Publicités intempestives
Bonjour,
je me permet de vous envoyer ce post, car depuis quelques jour, des publicités envahissent mon bureau.
j'ai regardé un peu sur le net, et j'ai installé malwarebytes.
Ci-joint le rapport :
Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3510
Windows 6.0.6002 Service Pack 2 (Safe Mode)
Internet Explorer 8.0.6001.18882
20/02/2010 18:49:37
mbam-log-2010-02-20 (18-49-37).txt
Type de recherche: Examen rapide
Eléments examinés: 112503
Temps écoulé: 9 minute(s), 8 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 18
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 8
Fichier(s) infecté(s): 11
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\cscrptxt.cscrptxt (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e0ec6fba-f009-3535-95d6-b6390db27da1} (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{fd4a3efe-0682-4eb5-bdc0-a4444658cd98} (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{fd4a3efe-0682-4eb5-bdc0-a4444658cd98} (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{fd4a3efe-0682-4eb5-bdc0-a4444658cd98} (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fd4a3efe-0682-4eb5-bdc0-a4444658cd98} (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\cscrptxt.cscrptxt.1.0 (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{931c624a-1932-49f4-b1e4-b7ab60881f75} (Adware.EzLife) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{025b1d48-fda2-439b-a74d-ceca8b704028} (Adware.EzLife) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\ezLife (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ezLife (Adware.EzLife) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\ezLife (Adware.EzLife) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Smart-Ads-Solutions (Adware.SmartAds) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Smart-Ads-Solutions (Adware.SmartAds) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Smart-Ads-Solutions (Adware.SmartAds) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fda30905-ba9b-48c2-a721-f358459e34f2} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{fda30905-ba9b-48c2-a721-f358459e34f2} (Trojan.BHO) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\softwarehelper (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ezlife (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rthdbpl (Trojan.Agent) -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
C:\Program Files\Smart-Ads-Solutions (Adware.SmartAds) -> Quarantined and deleted successfully.
C:\Program Files\Smart-Ads-Solutions\SmartAds (Adware.SmartAds) -> Quarantined and deleted successfully.
C:\Program Files\Smart-Ads-Solutions\SmartAds\1.3.2.0 (Adware.SmartAds) -> Quarantined and deleted successfully.
C:\Program Files\Smart-Ads-Solutions\SmartAds\1.3.6.0 (Adware.SmartAds) -> Quarantined and deleted successfully.
C:\Program Files\ezLife (Adware.EzLife) -> Quarantined and deleted successfully.
C:\Program Files\ezLife\ezLife (Adware.EzLife) -> Quarantined and deleted successfully.
C:\Program Files\ezLife\ezLife\1.3.2.0 (Adware.EzLife) -> Quarantined and deleted successfully.
C:\Program Files\ezLife\ezLife\1.3.6.0 (Adware.EzLife) -> Quarantined and deleted successfully.
Fichier(s) infecté(s):
C:\Users\Yoan\AppData\Roaming\EoRezo\SoftwareUpdate\SoftwareUpdateHP.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
C:\Windows\System32\ixohgcxm.dll (Adware.EZlife) -> Quarantined and deleted successfully.
C:\Program Files\Smart-Ads-Solutions\SmartAds\1.3.2.0\SmartAdsxtra.dll (Adware.SmartAds) -> Quarantined and deleted successfully.
C:\Program Files\Smart-Ads-Solutions\SmartAds\1.3.2.0\uninstall.exe (Adware.SmartAds) -> Quarantined and deleted successfully.
C:\Program Files\Smart-Ads-Solutions\SmartAds\1.3.6.0\SmartAdsxtra.dll (Adware.SmartAds) -> Quarantined and deleted successfully.
C:\Program Files\Smart-Ads-Solutions\SmartAds\1.3.6.0\uninstall.exe (Adware.SmartAds) -> Quarantined and deleted successfully.
C:\Program Files\ezLife\ezLife\1.3.2.0\uninstall.exe (Adware.EzLife) -> Quarantined and deleted successfully.
C:\Program Files\ezLife\ezLife\1.3.6.0\ezLifextra.dll (Adware.EzLife) -> Quarantined and deleted successfully.
C:\Program Files\ezLife\ezLife\1.3.6.0\uninstall.exe (Adware.EzLife) -> Quarantined and deleted successfully.
C:\Users\Yoan\AppData\Roaming\SystemProc\lsass.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\zbzppvbv.dll (Trojan.BHO) -> Quarantined and deleted successfully.
Merci d'avance.
je me permet de vous envoyer ce post, car depuis quelques jour, des publicités envahissent mon bureau.
j'ai regardé un peu sur le net, et j'ai installé malwarebytes.
Ci-joint le rapport :
Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3510
Windows 6.0.6002 Service Pack 2 (Safe Mode)
Internet Explorer 8.0.6001.18882
20/02/2010 18:49:37
mbam-log-2010-02-20 (18-49-37).txt
Type de recherche: Examen rapide
Eléments examinés: 112503
Temps écoulé: 9 minute(s), 8 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 18
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 8
Fichier(s) infecté(s): 11
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\cscrptxt.cscrptxt (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e0ec6fba-f009-3535-95d6-b6390db27da1} (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{fd4a3efe-0682-4eb5-bdc0-a4444658cd98} (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{fd4a3efe-0682-4eb5-bdc0-a4444658cd98} (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{fd4a3efe-0682-4eb5-bdc0-a4444658cd98} (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fd4a3efe-0682-4eb5-bdc0-a4444658cd98} (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\cscrptxt.cscrptxt.1.0 (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{931c624a-1932-49f4-b1e4-b7ab60881f75} (Adware.EzLife) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{025b1d48-fda2-439b-a74d-ceca8b704028} (Adware.EzLife) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\ezLife (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ezLife (Adware.EzLife) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\ezLife (Adware.EzLife) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Smart-Ads-Solutions (Adware.SmartAds) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Smart-Ads-Solutions (Adware.SmartAds) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Smart-Ads-Solutions (Adware.SmartAds) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fda30905-ba9b-48c2-a721-f358459e34f2} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{fda30905-ba9b-48c2-a721-f358459e34f2} (Trojan.BHO) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\softwarehelper (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ezlife (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rthdbpl (Trojan.Agent) -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
C:\Program Files\Smart-Ads-Solutions (Adware.SmartAds) -> Quarantined and deleted successfully.
C:\Program Files\Smart-Ads-Solutions\SmartAds (Adware.SmartAds) -> Quarantined and deleted successfully.
C:\Program Files\Smart-Ads-Solutions\SmartAds\1.3.2.0 (Adware.SmartAds) -> Quarantined and deleted successfully.
C:\Program Files\Smart-Ads-Solutions\SmartAds\1.3.6.0 (Adware.SmartAds) -> Quarantined and deleted successfully.
C:\Program Files\ezLife (Adware.EzLife) -> Quarantined and deleted successfully.
C:\Program Files\ezLife\ezLife (Adware.EzLife) -> Quarantined and deleted successfully.
C:\Program Files\ezLife\ezLife\1.3.2.0 (Adware.EzLife) -> Quarantined and deleted successfully.
C:\Program Files\ezLife\ezLife\1.3.6.0 (Adware.EzLife) -> Quarantined and deleted successfully.
Fichier(s) infecté(s):
C:\Users\Yoan\AppData\Roaming\EoRezo\SoftwareUpdate\SoftwareUpdateHP.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
C:\Windows\System32\ixohgcxm.dll (Adware.EZlife) -> Quarantined and deleted successfully.
C:\Program Files\Smart-Ads-Solutions\SmartAds\1.3.2.0\SmartAdsxtra.dll (Adware.SmartAds) -> Quarantined and deleted successfully.
C:\Program Files\Smart-Ads-Solutions\SmartAds\1.3.2.0\uninstall.exe (Adware.SmartAds) -> Quarantined and deleted successfully.
C:\Program Files\Smart-Ads-Solutions\SmartAds\1.3.6.0\SmartAdsxtra.dll (Adware.SmartAds) -> Quarantined and deleted successfully.
C:\Program Files\Smart-Ads-Solutions\SmartAds\1.3.6.0\uninstall.exe (Adware.SmartAds) -> Quarantined and deleted successfully.
C:\Program Files\ezLife\ezLife\1.3.2.0\uninstall.exe (Adware.EzLife) -> Quarantined and deleted successfully.
C:\Program Files\ezLife\ezLife\1.3.6.0\ezLifextra.dll (Adware.EzLife) -> Quarantined and deleted successfully.
C:\Program Files\ezLife\ezLife\1.3.6.0\uninstall.exe (Adware.EzLife) -> Quarantined and deleted successfully.
C:\Users\Yoan\AppData\Roaming\SystemProc\lsass.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\zbzppvbv.dll (Trojan.BHO) -> Quarantined and deleted successfully.
Merci d'avance.
Configuration: Windows Vista / Firefox 3.5.8
25 réponses
Résumé de la discussion
Les messages décrivent des publicités envahissantes et des infections associées à Adware et Rogue, détectées après l’analyse Malwarebytes qui a quarantainé et supprimé des éléments tels que Adware.EZlife, Adware.SmartAds et Rogue.Eorezo. Le rapport liste des clés et valeurs du registre infectées, des fichiers et dossiers supprimés ou mis en quarantaine, et des composants tels que Browser Helper Objects, Run et autres éléments auto-exécutables nettoyés ou désinstallés. D'autres éléments incluent des rapports RSIT et HijackThis, et une réponse indique qu'un changement d’antivirus a été effectué, avec une amélioration notable mais sans prise de position définitive sur l’état.
-
Bonjour,
Moi aussi j'ai le même problème.
Fenêtres pub intempestives.
Elles sont affichées par le logiciel :
http://www.offerbox.com/fr/?tsrc=bm&eme=O06GPFR16A2276153
Nom : OfferBox Editreur : Secure Digital Services
Que je n'arrive pas à désactiver à partir du Panneau de Configuration de Windows.
BitDefender m'indique qu' "un programme non autoriseé essaye d'accéder à votre ordinateur"
donc je ne l'autorise pas et la désinstallation ne se fait pas.
Je ne me souviens pas avoir chargé ce programme.
Dommage pour ceux qui ont acceptés de participer à ce programme d'affichage, je lis leur
marque pour ne pas l'acheter car je suis en colère.
Merci de me dire si vous savez comment désinstaller ce programme.
Cordialement. -
Contributeur sécuritéplus de pub ?
-
C'est bon j'ai changé mon antivirus en suivant tes conseils, je te remercie beaucoup pour toute ton aide !!!
-
Contributeur sécuritéoui fini si ta pas d'autre soucie
commencer par desintaller proprement avast içi la marcha a suivre
https://www.commentcamarche.net/telecharger/securite/22859-utilitaire-de-desinstallation-de-avast/
pour antivir içi lien de téléchargement et réglage optimal
https://kerio.probb.fr/t3106-tuto-antivir-antivirus-version-franaise
-
Après avoir fait cette étape peut-on dire que j'ai fini la désinfection de mon ordinateur ? Si oui, j'aurai une autre question , j'aimerai changer d'antivirus car on m'a conseillé Antivir plutot qu'Avast je pense qu'il y a une procédure à faire, comment faut-il procéder ? Merci d'avance .
-
Contributeur sécuritéOk
tu va télécharger Ccleaner http://dl.commentcamarche.net/www.commentcamarche.net/download/files/ccsetup227_slim.exe
ouvre "Ccleaner" vas dans l'onglet "Option" puis "Avancé" puis décoches "Effacer uniquement les fichiers, du dossier temp de Windows, plus vieux que 48 heures."
. Puis vas dans l'onglet "Nettoyeur" fais "Analyse" puis "Lancer le nettoyage".
Puis vas dans l'onglet "Registre" puis fait "Chercher des erreurs" puis "Réparer les erreurs sélectionnée"
. Tu refais tous ca 4-5 fois (le nettoyage et le registre).
Puis reste dans "Ccleaner" puis va dans "Option" puis "Propriété" puis coches "Nettoyer automatiquement l'ordinateur au démarrage".
içi mode d'emploi pour ccleaner
https://www.malekal.com/tutoriel-ccleaner/
-----après tu redémarre
HijackThis et listkillm tu les supprime manuellement via ajout et suppression de programme
et tu refait un coup de ccleaner
ccleaner et malwarbyte tu les garde et utilise les souvent
-
Ci-joint le rapport ToolsCleaner :
[ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ]
--> Recherche:
C:\Ad-R.exe: trouvé !
C:\UsbFix.txt: trouvé !
C:\UsbFix: trouvé !
C:\Rsit: trouvé !
C:\Ad-remover: trouvé !
C:\Program Files\trend micro\HijackThis: trouvé !
C:\Program Files\trend micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\trend micro\HijackThis\hijackthis.log: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\HijackThis: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programmes\HijackThis: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HijackThis: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: trouvé !
C:\Users\Yoan\AppData\Roaming\Microsoft\Windows\Recent\HijackThis.lnk: trouvé !
C:\Users\Yoan\Desktop\HijackThis.lnk: trouvé !
C:\Users\Yoan\Desktop\HJTInstall.exe: trouvé !
C:\Users\Yoan\Desktop\mbr.log: trouvé !
C:\Users\Yoan\Desktop\UsbFix.exe: trouvé !
C:\Users\Yoan\Desktop\Rsit.exe: trouvé !
---------------------------------
--> Suppression:
C:\Ad-R.exe: supprimé !
C:\Program Files\trend micro\HijackThis\HijackThis.exe: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: ERREUR DE SUPPRESSION !!
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: ERREUR DE SUPPRESSION !!
C:\Users\Yoan\AppData\Roaming\Microsoft\Windows\Recent\HijackThis.lnk: supprimé !
C:\Users\Yoan\Desktop\HijackThis.lnk: supprimé !
C:\Users\Yoan\Desktop\HJTInstall.exe: supprimé !
C:\UsbFix.txt: ERREUR DE SUPPRESSION !!
C:\Program Files\trend micro\HijackThis\hijackthis.log: ERREUR DE SUPPRESSION !!
C:\Users\Yoan\Desktop\mbr.log: supprimé !
C:\Users\Yoan\Desktop\UsbFix.exe: supprimé !
C:\Users\Yoan\Desktop\Rsit.exe: supprimé !
C:\UsbFix: supprimé !
C:\Rsit: supprimé !
C:\Ad-remover: supprimé !
C:\Program Files\trend micro\HijackThis: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\HijackThis: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis: ERREUR DE SUPPRESSION !!
C:\Users\All Users\Microsoft\Windows\Start Menu\Programmes\HijackThis: ERREUR DE SUPPRESSION !!
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HijackThis: ERREUR DE SUPPRESSION !! -
Contributeur sécuritébonkour
pour nettoyer les fix qui ont servit
Ferme toutes les applications en cours, puis télécharge ToolsCleaner2 sur ton Bureau.
http://pc-system.fr/
Double clique sur ToolsCleaner2.exe >
puis Recherche
et sur Suppression
Note : ton bureau va disparaître, c'est normal. S'il n'apparaît pas à la fin du scan, fais la manip suivante :
CTRL+ALT+SUPP pour ouvrir le Gestionnaire des tâches.
Puis rends toi à l'onglet "Processus". Clique en haut à gauche sur Fichiers et choisis "Exécuter"
Tape explorer.exe et valide. Cela fera re-apparaître le Bureau
tu poste le rapport générer après suppression -
Ci-joint le rapport dr.web, désolé pour le retard petit problème :
2 Gérer les vues.EXE C:\Documents and Settings\Yoan\Desktop\Didactitiel Think ID 2008.1\1 - Démarrage, administration et présentation Adware.Ezula Quarantaine.
2 Gérer les vues.EXE C:\Users\Yoan\Desktop\Didactitiel Think ID 2008.1\1 - Démarrage, administration et présentation Adware.Ezula Chemin invalide pour le fichier -
Contributeur sécurité> Télécharge Dr.Web CureIt sur ton Bureau :
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
- Double clique <drweb-cureit.exe> et ensuite clique sur <Analyse>;
- Clique <Ok> à l'invite de l'analyse rapide. S'il trouve des processus infectés alors clique le bouton <Oui>.
Note : une fenêtre s'ouvrira avec options pour "Commander" ou "50% de réduction" : Quitte en cliquant le "X".
- Lorsque le scan rapide est terminé, clique sur le menu <Options> puis <Changer la configuration> ; Choisis l'onglet <Scanner>, et décoche <Analyse heuristique>. Clique ensuite sur <Ok>.
- De retour à la fenêtre principale : clique pour activer <Analyse complète>
- Clique le bouton avec flèche verte sur la droite, et le scan débutera.
- Clique <Oui> pour tout à l'invite "Désinfecter ?" lorsqu'un fichier est détecté, et ensuite clique "Désinfecter".
- Lorsque le scan sera complété, regarde si tu peux cliquer sur l' icône, adjacente aux fichiers détectés (plusieurs feuilles l'une sur l'autres). Si oui, alors clique dessus et ensuite clique sur l'icône <Suivant>, au dessous, et choisis <Déplacer en quarantaine l'objet indésirable>.
- Du menu principal de l'outil, au haut à gauche, clique sur le menu <Fichier> et choisis <Enregistrer le rapport>. Sauvegarde le rapport sur ton Bureau. Ce dernier se nommera DrWeb.csv
- Ferme Dr.Web Cureit
- Redémarre ton ordi (important car certains fichiers peuvent être déplacés/réparés au redémarrage).
- Suite au redémarrage, poste (Copie/Colle) le contenu du rapport de Dr.Web dans ta prochaine réponse. -
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:14:39, on 21/02/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18882)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\conime.exe
C:\Windows\explorer.exe
C:\Users\Yoan\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Users\Yoan\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Windows\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5555
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll
O3 - Toolbar: Veoh Video Compass - {52836EB0-631A-47B1-94A6-61F9D9112DAE} - C:\Program Files\Veoh Networks\Veoh Video Compass\SearchRecsPlugin.dll
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [iTunesHelper] "D:\iTunesHelper.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: Outil de notification Live Search.lnk = C:\Users\Yoan\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: SketchBook Snapshot.lnk = C:\Program Files\Autodesk\SketchBookPro2010\SketchBookSnapshot.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 5.0\resources\fr-fr\local\search.html
O8 - Extra context menu item: Ajouter au fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O20 - AppInit_DLLs: C:\Windows\System32\d3d10level932.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Loki Drivers Auto Removal (pr2agqwc) (pr2agqwc) - Cyanide - C:\Windows\system32\pr2agqwc.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
-
Contributeur sécuritéposte un rapport hijackthis (outil de diagnostic)
Télécharge http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe
--) Enregistre HJTInstall.exe sur ton bureau
--) Double-clique sur HJTInstall.exe pour lancer le programme
--) Par défaut, il s'installera içi C:\Programme Files\Trend Micro\HijackThis
--) Accepte la license en cliquant sur le bouton "I Accept"
--) Choisis l'option "Do a system scan and save a log file"
--) Clique sur "Save log" pour enregistrer le rapport qui s'ouvrira avec le bloc-note
--) Clique sur "Édition -> Sélectionner tout", puis sur "Édition -> Copier" pour copier tout le contenu du rapport
--) Colle le rapport que tu viens de copier sur ce forum
--) Ne fixe encore AUCUNE ligne,
-
Ci-joint le rapport :
############################## | UsbFix V6.097 |
User : Yoan (Administrateurs) # BANDINI-YOAN
Update on 20/02/2010 by El Desaparecido , C_XX & Chimay8
Start at: 19:26:27 | 21/02/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com
Intel(R) Core(TM)2 Duo CPU T8100 @ 2.10GHz
Microsoft® Windows Vista™ Édition Familiale Premium (6.0.6002 32-bit) # Service Pack 2
Internet Explorer 8.0.6001.18882
Windows Firewall Status : Enabled
C:\ -> Disque fixe local # 137,26 Go (43,05 Go free) [OS] # NTFS
D:\ -> Disque fixe local # 149,05 Go (14,75 Go free) [DATA] # NTFS
E:\ -> Disque fixe local # 11,79 Go (2,14 Go free) [HP_RECOVERY] # NTFS
F:\ -> Disque CD-ROM # 4,07 Go (0 Mo free) [Apr 03 06 21:58] # UDF
G:\ -> Disque CD-ROM
H:\ -> Disque CD-ROM
############################## | Processus actifs |
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\winlogon.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\FsUsbExService.Exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\runonce.exe
C:\Windows\system32\msfeedssync.exe
C:\Windows\system32\conime.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup
C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Windows\system32\DrvInst.exe
C:\Windows\System32\rundll32.exe
################## | Elements infectieux |
Supprimé ! C:\$Recycle.Bin\S-1-5-21-1623765812-1753939175-1515361805-500
Supprimé ! C:\$Recycle.Bin\S-1-5-21-2099339373-4272136863-904444506-1000
Supprimé ! C:\$Recycle.Bin\S-1-5-21-2099339373-4272136863-904444506-500
Supprimé ! D:\DATA
Supprimé ! D:\$Recycle.Bin\S-1-5-21-2099339373-4272136863-904444506-1000
Supprimé ! D:\$Recycle.Bin\S-1-5-21-2099339373-4272136863-904444506-500
Supprimé ! E:\$Recycle.Bin\S-1-5-21-2099339373-4272136863-904444506-1000
Supprimé ! E:\$Recycle.Bin\S-1-5-21-2099339373-4272136863-904444506-500
################## | Registre |
################## | Mountpoints2 |
Supprimé ! HKCU\...\Explorer\MountPoints2\{14d9fdfd-2a86-11dd-8bbd-001e68267804}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{2b5d8d56-f8d0-11dd-956e-001e68267804}\Shell\Auto\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{36869884-c5bd-11dd-9f91-001e68267804}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{382d2f93-83c5-11dd-90f9-001e68267804}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{58781b96-2510-11dd-a79c-001e68267804}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{8cd81091-c750-11dd-b46d-001e68267804}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{f385cd1a-9e71-11dd-abf5-001e68267804}\Shell\Auto\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{f6c7b00a-197d-11df-974c-001e68267804}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{f70cafa3-8246-11dd-b48e-001e68267804}\Shell\AutoRun\Command
################## | Listing des fichiers présent |
[21/02/2010 12:09|--a------|1263511] C:\AD-R.exe
[21/02/2010 13:03|--a------|12431] C:\Ad-Report-CLEAN[1].log
[21/02/2010 12:37|--a------|12266] C:\Ad-Report-SCAN[1].log
[29/11/2009 22:01|--a------|49] C:\authlic.dat
[21/02/2010 17:25|--a------|4] C:\autoexec.bat
[11/04/2009 07:36|-rahs----|333257] C:\bootmgr
[18/09/2006 22:43|--a------|10] C:\config.sys
[?|?|?] C:\hiberfil.sys
[27/11/2007 00:24|--ah-----|360] C:\IPH.PH
[21/02/2010 17:25|--a------|6998] C:\Kill'em.txt
[21/02/2010 15:17|--a------|24798] C:\List'em.txt
[?|?|?] C:\pagefile.sys
[21/02/2010 19:32|--a------|5107] C:\UsbFix.txt
[07/10/1999 13:36|--a------|62976] D:\3dfx.dll
[26/10/2009 08:38|--a------|59083] D:\Acknowledgements.rtf
[05/03/2008 15:30|---------|1348242] D:\Apr2005_d3dx9_25_x64.cab
[05/03/2008 15:30|---------|1079850] D:\Apr2005_d3dx9_25_x86.cab
[05/03/2008 15:30|---------|1398718] D:\Apr2006_d3dx9_30_x64.cab
[05/03/2008 15:30|---------|1116109] D:\Apr2006_d3dx9_30_x86.cab
[05/03/2008 15:30|---------|917318] D:\Apr2006_MDX1_x86.cab
[05/03/2008 15:30|---------|4163518] D:\Apr2006_MDX1_x86_Archive.cab
[05/03/2008 15:30|---------|180021] D:\Apr2006_XACT_x64.cab
[05/03/2008 15:30|---------|133991] D:\Apr2006_XACT_x86.cab
[05/03/2008 15:30|---------|87989] D:\Apr2006_xinput_x64.cab
[05/03/2008 15:30|---------|46898] D:\Apr2006_xinput_x86.cab
[05/03/2008 15:30|---------|702212] D:\APR2007_d3dx10_33_x64.cab
[05/03/2008 15:30|---------|699465] D:\APR2007_d3dx10_33_x86.cab
[05/03/2008 15:30|---------|1610958] D:\APR2007_d3dx9_33_x64.cab
[05/03/2008 15:30|---------|1609639] D:\APR2007_d3dx9_33_x86.cab
[05/03/2008 15:30|---------|199366] D:\APR2007_XACT_x64.cab
[05/03/2008 15:30|---------|154825] D:\APR2007_XACT_x86.cab
[05/03/2008 15:30|---------|100417] D:\APR2007_xinput_x64.cab
[05/03/2008 15:30|---------|56902] D:\APR2007_xinput_x86.cab
[05/03/2008 15:30|---------|1351430] D:\Aug2005_d3dx9_27_x64.cab
[05/03/2008 15:30|---------|1078532] D:\Aug2005_d3dx9_27_x86.cab
[05/03/2008 15:30|---------|183863] D:\AUG2006_XACT_x64.cab
[05/03/2008 15:30|---------|138195] D:\AUG2006_XACT_x86.cab
[05/03/2008 15:30|---------|88102] D:\AUG2006_xinput_x64.cab
[05/03/2008 15:30|---------|47018] D:\AUG2006_xinput_x86.cab
[05/03/2008 15:30|---------|855886] D:\AUG2007_d3dx10_35_x64.cab
[05/03/2008 15:30|---------|800467] D:\AUG2007_d3dx10_35_x86.cab
[05/03/2008 15:30|---------|1803760] D:\AUG2007_d3dx9_35_x64.cab
[05/03/2008 15:30|---------|1711752] D:\AUG2007_d3dx9_35_x86.cab
[05/03/2008 15:30|---------|201696] D:\AUG2007_XACT_x64.cab
[05/03/2008 15:30|---------|156612] D:\AUG2007_XACT_x86.cab
[05/03/2008 15:30|---------|1156363] D:\BDANT.cab
[05/03/2008 15:30|---------|976020] D:\BDAXP.cab
[07/10/1999 13:15|-ra------|172032] D:\binkw32.dll
[28/10/2009 20:21|--a------|722160] D:\CDDBControlApple.dll
[07/10/1999 13:36|--a------|80384] D:\d3ddll.dll
[07/10/1999 13:15|-ra------|56832] D:\D3DPoly.dll
[05/03/2008 15:30|---------|1358864] D:\Dec2005_d3dx9_28_x64.cab
[05/03/2008 15:30|---------|1080344] D:\Dec2005_d3dx9_28_x86.cab
[05/03/2008 15:30|---------|213767] D:\DEC2006_d3dx10_00_x64.cab
[05/03/2008 15:30|---------|192680] D:\DEC2006_d3dx10_00_x86.cab
[05/03/2008 15:30|---------|1572114] D:\DEC2006_d3dx9_32_x64.cab
[05/03/2008 15:30|---------|1575336] D:\DEC2006_d3dx9_32_x86.cab
[05/03/2008 15:30|---------|193435] D:\DEC2006_XACT_x64.cab
[05/03/2008 15:30|---------|146559] D:\DEC2006_XACT_x86.cab
[07/10/1999 13:15|-ra------|39424] D:\DMAGlide.dll
[07/10/1999 13:15|-ra------|60416] D:\Dmavideo.dll
[05/03/2008 15:30|---------|97288] D:\DSETUP.dll
[05/03/2008 15:30|---------|1694728] D:\dsetup32.dll
[05/03/2008 15:30|---------|47596] D:\dxdllreg_x86.cab
[05/03/2008 15:30|---------|13265040] D:\dxnt.cab
[05/03/2008 15:30|---------|527880] D:\DXSETUP.exe
[05/03/2008 15:30|---------|97396] D:\dxupdate.cab
[05/03/2008 15:30|---------|1248387] D:\Feb2005_d3dx9_24_x64.cab
[05/03/2008 15:30|---------|1014113] D:\Feb2005_d3dx9_24_x86.cab
[05/03/2008 15:30|---------|1363684] D:\Feb2006_d3dx9_29_x64.cab
[05/03/2008 15:30|---------|1085608] D:\Feb2006_d3dx9_29_x86.cab
[05/03/2008 15:30|---------|179247] D:\Feb2006_XACT_x64.cab
[05/03/2008 15:30|---------|133297] D:\Feb2006_XACT_x86.cab
[05/03/2008 15:30|---------|198275] D:\FEB2007_XACT_x64.cab
[05/03/2008 15:30|---------|151583] D:\FEB2007_XACT_x86.cab
[29/04/2004 10:27|--a------|479232] D:\gta2 manager.exe
[27/04/2004 14:29|--a------|1667072] D:\gta2.exe
[28/10/2009 20:21|--a------|648480] D:\iPodUpdaterExt.dll
[28/10/2009 20:21|--a------|111912] D:\ITDetector.ocx
[28/10/2009 20:21|--a------|14769448] D:\iTunes.dll
[28/10/2009 20:21|--a------|10358048] D:\iTunes.exe
[28/10/2009 20:21|--a------|384800] D:\iTunesAdmin.dll
[28/10/2009 20:21|--a------|211232] D:\iTunesHelper.dll
[28/10/2009 20:21|--a------|141600] D:\iTunesHelper.exe
[28/10/2009 20:21|--a------|124192] D:\iTunesMiniPlayer.dll
[28/10/2009 20:21|--a------|294688] D:\iTunesOutlookAddIn.dll
[28/10/2009 20:21|--a------|292640] D:\iTunesPhotoProcessor.exe
[05/03/2008 15:30|---------|1336890] D:\Jun2005_d3dx9_26_x64.cab
[05/03/2008 15:30|---------|1065813] D:\Jun2005_d3dx9_26_x86.cab
[05/03/2008 15:30|---------|181745] D:\JUN2006_XACT_x64.cab
[05/03/2008 15:30|---------|134631] D:\JUN2006_XACT_x86.cab
[05/03/2008 15:30|---------|702644] D:\JUN2007_d3dx10_34_x64.cab
[05/03/2008 15:30|---------|702072] D:\JUN2007_d3dx10_34_x86.cab
[05/03/2008 15:30|---------|1611374] D:\JUN2007_d3dx9_34_x64.cab
[05/03/2008 15:30|---------|1610886] D:\JUN2007_d3dx9_34_x86.cab
[05/03/2008 15:30|---------|200722] D:\JUN2007_XACT_x64.cab
[05/03/2008 15:30|---------|156509] D:\JUN2007_XACT_x86.cab
[05/03/2008 15:30|---------|848132] D:\Mar2008_d3dx10_37_x64.cab
[05/03/2008 15:30|---------|821508] D:\Mar2008_d3dx10_37_x86.cab
[05/03/2008 15:30|---------|1773110] D:\Mar2008_d3dx9_37_x64.cab
[05/03/2008 15:30|---------|1446530] D:\Mar2008_d3dx9_37_x86.cab
[05/03/2008 15:30|---------|58306] D:\Mar2008_X3DAudio_x64.cab
[05/03/2008 15:30|---------|25115] D:\Mar2008_X3DAudio_x86.cab
[05/03/2008 15:30|---------|125584] D:\Mar2008_XACT_x64.cab
[05/03/2008 15:30|---------|96982] D:\Mar2008_XACT_x86.cab
[05/03/2008 15:30|---------|254442] D:\Mar2008_XAudio_x64.cab
[05/03/2008 15:30|---------|229498] D:\Mar2008_XAudio_x86.cab
[07/10/1999 13:15|-ra------|331776] D:\mss32.dll
[07/10/1999 13:12|-ra------|49152] D:\MSSDS3DH.M3D
[05/03/2008 15:30|---------|867848] D:\NOV2007_d3dx10_36_x64.cab
[05/03/2008 15:30|---------|807132] D:\NOV2007_d3dx10_36_x86.cab
[05/03/2008 15:30|---------|1805306] D:\NOV2007_d3dx9_36_x64.cab
[05/03/2008 15:30|---------|1712608] D:\NOV2007_d3dx9_36_x86.cab
[05/03/2008 15:30|---------|49392] D:\NOV2007_X3DAudio_x64.cab
[05/03/2008 15:30|---------|21744] D:\NOV2007_X3DAudio_x86.cab
[05/03/2008 15:30|---------|200010] D:\NOV2007_XACT_x64.cab
[05/03/2008 15:30|---------|151512] D:\NOV2007_XACT_x86.cab
[05/03/2008 15:30|---------|86925] D:\Oct2005_xinput_x64.cab
[05/03/2008 15:30|---------|46247] D:\Oct2005_xinput_x86.cab
[05/03/2008 15:30|---------|1413862] D:\OCT2006_d3dx9_31_x64.cab
[05/03/2008 15:30|---------|1128177] D:\OCT2006_d3dx9_31_x86.cab
[05/03/2008 15:30|---------|183321] D:\OCT2006_XACT_x64.cab
[05/03/2008 15:30|---------|138977] D:\OCT2006_XACT_x86.cab
[07/10/1999 13:15|-ra------|452188] D:\Polygon.dll
[29/04/2004 10:47|--a------|5516] D:\readme.txt
[26/04/2002 14:49|--a------|5694] D:\rockstar.ico
[11/09/2005 16:18|---hs----|340] E:\AUTOMODE
[08/05/2008 16:34|---hs----|13] E:\BLOCK.RIN
[04/10/2006 00:02|---hs----|438328] E:\bootmgr
[06/09/2008 12:19|---hs----|891] E:\Desktop.ini
[10/09/2002 17:14|---hs----|8134] E:\Folder.htt
[08/05/2008 16:49|--ahs----|816] E:\MASTER.LOG
[16/09/2002 15:37|---hs----|181898] E:\protect.chinese hong kong
[16/09/2002 15:37|---hs----|181916] E:\protect.chinese simplified
[16/09/2002 15:37|---hs----|181898] E:\protect.chinese traditional
[27/04/2006 17:19|---hs----|181865] E:\protect.czech
[03/11/2005 16:21|---hs----|181726] E:\protect.danish
[10/09/2002 14:56|---hs----|181605] E:\protect.dutch
[10/09/2002 14:50|---hs----|181651] E:\protect.ed
[22/11/2004 16:28|---hs----|181648] E:\protect.english
[03/11/2005 16:20|---hs----|181673] E:\protect.finnish
[03/11/2005 16:19|---hs----|181736] E:\protect.french
[03/11/2005 16:18|---hs----|181669] E:\protect.german
[23/11/2005 16:56|---hs----|182689] E:\protect.greek
[23/01/2006 10:18|---hs----|182605] E:\protect.hebrew
[28/08/2007 15:58|---hs----|181696] E:\protect.hungarian
[03/11/2005 16:17|---hs----|181554] E:\protect.italian
[10/04/2006 10:46|---hs----|182566] E:\protect.japanese
[24/11/2005 12:24|---hs----|218295] E:\protect.korean
[03/11/2005 16:15|---hs----|181578] E:\protect.norwegian
[25/04/2006 15:44|---hs----|181789] E:\protect.polish
[03/11/2005 16:13|---hs----|181624] E:\protect.portuguese
[27/10/2005 20:24|---hs----|181882] E:\protect.portuguese brazilian
[28/06/2004 09:52|---hs----|211936] E:\protect.russian
[03/11/2005 16:11|---hs----|181586] E:\protect.spanish
[10/09/2002 15:15|---hs----|181602] E:\protect.swedish
[12/08/2003 11:37|---hs----|181783] E:\protect.turkish
[04/03/2008 09:13|---hs----|0] E:\USER
[13/12/2005 14:22|-ra------|571809792] F:\AOE III DISC 1.iso
[13/12/2005 14:27|-ra------|640905216] F:\AOE III DISC 2.iso
[13/12/2005 14:28|-ra------|530524160] F:\AOE III DISC 3.iso
[13/03/2006 16:17|-ra------|752291196] F:\Reussir Ou Mourir 50 Cent FR 2006.avi
[16/02/2064 04:07|---------|0] J:\.metadata_never_index
################## | Vaccination |
# C:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido).
# D:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido).
# E:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido).
# J:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido).
################## | Upload |
Veuillez envoyer le fichier : C:\UsbFix_Upload_Me_Bandini-Yoan.zip : https://www.ionos.fr/?affiliate_id=77097
Merci pour votre contribution .
################## | ! Fin du rapport # UsbFix V6.097 ! | -
Contributeur sécuritéSuppression
Branche tes sources de données externes à ton PC, (clé USB, disque dur externe......) susceptibles d'avoir été infectés sans les ouvrir
(1) Double clic sur le raccourci UsbFix présent sur ton bureau
(2) Choisi l option 2 ( Suppression )
Ton bureau disparaitra et le pc redémarrera .
Au redémarrage , UsbFix scannera ton pc , laisse travailler l outil.
Ensuite poste le rapport UsbFix.txt qui apparaitra avec le bureau .
Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque.( C:\UsbFix.txt )
( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )
-
Ci-Joint le rapport :
############################## | UsbFix V6.097 |
User : Yoan (Administrateurs) # BANDINI-YOAN
Update on 20/02/2010 by El Desaparecido , C_XX & Chimay8
Start at: 18:56:09 | 21/02/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com
Intel(R) Core(TM)2 Duo CPU T8100 @ 2.10GHz
Microsoft® Windows Vista™ Édition Familiale Premium (6.0.6002 32-bit) # Service Pack 2
Internet Explorer 8.0.6001.18882
Windows Firewall Status : Enabled
C:\ -> Disque fixe local # 137,26 Go (40,45 Go free) [OS] # NTFS
D:\ -> Disque fixe local # 149,05 Go (14,75 Go free) [DATA] # NTFS
E:\ -> Disque fixe local # 11,79 Go (2,14 Go free) [HP_RECOVERY] # NTFS
F:\ -> Disque CD-ROM # 4,07 Go (0 Mo free) [Apr 03 06 21:58] # UDF
G:\ -> Disque CD-ROM
H:\ -> Disque CD-ROM
I:\ -> Disque amovible # 1,97 Go (368,19 Mo free) # FAT
J:\ -> Disque amovible # 15,03 Go (6,42 Go free) [IPOD YO YO] # FAT32
############################## | Processus actifs |
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\FsUsbExService.Exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Windows\system32\nvvsvc.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\conime.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\QuickTime\QTTask.exe
D:\iTunesHelper.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Users\Yoan\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Users\Yoan\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wbem\wmiprvse.exe
################## | Elements infectieux |
D:\DATA
################## | Registre |
################## | Mountpoints2 |
HKCU\..\..\Explorer\MountPoints2\{14d9fdfd-2a86-11dd-8bbd-001e68267804}
shell\AutoRun\command =C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs
HKCU\..\..\Explorer\MountPoints2\{2b5d8d56-f8d0-11dd-956e-001e68267804}
shell\Auto\command =G:\RavMonE.exe e
shell\AutoRun\command =C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL G:\RavMonE.exe e
HKCU\..\..\Explorer\MountPoints2\{36869884-c5bd-11dd-9f91-001e68267804}
shell\AutoRun\command =C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL G:\demarrer.html
HKCU\..\..\Explorer\MountPoints2\{382d2f93-83c5-11dd-90f9-001e68267804}
shell\AutoRun\command =G:\memorybar.exe
HKCU\..\..\Explorer\MountPoints2\{58781b96-2510-11dd-a79c-001e68267804}
shell\AutoRun\command =wd_windows_tools\setup.exe
HKCU\..\..\Explorer\MountPoints2\{8cd81091-c750-11dd-b46d-001e68267804}
shell\AutoRun\command =G:\ClickMe.exe
HKCU\..\..\Explorer\MountPoints2\{f385cd1a-9e71-11dd-abf5-001e68267804}
shell\Auto\command =AdobeR.exe e
shell\AutoRun\command =C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e
HKCU\..\..\Explorer\MountPoints2\{f6c7b00a-197d-11df-974c-001e68267804}
shell\AutoRun\command =G:\autorun.exe
shell\directx\command =G:\DirectX9\dxsetup.exe
shell\setup\command =G:\setup.exe
HKCU\..\..\Explorer\MountPoints2\{f70cafa3-8246-11dd-b48e-001e68267804}
shell\AutoRun\command =G:\setupSNK.exe
################## | Vaccin |
(!) Cet ordinateur n'est pas vacciné !
################## | ! Fin du rapport # UsbFix V6.097 ! | -
Contributeur sécuritéTélécharge UsbFix de C_XX & Chiquitine29
http://pagesperso-orange.fr/NosTools/Chiquitine29/UsbFix.exe
(!) Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d'avoir été infectées sans les ouvrir
• Double clic sur "UsbFix.exe" présent sur ton bureau ( clic droit "exécuter en tant qu'administrateur" pour Vista & 7 )
• Choisis l'option F pour français et tape sur [entrée] .
• Choisis l'option 1 ( Recherche ) et tape sur [entrée] .
• Laisse travailler l'outil.
• Ensuite poste le rapport UsbFix.txt qui apparaitra.
• Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt )
( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller )
• Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus. -
ci-joint le rapport RSIT :
Logfile of random's system information tool 1.06 (written by random/random)
Run by Yoan at 2010-02-21 17:38:19
Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 2
System drive C: has 39 GB (28%) free of 141 GB
Total RAM: 3070 MB (47% free)
HijackThis download failed
======Scheduled tasks folder======
C:\Windows\tasks\User_Feed_Synchronization-{24E665EE-AC97-4FB6-9D81-6C2346F8DD7F}.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Aide pour le lien d'Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2009-12-18 61888]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
Click-to-Call BHO - C:\Program Files\Windows Live\Messenger\wlchtc.dll [2009-02-06 73072]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll [2007-07-12 501136]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C554162-8CB7-45A4-B8F4-8EA1C75885F9}]
AOL Toolbar Launcher - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll [2007-07-30 1086816]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - c:\program files\google\googletoolbar1.dll [2008-05-18 770048]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe PDF Conversion Toolbar Helper - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [2009-12-18 320928]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}
{DE9C389F-3316-41A7-809B-AA305ED9D922} - AOL Toolbar - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll [2007-07-30 1086816]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar1.dll [2008-05-18 770048]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [2009-12-18 320928]
{0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - Veoh Web Player Video Finder - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll [2009-04-03 429816]
{52836EB0-631A-47B1-94A6-61F9D9112DAE} - Veoh Video Compass - C:\Program Files\Veoh Networks\Veoh Video Compass\SearchRecsPlugin.dll [2009-02-14 404216]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SynTPStart"=C:\Program Files\Synaptics\SynTP\SynTPStart.exe [2007-09-15 102400]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-08-17 4702208]
"IAAnotif"=C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [2007-07-25 174616]
"QlbCtrl"=C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [2007-09-19 202032]
"OnScreenDisplay"=C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe [2007-09-04 554320]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"hpWirelessAssistant"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [2007-09-13 480560]
"WAWifiMessage"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe [2007-01-08 311296]
""= []
"Acrobat Assistant 8.0"=C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe [2009-12-18 624056]
"UCam_Menu"=C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [2007-09-13 222504]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2008-03-28 1045800]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-09-05 417792]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-12-11 948672]
"NPSStartup"= []
"iTunesHelper"=D:\iTunesHelper.exe [2009-10-28 141600]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-11-25 81000]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2009-12-18 40368]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2009-10-30 369200]
"ares"=C:\Program Files\Ares\Ares.exe -h []
"liberiwo"=C:\Users\Yoan\AppData\Local\bcvrbw\vxntsftav.exe [2010-02-19 278784]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe [2009-12-18 624056]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2009-12-18 40368]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
c:\Program Files\Common Files\Symantec Shared\ccApp.exe []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]
[ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [2005-02-16 49152]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPAdvisor]
C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe [2007-10-01 1783136]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2007-08-23 455968]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
C:\Windows\system32\NvCpl.dll [2009-11-20 12685928]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
C:\Windows\system32\NvMcTray.dll [2009-11-20 110184]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService]
C:\Program Files\HP\QuickPlay\QPService.exe [2007-09-30 181544]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe [2009-09-05 417792]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe [2007-01-17 634880]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe [2007-07-12 132496]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UCam_Menu]
C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [2007-09-13 222504]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
C:\PROGRA~1\Adobe\ACROBA~1.0\Acrobat\ADOBEC~1.EXE [2009-12-18 738776]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Lancement rapide d'Adobe Acrobat.lnk]
C:\Windows\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe [2009-04-04 295606]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
SketchBook Snapshot.lnk - C:\Program Files\Autodesk\SketchBookPro2010\SketchBookSnapshot.exe
C:\Users\Yoan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Outil de notification Live Search.lnk - C:\Users\Yoan\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="C:\Windows\System32\d3d10level932.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{14d9fdfd-2a86-11dd-8bbd-001e68267804}]
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2b5d8d56-f8d0-11dd-956e-001e68267804}]
shell\Auto\command - G:\RavMonE.exe e
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL G:\RavMonE.exe e
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{36869884-c5bd-11dd-9f91-001e68267804}]
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL G:\demarrer.html
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{382d2f93-83c5-11dd-90f9-001e68267804}]
shell\AutoRun\command - G:\memorybar.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{58781b96-2510-11dd-a79c-001e68267804}]
shell\AutoRun\command - wd_windows_tools\setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8cd81091-c750-11dd-b46d-001e68267804}]
shell\AutoRun\command - G:\ClickMe.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f385cd1a-9e71-11dd-abf5-001e68267804}]
shell\Auto\command - AdobeR.exe e
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f6c7b00a-197d-11df-974c-001e68267804}]
shell\AutoRun\command - G:\autorun.exe
shell\directx\command - G:\DirectX9\dxsetup.exe
shell\setup\command - G:\setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f70cafa3-8246-11dd-b48e-001e68267804}]
shell\AutoRun\command - G:\setupSNK.exe
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - "C:\Program Files\Adobe\Adobe Dreamweaver CS3\Dreamweaver.exe","%1"
======List of files/folders created in the last 1 months======
2010-02-21 17:38:19 ----D---- C:\rsit
2010-02-21 17:38:19 ----D---- C:\Program Files\trend micro
2010-02-21 17:27:41 ----D---- C:\Kill'em
2010-02-21 16:54:51 ----A---- C:\Kill'em.txt
2010-02-21 15:35:24 ----D---- C:\Program Files\CCleaner
2010-02-21 14:36:22 ----A---- C:\List'em.txt
2010-02-21 14:35:43 ----D---- C:\Program Files\List_Kill'em
2010-02-21 12:11:31 ----D---- C:\Ad-Remover
2010-02-21 12:09:13 ----A---- C:\AD-R.exe
2010-02-20 18:35:54 ----D---- C:\Users\Yoan\AppData\Roaming\Malwarebytes
2010-02-20 18:35:44 ----D---- C:\ProgramData\Malwarebytes
2010-02-20 18:35:42 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-02-20 16:54:11 ----A---- C:\Windows\ntbtlog.txt
2010-02-14 18:37:13 ----A---- C:\Windows\system32\d3dx9_2532.dll
2010-02-14 18:37:09 ----A---- C:\Windows\system32\d3d10level932.dll
2010-02-14 16:29:20 ----D---- C:\Program Files\DAEMON Tools Lite
2010-02-14 16:28:55 ----D---- C:\Users\Yoan\AppData\Roaming\DAEMON Tools Lite
2010-02-14 16:28:52 ----D---- C:\ProgramData\DAEMON Tools Lite
2010-02-11 10:56:04 ----D---- C:\Users\Yoan\AppData\Roaming\download
2010-02-10 12:57:06 ----A---- C:\Windows\system32\xinput1_1.dll
2010-02-10 12:57:06 ----A---- C:\Windows\system32\xactengine2_1.dll
2010-02-10 12:56:23 ----A---- C:\Windows\system32\d3dx9_30.dll
2010-02-10 12:56:21 ----A---- C:\Windows\system32\xactengine2_0.dll
2010-02-10 12:56:21 ----A---- C:\Windows\system32\x3daudio1_0.dll
2010-02-10 12:56:12 ----A---- C:\Windows\system32\d3dx9_28.dll
2010-02-10 12:56:04 ----A---- C:\Windows\system32\d3dx9_27.dll
2010-02-10 12:55:59 ----A---- C:\Windows\system32\d3dx9_26.dll
2010-02-10 12:55:59 ----A---- C:\Windows\system32\d3dx9_25.dll
2010-02-10 12:55:58 ----A---- C:\Windows\system32\d3dx9_24.dll
2010-02-10 12:55:24 ----D---- C:\Windows\85EBB28365AF4C539EBE7C0A232762F7.TMP
2010-02-10 12:48:30 ----D---- C:\Program Files\Sierra Entertainment
2010-02-10 12:45:39 ----D---- C:\Users\Yoan\AppData\Roaming\InstallShield
2010-02-10 10:19:44 ----A---- C:\Windows\system32\ntoskrnl.exe
2010-02-10 10:19:44 ----A---- C:\Windows\system32\ntkrnlpa.exe
2010-02-10 10:19:25 ----A---- C:\Windows\system32\quartz.dll
2010-02-10 10:19:24 ----A---- C:\Windows\system32\tsbyuv.dll
2010-02-10 10:19:24 ----A---- C:\Windows\system32\msyuv.dll
2010-02-10 10:19:24 ----A---- C:\Windows\system32\msvidc32.dll
2010-02-10 10:19:24 ----A---- C:\Windows\system32\msrle32.dll
2010-02-10 10:19:24 ----A---- C:\Windows\system32\mciavi32.dll
2010-02-10 10:19:24 ----A---- C:\Windows\system32\iyuv_32.dll
2010-02-10 10:19:23 ----A---- C:\Windows\system32\msvfw32.dll
2010-02-10 10:19:23 ----A---- C:\Windows\system32\avifil32.dll
2010-02-09 00:42:39 ----D---- C:\Users\Yoan\AppData\Roaming\Command & Conquer 3 Tiberium Wars Demo
2010-02-09 00:41:20 ----A---- C:\Windows\system32\d3dx9_32.dll
2010-02-09 00:41:18 ----A---- C:\Windows\system32\d3dx9_29.dll
2010-02-08 20:33:22 ----D---- C:\Program Files\WinZip
2010-01-31 16:10:30 ----A---- C:\Windows\system32\dxqhxnll.dll
2010-01-31 16:10:12 ----A---- C:\Windows\system32\dckicgbd.dll
2010-01-22 19:28:08 ----A---- C:\Windows\system32\t2embed.dll
2010-01-22 19:28:08 ----A---- C:\Windows\system32\fontsub.dll
2010-01-22 19:28:04 ----A---- C:\Windows\system32\mshtml.dll
2010-01-22 19:28:03 ----A---- C:\Windows\system32\ieframe.dll
2010-01-22 19:28:02 ----A---- C:\Windows\system32\wininet.dll
2010-01-22 19:28:02 ----A---- C:\Windows\system32\urlmon.dll
2010-01-22 19:28:02 ----A---- C:\Windows\system32\iertutil.dll
2010-01-22 19:28:01 ----A---- C:\Windows\system32\occache.dll
2010-01-22 19:28:01 ----A---- C:\Windows\system32\msfeedssync.exe
2010-01-22 19:28:01 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-01-22 19:28:01 ----A---- C:\Windows\system32\msfeeds.dll
2010-01-22 19:28:01 ----A---- C:\Windows\system32\jsproxy.dll
2010-01-22 19:28:01 ----A---- C:\Windows\system32\ieUnatt.exe
2010-01-22 19:28:01 ----A---- C:\Windows\system32\ieui.dll
2010-01-22 19:28:01 ----A---- C:\Windows\system32\iesysprep.dll
2010-01-22 19:28:01 ----A---- C:\Windows\system32\iesetup.dll
2010-01-22 19:28:01 ----A---- C:\Windows\system32\iernonce.dll
2010-01-22 19:28:01 ----A---- C:\Windows\system32\iepeers.dll
2010-01-22 19:28:01 ----A---- C:\Windows\system32\iedkcs32.dll
2010-01-22 19:28:01 ----A---- C:\Windows\system32\ie4uinit.exe
======List of files/folders modified in the last 1 months======
2010-02-21 17:38:19 ----RD---- C:\Program Files
2010-02-21 17:38:17 ----D---- C:\Windows\Temp
2010-02-21 17:28:57 ----D---- C:\Program Files\Mozilla Firefox
2010-02-21 17:25:52 ----D---- C:\Windows\Debug
2010-02-21 17:25:52 ----A---- C:\autoexec.bat
2010-02-21 17:25:44 ----SD---- C:\Windows\Downloaded Program Files
2010-02-21 14:36:43 ----D---- C:\Windows\System32
2010-02-21 14:36:43 ----D---- C:\Windows\inf
2010-02-21 14:36:43 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-02-21 13:02:10 ----D---- C:\Windows\Prefetch
2010-02-21 13:00:17 ----HD---- C:\ProgramData
2010-02-20 18:50:44 ----RSD---- C:\Windows\Fonts
2010-02-20 18:50:44 ----D---- C:\Windows\system32\drivers
2010-02-20 16:54:11 ----D---- C:\Windows
2010-02-19 17:39:38 ----D---- C:\Users\Yoan\AppData\Roaming\Adobe
2010-02-19 02:20:07 ----SHD---- C:\System Volume Information
2010-02-17 16:37:24 ----D---- C:\Users\Yoan\AppData\Roaming\LimeWire
2010-02-14 19:23:36 ----HD---- C:\Program Files\InstallShield Installation Information
2010-02-14 19:23:28 ----RSD---- C:\Windows\assembly
2010-02-14 19:22:39 ----SHD---- C:\Windows\Installer
2010-02-14 19:13:38 ----D---- C:\Program Files\Microsoft Games
2010-02-14 16:29:47 ----D---- C:\Windows\system32\catroot2
2010-02-10 13:58:38 ----D---- C:\Windows\winsxs
2010-02-10 13:48:26 ----D---- C:\Windows\system32\catroot
2010-02-10 13:43:40 ----D---- C:\Program Files\Windows Mail
2010-02-10 13:04:02 ----D---- C:\ProgramData\Microsoft Help
2010-02-10 12:55:21 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2010-02-09 13:34:08 ----D---- C:\Windows\system32\WDI
2010-02-09 01:39:30 ----D---- C:\Windows\system32\Tasks
2010-02-09 00:37:10 ----D---- C:\Program Files\Electronic Arts
2010-02-08 20:33:54 ----D---- C:\ProgramData\WinZip
2010-02-06 20:10:55 ----D---- C:\Program Files\Internet Explorer
2010-02-01 20:26:20 ----A---- C:\Windows\system32\mrt.exe
2010-01-25 15:15:20 ----D---- C:\Users\Yoan\AppData\Roaming\Apple Computer
2010-01-25 09:27:23 ----D---- C:\ProgramData\Apple
2010-01-25 01:03:48 ----D---- C:\ProgramData\Adobe
2010-01-22 20:09:51 ----D---- C:\Program Files\Microsoft Silverlight
2010-01-22 20:08:59 ----D---- C:\Windows\system32\migration
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2009-11-25 23120]
R1 aswSP;avast! Self Protection; C:\Windows\system32\drivers\aswSP.sys [2009-11-25 114768]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2009-11-25 48560]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\DRIVERS\aswFsBlk.sys [2009-11-25 20560]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\DRIVERS\aswMonFlt.sys [2009-11-25 53328]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2007-02-24 39936]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2007-01-23 42496]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2007-03-21 37376]
R3 CmBatt;Pilote pour Batterie à méthode de contrôle ACPI Microsoft; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-19 14208]
R3 FsUsbExDisk;FsUsbExDisk; \??\C:\Windows\system32\FsUsbExDisk.SYS [2009-03-31 36608]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 HpqKbFiltr;HpqKbFilter Driver; C:\Windows\system32\DRIVERS\HpqKbFiltr.sys [2007-06-18 16768]
R3 HpqRemHid;HP Remote Control HID Device; C:\Windows\system32\DRIVERS\HpqRemHid.sys [2007-07-11 7168]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-08-22 1950552]
R3 NETw4v32;Pilote de carte Intel(R) Wireless WiFi Link pour Windows Vista 32 bits; C:\Windows\system32\DRIVERS\NETw4v32.sys [2007-10-31 2252800]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2009-11-21 11515752]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2007-09-18 98816]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-04-11 89088]
R3 smserial;smserial; C:\Windows\system32\DRIVERS\smserial.sys [2007-01-17 983936]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2008-03-28 199472]
R3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2009-08-28 40448]
R3 usbvideo;Périphérique vidéo USB (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-19 134016]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-19 11264]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
S3 aj7i5tv6;aj7i5tv6; C:\Windows\system32\drivers\aj7i5tv6.sys []
S3 BCM43XV;Broadcom Extensible 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-11-02 464384]
S3 catchme;catchme; \??\C:\Users\Yoan\AppData\Local\Temp\catchme.sys []
S3 dot4;Pilote MS IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4.sys [2008-01-19 131584]
S3 Dot4Print;Pilote de classe Imprimante pour IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2008-01-19 16384]
S3 Dot4Scan;Pilote de classe Scanneur pour IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Scan.sys [2008-01-19 10752]
S3 dot4usb;Filtre Dot4USB Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2008-01-19 36864]
S3 drmkaud;Filtre de décodeur DRM (Noyau Microsoft); C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 E100B;Intel(R) PRO Adapter Driver; C:\Windows\system32\DRIVERS\e100b325.sys [2006-11-02 163328]
S3 HdAudAddService;Pilote de fonction UAA 1.1 Microsoft pour le service High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2006-11-02 987648]
S3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2006-11-02 200704]
S3 ialm;ialm; C:\Windows\system32\DRIVERS\igdkmd32.sys [2006-10-19 1380864]
S3 mbr;mbr; \??\C:\Users\Yoan\AppData\Local\Temp\mbr.sys []
S3 MSKSSRV;Proxy de service de répartition Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Proxy d'horloge de répartition Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Proxy de gestion de qualité de répartition Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 NETw3v32;Pilote de carte Intel(R) PRO/Wireless 3945ABG pour Windows Vista 32 bits; C:\Windows\system32\DRIVERS\NETw3v32.sys [2006-11-02 1781760]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2007-09-17 21632]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM); C:\Windows\system32\DRIVERS\ss_bbus.sys [2009-03-20 90112]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter); C:\Windows\system32\DRIVERS\ss_bmdfl.sys [2009-03-20 14976]
S3 ss_bmdm;SAMSUNG USB Mobile Modem; C:\Windows\system32\DRIVERS\ss_bmdm.sys [2009-03-20 121856]
S3 SymIMMP;SymIMMP; C:\Windows\system32\DRIVERS\SymIM.sys []
S3 winachsf;winachsf; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2006-11-02 654336]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448]
S3 xnacc;Contrôleur XBOX 360 pour le service de pilote Windows; C:\Windows\system32\DRIVERS\xnacc.sys [2008-01-19 521216]
S3 xusb21;Xbox 360 Wireless Receiver Driver Service 21; C:\Windows\system32\DRIVERS\xusb21.sys [2007-08-28 55808]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-05-29 144712]
R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-11-25 18752]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-11-25 138680]
R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 FsUsbExService;FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [2009-03-31 233472]
R2 HP Health Check Service;HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [2007-09-19 65536]
R2 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2006-05-02 135168]
R2 IAANTMON;Intel(R) Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe [2007-07-25 354840]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-08-23 79136]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2009-11-20 122984]
R2 QPCapSvc;QuickPlay Background Capture Service (QBCS); C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe [2007-09-30 271760]
R2 QPSched;QuickPlay Task Scheduler (QTS); C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe [2007-09-30 112016]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2007-01-09 272024]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-11-25 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-11-25 352920]
R3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-05-18 654848]
R3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-10-28 545568]
S2 pr2agqwc;Loki Drivers Auto Removal (pr2agqwc); C:\Windows\system32\pr2agqwc.exe [2007-05-18 407152]
S3 Com4Qlb;Com4Qlb; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe [2007-03-05 110592]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S3 GameConsoleService;GameConsoleService; C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe [2009-08-27 238328]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-03 69632]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-04-07 430592]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2009-05-20 322032]
-----------------EOF----------------- -
Contributeur sécuritéTélécharge ici :
http://images.malwareremoval.com/random/RSIT.exe
random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.
Double-clique sur RSIT.exe afin de lancer RSIT.
Clique Continue à l'écran Disclaimer.
Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.
Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).
NB : Les rapports sont sauvegardés dans le dossier C:\rsit
Tutoriel pour t'aider
https://forum.pcastuces.com/randoms_system_information_tool_rsit-f31s31.htm -
merci Benurrr
ci-joint les rapports :
Kill'em by g3n-h@ckm@n 1.2.5.3
User : Yoan (Administrateurs)
Update on 19/02/2010 by g3n-h@ckm@n ::::: 13.15
Start at: 16:54:52 | 21/02/2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7
Intel(R) Core(TM)2 Duo CPU T8100 @ 2.10GHz
Microsoft® Windows Vista™ Édition Familiale Premium (6.0.6002 32-bit) # Service Pack 2
Internet Explorer 8.0.6001.18882
Windows Firewall Status : Enabled
C:\ -> Disque fixe local | 137,26 Go (37,8 Go free) [OS] | NTFS
D:\ -> Disque fixe local | 149,05 Go (14,75 Go free) [DATA] | NTFS
E:\ -> Disque fixe local | 11,79 Go (2,14 Go free) [HP_RECOVERY] | NTFS
F:\ -> Disque CD-ROM | 4,07 Go (0 Mo free) [Apr 03 06 21:58] | UDF
G:\ -> Disque CD-ROM
H:\ -> Disque CD-ROM
I:\ -> Disque amovible | 1,97 Go (368,19 Mo free) | FAT
J:\ -> Disque amovible | 15,03 Go (6,42 Go free) [IPOD YO YO] | FAT32
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\FsUsbExService.Exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Windows\system32\nvvsvc.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\conime.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\QuickTime\QTTask.exe
D:\iTunesHelper.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Users\Yoan\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Users\Yoan\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\List_Kill'em\List_Kill'em.scr
C:\Windows\system32\cmd.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Users\Yoan\AppData\Local\Temp\C6FA.tmp\ERUNT.EXE
C:\Users\Yoan\AppData\Local\Temp\C6FA.tmp\pv.exe
Detections :
==========
¤¤¤¤¤¤¤¤¤¤ Files/folders :
Quarantined & Deleted !! : C:\Windows\System32\drivers\etc\hosts.msn
Quarantined & Deleted !! : C:\Users\Yoan\AppData\Roaming\4412.tmp
Quarantined & Deleted !! : C:\Users\Yoan\AppData\Roaming\A44D.tmp
Quarantined & Deleted !! : C:\Users\Yoan\AppData\Roaming\DE71.tmp
Quarantined & Deleted !! : C:\Users\Yoan\AppData\Roaming\SystemProc
Quarantined & Deleted !! : C:\Users\Yoan\Local Settings\Temp\alm.log
Quarantined & Deleted !! : C:\Users\Yoan\Local Settings\Temp\amt.log
Quarantined & Deleted !! : C:\Users\Yoan\Local Settings\Temp\url.txt
Quarantined & Deleted !! : C:\Users\Yoan\Local Settings\Temp\_4.log
Quarantined & Deleted !! : C:\Users\Yoan\LOCAL Settings\Temp\09393D62-FA46-408b-9A69-833FB7E70874.exe
Quarantined & Deleted !! : C:\Users\Yoan\LOCAL Settings\Temp\DivXInstaller.exe
Quarantined & Deleted !! : C:\Users\Yoan\LOCAL Settings\Temp\FP_PL_MSI_INSTALLER.exe
Quarantined & Deleted !! : C:\Users\Yoan\LOCAL Settings\Temp\GoogleUpdate.exe374b91
Quarantined & Deleted !! : C:\Users\Yoan\LOCAL Settings\Temp\HPQSi.exe
Quarantined & Deleted !! : C:\Users\Yoan\LOCAL Settings\Temp\msgD179.exe
Quarantined & Deleted !! : C:\Users\Yoan\LOCAL Settings\Temp\rlfkow.exe
Quarantined & Deleted !! : C:\Users\Yoan\LOCAL Settings\Temp\WinZip-12.1.exe
Quarantined & Deleted !! : C:\Users\Yoan\LOCAL Settings\Temp\wlsetup-cvr.exe
Quarantined & Deleted !! : C:\Users\Yoan\LOCAL Settings\Temp\DefInstAction.dat
Quarantined & Deleted !! : C:\Users\Yoan\LOCAL Settings\Temp\FW_Register_Plugin_Action.dat
Quarantined & Deleted !! : C:\Users\Yoan\LOCAL Settings\Temp\QBackupInst.dat
Quarantined & Deleted !! : C:\Users\Yoan\LOCAL Settings\Temp\srtspse.dat
Quarantined & Deleted !! : C:\Users\Yoan\LOCAL Settings\Temp\srtspso.dat
Quarantined & Deleted !! : C:\Users\Yoan\LOCAL Settings\Temp\srtspsp.dat
Quarantined & Deleted !! : C:\Users\Yoan\LOCAL Settings\Temp\drm_dialogs.dll
Quarantined & Deleted !! : C:\Users\Yoan\LOCAL Settings\Temp\drm_dyndata_7290008.dll
Quarantined & Deleted !! : C:\Users\Yoan\LOCAL Settings\Temp\drm_dyndata_7340014.dll
Quarantined & Deleted !! : C:\Users\Yoan\LOCAL Settings\Temp\goopdate.dll374ba0
Quarantined & Deleted !! : C:\Users\Yoan\LOCAL Settings\Temp\goopdateres_fr.dll374bc0
==============
host file OK !
==============
========
Registry
========
========
Services
=========
Ndisuio : Start = 3
EapHost : Start = 2
Wlansvc : Start = 2
SharedAccess : Start = 2
windefend : Start = 2
wuauserv : Start = 2
wscsvc : Start = 2
============
Disk Cleaned
============
=================
anti-ver blaster : OK !!
=================
================
Prefetch cleaned
================
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK -
Contributeur sécuritéil y'a deux étapes a effrectuer
▶ Relance List&Kill'em(soit en clic droit pour vista),avec le raccourci sur ton bureau.
mais cette fois-ci :
▶ choisis l'option 2 = Mode Suppression
laisse travailler l'outil.
en fin de scan un rapport s'ouvre
▶ colle le contenu dans ta réponse
ensuite :
▶ Relance List&Kill'em(soit en clic droit pour vista),avec le raccourci sur ton bureau.
mais cette fois-ci :
▶ choisis l'option 6 = Restore MBR
laisse travailler l'outil.
en fin de scan un rapport s'ouvre
▶ colle le contenu dans ta réponse
- 1
- 2
Suivant
