
  Wed 16 Jul 2003 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
  Mon 10 Jul 2006 25,088 ...H. --- "C:\Documents and Settings\Administrateur\Administrateur.bak\Local Settings\Temp\~WRL0316.tmp"
  
  [b]Finished![/b]
  
  0
  
  Réagir
Réponse 12 / 19
moment de grace Contributeur sécurité
recu

je vais tacher de trouver ce qu'il nous faut...

je te tiens au courant

0

Réagir
Réponse 13 / 19
moment de grace Contributeur sécurité
faut croire que non...

on va tenter autrement

éléchargez et enregistrez le fichier d installation sur le bureau
http://pagesperso-orange.fr/NosTools/C_XX/AD-R.exe

Double cliquez sur le fichier d'installation de AD-Remover, le programme s'installera automatiquement.
Sous Vista : clic droit sur AD-Remover et sélectionner "Exécuter en tant qu'administrateur"
Au menu principal choisir l'option "s" et tapez sur [entrée] .
Laissez travailler l'outil et ne touchez à rien ...
Postez le rapport qui apparait à la fin.

( le rapport est sauvegardé aussi sous C:\Ad-report.log )

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Note :Process.exe est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

0

Réagir
1. bugs35
  
  hello, meme probleme, ADR ne demarre pas ....
  
  0
  
  Réagir
Réponse 14 / 19
moment de grace Contributeur sécurité
il en reste...on continue

Téléchargez Toolbar-S&D ( Merci à Eric_71, Angel Dark, Sham_Rock et XmichouX ) sur le Bureau

https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cpVobGk5bHnxrhQ4yaoEUDJvOYNnEGyYjgqHZz5GqZLfutR3fMFPlsC3-CGIilfupPAguYATNyua3csodN_frdMK8sSzUpit10Yac-QJCOkMqJKkbdKcP6ySs8trWPgoNVIq4TGGWCe6o0txXQv-ZueJF9vZzw3RXsGwFYIqN2lvF2LPdQzS8mE1d5kWOVOz6EMzQuE5-lClSJM869uq3oc7-t7yg%3D%3D&attredirects=3

Lancez l'installation du programme en exécutant le fichier téléchargé.
Double-cliquez maintenant sur le raccourci de Toolbar-S&D.
Sélectionnez la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
Choisir maintenant l'option 1 (Recherche). Patientez jusqu'à la fin de la recherche.
Postez le rapport généré. (C:\TB.txt)

Tuto: https://sites.google.com/site/toolbarsd/aideenimages

0

Réagir
1. bugs35
  
  c'est encore moi , j'ai bien chargé toolbar,en français , recherche , mais rien ne se passe , j'ai vu sur l'en-tete XP ou Vista , est ce qu'il marche aussi pour 2000 pro
  
  0
  
  Réagir
Réponse 15 / 19
moment de grace Contributeur sécurité
ok

relances RSIT (1 seul rapport) pour faire le point

0

Réagir
1. bugs35
  
  re bonjour , voici le rapport RSIT
  
  Logfile of random's system information tool 1.06 (written by random/random)
  Run by Administrateur at 2009-12-10 08:58:55
  Microsoft Windows 2000 Professionnel Service Pack 4
  System drive C: has 13 GB (33%) free of 39 GB
  Total RAM: 1023 MB (70% free)
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 08:58:58, on 10/12/2009
  Platform: Windows 2000 SP4 (WinNT 5.00.2195)
  MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
  Boot mode: Normal
  
  Running processes:
  C:\WINNT\System32\smss.exe
  C:\WINNT\system32\winlogon.exe
  C:\WINNT\system32\services.exe
  C:\WINNT\system32\lsass.exe
  C:\WINNT\system32\svchost.exe
  C:\WINNT\system32\spoolsv.exe
  C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
  C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
  C:\WINNT\System32\svchost.exe
  C:\WINNT\System32\FTRTSVC.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
  C:\WINNT\system32\nvsvc32.exe
  C:\WINNT\system32\HPZipm12.exe
  C:\WINNT\system32\regsvc.exe
  C:\WINNT\system32\MSTask.exe
  C:\WINNT\system32\stisvc.exe
  C:\Program Files\Nomad-Agri\apache2\bin\Apache.exe
  C:\WINNT\Explorer.EXE
  C:\Program Files\Nomad-Agri\mysql\bin\mysqld-nt.exe
  C:\WINNT\System32\WBEM\WinMgmt.exe
  C:\WINNT\system32\svchost.exe
  C:\WINNT\system32\faxsvc.exe
  C:\WINNT\System32\svchost.exe
  C:\Program Files\Nomad-Agri\apache2\bin\Apache.exe
  C:\Program Files\MessengerPlus! 3\MsgPlus.exe
  C:\WINNT\system32\ctfmon.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\WINNT\system32\wuauclt.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Documents and Settings\Administrateur\Bureau\RSIT.exe
  C:\Program Files\trend micro\Administrateur.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://login.orange.fr/captcha?return_url=https%3A%2F%2Frms.orange.fr%2Fmail%2Finbox%3FFromSubmit%3Dtrue%26dub%3D1
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yoower.com/
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  R3 - URLSearchHook: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
  R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
  O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
  O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
  O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
  O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
  O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')
  O4 - HKUS\.DEFAULT\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User 'Default user')
  O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
  O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
  O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
  O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
  O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
  O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
  O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
  O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
  O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
  O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINNT\bdoscandel.exe
  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINNT\bdoscandel.exe
  O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
  O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
  O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
  O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
  O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-18.cab
  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
  O16 - DPF: {6DB731A3-B074-4118-8B1C-32511C65D836} (FotovistaPhotoUploader.ctrFpu) - http://www.mypixmania.com/fr/fr/tools/activex/fpu.cab
  O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.girafoto.fr/uploaders/ImageUploader3.cab
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.5.0) - https://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
  O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
  O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
  O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
  O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
  O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINNT\System32\FTRTSVC.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
  O23 - Service: wampapache - Apache Software Foundation - C:\Program Files\Nomad-Agri\apache2\bin\Apache.exe
  O23 - Service: wampmysqld - Unknown owner - C:\Program Files\Nomad-Agri\mysql\bin\mysqld-nt.exe
  
  0
  
  Réagir
Réponse 16 / 19
moment de grace Contributeur sécurité
ca a l'air mieux

1) en mode normal
Téléchargez MalwareByte's Anti-Malware
https://www.majorgeeks.com/files/details/malwarebytes_anti_malware.html

. Sur la page cliques sur Télécharger Malwarebyte's Anti-Malware
. Enregistres le sur le bureau
. Double cliques sur le fichier téléchargé pour lancer le processus d'installation.
. Dans l'onglet "mise à jour", cliques sur le bouton Recherche de mise à jour
. Si le pare-feu demande l'autorisation de se connecter pour malwarebytes, accepte
. Une fois la mise à jour terminé
. Rend-toi dans l'onglet, Recherche
. Sélectionnes Exécuter un examen complet
. Cliques sur Rechercher
. Le scan démarre.
. A la fin de l'analyse, un message s'affiche : L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.
. Cliques sur Ok pour poursuivre.
. Si des malwares ont été détectés, clique sur Afficher les résultats
. Sélectionnes tout (ou laisses cochés) et cliques sur Supprimer la sélection Malwarebytes va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
. Malwarebytes va ouvrir le bloc-notes et y copier le rapport d'analyse.
. Rends toi dans l'onglet rapport/log
. Tu cliques dessus pour l'afficher, une fois affiché
. Tu cliques sur edition en haut du boc notes, et puis sur sélectionner tous
. Tu recliques sur edition et puis sur copier et tu reviens sur le forum et dans ta réponse
. tu cliques droit dans le cadre de la reponse et coller

Si tu as besoin d'aide regarde ces tutoriels :
Aide: https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
http://www.infos-du-net.com/forum/278396-11-tuto-malwarebytes-anti-malware-mbam

2) refaire un nouveau RSIT, poster juste le log

0

Réagir
1. bugs35
  
  bonjour , Malwarebytes a apparement bien travaillé, voici le rapport
  
  Malwarebytes' Anti-Malware 1.42
  Version de la base de données: 3328
  Windows 5.0.2195 Service Pack 4
  Internet Explorer 6.0.2800.1106
  
  10/12/2009 07:11:31
  mbam-log-2009-12-10 (07-11-31).txt
  
  Type de recherche: Examen complet (C:\|E:\|)
  Eléments examinés: 212196
  Temps écoulé: 2 hour(s), 45 minute(s), 1 second(s)
  
  Processus mémoire infecté(s): 0
  Module(s) mémoire infecté(s): 0
  Clé(s) du Registre infectée(s): 4
  Valeur(s) du Registre infectée(s): 0
  Elément(s) de données du Registre infecté(s): 0
  Dossier(s) infecté(s): 0
  Fichier(s) infecté(s): 2
  
  Processus mémoire infecté(s):
  (Aucun élément nuisible détecté)
  
  Module(s) mémoire infecté(s):
  (Aucun élément nuisible détecté)
  
  Clé(s) du Registre infectée(s):
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{90b5a95a-afd5-4d11-b9bd-a69d53d22226} (Adware.Hotbar) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8109fd3d-d891-4f80-8339-50a4913ace6f} (Adware.Zango) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Active Security (Rogue.ActiveSecurity) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\SOFTWARE\CoreGuard (Rogue.CoreguardAV) -> Quarantined and deleted successfully.
  
  Valeur(s) du Registre infectée(s):
  (Aucun élément nuisible détecté)
  
  Elément(s) de données du Registre infecté(s):
  (Aucun élément nuisible détecté)
  
  Dossier(s) infecté(s):
  (Aucun élément nuisible détecté)
  
  Fichier(s) infecté(s):
  C:\Documents and Settings\Administrateur\Local Settings\Temp\H8SRT1cbf.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
  C:\Documents and Settings\Administrateur\Local Settings\Temp\H8SRT1cee.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
  
  0
  
  Réagir
Réponse 17 / 19
moment de grace Contributeur sécurité
il faudrait refaire la même opération pour être sûr qu'il supprimes tous ces fichies détectés infectés
anti virus et pare feux désactivé

0

Réagir
1. bugs35
  
  bonsoir , voici le dernier rapport , et toujours le nettoyage disque qui n'a pas démarré
  Thx to Chiquitine29.....
  
  User : Administrateur (Administrateurs) # WKL1W5NZ550LYLH
  Update on 07/12/2009 by g3n-h@ckm@n ::::: 11:00
  Start at: 16:55:34 | 07/12/2009
  Contact : g3n-h@ckm@n sur CCM
  
  Intel(R) Celeron(R) CPU 2.00GHz
  Microsoft Windows 2000 Professionnel (5.0.2195 32-bit) # Service Pack 4
  Internet Explorer 6.0.2800.1106
  Windows Firewall Status : Enabled
  
  A:\ -> Lecteur de disquettes 3 ½ pouces
  C:\ -> Disque fixe local | 38,28 Go (12,8 Go free) | NTFS
  D:\ -> Disque CD-ROM
  E:\ -> Disque fixe local | 17,04 Go (3,4 Go free) | FAT32
  F:\ -> Disque CD-ROM
  G:\ -> Disque amovible
  
  ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running
  
  C:\WINNT\System32\smss.exe 208
  C:\WINNT\system32\csrss.exe 232
  C:\WINNT\system32\winlogon.exe 252
  C:\WINNT\system32\services.exe 280
  C:\WINNT\system32\lsass.exe 292
  C:\WINNT\system32\svchost.exe 468
  C:\WINNT\system32\spoolsv.exe 496
  C:\Program Files\AntiVir PersonalEdition Classic\sched.exe 524
  C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe 540
  C:\WINNT\System32\svchost.exe 572
  C:\WINNT\System32\FTRTSVC.exe 624
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe 648
  C:\WINNT\system32\nvsvc32.exe 684
  C:\WINNT\system32\HPZipm12.exe 708
  C:\WINNT\system32\regsvc.exe 728
  C:\WINNT\system32\MSTask.exe 744
  C:\WINNT\system32\stisvc.exe 796
  C:\Program Files\Nomad-Agri\apache2\bin\Apache.exe 848
  C:\Program Files\Nomad-Agri\mysql\bin\mysqld-nt.exe 868
  C:\WINNT\system32\svchost.exe 904
  C:\WINNT\system32\faxsvc.exe 916
  C:\Program Files\Nomad-Agri\apache2\bin\Apache.exe 1108
  C:\WINNT\Explorer.EXE 2292
  C:\Program Files\MessengerPlus! 3\MsgPlus.exe 2512
  C:\WINNT\system32\ctfmon.exe 2456
  C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\richtx64.exe 2424
  C:\Program Files\MSN Messenger\msnmsgr.exe 1060
  C:\WINNT\system32\wuauclt.exe 1072
  C:\WINNT\System32\WBEM\WinMgmt.exe 1064
  C:\Program Files\Wanadoo\GestionnaireInternet.exe 448
  C:\Program Files\Wanadoo\ComComp.exe 1020
  C:\PROGRA~1\Wanadoo\Toaster.exe 2556
  C:\PROGRA~1\Wanadoo\Inactivity.exe 480
  C:\PROGRA~1\Wanadoo\PollingModule.exe 2368
  C:\WINNT\System32\ALERTM~1\ALERTM~1.EXE 1032
  C:\Program Files\Wanadoo\Watch.exe 2616
  C:\Program Files\Internet Explorer\iexplore.exe 2812
  C:\Program Files\Internet Explorer\iexplore.exe 2760
  C:\Program Files\Internet Explorer\iexplore.exe 2620
  C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe 2632
  C:\Program Files\QuickZip4\QuickZip.exe 2720
  C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\QZTEMP\List_Kill'em.exe 948
  C:\WINNT\system32\cmd.exe 2936
  C:\Documents and Settings\Administrateur\Local Settings\Temp\99.tmp\pv.exe 3032
  
  ======================
  Keys "Run"
  ======================
  
  ! REG.EXE VERSION 3.0
  
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  MessengerPlus3 REG_SZ "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
  ctfmon.exe REG_SZ ctfmon.exe
  richtx64.exe REG_SZ C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\richtx64.exe
  AntiMalware REG_SZ "C:\Program Files\AntiMalware\antimalware.exe" -noscan
  msnmsgr REG_SZ "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  
  ! REG.EXE VERSION 3.0
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  NvCplDaemon REG_SZ RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
  Synchronization Manager REG_SZ mobsync.exe /logon
  QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
  MessengerPlus3 REG_SZ "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
  Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  Adobe ARM REG_SZ "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents
  =====================
  Other Keys
  =====================
  
  ! REG.EXE VERSION 3.0
  
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
  dontdisplaylastusername REG_DWORD 0x0
  legalnoticecaption REG_SZ
  legalnoticetext REG_SZ
  shutdownwithoutlogon REG_DWORD 0x1
  ===============
  
  ===============
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif
  ===============
  BHO :
  ======
  Windows Registry Editor Version 5.00
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
  @=""
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A}]
  @="SWEETIE"
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{724d43a9-0d85-11d4-9908-00400523e39a}]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
  "NoExplorer"=dword:00000001
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
  
  ================
  Internet Explorer :
  ================
  
  ! REG.EXE VERSION 3.0
  
  HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main
  Start Page REG_SZ http://www.yoower.com/
  
  ! REG.EXE VERSION 3.0
  
  HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
  Start Page REG_SZ https://www.orange.fr/portail
  
  ========
  Services
  ========
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]
  
  Ndisuio : 0x3
  SharedAccess : 0x3
  wuauserv : 0x2
  =========
  
  =========================
  Environnement variables :
  =========================
  
  ALLUSERSPROFILE=C:\Documents and Settings\All Users
  APPDATA=C:\Documents and Settings\Administrateur\Application Data
  choix=1
  COLLECTIONID=COL8143
  CommonProgramFiles=C:\Program Files\Fichiers communs
  COMPUTERNAME=WKL1W5NZ550LYLH
  ComSpec=C:\WINNT\system32\cmd.exe
  HMSERVER=https://wwss1proa.cce.hp.com/wuss/servlet/WUSSServlet
  HOMEDRIVE=C:
  HOMEPATH=\Documents and Settings\Administrateur
  ITEMID=dj-22741-15
  LANG=1036
  LOGONSERVER=\\WKL1W5NZ550LYLH
  NUMBER_OF_PROCESSORS=1
  OS=Windows_NT
  Os2LibPath=C:\WINNT\system32\os2\dll;
  OSVER=win2KP
  Path=C:\WINNT\system32;C:\WINNT;C:\WINNT\System32\Wbem;C:\Program Files\Fichiers communs\Ulead Systems\MPEG;C:\Program Files\Fichiers communs\Adaptec Shared\System;C:\Program Files\Fichiers communs\Ulead Systems\DVD
  PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
  PROCESSOR_ARCHITECTURE=x86
  PROCESSOR_IDENTIFIER=x86 Family 15 Model 2 Stepping 7, GenuineIntel
  PROCESSOR_LEVEL=15
  PROCESSOR_REVISION=0207
  ProgramFiles=C:\Program Files
  PROMPT=$P$G
  SESSIONID=1138922331638htx6060142e23f:1092b02cdc8:1b3b
  SWUTVER=1.0.22.20030804
  SystemDrive=C:
  SystemRoot=C:\WINNT
  TEMP=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
  TIMEOUT=0
  TMP=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
  TOOLPATH=/C:\Program%20Files\HP\HP%20Software%20Update\install.htm
  UPDATEDIR=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\rad9F54A.tmp
  USERDOMAIN=WKL1W5NZ550LYLH
  USERNAME=Administrateur
  USERPROFILE=C:\Documents and Settings\Administrateur
  VERSION=3.0.5.001
  windir=C:\WINNT
  
  ==========
  Programs
  ==========
  
  25000 Sudoku
  Absolutist.com
  Activision Value
  Adaptec
  Adobe
  Ahead
  Alwil Software
  Amanita Muscaria Memory
  AntiMalware
  AntiVir PersonalEdition Classic
  Anuman Interactive
  ArcSoft
  AvRack
  AVS4YOU
  BD00010_.WMF
  BenQ
  Boonty
  BoontyGames
  Caere
  Canon
  CDDC-MahJongg
  Codemasters
  CONEXANT
  Cool Nestor
  Core Design
  Creative
  Daydream Software
  desktop.ini
  directx
  DX-Ball
  EA Games
  EA SPORTS
  Eidos Interactive
  eToro
  Fichiers communs
  folder.htt
  GamesBar
  GameSpy Arcade
  Ghostgum
  Google
  gs
  Hercules
  Hewlett-Packard
  hijckthis
  HP
  InstallShield Installation Information
  Internet Explorer
  Java
  JPP
  Kazaa
  Kikoo
  LimeWire
  Macrogaming
  Messenger
  MessengerPlus! 3
  Micro Application
  Micrografx
  microsoft frontpage
  Microsoft Games
  Microsoft Office
  Microsoft Visual Studio
  Microsoft Works
  MOX PC
  Mozilla Firefox
  msconfig.zip
  MSN Messenger
  MSXML 4.0
  NetMeeting
  Nomad-Agri
  NZP
  Objective Tarot
  OnePlayer
  orange
  Outlook Express
  Overland
  PC Inspector File Recovery
  PowerArchiver
  QSuite
  QuickTime
  QuickZip4
  Rage Software
  Red Storm Entertainment
  ReflexiveArcade
  RegCleaner
  Roxio
  SAGEM
  Securitoo
  Siber Systems
  Sierra On-Line
  SIM editor
  SiSLan
  Spybot - Search & Destroy
  StofWare
  trend micro
  Ubisoft
  Ulead Systems
  Uninstall Information
  VideoLAN
  Virgin Interactive
  vso
  wab.exe
  Wanadoo
  Wanadoo Messager
  Windows Draw
  Windows Media Components
  Windows Media Player
  Windows NT
  WindowsUpdate
  XnView
  YourTrain
  ZTE Corporation
  Zylom Games
  
  ¤¤¤¤¤¤¤¤¤¤ Files/folders :
  
  C:\Program Files\AntiMalware
  C:\Program Files\GamesBar
  C:\Program Files\KaZaA
  C:\WINNT\Downloaded Program Files\IaLdr32.inf
  C:\WINNT\Fonts\acrsec.fon
  C:\WINNT\Fonts\acrsecB.fon
  C:\WINNT\Fonts\acrsecI.fon
  C:\WINNT\pack.epk
  C:\WINNT\system32\MSINET.oca
  C:\WINNT\System32\SET127.tmp
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\eToroSetup.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\hpzmsi01.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\HPZscr01.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\Installer.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\jre-6u2-windows-i586-p-iftw_7070c3f7.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\richtx64.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\Setup.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\_isA5.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\_isA6.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\_isA7.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\_isAF.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\_isB0.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\_isB1.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\tmp157.tmp
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\tmp2.tmp
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\tmp9C.tmp
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\tmpD1.tmp
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\tmpD5.tmp
  
  ¤¤¤¤¤¤¤¤¤¤ Keys :
  
  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "AntiMalware"
  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "richtx64.exe"
  HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser "{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938}"
  "HKLM\SOFTWARE\Classes\AppID\Altnet Signing Module.exe"
  "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
  "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe"
  "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A}"
  "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A}"
  HKCR\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
  HKCR\CLSID\{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938}
  HKCR\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632
  HKCR\MgMediaPlayer.GifAnimator
  HKCR\MgMediaPlayer.GifAnimator.1
  HKCR\SWEETIE.IEToolbar
  HKCR\SWEETIE.IEToolbar.1
  HKCR\SWEETIE.SWEETIE
  HKCR\SWEETIE.SWEETIE.1
  HKCR\ToolBand.SWEETIE
  HKCR\ToolBand.SWEETIE.1
  HKCR\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
  HKCR\Typelib\{58906392-79C4-497C-ACC6-6942B59F1A08}
  HKCU\SOFTWARE\SWEETIE
  HKLM\Software\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
  HKLM\Software\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
  HKLM\Software\Classes\MgMediaPlayer.GifAnimator
  HKLM\Software\Classes\MgMediaPlayer.GifAnimator.1
  HKLM\Software\Classes\SWEETIE.IEToolbar
  HKLM\Software\Classes\SWEETIE.IEToolbar.1
  HKLM\Software\Classes\SWEETIE.SWEETIE
  HKLM\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
  HKLM\Software\Classes\TypeLib\{58906392-79C4-497C-ACC6-6942B59F1A08}
  HKLM\SOFTWARE\Macrogaming
  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0
  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
  
  =========
  Rootkits
  =========
  
  catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2009-12-07 16:59:19
  Windows 5.0.2195 Service Pack 4 NTFS
  
  scanning hidden processes ...
  
  scanning hidden services & system hive ...
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_05a9&Pid_4519&Mi_01\6&1110c199&0&1\Device Parameters]
  "HWRevision?U\x2039ì\x81ìÌ?"="100"
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_05a9&Pid_4519&Mi_01\6&1fbf2923&0&1\Device Parameters]
  "HWRevision?U\x2039ì\x81ìÌ?"="100"
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_05a9&Pid_4519&Mi_01\6&1fbf2923&1&1\Device Parameters]
  "HWRevision?U\x2039ì\x81ìÌ?"="100"
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_05a9&Pid_4519&Mi_01\6&1fbf2923&2&1\Device Parameters]
  "HWRevision?U\x2039ì\x81ìÌ?"="100"
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\USB\Vid_05a9&Pid_4519&Mi_01\6&1110c199&0&1\Device Parameters]
  "HWRevision?U\x2039ì\x81ìÌ?"="100"
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\USB\Vid_05a9&Pid_4519&Mi_01\6&1fbf2923&0&1\Device Parameters]
  "HWRevision?U\x2039ì\x81ìÌ?"="100"
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\USB\Vid_05a9&Pid_4519&Mi_01\6&1fbf2923&1&1\Device Parameters]
  "HWRevision?U\x2039ì\x81ìÌ?"="100"
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\USB\Vid_05a9&Pid_4519&Mi_01\6&1fbf2923&2&1\Device Parameters]
  "HWRevision?U\x2039ì\x81ìÌ?"="100"
  
  scanning hidden registry entries ...
  
  scanning hidden files ...
  
  scan completed successfully
  hidden processes: 0
  hidden services: 0
  hidden files: 0
  
  ¤¤¤¤¤¤¤¤¤¤ C:\WINNT\Prefetch :
  
  ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
  
  0
  
  Réagir
Réponse 18 / 19
moment de grace Contributeur sécurité
Suppression :

REDEMARRE EN MODE SANS ECHEC ,

https://www.micro-astuce.com/depannage/demarrer-mode-sans-echec.php

puis :

▶ Relance List&Kill'em comme tu as fait pour l'option 1 (soit en clic droit pour vista),

mais cette fois-ci :

▶ choisis l'option 2 = Mode Destruction

laisse travailler l'outil

▶ colle le contenu de C:\Kill'em.txt dans ta réponse après avoir redémarré en mode normal

0

Réagir
1. bugs35
  
  bonjour , j'ai bien effectué la manip , par contre a la fin du processus de destruction , kill'em n'as pas demarré le nettoyage de disque affiché a l'ecran.....j'ai donc redemarré mon ordi en mode normal.et voici le rapport.
  
  User : Administrateur () # WKL1W5NZ550LYLH
  Update on 07/12/2009 by g3n-h@ckm@n ::::: 11:00
  Start at: 12:20:28 | 08/12/2009
  Contact : g3n-h@ckm@n sur CCM
  
  Intel(R) Celeron(R) CPU 2.00GHz
  Microsoft Windows 2000 Professionnel (5.0.2195 32-bit) # Service Pack 4
  Internet Explorer 6.0.2800.1106
  Windows Firewall Status : Enabled
  
  A:\ -> Lecteur de disquettes 3 ½ pouces
  C:\ -> Disque fixe local | 38,28 Go (12,8 Go free) | NTFS
  D:\ -> Disque CD-ROM
  E:\ -> Disque fixe local | 17,04 Go (3,4 Go free) | FAT32
  F:\ -> Disque CD-ROM
  G:\ -> Disque amovible
  
  ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running
  
  C:\WINNT\System32\smss.exe 140
  C:\WINNT\system32\csrss.exe 168
  C:\WINNT\system32\winlogon.exe 188
  C:\WINNT\system32\services.exe 216
  C:\WINNT\system32\lsass.exe 228
  C:\WINNT\system32\svchost.exe 384
  C:\WINNT\System32\WBEM\WinMgmt.exe 408
  C:\WINNT\system32\userinit.exe 336
  C:\WINNT\Explorer.EXE 424
  C:\Program Files\QuickZip4\QuickZip.exe 508
  C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\QZTEMP\List_Kill'em.exe 496
  C:\WINNT\system32\cmd.exe 480
  C:\Documents and Settings\Administrateur\Local Settings\Temp\1.tmp\pv.exe 288
  
  Detections :
  ==========
  
  ¤¤¤¤¤¤¤¤¤¤ Files/folders :
  
  "C:\Program Files\GamesBar"
  "C:\Program Files\KaZaA"
  "C:\WINNT\Downloaded Program Files\IaLdr32.inf"
  "C:\WINNT\Fonts\acrsec.fon"
  "C:\WINNT\Fonts\acrsecB.fon"
  "C:\WINNT\Fonts\acrsecI.fon"
  "C:\WINNT\pack.epk"
  "C:\WINNT\system32\MSINET.oca"
  C:\WINNT\System32\SET127.tmp
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\eToroSetup.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\hpzmsi01.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\HPZscr01.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\Installer.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\jre-6u2-windows-i586-p-iftw_7070c3f7.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\richtx64.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\Setup.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\_isA5.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\_isA6.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\_isA7.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\_isAF.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\_isB0.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\_isB1.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\tmp157.tmp
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\tmp2.tmp
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\tmp9C.tmp
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\tmpD1.tmp
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\tmpD5.tmp
  
  ¤¤¤¤¤¤¤¤¤¤ Files/folders deleted :
  
  Quarantine :
  
  acrsec.fon.Kill'em
  acrsecB.fon.Kill'em
  acrsecI.fon.Kill'em
  eToroSetup.exe.Kill'em
  GamesBar.Kill'em
  hpzmsi01.exe.Kill'em
  HPZscr01.exe.Kill'em
  IaLdr32.inf.Kill'em
  Installer.exe.Kill'em
  jre-6u2-windows-i586-p-iftw_7070c3f7.exe.Kill'em
  Kazaa.Kill'em
  MSINET.oca.Kill'em
  pack.epk.Kill'em
  richtx64.exe.Kill'em
  SET127.tmp.Kill'em
  Setup.exe.Kill'em
  tmp157.tmp.Kill'em
  tmp2.tmp.Kill'em
  tmp9C.tmp.Kill'em
  tmpD1.tmp.Kill'em
  tmpD5.tmp.Kill'em
  _isA5.exe.Kill'em
  _isA6.exe.Kill'em
  _isA7.exe.Kill'em
  _isAF.exe.Kill'em
  _isB0.exe.Kill'em
  _isB1.exe.Kill'em
  
  ==============
  host file OK !
  ==============
  
  ========
  Registry
  ========
  Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalware
  Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\richtx64.exe
  Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938}
  Deleted : HKLM\SOFTWARE\Classes\AppID\Altnet Signing Module.exe
  Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe
  Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
  Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A}
  Deleted : HKCR\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
  Deleted : HKCR\CLSID\{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938}
  Deleted : HKCR\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632
  Deleted : HKCR\MgMediaPlayer.GifAnimator
  Deleted : HKCR\MgMediaPlayer.GifAnimator.1
  Deleted : HKCR\SWEETIE.IEToolbar
  Deleted : HKCR\SWEETIE.IEToolbar.1
  Deleted : HKCR\SWEETIE.SWEETIE
  Deleted : HKCR\SWEETIE.SWEETIE.1
  Deleted : HKCR\ToolBand.SWEETIE
  Deleted : HKCR\ToolBand.SWEETIE.1
  Deleted : HKCR\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
  Deleted : HKCR\Typelib\{58906392-79C4-497C-ACC6-6942B59F1A08}
  Deleted : HKCU\SOFTWARE\SWEETIE
  Deleted : HKLM\Software\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
  Deleted : HKLM\SOFTWARE\Macrogaming
  Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0
  Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632
  Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
  Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
  Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
  Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8
  Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
  Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
  Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
  Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
  Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
  Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
  Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
  Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
  Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
  Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
  Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
  Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
  Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
  Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
  Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
  Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
  Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
  Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
  Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
  Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
  Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
  Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
  
  0
  
  Réagir
Réponse 19 / 19
moment de grace Contributeur sécurité
bonjour

pas mal d'infection

espérons que les outils seront compatibles avec win 2000

Desactive ton antivirus le temps de la manip ainsi que ton parefeu si présent

▶ Télécharge List&Kill'em et enregistre le sur ton bureau

http://sd-1.archive-host.com/membres/up/829108531491024/List_Killem.exe

Il ne necessite pas d'installation

▶double clic (clic droit "executer en tant qu'administrateur" pour Vista) pour lancer le scan

choisis la langue puis choisis l'option 1 = Mode Recherche

▶laisse travailler l'outil

à la fin du scan la fenêtre se referme seule.

ouvre C:\List'em.txt

▶colle le contenu dans ta prochaine réponse

0

Réagir
1. bugs35
  
  bonsoir, et encore merci...voici le rapport
  
  Thx to Chiquitine29.....
  
  User : Administrateur (Administrateurs) # WKL1W5NZ550LYLH
  Update on 07/12/2009 by g3n-h@ckm@n ::::: 11:00
  Start at: 16:55:34 | 07/12/2009
  Contact : g3n-h@ckm@n sur CCM
  
  Intel(R) Celeron(R) CPU 2.00GHz
  Microsoft Windows 2000 Professionnel (5.0.2195 32-bit) # Service Pack 4
  Internet Explorer 6.0.2800.1106
  Windows Firewall Status : Enabled
  
  A:\ -> Lecteur de disquettes 3 ½ pouces
  C:\ -> Disque fixe local | 38,28 Go (12,8 Go free) | NTFS
  D:\ -> Disque CD-ROM
  E:\ -> Disque fixe local | 17,04 Go (3,4 Go free) | FAT32
  F:\ -> Disque CD-ROM
  G:\ -> Disque amovible
  
  ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running
  
  C:\WINNT\System32\smss.exe 208
  C:\WINNT\system32\csrss.exe 232
  C:\WINNT\system32\winlogon.exe 252
  C:\WINNT\system32\services.exe 280
  C:\WINNT\system32\lsass.exe 292
  C:\WINNT\system32\svchost.exe 468
  C:\WINNT\system32\spoolsv.exe 496
  C:\Program Files\AntiVir PersonalEdition Classic\sched.exe 524
  C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe 540
  C:\WINNT\System32\svchost.exe 572
  C:\WINNT\System32\FTRTSVC.exe 624
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe 648
  C:\WINNT\system32\nvsvc32.exe 684
  C:\WINNT\system32\HPZipm12.exe 708
  C:\WINNT\system32\regsvc.exe 728
  C:\WINNT\system32\MSTask.exe 744
  C:\WINNT\system32\stisvc.exe 796
  C:\Program Files\Nomad-Agri\apache2\bin\Apache.exe 848
  C:\Program Files\Nomad-Agri\mysql\bin\mysqld-nt.exe 868
  C:\WINNT\system32\svchost.exe 904
  C:\WINNT\system32\faxsvc.exe 916
  C:\Program Files\Nomad-Agri\apache2\bin\Apache.exe 1108
  C:\WINNT\Explorer.EXE 2292
  C:\Program Files\MessengerPlus! 3\MsgPlus.exe 2512
  C:\WINNT\system32\ctfmon.exe 2456
  C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\richtx64.exe 2424
  C:\Program Files\MSN Messenger\msnmsgr.exe 1060
  C:\WINNT\system32\wuauclt.exe 1072
  C:\WINNT\System32\WBEM\WinMgmt.exe 1064
  C:\Program Files\Wanadoo\GestionnaireInternet.exe 448
  C:\Program Files\Wanadoo\ComComp.exe 1020
  C:\PROGRA~1\Wanadoo\Toaster.exe 2556
  C:\PROGRA~1\Wanadoo\Inactivity.exe 480
  C:\PROGRA~1\Wanadoo\PollingModule.exe 2368
  C:\WINNT\System32\ALERTM~1\ALERTM~1.EXE 1032
  C:\Program Files\Wanadoo\Watch.exe 2616
  C:\Program Files\Internet Explorer\iexplore.exe 2812
  C:\Program Files\Internet Explorer\iexplore.exe 2760
  C:\Program Files\Internet Explorer\iexplore.exe 2620
  C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe 2632
  C:\Program Files\QuickZip4\QuickZip.exe 2720
  C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\QZTEMP\List_Kill'em.exe 948
  C:\WINNT\system32\cmd.exe 2936
  C:\Documents and Settings\Administrateur\Local Settings\Temp\99.tmp\pv.exe 3032
  
  ======================
  Keys "Run"
  ======================
  
  ! REG.EXE VERSION 3.0
  
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  MessengerPlus3 REG_SZ "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
  ctfmon.exe REG_SZ ctfmon.exe
  richtx64.exe REG_SZ C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\richtx64.exe
  AntiMalware REG_SZ "C:\Program Files\AntiMalware\antimalware.exe" -noscan
  msnmsgr REG_SZ "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  
  ! REG.EXE VERSION 3.0
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  NvCplDaemon REG_SZ RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
  Synchronization Manager REG_SZ mobsync.exe /logon
  QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
  MessengerPlus3 REG_SZ "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
  Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  Adobe ARM REG_SZ "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents
  =====================
  Other Keys
  =====================
  
  ! REG.EXE VERSION 3.0
  
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
  dontdisplaylastusername REG_DWORD 0x0
  legalnoticecaption REG_SZ
  legalnoticetext REG_SZ
  shutdownwithoutlogon REG_DWORD 0x1
  ===============
  
  ===============
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif
  ===============
  BHO :
  ======
  Windows Registry Editor Version 5.00
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
  @=""
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A}]
  @="SWEETIE"
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{724d43a9-0d85-11d4-9908-00400523e39a}]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
  "NoExplorer"=dword:00000001
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
  
  ================
  Internet Explorer :
  ================
  
  ! REG.EXE VERSION 3.0
  
  HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main
  Start Page REG_SZ http://www.yoower.com/
  
  ! REG.EXE VERSION 3.0
  
  HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
  Start Page REG_SZ https://www.orange.fr/portail
  
  ========
  Services
  ========
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]
  
  Ndisuio : 0x3
  SharedAccess : 0x3
  wuauserv : 0x2
  =========
  
  =========================
  Environnement variables :
  =========================
  
  ALLUSERSPROFILE=C:\Documents and Settings\All Users
  APPDATA=C:\Documents and Settings\Administrateur\Application Data
  choix=1
  COLLECTIONID=COL8143
  CommonProgramFiles=C:\Program Files\Fichiers communs
  COMPUTERNAME=WKL1W5NZ550LYLH
  ComSpec=C:\WINNT\system32\cmd.exe
  HMSERVER=https://wwss1proa.cce.hp.com/wuss/servlet/WUSSServlet
  HOMEDRIVE=C:
  HOMEPATH=\Documents and Settings\Administrateur
  ITEMID=dj-22741-15
  LANG=1036
  LOGONSERVER=\\WKL1W5NZ550LYLH
  NUMBER_OF_PROCESSORS=1
  OS=Windows_NT
  Os2LibPath=C:\WINNT\system32\os2\dll;
  OSVER=win2KP
  Path=C:\WINNT\system32;C:\WINNT;C:\WINNT\System32\Wbem;C:\Program Files\Fichiers communs\Ulead Systems\MPEG;C:\Program Files\Fichiers communs\Adaptec Shared\System;C:\Program Files\Fichiers communs\Ulead Systems\DVD
  PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
  PROCESSOR_ARCHITECTURE=x86
  PROCESSOR_IDENTIFIER=x86 Family 15 Model 2 Stepping 7, GenuineIntel
  PROCESSOR_LEVEL=15
  PROCESSOR_REVISION=0207
  ProgramFiles=C:\Program Files
  PROMPT=$P$G
  SESSIONID=1138922331638htx6060142e23f:1092b02cdc8:1b3b
  SWUTVER=1.0.22.20030804
  SystemDrive=C:
  SystemRoot=C:\WINNT
  TEMP=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
  TIMEOUT=0
  TMP=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
  TOOLPATH=/C:\Program%20Files\HP\HP%20Software%20Update\install.htm
  UPDATEDIR=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\rad9F54A.tmp
  USERDOMAIN=WKL1W5NZ550LYLH
  USERNAME=Administrateur
  USERPROFILE=C:\Documents and Settings\Administrateur
  VERSION=3.0.5.001
  windir=C:\WINNT
  
  ==========
  Programs
  ==========
  
  25000 Sudoku
  Absolutist.com
  Activision Value
  Adaptec
  Adobe
  Ahead
  Alwil Software
  Amanita Muscaria Memory
  AntiMalware
  AntiVir PersonalEdition Classic
  Anuman Interactive
  ArcSoft
  AvRack
  AVS4YOU
  BD00010_.WMF
  BenQ
  Boonty
  BoontyGames
  Caere
  Canon
  CDDC-MahJongg
  Codemasters
  CONEXANT
  Cool Nestor
  Core Design
  Creative
  Daydream Software
  desktop.ini
  directx
  DX-Ball
  EA Games
  EA SPORTS
  Eidos Interactive
  eToro
  Fichiers communs
  folder.htt
  GamesBar
  GameSpy Arcade
  Ghostgum
  Google
  gs
  Hercules
  Hewlett-Packard
  hijckthis
  HP
  InstallShield Installation Information
  Internet Explorer
  Java
  JPP
  Kazaa
  Kikoo
  LimeWire
  Macrogaming
  Messenger
  MessengerPlus! 3
  Micro Application
  Micrografx
  microsoft frontpage
  Microsoft Games
  Microsoft Office
  Microsoft Visual Studio
  Microsoft Works
  MOX PC
  Mozilla Firefox
  msconfig.zip
  MSN Messenger
  MSXML 4.0
  NetMeeting
  Nomad-Agri
  NZP
  Objective Tarot
  OnePlayer
  orange
  Outlook Express
  Overland
  PC Inspector File Recovery
  PowerArchiver
  QSuite
  QuickTime
  QuickZip4
  Rage Software
  Red Storm Entertainment
  ReflexiveArcade
  RegCleaner
  Roxio
  SAGEM
  Securitoo
  Siber Systems
  Sierra On-Line
  SIM editor
  SiSLan
  Spybot - Search & Destroy
  StofWare
  trend micro
  Ubisoft
  Ulead Systems
  Uninstall Information
  VideoLAN
  Virgin Interactive
  vso
  wab.exe
  Wanadoo
  Wanadoo Messager
  Windows Draw
  Windows Media Components
  Windows Media Player
  Windows NT
  WindowsUpdate
  XnView
  YourTrain
  ZTE Corporation
  Zylom Games
  
  ¤¤¤¤¤¤¤¤¤¤ Files/folders :
  
  C:\Program Files\AntiMalware
  C:\Program Files\GamesBar
  C:\Program Files\KaZaA
  C:\WINNT\Downloaded Program Files\IaLdr32.inf
  C:\WINNT\Fonts\acrsec.fon
  C:\WINNT\Fonts\acrsecB.fon
  C:\WINNT\Fonts\acrsecI.fon
  C:\WINNT\pack.epk
  C:\WINNT\system32\MSINET.oca
  C:\WINNT\System32\SET127.tmp
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\eToroSetup.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\hpzmsi01.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\HPZscr01.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\Installer.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\jre-6u2-windows-i586-p-iftw_7070c3f7.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\richtx64.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\Setup.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\_isA5.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\_isA6.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\_isA7.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\_isAF.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\_isB0.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\_isB1.exe
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\tmp157.tmp
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\tmp2.tmp
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\tmp9C.tmp
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\tmpD1.tmp
  C:\Documents and Settings\Administrateur\LOCAL Settings\Temp\tmpD5.tmp
  
  ¤¤¤¤¤¤¤¤¤¤ Keys :
  
  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "AntiMalware"
  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "richtx64.exe"
  HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser "{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938}"
  "HKLM\SOFTWARE\Classes\AppID\Altnet Signing Module.exe"
  "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
  "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe"
  "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A}"
  "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A}"
  HKCR\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
  HKCR\CLSID\{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938}
  HKCR\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632
  HKCR\MgMediaPlayer.GifAnimator
  HKCR\MgMediaPlayer.GifAnimator.1
  HKCR\SWEETIE.IEToolbar
  HKCR\SWEETIE.IEToolbar.1
  HKCR\SWEETIE.SWEETIE
  HKCR\SWEETIE.SWEETIE.1
  HKCR\ToolBand.SWEETIE
  HKCR\ToolBand.SWEETIE.1
  HKCR\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
  HKCR\Typelib\{58906392-79C4-497C-ACC6-6942B59F1A08}
  HKCU\SOFTWARE\SWEETIE
  HKLM\Software\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
  HKLM\Software\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
  HKLM\Software\Classes\MgMediaPlayer.GifAnimator
  HKLM\Software\Classes\MgMediaPlayer.GifAnimator.1
  HKLM\Software\Classes\SWEETIE.IEToolbar
  HKLM\Software\Classes\SWEETIE.IEToolbar.1
  HKLM\Software\Classes\SWEETIE.SWEETIE
  HKLM\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
  HKLM\Software\Classes\TypeLib\{58906392-79C4-497C-ACC6-6942B59F1A08}
  HKLM\SOFTWARE\Macrogaming
  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0
  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
  
  =========
  Rootkits
  =========
  
  catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2009-12-07 16:59:19
  Windows 5.0.2195 Service Pack 4 NTFS
  
  scanning hidden processes ...
  
  scanning hidden services & system hive ...
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_05a9&Pid_4519&Mi_01\6&1110c199&0&1\Device Parameters]
  "HWRevision?U\x2039ì\x81ìÌ?"="100"
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_05a9&Pid_4519&Mi_01\6&1fbf2923&0&1\Device Parameters]
  "HWRevision?U\x2039ì\x81ìÌ?"="100"
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_05a9&Pid_4519&Mi_01\6&1fbf2923&1&1\Device Parameters]
  "HWRevision?U\x2039ì\x81ìÌ?"="100"
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_05a9&Pid_4519&Mi_01\6&1fbf2923&2&1\Device Parameters]
  "HWRevision?U\x2039ì\x81ìÌ?"="100"
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\USB\Vid_05a9&Pid_4519&Mi_01\6&1110c199&0&1\Device Parameters]
  "HWRevision?U\x2039ì\x81ìÌ?"="100"
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\USB\Vid_05a9&Pid_4519&Mi_01\6&1fbf2923&0&1\Device Parameters]
  "HWRevision?U\x2039ì\x81ìÌ?"="100"
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\USB\Vid_05a9&Pid_4519&Mi_01\6&1fbf2923&1&1\Device Parameters]
  "HWRevision?U\x2039ì\x81ìÌ?"="100"
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\USB\Vid_05a9&Pid_4519&Mi_01\6&1fbf2923&2&1\Device Parameters]
  "HWRevision?U\x2039ì\x81ìÌ?"="100"
  
  scanning hidden registry entries ...
  
  scanning hidden files ...
  
  scan completed successfully
  hidden processes: 0
  hidden services: 0
  hidden files: 0
  
  ¤¤¤¤¤¤¤¤¤¤ C:\WINNT\Prefetch :
  
  ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
  
  0
  
  Réagir

Malware indesirable

19 réponses

Discussions similaires

Newsletters