systeme infecté Résolu

Question

Bonjour,
Je pense que mon PC est infecté par un ou plusieur virus. je mets un scan de hijackthis pour celui qui peut m'aider

Merci d'avance.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:30:18, on 30/11/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe
C:\Documents and Settings\maison\1.exe
C:\DOCUME~1\maison\LOCALS~1\Temp\cj1.exe
C:\DOCUME~1\maison\LOCALS~1\Temp\cj2.exe
C:\DOCUME~1\maison\LOCALS~1\Temp\cj6.exe
C:\DOCUME~1\maison\LOCALS~1\Temp\cj9.exe
C:\DOCUME~1\maison\LOCALS~1\Temp\cj8.exe
C:\DOCUME~1\maison\LOCALS~1\Temp	este3_p.exe
C:\DOCUME~1\maison\LOCALS~1\Temp	este2_p.exe
C:\DOCUME~1\maison\LOCALS~1\Temp	este4_p.exe
C:\WINDOWS\System32\svchost.exe
C:\DOCUME~1\maison\LOCALS~1\Temp\avto.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Share_Accelerator toolbar - {f5c93451-2609-4723-a053-5c19516be1a8} - C:\Program Files\Share_Accelerator	bSha0.dll
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: (no name) - {91AD9DC2-523A-47E2-A598-6C277F16CC50} - c:\windows\system32\aadcaad.dll
O3 - Toolbar: Share_Accelerator toolbar - {f5c93451-2609-4723-a053-5c19516be1a8} - C:\Program Files\Share_Accelerator	bSha0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [M1000Mnt] M1000Rmv.exe /StartStillMnt
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [VirusGarde] C:\Program Files\VirusGarde\pgs.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [netc] C:\WINDOWS\svc.exe
O4 - HKLM\..\Run: [runsql] C:\WINDOWSunsql.exe
O4 - HKLM\..\Run: [netzip] C:\WINDOWS\svzip.exe
O4 - HKLM\..\Run: [netsv32] C:\WINDOWS\sv.exe
O4 - HKLM\..\Run: [net64] C:\WINDOWS\svhoster.exe
O4 - HKLM\..\Run: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKLM\..\RunServices: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKCU\..\RunServices: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/02084dfa22d225efae05/netzip/RdxIE601_fr.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

jlpjlp · Answer

slt,

scan avec vundofix (colle le rapport)

Téléchargez VundoFix -> http://www.atribune.org/ccount/click.php?id=4

Double cliquez VundoFix.exe pour l'exécuter.
Quand VundoFix s'ouvre, cliquez sur le bouton Scan for Vundo.
Une fois le scan fini, cliquez sur le bouton Remove Vundo.
Vous recevrez un avertissement vous demandant si vous voulez effacer ces
fichiers répondez en cliquant sur YES
Une fois que vous avez cliqué yes, votre bureau deviendra vide au moment où il
enlève Vundo.

Quand c'est fini, il vous sera demandé de redémarrer votre ordinateur, cliquez
OK.


puis :

__________________


virtumondebegone (colle le rapport)

http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe


______________________

combofix (colle le rapport)
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Julien · Answer

bonjour et merci d'avaoir repondu. J'ai fait un scan vundofix et il a trouvé qql chose mais je n'arrive pas avoir de rapport. Ensuite avec virtumondebegon le ropport est le suivant [12/01/2007, 11:28:22] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\maison\Bureau\VirtumundoBeGone.exe" ) [12/01/2007, 11:28:26] - Detected System Information: [12/01/2007, 11:28:26] - Windows Version: 5.1.2600, Service Pack 1 [12/01/2007, 11:28:26] - Current Username: maison (Admin) [12/01/2007, 11:28:26] - Windows is in NORMAL mode. [12/01/2007, 11:28:26] - Searching for Browser Helper Objects: [12/01/2007, 11:28:26] - BHO 1: {91AD9DC2-523A-47E2-A598-6C277F16CC50} () [12/01/2007, 11:28:26] - WARNING: BHO has no default name. Checking for Winlogon reference. [12/01/2007, 11:28:26] - Checking for HKLM\...\Winlogon\Notify\aadcaad [12/01/2007, 11:28:26] - Key not found: HKLM\...\Winlogon\Notify\aadcaad, continuing. [12/01/2007, 11:28:26] - Finished Searching Browser Helper Objects [12/01/2007, 11:28:26] - Finishing up... [12/01/2007, 11:28:26] - Nothing found! Exiting... Et enfin combofix rapport... ComboFix 07-11-19.4C - maison 2007-12-01 11:33:24.4 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.1.1252.1.1036.18.73 [GMT 1:00] Running from: C:\Documents and Settings\maison\Bureau\ComboFix.exe * Created a new restore point . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\runsql.exe C:\WINDOWS\sv.exe C:\WINDOWS\svc.exe C:\WINDOWS\svhoster.exe C:\WINDOWS\svzip.exe C:\WINDOWS\system32\LDR3.tmp C:\WINDOWS\system32\LDR5.tmp C:\WINDOWS\system32\LDR7.tmp . ((((((((((((((((((((((((((((( Fichiers créés 2007-11-01 to 2007-12-01 )))))))))))))))))))))))))))))))))))) . 2007-12-01 11:17 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe 2007-11-30 14:40 45,056 -r-hs---- C:\WINDOWS\system32\1033v.exe 2007-11-30 14:40 144 --ahs---- C:\WINDOWS\system32\1549314879.dat 2007-11-30 14:37 16,384 --a------ C:\Documents and Settings\maison\1.exe 2007-11-03 10:13 d-------- C:\WINDOWS\system32\bits 2007-11-03 10:13 d--h----- C:\WINDOWS\$hf_mig$ . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-01 10:26 --------- d-----w C:\Program Files\Wanadoo 2007-11-29 08:21 3,148 ----a-w C:\Documents and Settings\maison\Application Data\wklnhst.dat 2007-10-19 18:14 --------- d-----w C:\Program Files\Navilog1 2007-10-18 20:26 --------- d-----w C:\Program Files\DivX 2007-10-17 04:58 7,456 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2007-10-17 04:58 2,948 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2007-10-17 04:58 159,776 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2007-10-17 04:58 1,748 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2007-10-17 04:54 --------- d-----w C:\Program Files\Zapu 2007-10-17 04:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\MailFrontier 2007-10-17 04:49 75,932 ----a-w C:\WINDOWS\system32\drivers\klick.dat 2007-10-17 04:49 74,396 ----a-w C:\WINDOWS\system32\drivers\klin.dat 2007-10-16 20:55 81,408 ----a-w C:\WINDOWS\system32\aadcaad.dll 2007-10-14 18:16 --------- d-----w C:\Program Files\Trend Micro 2007-10-14 17:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft 2007-10-14 06:41 17,792 ----a-w C:\WINDOWS\system32\drivers\miqvzwcl.dat 2007-10-12 17:07 --------- d-----w C:\Program Files\Fichiers communs\G DATA 2007-10-12 16:50 --------- d-----w C:\Documents and Settings\maison\Application Data\Lavasoft 2007-10-05 23:24 52,602 ----a-w C:\WINDOWS\system32\interceptor.sys 2007-10-05 23:22 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-10-05 23:06 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2007-10-05 20:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip 2007-10-05 19:40 --------- d-----w C:\Documents and Settings\maison\Application Data\cv=2.4&pn=&pv=&pt=&sn=&sna=&sns=&sne=&snr=&snb=&us=sxmea 2007-10-05 19:35 --------- d-----r C:\Documents and Settings\All Users\Application Data\cv=2.4&pn=&pv=&pt=&sn=&sna=&sns=&sne=&snr=&snb=&us=sxmea 2007-10-05 18:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7 2007-10-05 18:11 --------- d-----w C:\Documents and Settings\maison\Application Data\AVG7 2007-10-04 20:30 --------- d-----w C:\Documents and Settings\LocalService\Application Data\AVG7 2007-10-03 22:36 25,600 ----a-w C:\WINDOWS\system32\WS2Fix.exe 2007-09-06 10:09 801,144 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-09-06 10:00 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr 2007-09-05 22:22 289,144 ----a-w C:\WINDOWS\system32\VCCLSID.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{91AD9DC2-523A-47E2-A598-6C277F16CC50}] 2007-10-16 21:55 81408 --a------ c:\windows\system32\aadcaad.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-08-29 10:45] "WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 13:50] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-11 15:33] "Shareaza"="C:\Program Files\Shareaza\Shareaza.exe" [2007-02-05 03:05] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:55] "UpdateWin"="C:\WINDOWS\System32\1033v.exe" [2007-11-30 14:39] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] "UpdateWin"="C:\WINDOWS\System32\1033v.exe" [2007-11-30 14:39] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 16:07 C:\WINDOWS\system32\HdAShCut.exe] "RTHDCPL"="RTHDCPL.EXE" [2005-07-13 03:37 C:\WINDOWS\RTHDCPL.EXE] "EasyTuneV"="C:\Program Files\Gigabyte\ET5\GUI.exe" [2004-06-14 10:54] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50] "WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 13:49] "WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 15:55] "M1000Mnt"="M1000Rmv.exe" [] "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-09-02 11:25] "VirusGarde"="C:\Program Files\VirusGarde\pgs.exe" [] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 11:06] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 20:54] "UpdateWin"="C:\WINDOWS\System32\1033v.exe" [2007-11-30 14:39] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] "UpdateWin"="C:\WINDOWS\System32\1033v.exe" [2007-11-30 14:39] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-08-29 10:45] C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\ Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 03:44:06] WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2007-06-06 10:10:02] [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoControlPanel"= 1 (0x1) "NoWindowsUpdate"= 1 (0x1) [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "UpdateWin"= C:\WINDOWS\System32\1033v.exe R0 nvrfhgrt;Microsoft RPC API Helper;C:\WINDOWS\System32\drivers\miqvzwcl.dat S3 gdrv;gdrv;\??\C:\WINDOWS\gdrv.sys S3 M1000Srv;M5603C USB2.0 Camera Driver;C:\WINDOWS\System32\Drivers\M1000KNT.sys . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-01 11:35:05 Windows 5.1.2600 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-01 11:35:40 C:\ComboFix2.txt ... 2007-11-04 20:20 C:\ComboFix3.txt ... 2007-10-23 20:58 . --- E O F ---

superboy1 · Answer

Salut!
Le mieux si tu es vraiment infecté de virus, investit toi dans un anti virus (de valeur sur et de simplicité) ou dans avast un anti virus gratuit mais puissant!!

Julien · Answer

slt, je suis equipé d'avast antivirus (version gratuite) mais commecela fait qql mois que j'ai recuperé cet tour j'essaye de la remettre a niveau et de la nettoyer.

superboy1 · Answer

es ce que tu lui a fait faire un scan, je suppose que oui mais il détecte quelque chose? sinon nettoyer c'est simple soit tu formate si tu connait tous les drivers des périphériques, que ta gardé les donnés importantes pour toi et le code windows soit tu paufine comme la mais n'oubli pas de défragmenter et utiliser scan disque, et regarder qu'es qui se boot au démarrage avec msconfig

Julien · Answer

re, oui j'ai fait un scan et il a detecté qql chose dans le dossier windows system 32 et je ne peu pas formaté car je ne connais pas les peripherique et je n'ai pas de code windows car j'ai recuperé cette tour du travail a mon beau pere.
j'ai pas compris qu'est ce qui se boot au demarage avec msconfig.?

Sinon pour info mon ordi fonctionne bien il est rapide et tout mais juste quand je fais un scan il trouve un virus win32.

Voila merci

superboy1 · Answer

win32 c'est simple c'est une vraie plaie faut que tu t'en occupe au + vite meme si il é juste pas gentil ,en faite si je me souviens bien, si je ne confond pas avec un autre virus analogue il empeche les applications de se démarrer et + tu laisse le pc tourné plus il se multipli mais un cout d'anti virus et tout remarche!!

si t'a fait un scan avast en a fait quelque chose??? (je supose que oui mais regarde c'est important) mais normalement ton probleme est résolu!!! et puis si tu aime les scan refaisant un autre lol pour etre sur

sinon pour demarrer msconfig tu fait exécuter dans le menu demarrer et tu tape msconfig et tu va dans l'onglet démarrage et tu choisis les applications qui ne demarrerons pas au démarrage pour rendre ton pc + rapide et avec moin de fenetre qui s'ouvre au démarrge, regarde ce que c'est tout de meme comme application!!

Julien · Answer

re, ecoute je ne sais pas du tout ce qu'a fait avast du virus mais je n'ai plus d'alerte comme quoi je suis infecté par un virus etc... la je relance un scan standard mais je dois y aller alors j'essaye de me connecter ce soir sinon je te post tt ça demain ok.
Je te remercie. Aplus

jlpjlp · Answer

recolle un rapport hijackthis svp

________________

et colle le rapport d'un scan avec panda (desactive avcast le temps du scan)

Panda en ligne : 
http://pandasoftware.fr

Julien06 · Answer

Salut, 

Voila le rapport de hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:52:02, on 02/12/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Share_Accelerator toolbar - {f5c93451-2609-4723-a053-5c19516be1a8} - C:\Program Files\Share_Accelerator	bSha0.dll
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: (no name) - {91AD9DC2-523A-47E2-A598-6C277F16CC50} - c:\windows\system32\aadcaad.dll
O3 - Toolbar: Share_Accelerator toolbar - {f5c93451-2609-4723-a053-5c19516be1a8} - C:\Program Files\Share_Accelerator	bSha0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [M1000Mnt] M1000Rmv.exe /StartStillMnt
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [VirusGarde] C:\Program Files\VirusGarde\pgs.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKLM\..\RunServices: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\RunServices: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/02084dfa22d225efae05/netzip/RdxIE601_fr.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

jlpjlp · Answer

Mais en fesant l'analyse avec totalscan je me suis fait infecté par un win32 car j'avais desactivé avast je suis deg...


le virus était déjà là avant !!!!!!

______________________

desinstalle via ton panneau de configuration :
Share_Accelerator toolbar 

_____________________


Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked". 

R3 - URLSearchHook: Share_Accelerator toolbar - {f5c93451-2609-4723-a053-5c19516be1a8} - C:\Program Files\Share_Accelerator	bSha0.dll
O2 - BHO: (no name) - {91AD9DC2-523A-47E2-A598-6C277F16CC50} - c:\windows\system32\aadcaad.dll
O3 - Toolbar: Share_Accelerator toolbar - {f5c93451-2609-4723-a053-5c19516be1a8} - C:\Program Files\Share_Accelerator	bSha0.dll

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"

O4 - HKLM\..\Run: [VirusGarde] C:\Program Files\VirusGarde\pgs.exe

O4 - HKCU\..\Run: [UpdateWin] C:\WINDOWS\System32\1033v.exe

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe

_______________________


télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe (de Old_Timer) sur ton Bureau. 
double-clique sur OTMoveIt.exe pour le lancer. 
copie la liste qui se trouve en citation ci-dessous, 
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved. 

Citation : 


C:\Program Files\VirusGarde\pgs.exe
c:\windows\system32\aadcaad.dll


clique sur MoveIt! pour lancer la suppression. 
le résultat apparaitra dans le cadre "Results". 
clique sur Exit pour fermer. 
poste le rapport situé dans C:\_OTMoveIt\MovedFiles. 

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes. 

__________________________

analyse ce fichier sur virus total et colle moi le rapport
C:\WINDOWS\System32\1033v.exe

__________________________


smit fraud fix (colle le rapport)

1/ telecharger :

http://siri.urz.free.fr/Fix/SmitfraudFix.php




2/ double clique sur smitfraudfix. puis sélectionne 1 et appuyer sur entrée afin de créer le rapport des infection présentes. une fois le rapport effectué redémarre en mode sans échec (en appuyant sur F8 ou suppr, ou F5 au démarrage en général)

superboy1 · Answer

Que des points exe!!! lol c'est la ou il agit préférentiellement mais regarde normalement tes applications qui ont été touché soit elle marche soit elle ne marche pas et si ca marche alors c'est bon

Julien06 · Answer

re, voila le rapport de hijackthis avec ce que tu m'a demandé de faire

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:42:18, on 02/12/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {91AD9DC2-523A-47E2-A598-6C277F16CC50} - c:\windows\system32\aadcaad.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [M1000Mnt] M1000Rmv.exe /StartStillMnt
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKLM\..\RunServices: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\RunServices: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/02084dfa22d225efae05/netzip/RdxIE601_fr.cab
O16 - DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} (NanoInstaller Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Julien06 · Answer

ensuite avec smitfraudfix j'ai fait l'option 1 et le rapport donne ceci...

SmitFraudFix v2.240

Rapport fait à 18:48:33,51, 02/12/2007
Executé à partir de C:\Documents and Settings\maison\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\maison


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\maison\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\maison\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
 

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: NVIDIA nForce Networking Controller - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1
DNS Server Search Order: 0.0.0.0

HKLM\SYSTEM\CCS\Services\Tcpip\..\{AD62D0E4-1941-41A0-8513-E63CB3FCC2B0}: DhcpNameServer=192.168.1.1 0.0.0.0
HKLM\SYSTEM\CS1\Services\Tcpip\..\{AD62D0E4-1941-41A0-8513-E63CB3FCC2B0}: DhcpNameServer=192.168.1.1 0.0.0.0
HKLM\SYSTEM\CS2\Services\Tcpip\..\{AD62D0E4-1941-41A0-8513-E63CB3FCC2B0}: DhcpNameServer=192.168.1.1 0.0.0.0
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

Mais je n'ai pas compris ce que je devais faire en redemarrant en mode sans echec?

jlpjlp · Answer

lance rogue remover et dis moi ce qui est trouvé:

https://www.01net.com/telecharger/ 

_______________

fix cette ligne:

O2 - BHO: (no name) - {91AD9DC2-523A-47E2-A598-6C277F16CC50} - c:\windows\system32\aadcaad.dll

_________________


télécharges et installes : 

kill box 
https://www.bleepingcomputer.com/download/linux/ 


aide kill box 
http://perso.wanadoo.fr/jesses/Docs/Logiciels/KillBox.htm 


- Redémarre en mode sans échec, si tu sais pas comment on fait lis ceci 

- Double-clic sur fix.reg 

Ouvres killbox 
- Sélectionne "delete on reboot" 
- Clique sur le dossier jaune à droite et sélectionne le fichier : c:\windows\system32\aadcaad.dll
- Clique sur la croix rouge et et blanche 
- Répond yes et laisse redémarrer ton pc. 
N'hésite pas à consulter l'Aide killbox 

Vérifie que le fichier c:\windows\system32\aadcaad.dll n'est plus présent.

____________________

recolle un rapport hijackhtis

Julien06 · Answer

re, 

rogue remover dit apres un scan : Congratulations, R R did not detect any items

ensuite tu me dis fix cette ligne O2 - BHO: (no name) - {91AD9DC2-523A-47E2-A598-6C277F16CC50} - c:\windows\system32\aadcaad.dll
dans hijackthis je pense ?? je le fais meme si c'est pas ça lol
Mais quand je le fixe il ne se supprime pas c'est normal ?

apres je fais la suite

jlpjlp · Answer

slt,

lance rogue remover et dis ce qui est trouvé


https://www.01net.com/telecharger/ 

_________________

Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked". 

O2 - BHO: (no name) - {91AD9DC2-523A-47E2-A598-6C277F16CC50} - c:\windows\system32\aadcaad.dll

______________


télécharges et installes : 

kill box 
https://www.bleepingcomputer.com/download/linux/ 


aide kill box 
http://perso.wanadoo.fr/jesses/Docs/Logiciels/KillBox.htm 


- Redémarre en mode sans échec, si tu sais pas comment on fait lis ceci 

- Double-clic sur fix.reg 

Ouvres killbox 
- Sélectionne "delete on reboot" 
- Clique sur le dossier jaune à droite et sélectionne le fichier : C:\windows\system32\aadcaad.dll
- Clique sur la croix rouge et et blanche 
- Répond yes et laisse redémarrer ton pc. 
N'hésite pas à consulter l'Aide killbox 

Vérifie que le fichier C:\windows\system32\aadcaad.dll n'est plus présent.

__________________


scan avec des antiespions (en mode sans échec): 

spybot :  (si vous avez une version instalée avant sept 2007 changer là par la version 1.5)

https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/26157.html 

voir demo d utilisation (merci Balltrap)
http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm

___________________


AVG antispyware

https://www.01net.com/telecharger/

Tuto : 
http://www.kachouri.com/tuto/tuto-161-avg-anti-spyware-75-pour-votre-securite.html


->Relance AVG AS -> "Analyse" ->"Paramètres" 

Sous la question "Comment réagir ?" : 

-> clique sur "Actions recommandées" et choisis "Quarantaines" 
-> Re-clique sur l'onglet "Analyse" puis réalise une "Analyse complète du système" 

Si un fichier est infecté en fin d'analyse 

->Clique sur "Appliquer toutes les actions " 

->Clique sur "Enregistrer le rapport" puis sur "Enregistrer le rapport sous". 

->Enregistre ce fichier texte sur ton bureau ensuite colle le rapport ici
_________________

recolle un raport hijackthis et dis tes soucis

Julien06 · Answer

re,
J'ai fait ce que tu m'a dit avec Killbos et apres j'ai recherché le fichier C:\windows\system32\aadcaad.dll dans le dossier system32 il n'y ai plus seulement un icone aadcaad.dll.bak et killbox n'a pas redemarrer mon pc. J'ai fait tous ça en mode normal car j'ai pas compris quand tu m'as demandé double clic sur fix.reg?
La je suis entrain de faire l'analyse complete avec AVG... ensuite redemarre en sans echec pour les anti espions.
Merci

jlpjlp · Answer

ok 

ap lus

Julien06 · Answer

re, 
Voici l'analyse de avg et son rapport
---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	20:21:02 02/12/2007

 + Résultat de l'analyse:	



C:\Documents and Settings\maison\Cookies\maison@pandasoftware.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\RECYCLER\S-1-5-21-2025429265-1417001333-725345543-1003\Dc120.txt -> TrackingCookie.2o7 : Nettoyé.
C:\RECYCLER\S-1-5-21-2025429265-1417001333-725345543-1003\Dc136.txt -> TrackingCookie.2o7 : Nettoyé.
C:\RECYCLER\S-1-5-21-2025429265-1417001333-725345543-1003\Dc16.txt -> TrackingCookie.Adbrite : Nettoyé.
C:\RECYCLER\S-1-5-21-2025429265-1417001333-725345543-1003\Dc99.txt -> TrackingCookie.Adbrite : Nettoyé.
C:\RECYCLER\S-1-5-21-2025429265-1417001333-725345543-1003\Dc100.txt -> TrackingCookie.Adtech : Nettoyé.
C:\RECYCLER\S-1-5-21-2025429265-1417001333-725345543-1003\Dc18.txt -> TrackingCookie.Advertising : Nettoyé.
C:\Documents and Settings\maison\Cookies\maison@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
C:\RECYCLER\S-1-5-21-2025429265-1417001333-725345543-1003\Dc104.txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\maison\Cookies\maison@bluestreak[2].txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\RECYCLER\S-1-5-21-2025429265-1417001333-725345543-1003\Dc25.txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\maison\Cookies\maison@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\RECYCLER\S-1-5-21-2025429265-1417001333-725345543-1003\Dc32.txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\RECYCLER\S-1-5-21-2025429265-1417001333-725345543-1003\Dc56.txt -> TrackingCookie.Overture : Nettoyé.
:mozilla.10:C:\Documents and Settings\maison\Application Data\Mozilla\Firefox\Profiles\znqm2fwc.default\cookies.txt -> TrackingCookie.Real : Nettoyé.
:mozilla.7:C:\Documents and Settings\maison\Application Data\Mozilla\Firefox\Profiles\znqm2fwc.default\cookies.txt -> TrackingCookie.Real : Nettoyé.
:mozilla.9:C:\Documents and Settings\maison\Application Data\Mozilla\Firefox\Profiles\znqm2fwc.default\cookies.txt -> TrackingCookie.Real : Nettoyé.
C:\RECYCLER\S-1-5-21-2025429265-1417001333-725345543-1003\Dc121.txt -> TrackingCookie.Real : Nettoyé.
C:\RECYCLER\S-1-5-21-2025429265-1417001333-725345543-1003\Dc60.txt -> TrackingCookie.Real : Nettoyé.
C:\Documents and Settings\maison\Cookies\maison@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\maison\Cookies\maison@serving-sys[1].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\RECYCLER\S-1-5-21-2025429265-1417001333-725345543-1003\Dc108.txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\RECYCLER\S-1-5-21-2025429265-1417001333-725345543-1003\Dc145.txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\RECYCLER\S-1-5-21-2025429265-1417001333-725345543-1003\Dc146.txt -> TrackingCookie.Sextracker : Nettoyé.
C:\RECYCLER\S-1-5-21-2025429265-1417001333-725345543-1003\Dc28.txt -> TrackingCookie.Sextracker : Nettoyé.
C:\Documents and Settings\maison\Cookies\maison@smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\RECYCLER\S-1-5-21-2025429265-1417001333-725345543-1003\Dc147.txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\RECYCLER\S-1-5-21-2025429265-1417001333-725345543-1003\Dc65.txt -> TrackingCookie.Specificclick : Nettoyé.
C:\RECYCLER\S-1-5-21-2025429265-1417001333-725345543-1003\Dc154.txt -> TrackingCookie.Statcounter : Nettoyé.
C:\RECYCLER\S-1-5-21-2025429265-1417001333-725345543-1003\Dc158.txt -> TrackingCookie.Tradedoubler : Nettoyé.
C:\Documents and Settings\maison\Cookies\maison@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé.
C:\RECYCLER\S-1-5-21-2025429265-1417001333-725345543-1003\Dc161.txt -> TrackingCookie.Weborama : Nettoyé.
C:\RECYCLER\S-1-5-21-2025429265-1417001333-725345543-1003\Dc155.txt -> TrackingCookie.Webtrendslive : Nettoyé.
C:\RECYCLER\S-1-5-21-2025429265-1417001333-725345543-1003\Dc98.txt -> TrackingCookie.Yieldmanager : Nettoyé.
C:\RECYCLER\S-1-5-21-2025429265-1417001333-725345543-1003\Dc11.txt -> TrackingCookie.Zedo : Nettoyé.


Fin du rapport

la je redemarre en mode ss echec et je te post ça.

jlpjlp · Answer

ok

pour ca:

C:\RECYCLER


vide tout smplement ta pourbeille (corbeille)

Julien06 · Answer

re, ok pour recycler c'est ok merci.

Sinon pour le mode ss echec et spybot le rapport est le suivant


--- Search result list ---
RealDownloadExpress: [SBI $1EDE24BC] Root class (Clé du registre, fixed)
  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RealDownloadExpress.IE

RealDownloadExpress: [SBI $1EDE24BC] Root class (Clé du registre, fixed)
  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RealDownloadExpress.IE.1

RealDownloadExpress: [SBI $1EDE24BC] Class ID (Clé du registre, fixed)
  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56336BCB-3D8A-11d6-A00B-0050DA18DE71}

RealDownloadExpress: [SBI $3BB925FD] Class ID (Clé du registre, fixed)
  HKEY_CLASSES_ROOT\TypeLib\{FDF5CDE5-17A6-40B3-A544-A8527AE8B243}

UtileProtection: [SBI $7162C2E7] Réglages (Clé du registre, fixed)
  HKEY_LOCAL_MACHINE\SOFTWARE\Purchased Products\System Error Repair

Vario.AntiVirus: [SBI $6DD17C26] Dossier Programme (Répertoire, fixed)
  c:\UGA6PV\

Vario.AntiVirus: [SBI $FD1D24F8] Réglages utilisateur (Clé du registre, fixed)
  HKEY_USERS\S-1-5-21-2025429265-1417001333-725345543-1003\Software\VirusGarde

Vario.AntiVirus: [SBI $AAAFC4B0] Réglages (Clé du registre, fixed)
  HKEY_LOCAL_MACHINE\SOFTWARE\VirusGarde

Vario.AntiVirus: [SBI $28842A62] Dossier Programme (Répertoire, fixed)
  C:\Documents and Settings\All Users\Menu Démarrer\Programmes\VirusGarde\

Vario.AntiVirus: [SBI $68FB8D46]  Lien (Fichier, fixed)
  C:\Documents and Settings\All Users\Menu Démarrer\Programmes\virusgarde\VirusGarde.lnk

EverestPoker: [SBI $03A31629] Réglages (Clé du registre, fixed)
  HKEY_USERS\S-1-5-21-2025429265-1417001333-725345543-1003\Software\Grand Virtual

EverestPoker: [SBI $34F4B617] Réglages désinstallation (Clé du registre, fixed)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Everest Poker

EverestPoker: [SBI $EB906E36] Dossier Programme (Répertoire, fixed)
  C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Everest Poker\

EverestPoker: [SBI $C42AAFB3] Réglages utilisateur (Valeur du registre, fixed)
  HKEY_USERS\S-1-5-21-2025429265-1417001333-725345543-1003\Software\Grand Virtual\XD3C

Microsoft.Windows.Explorer: [SBI $E3838056] Réglages utilisateur (Modification du registre, fixed)
  HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel

Microsoft.Windows.Explorer: [SBI $E3838056] Réglages utilisateur (Modification du registre, fixed)
  HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel

Microsoft.WindowsSecurityCenter.AntiVirusDisableNotify: [SBI $5509538C] Réglages (Modification du registre, fixed)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify

Microsoft.WindowsSecurityCenter.AntiVirusOverride: [SBI $3604910C] Réglages (Modification du registre, fixed)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride

Alexa Related: [SBI $9263101F]  Lien (Remplacer le fichier, fixed)
  C:\WINDOWS\Webelated.htm

Win32.Banker.aipy.rtk: [SBI $1C9E9F4A]  Bibliothèque (Fichier, fixed)
  C:\WINDOWS\system32\iebudata.dll

Win32.Banker.aipy.rtk: [SBI $7B5B3ACC]  Bibliothèque (Fichier, fixed)
  C:\WINDOWS\system32\ierql.dll

Win32.Banker.aipy.rtk: [SBI $D875AB6E]  Bibliothèque (Fichier, fixed)
  C:\WINDOWS\system32\qshl.dll

Win32.Murlo.ff.rtk: [SBI $67E0FCFD] Réglages (Valeur du registre, fixed)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\UID

DoubleClick: [SBI $4CDCC3D5] Cookie traceur (Internet Explorer: maison) (Cookie, fixed)
  

SexTracker: [SBI $4CDCC3D5] Cookie traceur (Internet Explorer: maison) (Cookie, fixed)
  

Statcounter: [SBI $4CDCC3D5] Cookie traceur (Internet Explorer: maison) (Cookie, fixed)
  

Zedo: [SBI $4CDCC3D5] Cookie traceur (Internet Explorer: maison) (Cookie, fixed)
  

WebTrends live: [SBI $4CDCC3D5] Cookie traceur (Internet Explorer: maison) (Cookie, fixed)
  

MediaPlex: [SBI $4CDCC3D5] Cookie traceur (Internet Explorer: maison) (Cookie, fixed)
  

MediaPlex: [SBI $4CDCC3D5] Cookie traceur (Internet Explorer: maison) (Cookie, fixed)
  

BlueStreak: [SBI $4CDCC3D5] Cookie traceur (Internet Explorer: maison) (Cookie, fixed)
  

TagASaurus: [SBI $4CDCC3D5] Cookie traceur (Internet Explorer: maison) (Cookie, fixed)
  

Tradedoubler: [SBI $4CDCC3D5] Cookie traceur (Internet Explorer: maison) (Cookie, fixed)
  

SexTracker: [SBI $4CDCC3D5] Cookie traceur (Internet Explorer: maison) (Cookie, fixed)
  


--- Spybot - Search & Destroy version: 1.5  (build: 20070830) ---

2007-08-31 blindman.exe (1.0.0.6)
2007-08-31 SDMain.exe (1.0.0.4)
2007-08-31 SDUpdate.exe (1.0.6.4)
2007-08-31 SDWinSec.exe (1.0.0.8)
2007-08-31 SpybotSD.exe (1.5.1.15)
2007-08-31 TeaTimer.exe (1.5.0.9)
2007-12-02 unins000.exe (51.46.0.0)
2007-08-31 Update.exe (1.4.0.5)
2007-08-31 advcheck.dll (1.5.3.0)
2007-04-02 aports.dll (2.1.0.0)
2007-04-02 DelZip179.dll (1.79.5.3)
2007-08-31 SDHelper.dll (1.5.0.8)
2007-08-31 Tools.dll (2.1.2.0)
2007-11-28 Includes\Cookies.sbi (*)
2007-10-31 Includes\Dialer.sbi (*)
2007-11-28 Includes\DialerC.sbi (*)
2007-11-07 Includes\Hijackers.sbi (*)
2007-11-28 Includes\HijackersC.sbi (*)
2007-10-04 Includes\Keyloggers.sbi (*)
2007-11-28 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2007-11-07 Includes\Malware.sbi (*)
2007-11-28 Includes\MalwareC.sbi (*)
2007-10-24 Includes\PUPS.sbi (*)
2007-11-28 Includes\PUPSC.sbi (*)
2007-11-28 Includes\Revision.sbi (*)
2007-05-30 Includes\Security.sbi (*)
2007-11-28 Includes\SecurityC.sbi (*)
2007-11-07 Includes\Spybots.sbi (*)
2007-11-28 Includes\SpybotsC.sbi (*)
2007-11-06 Includes\Tracks.uti
2007-11-28 Includes\Trojans.sbi (*)
2007-11-28 Includes\TrojansC.sbi (*)
2008-12-24 Plugins\TCPIPAddress.dll



--- System information ---
Windows XP (Build: 2600) Service Pack 1 (5.1.2600)
 / Windows XP / SP2: Correctif Windows XP - KB842773
 / Windows XP / SP3: Correctif Windows XP - KB890859
 / Windows XP / SP3: Windows Installer 3.1 (KB893803)
 / Windows XP / SP3: Mise à jour pour Windows XP (KB898461)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB908519)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB914389)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB920683)


--- Startup entries list ---
Located: HK_LM:Run, !AVG Anti-Spyware
command: "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
   file: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
   size: 6731312
    MD5: CC6BC45DD5A58158645E7FB2953604FE

Located: HK_LM:Run, avast!
command: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
   file: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
   size: 79224
    MD5: 8CF58586AE4577ED71FFE8883A6D4B3B

Located: HK_LM:Run, EasyTuneV
command: C:\Program Files\Gigabyte\ET5\GUI.exe
   file: C:\Program Files\Gigabyte\ET5\GUI.exe
   size: 200704
    MD5: 9565F8CA2D91EBD35DFE2979764C21C7

Located: HK_LM:Run, High Definition Audio Property Page Shortcut
command: HDAShCut.exe
   file: C:\WINDOWS\system32\HDAShCut.exe
   size: 61952
    MD5: 9C3B2302B60FB0EFB13BC880A5E3E93E

Located: HK_LM:Run, M1000Mnt
command: M1000Rmv.exe /StartStillMnt
   file: 
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: HK_LM:Run, NeroFilterCheck
command: C:\WINDOWS\system32\NeroCheck.exe
   file: C:\WINDOWS\system32\NeroCheck.exe
   size: 155648
    MD5: 3E4C03CEFAD8DE135263236B61A49C90

Located: HK_LM:Run, RTHDCPL
command: RTHDCPL.EXE
   file: C:\WINDOWS\RTHDCPL.EXE
   size: 14679552
    MD5: 8658493317CD85B5C655557061D08B53

Located: HK_LM:Run, TkBellExe
command: "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
   file: C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
   size: 185632
    MD5: 28525D80EA1D33CF60B8AC318A5F1C82

Located: HK_LM:Run, UpdateWin
command: C:\WINDOWS\System32\1033v.exe
   file: C:\WINDOWS\System32\1033v.exe
   size: 45056
    MD5: 7667B1977C2C63EE118D149722D1A38C

Located: HK_LM:Run, WOOTASKBARICON
command: C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
   file: C:\PROGRA~1\Wanadoo\GestMaj.exe
   size: 32768
    MD5: 8D6F2C724CFC608872EDE3CC4A7B49B9

Located: HK_LM:Run, WOOWATCH
command: C:\PROGRA~1\Wanadoo\Watch.exe
   file: C:\PROGRA~1\Wanadoo\Watch.exe
   size: 20480
    MD5: 9A29592CD135F6262C429152F7A8DD4A

Located: HK_LM:Run, ZoneAlarm Client
command: "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
   file: C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
   size: 919016
    MD5: 7462B3864DA32E6B3D1EF0524E663A23

Located: HK_LM:RunServices, UpdateWin
command: C:\WINDOWS\System32\1033v.exe
   file: C:\WINDOWS\System32\1033v.exe
   size: 45056
    MD5: 7667B1977C2C63EE118D149722D1A38C

Located: HK_CU:Run, CTFMON.EXE
  where: .DEFAULT...
command: C:\WINDOWS\System32\CTFMON.EXE
   file: C:\WINDOWS\System32\CTFMON.EXE
   size: 13312
    MD5: 2C856908EE61424238772508E9FBCBC8

Located: HK_CU:Run, CTFMON.EXE
  where: S-1-5-21-2025429265-1417001333-725345543-1003...
command: C:\WINDOWS\System32\ctfmon.exe
   file: C:\WINDOWS\System32\ctfmon.exe
   size: 13312
    MD5: 2C856908EE61424238772508E9FBCBC8

Located: HK_CU:Run, MsnMsgr
  where: S-1-5-21-2025429265-1417001333-725345543-1003...
command: "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
   file: C:\Program Files\MSN Messenger\MsnMsgr.Exe
   size: 5674352
    MD5: A7EFC7EA7EF6FB022A8A95813EDCBE5D

Located: HK_CU:Run, Shareaza
  where: S-1-5-21-2025429265-1417001333-725345543-1003...
command: "C:\Program Files\Shareaza\Shareaza.exe" -tray
   file: C:\Program Files\Shareaza\Shareaza.exe
   size: 4354048
    MD5: 58DA6D8B55FEDFF760FA3980BDBDDB7E

Located: HK_CU:Run, SpybotSD TeaTimer
  where: S-1-5-21-2025429265-1417001333-725345543-1003...
command: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
   file: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
   size: 1460560
    MD5: B7D4586BFC0DD6C3BE7DCCC252A3E97E

Located: HK_CU:Run, swg
  where: S-1-5-21-2025429265-1417001333-725345543-1003...
command: C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
   file: C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
   size: 68856
    MD5: E616A6A6E91B0A86F2F6217CDE835FFE

Located: HK_CU:Run, UpdateWin
  where: S-1-5-21-2025429265-1417001333-725345543-1003...
command: C:\WINDOWS\System32\1033v.exe
   file: C:\WINDOWS\System32\1033v.exe
   size: 45056
    MD5: 7667B1977C2C63EE118D149722D1A38C

Located: HK_CU:Run, WOOKIT
  where: S-1-5-21-2025429265-1417001333-725345543-1003...
command: C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
   file: C:\PROGRA~1\Wanadoo\Shell.exe
   size: 122880
    MD5: 2BD5E1E68614DBC6B320597856ED6EA7

Located: HK_CU:RunServices, UpdateWin
  where: S-1-5-21-2025429265-1417001333-725345543-1003...
command: C:\WINDOWS\System32\1033v.exe
   file: C:\WINDOWS\System32\1033v.exe
   size: 45056
    MD5: 7667B1977C2C63EE118D149722D1A38C

Located: HK_CU:Run, CTFMON.EXE
  where: S-1-5-18...
command: C:\WINDOWS\System32\CTFMON.EXE
   file: C:\WINDOWS\System32\CTFMON.EXE
   size: 13312
    MD5: 2C856908EE61424238772508E9FBCBC8

Located: Démarrage (tous utilisateurs), WinZip Quick Pick.lnk
  where: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage...
command: C:\Program Files\WinZip\WZQKPICK.EXE
   file: C:\Program Files\WinZip\WZQKPICK.EXE
   size: 394856
    MD5: 6D23B8CB307E455428A778535BE6E6D9

Located: WinLogon, AtiExtEvent
command: Ati2evxx.dll
   file: Ati2evxx.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: WinLogon, crypt32chain
command: crypt32.dll
   file: crypt32.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: WinLogon, cryptnet
command: cryptnet.dll
   file: cryptnet.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: WinLogon, cscdll
command: cscdll.dll
   file: cscdll.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: WinLogon, ScCertProp
command: wlnotify.dll
   file: wlnotify.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: WinLogon, Schedule
command: wlnotify.dll
   file: wlnotify.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: WinLogon, sclgntfy
command: sclgntfy.dll
   file: sclgntfy.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: WinLogon, SensLogn
command: WlNotify.dll
   file: WlNotify.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: WinLogon, termsrv
command: wlnotify.dll
   file: wlnotify.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: WinLogon, wlballoon
command: wlnotify.dll
   file: wlnotify.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!



--- Browser helper object list ---
{91AD9DC2-523A-47E2-A598-6C277F16CC50} ()
          location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
          BHO name: 
        CLSID name: 
              Path: c:\windows\system32\
         Long name:        aadcaad.dll
        Short name:                   
    Date (created): 16/10/2007 21:45:18
Date (last access): 02/12/2007 20:29:24
 Date (last write): 16/10/2007 21:56:00
          Filesize:              81408
        Attributes:           archive 
               MD5: F60656A17ADB3D4447479B2ADFC882C6
             CRC32:           95F9647E



--- ActiveX list ---
DirectAnimation Java Classes (DirectAnimation Java Classes)
          DPF name: DirectAnimation Java Classes
        CLSID name: 
         Installer: 
          Codebase: file://C:\WINDOWS\Java\classes\dajava.cab
       description: 
    classification: Legitimate
    known filename: %WINDIR%\Java\classes\dajava.cab
         info link: 
       info source: Patrick M. Kolla

Microsoft XML Parser for Java (Microsoft XML Parser for Java)
          DPF name: Microsoft XML Parser for Java
        CLSID name: 
         Installer: 
          Codebase: file://C:\WINDOWS\Java\classes\xmldso.cab
       description: 
    classification: Legitimate
    known filename: %WINDIR%\Java\classes\xmldso.cab
         info link: 
       info source: Patrick M. Kolla

{166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control)
          DPF name: 
        CLSID name: Shockwave ActiveX Control
         Installer: C:\WINDOWS\Downloaded Program Files\setup.inf
          Codebase: http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
       description: Macromedia ShockWave Flash Player 7
    classification: Unknown
    known filename: SWDIR.DLL
         info link: 
       info source: Patrick M. Kolla
              Path: C:\WINDOWS\System32\macromed\Director\
         Long name:          swdir.dll
        Short name:                   
    Date (created): 21/07/2007 11:49:48
Date (last access): 01/12/2007 11:16:48
 Date (last write): 02/05/2007 11:32:04
          Filesize:             182512
        Attributes:           archive 
               MD5: 95F03ABE4B96C50CF4DA8245819138E4
             CRC32:           12E5BB80
           Version:          10.2.0.22

{512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class)
          DPF name: 
        CLSID name: TotalScan Installer Class
         Installer: C:\WINDOWS\Downloaded Program Files\CONFLICT.1\ascstubie.inf
          Codebase: https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
              Path: C:\WINDOWS\Downloaded Program Files\CONFLICT.1\
         Long name:      ascstubie.dll
        Short name:       ASCSTU~1.DLL
    Date (created): 21/08/2007 14:37:26
Date (last access): 02/12/2007 09:57:36
 Date (last write): 21/08/2007 14:37:26
          Filesize:             124208
        Attributes:           archive 
               MD5: 0AD87599756B34C0214AFCE961E78DD5
             CRC32:           EA254381
           Version:            1.0.0.7

{56336BCB-3D8A-11D6-A00B-0050DA18DE71} ()
          DPF name: 
        CLSID name: 
         Installer: 
          Codebase: http://software-dl.real.com/02084dfa22d225efae05/netzip/RdxIE601_fr.cab
       description: Netster
    classification: Confirmed as malware
    known filename: 
         info link: 
       info source: 

{8436FE12-31DB-48BF-83BF-FE682F9160B4} (NanoInstaller Class)
          DPF name: 
        CLSID name: NanoInstaller Class
         Installer: C:\WINDOWS\Downloaded Program Files
anoinst.inf
          Codebase: https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
              Path: C:\WINDOWS\Downloaded Program Files\
         Long name:       NanoInst.dll
        Short name:                   
    Date (created): 11/09/2007 13:49:28
Date (last access): 02/12/2007 20:28:16
 Date (last write): 11/09/2007 13:49:28
          Filesize:              38280
        Attributes:           archive 
               MD5: 4BEEB9E3A93CF218602A7A9AE21EDCA7
             CRC32:           FD77ABF2
           Version:            2.2.0.5

{8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0)
          DPF name: Java Runtime Environment 1.6.0
        CLSID name: Java Plug-in 1.6.0_02
         Installer: 
          Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
       description: Sun Java
    classification: Legitimate
    known filename: %PROGRAM FILES%\JabaSoft\JRE\*\Bin
pjava131.dll
         info link: 
       info source: Patrick M. Kolla
              Path: C:\Program Files\Java\jre1.6.0_02\bin\
         Long name:    npjpi160_02.dll
        Short name:       NPJPI1~1.DLL
    Date (created): 12/07/2007 01:22:38
Date (last access): 12/10/2007 16:57:42
 Date (last write): 12/07/2007 03:00:36
          Filesize:             132496
        Attributes:           archive 
               MD5: E3811F1A1C5063C941EC0E2766C3EA39
             CRC32:           AEFD3747
           Version:           6.0.20.6

{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} (Java Runtime Environment 1.5.0)
          DPF name: Java Runtime Environment 1.5.0
        CLSID name: Java Plug-in 1.5.0_04
         Installer: 
          Codebase: http://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab
              Path: C:\Program Files\Java\jre1.5.0_04\bin\
         Long name:    NPJPI150_04.dll
        Short name:       NPJPI1~1.DLL
    Date (created): 03/06/2005 02:52:58
Date (last access): 12/10/2007 16:53:06
 Date (last write): 03/06/2005 03:09:54
          Filesize:              69746
        Attributes:           archive 
               MD5: 8548FE98BD687F35AFD0AED9C2A2DEE3
             CRC32:           4058FA1B
           Version:           5.0.40.5

{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)
          DPF name: Java Runtime Environment 1.6.0
        CLSID name: Java Plug-in 1.6.0_02
         Installer: 
          Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
              Path: C:\Program Files\Java\jre1.6.0_02\bin\
         Long name:    npjpi160_02.dll
        Short name:       NPJPI1~1.DLL
    Date (created): 12/07/2007 01:22:38
Date (last access): 02/12/2007 20:44:52
 Date (last write): 12/07/2007 03:00:36
          Filesize:             132496
        Attributes:           archive 
               MD5: E3811F1A1C5063C941EC0E2766C3EA39
             CRC32:           AEFD3747
           Version:           6.0.20.6

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)
          DPF name: Java Runtime Environment 1.6.0
        CLSID name: Java Plug-in 1.6.0_02
         Installer: 
          Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
              Path: C:\Program Files\Java\jre1.6.0_02\bin\
         Long name:    npjpi160_02.dll
        Short name:       NPJPI1~1.DLL
    Date (created): 12/07/2007 01:22:38
Date (last access): 02/12/2007 20:44:52
 Date (last write): 12/07/2007 03:00:36
          Filesize:             132496
        Attributes:           archive 
               MD5: E3811F1A1C5063C941EC0E2766C3EA39
             CRC32:           AEFD3747
           Version:           6.0.20.6

{D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object)
          DPF name: 
        CLSID name: Shockwave Flash Object
         Installer: C:\WINDOWS\Downloaded Program Files\swflash.inf
          Codebase: http://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
       description: Macromedia Shockwave Flash Player
    classification: Legitimate
    known filename: 
         info link: 
       info source: Patrick M. Kolla
              Path: C:\WINDOWS\System32\Macromed\Flash\
         Long name:        Flash9c.ocx
        Short name:                   
    Date (created): 26/03/2007 17:34:38
Date (last access): 02/12/2007 19:22:24
 Date (last write): 26/03/2007 17:34:38
          Filesize:            2267368
        Attributes:  readonly archive 
               MD5: 82FCE4AC7EC2D077A8DD3C14EDEAD219
             CRC32:           7167E898
           Version:           9.0.45.0



--- Process list ---
PID:    0 (   0) [System]
PID:  148 (   0) \SystemRoot\System32\smss.exe
 size: 45568
PID:  200 (   0) \??\C:\WINDOWS\system32\csrss.exe
 size: 4096
PID:  224 (   0) \??\C:\WINDOWS\system32\winlogon.exe
 size: 520704
PID:  268 (   0) C:\WINDOWS\system32\services.exe
 size: 101888
  MD5: FC0691097471EE374907E1024EDCBD43
PID:  280 (   0) C:\WINDOWS\system32\lsass.exe
 size: 11776
  MD5: B7B1C150AFF59455DB4DF082815F88F5
PID:  440 (   0) C:\WINDOWS\system32\svchost.exe
 size: 12800
  MD5: 333A4DB8410D8E24DB06D6AEBECDC7C2
PID:  472 (   0) C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
 size: 312880
  MD5: 5DCD235C061022BCDA9AA48670B64211
PID:  484 (   0) C:\WINDOWS\system32\svchost.exe
 size: 12800
  MD5: 333A4DB8410D8E24DB06D6AEBECDC7C2
PID:  748 (   0) C:\WINDOWS\Explorer.EXE
 size: 1008128
  MD5: 82FE0D400CB1AC937234467B927B867A
PID:  872 (   0) C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
 size: 4943184
  MD5: C92780F50B8BB7A89E919585916494A9


--- Browser start & search pages list ---
Spybot - Search & Destroy browser pages report, 02/12/2007 20:44:52

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page
  C:\windows\system32\blank.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page
  https://www.google.com/?gws_rd=ssl
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Bar
  http://www.google.com/toolbar/ie8/sidebar.html
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
  https://www.google.fr/?gws_rd=ssl
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
  http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\SearchAssistant
  http://www.google.com/toolbar/ie8/sidebar.html
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\@
  http://www.google.com/search?q=%s
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page
  C:\windows\system32\blank.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page
  http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page
  http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
  http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
  http://www.google.com/toolbar/ie8/sidebar.html
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant
  http://www.google.com/toolbar/ie8/sidebar.html
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
  https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm


--- Winsock Layered Service Provider list ---


--- Uninstall list ---
7-Zip 4.23  (7-Zip)
   uninstall cmd: "C:\Program Files\7-Zip\Uninstall.exe"

@BIOS  (@BIOS)
   uninstall cmd: C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Gigabyte\BIOS\Uninst.isu"

  (AddressBook)

Adobe Shockwave Player 10.2.0.22 (Adobe Shockwave Player)
   uninstall cmd: C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
       publisher: Adobe Systems, Inc.
       help link: https://helpx.adobe.com/shockwave.html

ATI Display Driver 8.152-050629m-024086C-ATI (ATI Display Driver)
   uninstall cmd: rundll32 C:\WINDOWS\System32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean

avast! Antivirus 4.7 (avast!)
 version (major): 4
 version (minor): 7
install location: C:\PROGRA~1\ALWILS~1\Avast4
  install source: C:\DOCUME~1\maison\LOCALS~1\TEMPOR~1\Content.IE5\0DERST6V
   uninstall cmd: rundll32 C:\PROGRA~1\ALWILS~1\Avast4\Setup\setiface.dll,RunSetup
       publisher: Alwil Software
       help link: https://www.avast.com/fr-fr/index

AVG Anti-Spyware 7.5  (AVGAntiSpyware75)
install location: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5
   uninstall cmd: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe
       publisher: Grisoft Ltd.
       help link: https://www.avg.com/fr-fr/homepage

  (Branding)

Composant Hmk  (Composant Hmk)
   uninstall cmd: C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\Vidal\Communs\Hmk.isu"

  (Connection Manager)

VIDAL CD  (Dictionnaire Vidal)
   uninstall cmd: C:\WINDOWS\ISUN040C.EXE -f"C:\Program Files\VIDAL\VIDAL CD\Uninst.isu" -c"C:\Program Files\VIDAL\VIDAL CD\Bin\UnInstVCD.dll"

  (DirectAnimation)

  (DirectDrawEx)

EasyTune5  (EasyTune5)
   uninstall cmd: C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Gigabyte\ET5\Uninst.isu" -c"C:\Program Files\Gigabyte\ET5\uninstdrv.dll"

eMule  (eMule)
   uninstall cmd: "C:\Program Files\eMule\Uninstall.exe"

  (Fontcore)

Navigateur Orange  (FranceTelecomUninstall_FTBrowser)
install location: C:\PROGRA~1\Wanadoo\WOOBrowser
   uninstall cmd: C:\PROGRA~1\Wanadoo\Shell.exe inst\uninst_FTBrowser.shl

Gestionnaire Internet  (GestionnaireInternet.exe)
   uninstall cmd: C:\PROGRA~1\Wanadoo\uninstall.exe

HijackThis 2.0.2 2.0.2 (HijackThis)
   uninstall cmd: "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
       publisher: TrendMicro

  (ICW)

  (IE40)

  (IE4Data)

  (IE5BAKEX)

  (IEData)

Information Center  (Information Center)
   uninstall cmd: "C:\Program Files\Online Add-on\icun.exe"

  (InstallShield Uninstall Information)

Correctif Windows XP - KB842773 20040805.140010 (KB842773)
   uninstall cmd: C:\WINDOWS\$NtUninstallKB842773$\spuninst\spuninst.exe
       publisher: Microsoft Corporation
       help link: https://support.microsoft.com/en-us/help/842773

  (KB884016)

High Definition Audio Driver Package - KB888111 20040219.000000 (KB888111WXP)
   uninstall cmd: "C:\WINDOWS\$NtUninstallKB888111WXP$\spuninst\spuninst.exe"
       publisher: Microsoft Corporation
       help link: https://support.microsoft.com/en-us

Correctif Windows XP - KB890859 1 (KB890859)
   uninstall cmd: "C:\WINDOWS\$NtUninstallKB890859$\spuninst\spuninst.exe"
       publisher: Microsoft Corporation
       help link: https://support.microsoft.com/en-us/help/890859

  (KB893803)

Windows Installer 3.1 (KB893803) 3.1 (KB893803v2)
   uninstall cmd: "C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
       publisher: Microsoft Corporation
       help link: https://support.microsoft.com/en-us/help/893803/windows-installer-3-1-v2-3-1-4000-2435-is-available

Mise à jour pour Windows XP (KB898461) 1 (KB898461)
   uninstall cmd: "C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
       publisher: Microsoft Corporation
       help link: https://support.microsoft.com/en-us/help/898461/

Mise à jour de sécurité pour Windows XP (KB908519) 1 (KB908519)
    install date: 20071130
   uninstall cmd: "C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe"
       publisher: Microsoft Corporation
       help link: https://support.microsoft.com/en-us/help/908519

Mise à jour de sécurité pour Windows XP (KB914389) 1 (KB914389)
    install date: 20071130
   uninstall cmd: "C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe"
       publisher: Microsoft Corporation
       help link: https://support.microsoft.com/en-us/help/914389

Mise à jour de sécurité pour Windows XP (KB920683) 1 (KB920683)
    install date: 20071130
   uninstall cmd: "C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe"
       publisher: Microsoft Corporation
       help link: https://support.microsoft.com/en-us/help/920683

Malwarebytes' RogueRemover 1.22  (Malwarebytes' RogueRemover FREE_is1)
    install date: 20071202
install location: C:\Program Files\RogueRemover FREE\
   uninstall cmd: "C:\Program Files\RogueRemover FREE\unins000.exe"
       publisher: Malwarebytes
       help link: https://www.malwarebytes.com/

  (Microsoft NetShow Player 2.0)

  (MobileOptionPack)

Mozilla Firefox (1.0.7) 1.0.7 (fr-FR) (Mozilla Firefox (1.0.7))
install location: C:\Program Files\Mozilla Firefox
   uninstall cmd: C:\WINDOWS\UninstallFirefox.exe /ua "1.0.7 (fr-FR)"
       publisher: Mozilla

Mozilla Thunderbird (1.0.6) 1.0.6 (fr) (Mozilla Thunderbird (1.0.6))
install location: C:\Program Files\Mozilla Thunderbird
   uninstall cmd: C:\WINDOWS\UninstallThunderbird.exe /ua "1.0.6 (fr)"
       publisher: Mozilla

  (MPlayer2)

  (MSI30-Beta1)

  (MSI30-Beta2)

  (MSI30-KB884016)

  (MSI30-RC1)

  (MSI30-RC2)

  (MSI30a-KB884016)

  (MSI31-Beta)

  (MSI31-RC1)

  (MsJavaVM)

Panda NanoScan  (NanoScan)
  estimated size: 400
install location: C:\Program Files\Panda Security\NanoScan
   uninstall cmd: C:\Program Files\Panda Security\NanoScan
anounst.exe
       publisher: Panda Security
       help link: https://www.pandasecurity.com/en/mediacenter/?ref=mc_blogcav

Navilog1 3.3.0  (Navilog1_is1)
    install date: 20071019
install location: C:\Program Files\Navilog1\
   uninstall cmd: "C:\Program Files\Navilog1\unins000.exe"
       publisher: @IL-MAFIOSO

Nero OEM  (Nero - Burning Rom!UninstallKey)
   uninstall cmd: C:\Program Files\Ahead
ero\uninstall\UNNERO.exe /UNINSTALL

Nero Suite  (NeroMultiInstaller!UninstallKey)
   uninstall cmd: C:\Program Files\Fichiers communs\Ahead\Uninstall\Setup.exe /uninstall

NeroVision Express 2  (NeroVision!UninstallKey)
   uninstall cmd: C:\WINDOWS\UNNeroVision.exe /UNINSTALL

  (NetMeeting)

  (NVEContent!UninstallKey)
   uninstall cmd: C:\WINDOWS\UNNVEContent.exe /UNINSTALL

NVIDIA Drivers  (NVIDIA Drivers)
   uninstall cmd: C:\WINDOWS\System32
vunrm.exe UninstallGUI

  (OutlookExpress)

  (PCHealth)
   uninstall cmd: rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf

  (RealJukebox 1.0)
   uninstall cmd: C:\Program Files\Fichiers communs\Real\Update_OB1puninst.exe RealNetworks|RealPlayer|6.0

RealPlayer  (RealPlayer 6.0)
install location: C:\Program Files\Real\RealPlayerealplay.exe
   uninstall cmd: C:\Program Files\Fichiers communs\Real\Update_OB1puninst.exe RealNetworks|RealPlayer|6.0
       publisher: RealNetworks
        comments: Diffusez, enregistrez et organisez votre musique et vos vidéos, gravez un CD ou emportez votre musique partout avec vous.
         contact: RealNetworks

  (SchedulingAgent)

Shareaza version 2.2.5.0 2.2.5.0 (Shareaza_is1)
    install date: 20070401
install location: C:\Program Files\Shareaza\
   uninstall cmd: "C:\Program Files\Shareaza\Uninstall\unins000.exe"
       publisher: Shareaza Development Team
        comments: Shareaza Ultimate File Sharing
       help link: http://www.shareaza.com/?id=support

  (Shockwave)

Adobe Flash Player 9 ActiveX 9 (ShockwaveFlash)
   uninstall cmd: C:\WINDOWS\System32\Macromed\Flash\FlashUtil9c.exe -uninstallUnlock
       publisher: Adobe Systems
       help link: https://helpx.adobe.com/flash-player.html

Panda TotalScan 01.01.01.0002 (TotalScan)
  estimated size: 4000
install location: C:\Program Files\Panda Security\TotalScan
   uninstall cmd: C:\Program Files\Panda Security\TotalScan\ascuninst.exe
       publisher: Panda Security
       help link: https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan

Windows Media Format Runtime  (Windows Media Format Runtime)
   uninstall cmd: "C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll

Lecteur Windows Media 10  (Windows Media Player)
   uninstall cmd: "C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall

ZoneAlarm 7.0.362.000 (ZoneAlarm)
   uninstall cmd: C:\Program Files\Zone Labs\ZoneAlarm\zauninst.exe
       publisher: Check Point, Inc
       help link: C:\Program Files\Zone Labs\ZoneAlarm\Aide\zaclients.chm

livebox  ({17342E3B-0818-4A6F-BFF8-99476605ADD6})
   uninstall cmd: RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{17342E3B-0818-4A6F-BFF8-99476605ADD6}\Setup.exe" -l0x40c 

Google Toolbar for Internet Explorer  ({2318C2B1-4965-11d4-9B18-009027A5CD4F})
   uninstall cmd: regsvr32 /u /s "c:\program files\google\googletoolbar2.dll"

J2SE Runtime Environment 5.0 Update 4 1.5.0.40 ({3248F0A8-6813-11D6-A77B-00B0D0150040})
         version: 17104896
 version (major): 1
 version (minor): 5
  estimated size: 121289
    install date: 20070330
  install source: C:\Documents and Settings\maison\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150040}\
   uninstall cmd: MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150040}
       publisher: Sun Microsystems, Inc.
         contact: https://www.java.com/en/
       help link: https://www.java.com/en/
          readme: C:\Program Files\Java\jre1.5.0_04\README.txt

Java(TM) 6 Update 2 1.6.0.20 ({3248F0A8-6813-11D6-A77B-00B0D0160020})
         version: 17170432
 version (major): 1
 version (minor): 6
  estimated size: 113938
    install date: 20070721
  install source: http://javadl.sun.com/webapps/download/GetFile/1.6.0_02-b06/windows-i586/
   uninstall cmd: MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
       publisher: Sun Microsystems, Inc.
         contact: https://www.java.com/en/
       help link: https://www.java.com/en/
          readme: C:\Program Files\Java\jre1.6.0_02\README.txt

WebFldrs XP 9.50.6513 ({350C940c-3D7C-4EE8-BAA9-00BCB3D54227})
         version: 154278257
 version (major): 9
 version (minor): 50
  estimated size: 2652
    install date: 20070329
  install source: C:\WINDOWS\System32\
       publisher: Microsoft Corporation
       help link: https://www.microsoft.com/en-us/windows/

Windows Live Sign-in Assistant 4.100.313.1 ({49672EC2-171B-47B4-8CE7-50D7806360D7})
         version: 73662777
 version (major): 4
 version (minor): 100
  estimated size: 1240
    install date: 20070401
  install source: C:\DOCUME~1\maison\LOCALS~1\Temp\IXP000.TMP\
   uninstall cmd: MsiExec.exe /I{49672EC2-171B-47B4-8CE7-50D7806360D7}
       publisher: Microsoft Corporation

USB2.0 Web Camera  ({56A648C2-D185-46A9-BBFF-78AE7A501000})
   uninstall cmd: C:\WINDOWS\System\M1000Rmv.exe

Microsoft Works 08.04.0702 ({A059DE09-1B49-4450-B340-7AE097EC3F04})
         version: 134480574
 version (major): 8
 version (minor): 4
  estimated size: 296363
    install date: 20070330
install location: INSTALLDIR
  install source: D:\MSWORKS\
   uninstall cmd: MsiExec.exe /I{A059DE09-1B49-4450-B340-7AE097EC3F04}
       publisher: Microsoft Corporation
        comments: Microsoft Works 8.0 installation.
       help link: https://support.microsoft.com/en-us
  help telephone:  

Microsoft Visual C++ 2005 Redistributable 8.0.50727.42 ({A49F249F-0C91-497F-86DF-B2585E8E76B7})
         version: 134268455
 version (major): 8
  estimated size: 5192
    install date: 20071006
  install source: C:\DOCUME~1\maison\LOCALS~1\Temp\IXP000.TMP\
   uninstall cmd: MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
       publisher: Microsoft Corporation

Adobe Reader 7.0 - Français 7.0.0 ({AC76BA86-7AD7-1036-7B44-A70000000000})
         version: 117440512
 version (major): 7
  estimated size: 74744
    install date: 20070330
install location: C:\Program Files\Adobe\Acrobat 7.0\Reader\
  install source: C:\Program Files\Adobe\Acrobat 7.0\Setup Files\RdrBIG\FRA\
   uninstall cmd: MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A70000000000}
       publisher: Adobe Systems Incorporated
        comments:    
         contact:  
       help link: https://helpx.adobe.com/support.html
  help telephone:    
          readme: C:\Program Files\Adobe\Acrobat 7.0\Reader\Readme.htm

Spybot - Search & Destroy 1.5.1.15 ({B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1)
    install date: 20071202
install location: C:\Program Files\Spybot - Search & Destroy\
   uninstall cmd: "C:\Program Files\Spybot - Search & Destroy\unins000.exe"
       publisher: Safer Networking Limited
       help link: https://www.safer-networking.org/?page=support

Athlon 64 Processor Driver 1.2.2.2 ({C151CE54-E7EA-4804-854B-F515368B0798})
         version: 16908290
install location: C:\Program Files\AMD\Athlon 64 Processor Driver
   uninstall cmd: RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C151CE54-E7EA-4804-854B-F515368B0798}\setup.exe" -l0x40c 

WinZip 11.1 11.1.7466 ({CD95F661-A5C4-44F5-A6AA-ECDD91C240B5})
         version: 184622378
 version (major): 11
 version (minor): 1
  estimated size: 11558
    install date: 20071202
install location: C:\Program Files\WinZip\
  install source: C:\Documents and Settings\maison\Local Settings\Temporary Internet Files\Content.IE5\IZO7JS9C\
   uninstall cmd: MsiExec.exe /X{CD95F661-A5C4-44F5-A6AA-ECDD91C240B5}
       publisher: WinZip Computing, S.L. 
       help link: https://www.winzip.com/win/fr/contact.html

GEAR 32bit Driver Installer 2.005.1 ({E89B484C-B913-49A0-959B-89E836001658})
         version: 33882113
 version (major): 2
 version (minor): 5
  estimated size: 124
    install date: 20071006
install location: C:\Program Files\GEAR Software, Inc.\My Product Name\
  install source: C:\DOCUME~1\maison\LOCALS~1\Temp\_is5\
   uninstall cmd: MsiExec.exe /X{E89B484C-B913-49A0-959B-89E836001658}
       publisher: GEAR Software, Inc.
         contact: Technical Support
       help link: http://gearsoftware.com/support/online-support.php
  help telephone: +1 561-575-3247

Realtek High Definition Audio Driver 1.92 ({F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC})
         version: 22806528
    install date: 20070329
install location: C:\Program Files\Realtek\InstallShield\
  install source: D:\audio\HD_Audio\
   uninstall cmd: RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x40c  -removeonly
       publisher: Realtek Semiconductor Corp.

Windows Live Messenger 8.1.0178.00 ({F6326B60-1B1D-4ABF-BFCD-7B7404F44411})
         version: 134283442
 version (major): 8
 version (minor): 1
  estimated size: 32219
    install date: 20070401
  install source: C:\DOCUME~1\maison\LOCALS~1\Temp\IXP000.TMP\
   uninstall cmd: MsiExec.exe /I{F6326B60-1B1D-4ABF-BFCD-7B7404F44411}
       publisher: Microsoft Corporation



--- System Services ---
Service (registry key): Aavmker4
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: avast! Asynchronous Virus Monitor
   Control Set: CurrentControlSet
         Start: 1
          Type: 1
 Error Control: 1

Service (registry key): Abiosdsk
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 0

Service (registry key): abp480n5
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): ACPI
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote ACPI Microsoft
    Image path: System32\DRIVERS\ACPI.sys
    Image size: 0
     Image MD5: D41D8CD98F00B204E9800998ECF8427E
   Control Set: CurrentControlSet
         Start: 0
          Type: 1
 Error Control: 1

Service (registry key): ACPIEC
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): adpu160m
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): aec
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Suppresseur d'écho acoustique (Noyau Microsoft)
    Image path: system32\drivers\aec.sys
    Image size: 0
     Image MD5: D41D8CD98F00B204E9800998ECF8427E
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1

Service (registry key): AFD
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Environnement de prise en charge de réseau AFD
    Image path: \SystemRoot\System32\drivers\afd.sys
    Image size: 0
     Image MD5: D41D8CD98F00B204E9800998ECF8427E
   Control Set: CurrentControlSet
         Start: 2
          Type: 1
 Error Control: 1

Service (registry key): Aha154x
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): aic78u2
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): aic78xx
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): Alerter
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Avertissement
   Description: Informe les utilisateurs et les ordinateurs sélectionnés des alertes administratives. Si ce service est arrêté, les programmes qui utilisent les alertes administratives ne les recevront pas. Si ce service est désactivé, les services qui en dépendent ne pourront pas démarrer.
   Object name: NT AUTHORITY\LocalService
    Image path: %SystemRoot%\System32\svchost.exe -k LocalService
    Image size: 12800
     Image MD5: 333A4DB8410D8E24DB06D6AEBECDC7C2
   Control Set: CurrentControlSet
         Start: 3
          Type: 32
 Error Control: 1
 Depends On services: LanmanWorkstation

Service (registry key): ALG
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Service de la passerelle de la couche Application
   Description: Fournit la prise en charge des plugins de protocoles tiers pour le partage de connexion Internet et le pare-feu Internet.
   Object name: NT AUTHORITY\LocalService
    Image path: %SystemRoot%\System32\alg.exe
    Image size: 41984
     Image MD5: 292FBA8E83DB606519D45DD1FCBBD3B8
   Control Set: CurrentControlSet
         Start: 3
          Type: 16
 Error Control: 1

Service (registry key): AliIde
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): AmdK8
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote de processeur AMD
    Image path: System32\DRIVERS\AmdK8.sys
    Image size: 0
     Image MD5: D41D8CD98F00B204E9800998ECF8427E
   Control Set: CurrentControlSet
         Start: 1
          Type: 1
 Error Control: 1

Service (registry key): amsint
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): AppMgmt
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Gestion d'applications
   Description: Fournit des services d'installation de logiciels tels que Attribuer, Publier et Supprimer.
   Object name: LocalSystem
    Image path: %SystemRoot%\system32\svchost.exe -k netsvcs
    Image size: 12800
     Image MD5: 333A4DB8410D8E24DB06D6AEBECDC7C2
   Control Set: CurrentControlSet
         Start: 3
          Type: 32
 Error Control: 1

Service (registry key): Arp1394
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Protocole client ARP 1394
   Description: Protocole client ARP 1394
    Image path: System32\DRIVERS\arp1394.sys
    Image size: 0
     Image MD5: D41D8CD98F00B204E9800998ECF8427E
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1
 Depends On services: Tcpip

Service (registry key): asc
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): asc3350p
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): asc3550
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): aswMon2
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: avast! Standard Shield Support
   Control Set: CurrentControlSet
         Start: 2
          Type: 2
 Error Control: 1

Service (registry key): aswRdr
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: aswRdr
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1
 Depends On services: tcpip

Service (registry key): aswTdi
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: avast! Network Shield Support
   Control Set: CurrentControlSet
         Start: 1
          Type: 1
 Error Control: 1
 Depends On services: tcpip

Service (registry key): aswUpdSv
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: avast! iAVS4 Control Service
   Description: Fournit la mise à jour automatique pour l'antivirus avast!.
   Object name: LocalSystem
    Image path: "C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"
    Image size: 16248
     Image MD5: 765E0E2BDB83C58FFC411DA401D8BA66
   Control Set: CurrentControlSet
         Start: 2
          Type: 272
 Error Control: 1

Service (registry key): AsyncMac
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote de média asynchrone RAS
   Description: Pilote de média asynchrone RAS
    Image path: System32\DRIVERS\asyncmac.sys
    Image size: 0
     Image MD5: D41D8CD98F00B204E9800998ECF8427E
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1

Service (registry key): atapi
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Contrôleur de disque dur IDE/ESDI standard
    Image path: System32\DRIVERS\atapi.sys
    Image size: 0
     Image MD5: D41D8CD98F00B204E9800998ECF8427E
   Control Set: CurrentControlSet
         Start: 0
          Type: 1
 Error Control: 1

Service (registry key): Atdisk
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 0

Service (registry key): Ati HotKey Poller
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Object name: LocalSystem
    Image path: %SystemRoot%\System32\Ati2evxx.exe
    Image size: 376832
     Image MD5: 06B67E6A0B679D037D2D9E27A64CE90C
   Control Set: CurrentControlSet
         Start: 2
          Type: 272
 Error Control: 1

Service (registry key): ati2mtag
 Registry path: \SYSTEM\CurrentControlSet\Services\
    Image path: System32\DRIVERS\ati2mtag.sys
    Image size: 0
     Image MD5: D41D8CD98F00B204E9800998ECF8427E
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 0

Service (registry key): Atierecord
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 0
          Type: 0
 Error Control: 0

Service (registry key): atinrvxx
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: ATI WDM Rage Theater Video
    Image path: System32\DRIVERS\atinrvxx.sys
    Image size: 0
     Image MD5: D41D8CD98F00B204E9800998ECF8427E
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1

Service (registry key): Atmarpc
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Protocole client ATM ARP
   Description: Protocole client ATM ARP
    Image path: System32\DRIVERS\atmarpc.sys
    Image size: 0
     Image MD5: D41D8CD98F00B204E9800998ECF8427E
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1
 Depends On services: Tcpip

Service (registry key): AudioSrv
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Audio Windows
   Description: Gère les périphériques audio pour les programmes basés sur Windows. Si ce service est arrêté, les périphériques et les effets audio ne fonctionneront pas correctement. Si ce service est désactivé, les services en dépendant explicitement ne démarreront pas.
   Object name: LocalSystem
    Image path: %SystemRoot%\System32\svchost.exe -k netsvcs
    Image size: 12800
     Image MD5: 333A4DB8410D8E24DB06D6AEBECDC7C2
   Control Set: CurrentControlSet
         Start: 2
          Type: 32
 Error Control: 1
 Depends On services: PlugPlay,RpcSs

Service (registry key): audstub
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote audio Stub
    Image path: System32\DRIVERS\audstub.sys
    Image size: 0
     Image MD5: D41D8CD98F00B204E9800998ECF8427E
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1

Service (registry key): avast! Antivirus
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: avast! Antivirus
   Description: Gère et implémente les services de l'antivirus avast! pour cet ordinateur. Ceci inclut la protection résidente, la zone de quarantaine et le planificateur.
   Object name: LocalSystem
    Image path: "C:\Program Files\Alwil Software\Avast4\ashServ.exe"
    Image size: 132472
     Image MD5: 47DF7F40F77FCE0A134021C6BF0FF52A
   Control Set: CurrentControlSet
         Start: 2
          Type: 272
 Error Control: 1
 Depends On services: aswMon2,RpcSS

Service (registry key): avast! Mail Scanner
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: avast! Mail Scanner
   Description: Implémente l'analyse du courrier électronique pour l'antivirus avast!.
   Object name: LocalSystem
    Image path: "C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service
    Image size: 243064
     Image MD5: 3F4A782FECFA42AB86CEA759EB929106
   Control Set: CurrentControlSet
         Start: 3
          Type: 272
 Error Control: 1
 Depends On services: "avast! Antivirus"

Service (registry key): avast! Web Scanner
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: avast! Web Scanner
   Description: Implémente l'analyse du contenu web (HTTP) pour l'antivirus avast!.
   Object name: LocalSystem
    Image path: "C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service
    Image size: 345464
     Image MD5: CDED5892E327CDCBB64E598AE6C4E3E3
   Control Set: CurrentControlSet
         Start: 3
          Type: 272
 Error Control: 1
 Depends On services: "avast! Antivirus"

Service (registry key): AVG Anti-Spyware Driver
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: AVG Anti-Spyware Driver
    Image path: \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys
    Image size: 0
     Image MD5: D41D8CD98F00B204E9800998ECF8427E
   Control Set: CurrentControlSet
         Start: 1
          Type: 1
 Error Control: 1

Service (registry key): AVG Anti-Spyware Guard
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: AVG Anti-Spyware Guard
   Object name: LocalSystem
    Image path: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    Image size: 312880
     Image MD5: 5DCD235C061022BCDA9AA48670B64211
   Control Set: CurrentControlSet
         Start: 2
          Type: 16
 Error Control: 1

Service (registry key): AvgAsCln
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: AVG Anti-Spyware Clean Driver
    Image path: System32\DRIVERS\AvgAsCln.sys
    Image size: 0
     Image MD5: D41D8CD98F00B204E9800998ECF8427E
   Control Set: CurrentControlSet
         Start: 1
          Type: 1
 Error Control: 1

Service (registry key): BattC
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 0
          Type: 0
 Error Control: 0

Service (registry key): Beep
 Registry path: \SYSTEM\CurrentControlSet\Services\

Julien06 · Answer

re, ok pour recycler c'est ok merci.

Sinon pour le mode ss echec et spybot le rapport est le suivant


--- Search result list ---
RealDownloadExpress: [SBI $1EDE24BC] Root class (Clé du registre, fixed)
  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RealDownloadExpress.IE

RealDownloadExpress: [SBI $1EDE24BC] Root class (Clé du registre, fixed)
  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RealDownloadExpress.IE.1

RealDownloadExpress: [SBI $1EDE24BC] Class ID (Clé du registre, fixed)
  HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56336BCB-3D8A-11d6-A00B-0050DA18DE71}

RealDownloadExpress: [SBI $3BB925FD] Class ID (Clé du registre, fixed)
  HKEY_CLASSES_ROOT\TypeLib\{FDF5CDE5-17A6-40B3-A544-A8527AE8B243}

UtileProtection: [SBI $7162C2E7] Réglages (Clé du registre, fixed)
  HKEY_LOCAL_MACHINE\SOFTWARE\Purchased Products\System Error Repair

Vario.AntiVirus: [SBI $6DD17C26] Dossier Programme (Répertoire, fixed)
  c:\UGA6PV\

Vario.AntiVirus: [SBI $FD1D24F8] Réglages utilisateur (Clé du registre, fixed)
  HKEY_USERS\S-1-5-21-2025429265-1417001333-725345543-1003\Software\VirusGarde

Vario.AntiVirus: [SBI $AAAFC4B0] Réglages (Clé du registre, fixed)
  HKEY_LOCAL_MACHINE\SOFTWARE\VirusGarde

Vario.AntiVirus: [SBI $28842A62] Dossier Programme (Répertoire, fixed)
  C:\Documents and Settings\All Users\Menu Démarrer\Programmes\VirusGarde\

Vario.AntiVirus: [SBI $68FB8D46]  Lien (Fichier, fixed)
  C:\Documents and Settings\All Users\Menu Démarrer\Programmes\virusgarde\VirusGarde.lnk

EverestPoker: [SBI $03A31629] Réglages (Clé du registre, fixed)
  HKEY_USERS\S-1-5-21-2025429265-1417001333-725345543-1003\Software\Grand Virtual

EverestPoker: [SBI $34F4B617] Réglages désinstallation (Clé du registre, fixed)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Everest Poker

EverestPoker: [SBI $EB906E36] Dossier Programme (Répertoire, fixed)
  C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Everest Poker\

EverestPoker: [SBI $C42AAFB3] Réglages utilisateur (Valeur du registre, fixed)
  HKEY_USERS\S-1-5-21-2025429265-1417001333-725345543-1003\Software\Grand Virtual\XD3C

Microsoft.Windows.Explorer: [SBI $E3838056] Réglages utilisateur (Modification du registre, fixed)
  HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel

Microsoft.Windows.Explorer: [SBI $E3838056] Réglages utilisateur (Modification du registre, fixed)
  HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel

Microsoft.WindowsSecurityCenter.AntiVirusDisableNotify: [SBI $5509538C] Réglages (Modification du registre, fixed)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify

Microsoft.WindowsSecurityCenter.AntiVirusOverride: [SBI $3604910C] Réglages (Modification du registre, fixed)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride

Alexa Related: [SBI $9263101F]  Lien (Remplacer le fichier, fixed)
  C:\WINDOWS\Webelated.htm

Win32.Banker.aipy.rtk: [SBI $1C9E9F4A]  Bibliothèque (Fichier, fixed)
  C:\WINDOWS\system32\iebudata.dll

Win32.Banker.aipy.rtk: [SBI $7B5B3ACC]  Bibliothèque (Fichier, fixed)
  C:\WINDOWS\system32\ierql.dll

Win32.Banker.aipy.rtk: [SBI $D875AB6E]  Bibliothèque (Fichier, fixed)
  C:\WINDOWS\system32\qshl.dll

Win32.Murlo.ff.rtk: [SBI $67E0FCFD] Réglages (Valeur du registre, fixed)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\UID

DoubleClick: [SBI $4CDCC3D5] Cookie traceur (Internet Explorer: maison) (Cookie, fixed)
  

SexTracker: [SBI $4CDCC3D5] Cookie traceur (Internet Explorer: maison) (Cookie, fixed)
  

Statcounter: [SBI $4CDCC3D5] Cookie traceur (Internet Explorer: maison) (Cookie, fixed)
  

Zedo: [SBI $4CDCC3D5] Cookie traceur (Internet Explorer: maison) (Cookie, fixed)
  

WebTrends live: [SBI $4CDCC3D5] Cookie traceur (Internet Explorer: maison) (Cookie, fixed)
  

MediaPlex: [SBI $4CDCC3D5] Cookie traceur (Internet Explorer: maison) (Cookie, fixed)
  

MediaPlex: [SBI $4CDCC3D5] Cookie traceur (Internet Explorer: maison) (Cookie, fixed)
  

BlueStreak: [SBI $4CDCC3D5] Cookie traceur (Internet Explorer: maison) (Cookie, fixed)
  

TagASaurus: [SBI $4CDCC3D5] Cookie traceur (Internet Explorer: maison) (Cookie, fixed)
  

Tradedoubler: [SBI $4CDCC3D5] Cookie traceur (Internet Explorer: maison) (Cookie, fixed)
  

SexTracker: [SBI $4CDCC3D5] Cookie traceur (Internet Explorer: maison) (Cookie, fixed)
  


--- Spybot - Search & Destroy version: 1.5  (build: 20070830) ---

2007-08-31 blindman.exe (1.0.0.6)
2007-08-31 SDMain.exe (1.0.0.4)
2007-08-31 SDUpdate.exe (1.0.6.4)
2007-08-31 SDWinSec.exe (1.0.0.8)
2007-08-31 SpybotSD.exe (1.5.1.15)
2007-08-31 TeaTimer.exe (1.5.0.9)
2007-12-02 unins000.exe (51.46.0.0)
2007-08-31 Update.exe (1.4.0.5)
2007-08-31 advcheck.dll (1.5.3.0)
2007-04-02 aports.dll (2.1.0.0)
2007-04-02 DelZip179.dll (1.79.5.3)
2007-08-31 SDHelper.dll (1.5.0.8)
2007-08-31 Tools.dll (2.1.2.0)
2007-11-28 Includes\Cookies.sbi (*)
2007-10-31 Includes\Dialer.sbi (*)
2007-11-28 Includes\DialerC.sbi (*)
2007-11-07 Includes\Hijackers.sbi (*)
2007-11-28 Includes\HijackersC.sbi (*)
2007-10-04 Includes\Keyloggers.sbi (*)
2007-11-28 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2007-11-07 Includes\Malware.sbi (*)
2007-11-28 Includes\MalwareC.sbi (*)
2007-10-24 Includes\PUPS.sbi (*)
2007-11-28 Includes\PUPSC.sbi (*)
2007-11-28 Includes\Revision.sbi (*)
2007-05-30 Includes\Security.sbi (*)
2007-11-28 Includes\SecurityC.sbi (*)
2007-11-07 Includes\Spybots.sbi (*)
2007-11-28 Includes\SpybotsC.sbi (*)
2007-11-06 Includes\Tracks.uti
2007-11-28 Includes\Trojans.sbi (*)
2007-11-28 Includes\TrojansC.sbi (*)
2008-12-24 Plugins\TCPIPAddress.dll



--- System information ---
Windows XP (Build: 2600) Service Pack 1 (5.1.2600)
 / Windows XP / SP2: Correctif Windows XP - KB842773
 / Windows XP / SP3: Correctif Windows XP - KB890859
 / Windows XP / SP3: Windows Installer 3.1 (KB893803)
 / Windows XP / SP3: Mise à jour pour Windows XP (KB898461)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB908519)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB914389)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB920683)


--- Startup entries list ---
Located: HK_LM:Run, !AVG Anti-Spyware
command: "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
   file: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
   size: 6731312
    MD5: CC6BC45DD5A58158645E7FB2953604FE

Located: HK_LM:Run, avast!
command: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
   file: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
   size: 79224
    MD5: 8CF58586AE4577ED71FFE8883A6D4B3B

Located: HK_LM:Run, EasyTuneV
command: C:\Program Files\Gigabyte\ET5\GUI.exe
   file: C:\Program Files\Gigabyte\ET5\GUI.exe
   size: 200704
    MD5: 9565F8CA2D91EBD35DFE2979764C21C7

Located: HK_LM:Run, High Definition Audio Property Page Shortcut
command: HDAShCut.exe
   file: C:\WINDOWS\system32\HDAShCut.exe
   size: 61952
    MD5: 9C3B2302B60FB0EFB13BC880A5E3E93E

Located: HK_LM:Run, M1000Mnt
command: M1000Rmv.exe /StartStillMnt
   file: 
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: HK_LM:Run, NeroFilterCheck
command: C:\WINDOWS\system32\NeroCheck.exe
   file: C:\WINDOWS\system32\NeroCheck.exe
   size: 155648
    MD5: 3E4C03CEFAD8DE135263236B61A49C90

Located: HK_LM:Run, RTHDCPL
command: RTHDCPL.EXE
   file: C:\WINDOWS\RTHDCPL.EXE
   size: 14679552
    MD5: 8658493317CD85B5C655557061D08B53

Located: HK_LM:Run, TkBellExe
command: "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
   file: C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
   size: 185632
    MD5: 28525D80EA1D33CF60B8AC318A5F1C82

Located: HK_LM:Run, UpdateWin
command: C:\WINDOWS\System32\1033v.exe
   file: C:\WINDOWS\System32\1033v.exe
   size: 45056
    MD5: 7667B1977C2C63EE118D149722D1A38C

Located: HK_LM:Run, WOOTASKBARICON
command: C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
   file: C:\PROGRA~1\Wanadoo\GestMaj.exe
   size: 32768
    MD5: 8D6F2C724CFC608872EDE3CC4A7B49B9

Located: HK_LM:Run, WOOWATCH
command: C:\PROGRA~1\Wanadoo\Watch.exe
   file: C:\PROGRA~1\Wanadoo\Watch.exe
   size: 20480
    MD5: 9A29592CD135F6262C429152F7A8DD4A

Located: HK_LM:Run, ZoneAlarm Client
command: "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
   file: C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
   size: 919016
    MD5: 7462B3864DA32E6B3D1EF0524E663A23

Located: HK_LM:RunServices, UpdateWin
command: C:\WINDOWS\System32\1033v.exe
   file: C:\WINDOWS\System32\1033v.exe
   size: 45056
    MD5: 7667B1977C2C63EE118D149722D1A38C

Located: HK_CU:Run, CTFMON.EXE
  where: .DEFAULT...
command: C:\WINDOWS\System32\CTFMON.EXE
   file: C:\WINDOWS\System32\CTFMON.EXE
   size: 13312
    MD5: 2C856908EE61424238772508E9FBCBC8

Located: HK_CU:Run, CTFMON.EXE
  where: S-1-5-21-2025429265-1417001333-725345543-1003...
command: C:\WINDOWS\System32\ctfmon.exe
   file: C:\WINDOWS\System32\ctfmon.exe
   size: 13312
    MD5: 2C856908EE61424238772508E9FBCBC8

Located: HK_CU:Run, MsnMsgr
  where: S-1-5-21-2025429265-1417001333-725345543-1003...
command: "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
   file: C:\Program Files\MSN Messenger\MsnMsgr.Exe
   size: 5674352
    MD5: A7EFC7EA7EF6FB022A8A95813EDCBE5D

Located: HK_CU:Run, Shareaza
  where: S-1-5-21-2025429265-1417001333-725345543-1003...
command: "C:\Program Files\Shareaza\Shareaza.exe" -tray
   file: C:\Program Files\Shareaza\Shareaza.exe
   size: 4354048
    MD5: 58DA6D8B55FEDFF760FA3980BDBDDB7E

Located: HK_CU:Run, SpybotSD TeaTimer
  where: S-1-5-21-2025429265-1417001333-725345543-1003...
command: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
   file: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
   size: 1460560
    MD5: B7D4586BFC0DD6C3BE7DCCC252A3E97E

Located: HK_CU:Run, swg
  where: S-1-5-21-2025429265-1417001333-725345543-1003...
command: C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
   file: C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
   size: 68856
    MD5: E616A6A6E91B0A86F2F6217CDE835FFE

Located: HK_CU:Run, UpdateWin
  where: S-1-5-21-2025429265-1417001333-725345543-1003...
command: C:\WINDOWS\System32\1033v.exe
   file: C:\WINDOWS\System32\1033v.exe
   size: 45056
    MD5: 7667B1977C2C63EE118D149722D1A38C

Located: HK_CU:Run, WOOKIT
  where: S-1-5-21-2025429265-1417001333-725345543-1003...
command: C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
   file: C:\PROGRA~1\Wanadoo\Shell.exe
   size: 122880
    MD5: 2BD5E1E68614DBC6B320597856ED6EA7

Located: HK_CU:RunServices, UpdateWin
  where: S-1-5-21-2025429265-1417001333-725345543-1003...
command: C:\WINDOWS\System32\1033v.exe
   file: C:\WINDOWS\System32\1033v.exe
   size: 45056
    MD5: 7667B1977C2C63EE118D149722D1A38C

Located: HK_CU:Run, CTFMON.EXE
  where: S-1-5-18...
command: C:\WINDOWS\System32\CTFMON.EXE
   file: C:\WINDOWS\System32\CTFMON.EXE
   size: 13312
    MD5: 2C856908EE61424238772508E9FBCBC8

Located: Démarrage (tous utilisateurs), WinZip Quick Pick.lnk
  where: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage...
command: C:\Program Files\WinZip\WZQKPICK.EXE
   file: C:\Program Files\WinZip\WZQKPICK.EXE
   size: 394856
    MD5: 6D23B8CB307E455428A778535BE6E6D9

Located: WinLogon, AtiExtEvent
command: Ati2evxx.dll
   file: Ati2evxx.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: WinLogon, crypt32chain
command: crypt32.dll
   file: crypt32.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: WinLogon, cryptnet
command: cryptnet.dll
   file: cryptnet.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: WinLogon, cscdll
command: cscdll.dll
   file: cscdll.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: WinLogon, ScCertProp
command: wlnotify.dll
   file: wlnotify.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: WinLogon, Schedule
command: wlnotify.dll
   file: wlnotify.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: WinLogon, sclgntfy
command: sclgntfy.dll
   file: sclgntfy.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: WinLogon, SensLogn
command: WlNotify.dll
   file: WlNotify.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: WinLogon, termsrv
command: wlnotify.dll
   file: wlnotify.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: WinLogon, wlballoon
command: wlnotify.dll
   file: wlnotify.dll
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!



--- Browser helper object list ---
{91AD9DC2-523A-47E2-A598-6C277F16CC50} ()
          location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
          BHO name: 
        CLSID name: 
              Path: c:\windows\system32\
         Long name:        aadcaad.dll
        Short name:                   
    Date (created): 16/10/2007 21:45:18
Date (last access): 02/12/2007 20:29:24
 Date (last write): 16/10/2007 21:56:00
          Filesize:              81408
        Attributes:           archive 
               MD5: F60656A17ADB3D4447479B2ADFC882C6
             CRC32:           95F9647E



--- ActiveX list ---
DirectAnimation Java Classes (DirectAnimation Java Classes)
          DPF name: DirectAnimation Java Classes
        CLSID name: 
         Installer: 
          Codebase: file://C:\WINDOWS\Java\classes\dajava.cab
       description: 
    classification: Legitimate
    known filename: %WINDIR%\Java\classes\dajava.cab
         info link: 
       info source: Patrick M. Kolla

Microsoft XML Parser for Java (Microsoft XML Parser for Java)
          DPF name: Microsoft XML Parser for Java
        CLSID name: 
         Installer: 
          Codebase: file://C:\WINDOWS\Java\classes\xmldso.cab
       description: 
    classification: Legitimate
    known filename: %WINDIR%\Java\classes\xmldso.cab
         info link: 
       info source: Patrick M. Kolla

{166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control)
          DPF name: 
        CLSID name: Shockwave ActiveX Control
         Installer: C:\WINDOWS\Downloaded Program Files\setup.inf
          Codebase: http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
       description: Macromedia ShockWave Flash Player 7
    classification: Unknown
    known filename: SWDIR.DLL
         info link: 
       info source: Patrick M. Kolla
              Path: C:\WINDOWS\System32\macromed\Director\
         Long name:          swdir.dll
        Short name:                   
    Date (created): 21/07/2007 11:49:48
Date (last access): 01/12/2007 11:16:48
 Date (last write): 02/05/2007 11:32:04
          Filesize:             182512
        Attributes:           archive 
               MD5: 95F03ABE4B96C50CF4DA8245819138E4
             CRC32:           12E5BB80
           Version:          10.2.0.22

{512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class)
          DPF name: 
        CLSID name: TotalScan Installer Class
         Installer: C:\WINDOWS\Downloaded Program Files\CONFLICT.1\ascstubie.inf
          Codebase: https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
              Path: C:\WINDOWS\Downloaded Program Files\CONFLICT.1\
         Long name:      ascstubie.dll
        Short name:       ASCSTU~1.DLL
    Date (created): 21/08/2007 14:37:26
Date (last access): 02/12/2007 09:57:36
 Date (last write): 21/08/2007 14:37:26
          Filesize:             124208
        Attributes:           archive 
               MD5: 0AD87599756B34C0214AFCE961E78DD5
             CRC32:           EA254381
           Version:            1.0.0.7

{56336BCB-3D8A-11D6-A00B-0050DA18DE71} ()
          DPF name: 
        CLSID name: 
         Installer: 
          Codebase: http://software-dl.real.com/02084dfa22d225efae05/netzip/RdxIE601_fr.cab
       description: Netster
    classification: Confirmed as malware
    known filename: 
         info link: 
       info source: 

{8436FE12-31DB-48BF-83BF-FE682F9160B4} (NanoInstaller Class)
          DPF name: 
        CLSID name: NanoInstaller Class
         Installer: C:\WINDOWS\Downloaded Program Files
anoinst.inf
          Codebase: https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
              Path: C:\WINDOWS\Downloaded Program Files\
         Long name:       NanoInst.dll
        Short name:                   
    Date (created): 11/09/2007 13:49:28
Date (last access): 02/12/2007 20:28:16
 Date (last write): 11/09/2007 13:49:28
          Filesize:              38280
        Attributes:           archive 
               MD5: 4BEEB9E3A93CF218602A7A9AE21EDCA7
             CRC32:           FD77ABF2
           Version:            2.2.0.5

{8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0)
          DPF name: Java Runtime Environment 1.6.0
        CLSID name: Java Plug-in 1.6.0_02
         Installer: 
          Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
       description: Sun Java
    classification: Legitimate
    known filename: %PROGRAM FILES%\JabaSoft\JRE\*\Bin
pjava131.dll
         info link: 
       info source: Patrick M. Kolla
              Path: C:\Program Files\Java\jre1.6.0_02\bin\
         Long name:    npjpi160_02.dll
        Short name:       NPJPI1~1.DLL
    Date (created): 12/07/2007 01:22:38
Date (last access): 12/10/2007 16:57:42
 Date (last write): 12/07/2007 03:00:36
          Filesize:             132496
        Attributes:           archive 
               MD5: E3811F1A1C5063C941EC0E2766C3EA39
             CRC32:           AEFD3747
           Version:           6.0.20.6

{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} (Java Runtime Environment 1.5.0)
          DPF name: Java Runtime Environment 1.5.0
        CLSID name: Java Plug-in 1.5.0_04
         Installer: 
          Codebase: http://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab
              Path: C:\Program Files\Java\jre1.5.0_04\bin\
         Long name:    NPJPI150_04.dll
        Short name:       NPJPI1~1.DLL
    Date (created): 03/06/2005 02:52:58
Date (last access): 12/10/2007 16:53:06
 Date (last write): 03/06/2005 03:09:54
          Filesize:              69746
        Attributes:           archive 
               MD5: 8548FE98BD687F35AFD0AED9C2A2DEE3
             CRC32:           4058FA1B
           Version:           5.0.40.5

{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)
          DPF name: Java Runtime Environment 1.6.0
        CLSID name: Java Plug-in 1.6.0_02
         Installer: 
          Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
              Path: C:\Program Files\Java\jre1.6.0_02\bin\
         Long name:    npjpi160_02.dll
        Short name:       NPJPI1~1.DLL
    Date (created): 12/07/2007 01:22:38
Date (last access): 02/12/2007 20:44:52
 Date (last write): 12/07/2007 03:00:36
          Filesize:             132496
        Attributes:           archive 
               MD5: E3811F1A1C5063C941EC0E2766C3EA39
             CRC32:           AEFD3747
           Version:           6.0.20.6

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)
          DPF name: Java Runtime Environment 1.6.0
        CLSID name: Java Plug-in 1.6.0_02
         Installer: 
          Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
              Path: C:\Program Files\Java\jre1.6.0_02\bin\
         Long name:    npjpi160_02.dll
        Short name:       NPJPI1~1.DLL
    Date (created): 12/07/2007 01:22:38
Date (last access): 02/12/2007 20:44:52
 Date (last write): 12/07/2007 03:00:36
          Filesize:             132496
        Attributes:           archive 
               MD5: E3811F1A1C5063C941EC0E2766C3EA39
             CRC32:           AEFD3747
           Version:           6.0.20.6

{D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object)
          DPF name: 
        CLSID name: Shockwave Flash Object
         Installer: C:\WINDOWS\Downloaded Program Files\swflash.inf
          Codebase: http://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
       description: Macromedia Shockwave Flash Player
    classification: Legitimate
    known filename: 
         info link: 
       info source: Patrick M. Kolla
              Path: C:\WINDOWS\System32\Macromed\Flash\
         Long name:        Flash9c.ocx
        Short name:                   
    Date (created): 26/03/2007 17:34:38
Date (last access): 02/12/2007 19:22:24
 Date (last write): 26/03/2007 17:34:38
          Filesize:            2267368
        Attributes:  readonly archive 
               MD5: 82FCE4AC7EC2D077A8DD3C14EDEAD219
             CRC32:           7167E898
           Version:           9.0.45.0



--- Process list ---
PID:    0 (   0) [System]
PID:  148 (   0) \SystemRoot\System32\smss.exe
 size: 45568
PID:  200 (   0) \??\C:\WINDOWS\system32\csrss.exe
 size: 4096
PID:  224 (   0) \??\C:\WINDOWS\system32\winlogon.exe
 size: 520704
PID:  268 (   0) C:\WINDOWS\system32\services.exe
 size: 101888
  MD5: FC0691097471EE374907E1024EDCBD43
PID:  280 (   0) C:\WINDOWS\system32\lsass.exe
 size: 11776
  MD5: B7B1C150AFF59455DB4DF082815F88F5
PID:  440 (   0) C:\WINDOWS\system32\svchost.exe
 size: 12800
  MD5: 333A4DB8410D8E24DB06D6AEBECDC7C2
PID:  472 (   0) C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
 size: 312880
  MD5: 5DCD235C061022BCDA9AA48670B64211
PID:  484 (   0) C:\WINDOWS\system32\svchost.exe
 size: 12800
  MD5: 333A4DB8410D8E24DB06D6AEBECDC7C2
PID:  748 (   0) C:\WINDOWS\Explorer.EXE
 size: 1008128
  MD5: 82FE0D400CB1AC937234467B927B867A
PID:  872 (   0) C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
 size: 4943184
  MD5: C92780F50B8BB7A89E919585916494A9


--- Browser start & search pages list ---
Spybot - Search & Destroy browser pages report, 02/12/2007 20:44:52

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page
  C:\windows\system32\blank.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page
  https://www.google.com/?gws_rd=ssl
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Bar
  http://www.google.com/toolbar/ie8/sidebar.html
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
  https://www.google.fr/?gws_rd=ssl
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
  http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\SearchAssistant
  http://www.google.com/toolbar/ie8/sidebar.html
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\@
  http://www.google.com/search?q=%s
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page
  C:\windows\system32\blank.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page
  http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page
  http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
  http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
  http://www.google.com/toolbar/ie8/sidebar.html
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant
  http://www.google.com/toolbar/ie8/sidebar.html
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
  https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm


--- Winsock Layered Service Provider list ---


--- Uninstall list ---
7-Zip 4.23  (7-Zip)
   uninstall cmd: "C:\Program Files\7-Zip\Uninstall.exe"

@BIOS  (@BIOS)
   uninstall cmd: C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Gigabyte\BIOS\Uninst.isu"

  (AddressBook)

Adobe Shockwave Player 10.2.0.22 (Adobe Shockwave Player)
   uninstall cmd: C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
       publisher: Adobe Systems, Inc.
       help link: https://helpx.adobe.com/shockwave.html

ATI Display Driver 8.152-050629m-024086C-ATI (ATI Display Driver)
   uninstall cmd: rundll32 C:\WINDOWS\System32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean

avast! Antivirus 4.7 (avast!)
 version (major): 4
 version (minor): 7
install location: C:\PROGRA~1\ALWILS~1\Avast4
  install source: C:\DOCUME~1\maison\LOCALS~1\TEMPOR~1\Content.IE5\0DERST6V
   uninstall cmd: rundll32 C:\PROGRA~1\ALWILS~1\Avast4\Setup\setiface.dll,RunSetup
       publisher: Alwil Software
       help link: https://www.avast.com/fr-fr/index

AVG Anti-Spyware 7.5  (AVGAntiSpyware75)
install location: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5
   uninstall cmd: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe
       publisher: Grisoft Ltd.
       help link: https://www.avg.com/fr-fr/homepage

  (Branding)

Composant Hmk  (Composant Hmk)
   uninstall cmd: C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\Vidal\Communs\Hmk.isu"

  (Connection Manager)

VIDAL CD  (Dictionnaire Vidal)
   uninstall cmd: C:\WINDOWS\ISUN040C.EXE -f"C:\Program Files\VIDAL\VIDAL CD\Uninst.isu" -c"C:\Program Files\VIDAL\VIDAL CD\Bin\UnInstVCD.dll"

  (DirectAnimation)

  (DirectDrawEx)

EasyTune5  (EasyTune5)
   uninstall cmd: C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Gigabyte\ET5\Uninst.isu" -c"C:\Program Files\Gigabyte\ET5\uninstdrv.dll"

eMule  (eMule)
   uninstall cmd: "C:\Program Files\eMule\Uninstall.exe"

  (Fontcore)

Navigateur Orange  (FranceTelecomUninstall_FTBrowser)
install location: C:\PROGRA~1\Wanadoo\WOOBrowser
   uninstall cmd: C:\PROGRA~1\Wanadoo\Shell.exe inst\uninst_FTBrowser.shl

Gestionnaire Internet  (GestionnaireInternet.exe)
   uninstall cmd: C:\PROGRA~1\Wanadoo\uninstall.exe

HijackThis 2.0.2 2.0.2 (HijackThis)
   uninstall cmd: "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
       publisher: TrendMicro

  (ICW)

  (IE40)

  (IE4Data)

  (IE5BAKEX)

  (IEData)

Information Center  (Information Center)
   uninstall cmd: "C:\Program Files\Online Add-on\icun.exe"

  (InstallShield Uninstall Information)

Correctif Windows XP - KB842773 20040805.140010 (KB842773)
   uninstall cmd: C:\WINDOWS\$NtUninstallKB842773$\spuninst\spuninst.exe
       publisher: Microsoft Corporation
       help link: https://support.microsoft.com/en-us/help/842773

  (KB884016)

High Definition Audio Driver Package - KB888111 20040219.000000 (KB888111WXP)
   uninstall cmd: "C:\WINDOWS\$NtUninstallKB888111WXP$\spuninst\spuninst.exe"
       publisher: Microsoft Corporation
       help link: https://support.microsoft.com/en-us

Correctif Windows XP - KB890859 1 (KB890859)
   uninstall cmd: "C:\WINDOWS\$NtUninstallKB890859$\spuninst\spuninst.exe"
       publisher: Microsoft Corporation
       help link: https://support.microsoft.com/en-us/help/890859

  (KB893803)

Windows Installer 3.1 (KB893803) 3.1 (KB893803v2)
   uninstall cmd: "C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
       publisher: Microsoft Corporation
       help link: https://support.microsoft.com/en-us/help/893803/windows-installer-3-1-v2-3-1-4000-2435-is-available

Mise à jour pour Windows XP (KB898461) 1 (KB898461)
   uninstall cmd: "C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
       publisher: Microsoft Corporation
       help link: https://support.microsoft.com/en-us/help/898461/

Mise à jour de sécurité pour Windows XP (KB908519) 1 (KB908519)
    install date: 20071130
   uninstall cmd: "C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe"
       publisher: Microsoft Corporation
       help link: https://support.microsoft.com/en-us/help/908519

Mise à jour de sécurité pour Windows XP (KB914389) 1 (KB914389)
    install date: 20071130
   uninstall cmd: "C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe"
       publisher: Microsoft Corporation
       help link: https://support.microsoft.com/en-us/help/914389

Mise à jour de sécurité pour Windows XP (KB920683) 1 (KB920683)
    install date: 20071130
   uninstall cmd: "C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe"
       publisher: Microsoft Corporation
       help link: https://support.microsoft.com/en-us/help/920683

Malwarebytes' RogueRemover 1.22  (Malwarebytes' RogueRemover FREE_is1)
    install date: 20071202
install location: C:\Program Files\RogueRemover FREE\
   uninstall cmd: "C:\Program Files\RogueRemover FREE\unins000.exe"
       publisher: Malwarebytes
       help link: https://www.malwarebytes.com/

  (Microsoft NetShow Player 2.0)

  (MobileOptionPack)

Mozilla Firefox (1.0.7) 1.0.7 (fr-FR) (Mozilla Firefox (1.0.7))
install location: C:\Program Files\Mozilla Firefox
   uninstall cmd: C:\WINDOWS\UninstallFirefox.exe /ua "1.0.7 (fr-FR)"
       publisher: Mozilla

Mozilla Thunderbird (1.0.6) 1.0.6 (fr) (Mozilla Thunderbird (1.0.6))
install location: C:\Program Files\Mozilla Thunderbird
   uninstall cmd: C:\WINDOWS\UninstallThunderbird.exe /ua "1.0.6 (fr)"
       publisher: Mozilla

  (MPlayer2)

  (MSI30-Beta1)

  (MSI30-Beta2)

  (MSI30-KB884016)

  (MSI30-RC1)

  (MSI30-RC2)

  (MSI30a-KB884016)

  (MSI31-Beta)

  (MSI31-RC1)

  (MsJavaVM)

Panda NanoScan  (NanoScan)
  estimated size: 400
install location: C:\Program Files\Panda Security\NanoScan
   uninstall cmd: C:\Program Files\Panda Security\NanoScan
anounst.exe
       publisher: Panda Security
       help link: https://www.pandasecurity.com/en/mediacenter/?ref=mc_blogcav

Navilog1 3.3.0  (Navilog1_is1)
    install date: 20071019
install location: C:\Program Files\Navilog1\
   uninstall cmd: "C:\Program Files\Navilog1\unins000.exe"
       publisher: @IL-MAFIOSO

Nero OEM  (Nero - Burning Rom!UninstallKey)
   uninstall cmd: C:\Program Files\Ahead
ero\uninstall\UNNERO.exe /UNINSTALL

Nero Suite  (NeroMultiInstaller!UninstallKey)
   uninstall cmd: C:\Program Files\Fichiers communs\Ahead\Uninstall\Setup.exe /uninstall

NeroVision Express 2  (NeroVision!UninstallKey)
   uninstall cmd: C:\WINDOWS\UNNeroVision.exe /UNINSTALL

  (NetMeeting)

  (NVEContent!UninstallKey)
   uninstall cmd: C:\WINDOWS\UNNVEContent.exe /UNINSTALL

NVIDIA Drivers  (NVIDIA Drivers)
   uninstall cmd: C:\WINDOWS\System32
vunrm.exe UninstallGUI

  (OutlookExpress)

  (PCHealth)
   uninstall cmd: rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf

  (RealJukebox 1.0)
   uninstall cmd: C:\Program Files\Fichiers communs\Real\Update_OB1puninst.exe RealNetworks|RealPlayer|6.0

RealPlayer  (RealPlayer 6.0)
install location: C:\Program Files\Real\RealPlayerealplay.exe
   uninstall cmd: C:\Program Files\Fichiers communs\Real\Update_OB1puninst.exe RealNetworks|RealPlayer|6.0
       publisher: RealNetworks
        comments: Diffusez, enregistrez et organisez votre musique et vos vidéos, gravez un CD ou emportez votre musique partout avec vous.
         contact: RealNetworks

  (SchedulingAgent)

Shareaza version 2.2.5.0 2.2.5.0 (Shareaza_is1)
    install date: 20070401
install location: C:\Program Files\Shareaza\
   uninstall cmd: "C:\Program Files\Shareaza\Uninstall\unins000.exe"
       publisher: Shareaza Development Team
        comments: Shareaza Ultimate File Sharing
       help link: http://www.shareaza.com/?id=support

  (Shockwave)

Adobe Flash Player 9 ActiveX 9 (ShockwaveFlash)
   uninstall cmd: C:\WINDOWS\System32\Macromed\Flash\FlashUtil9c.exe -uninstallUnlock
       publisher: Adobe Systems
       help link: https://helpx.adobe.com/flash-player.html

Panda TotalScan 01.01.01.0002 (TotalScan)
  estimated size: 4000
install location: C:\Program Files\Panda Security\TotalScan
   uninstall cmd: C:\Program Files\Panda Security\TotalScan\ascuninst.exe
       publisher: Panda Security
       help link: https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan

Windows Media Format Runtime  (Windows Media Format Runtime)
   uninstall cmd: "C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll

Lecteur Windows Media 10  (Windows Media Player)
   uninstall cmd: "C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall

ZoneAlarm 7.0.362.000 (ZoneAlarm)
   uninstall cmd: C:\Program Files\Zone Labs\ZoneAlarm\zauninst.exe
       publisher: Check Point, Inc
       help link: C:\Program Files\Zone Labs\ZoneAlarm\Aide\zaclients.chm

livebox  ({17342E3B-0818-4A6F-BFF8-99476605ADD6})
   uninstall cmd: RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{17342E3B-0818-4A6F-BFF8-99476605ADD6}\Setup.exe" -l0x40c 

Google Toolbar for Internet Explorer  ({2318C2B1-4965-11d4-9B18-009027A5CD4F})
   uninstall cmd: regsvr32 /u /s "c:\program files\google\googletoolbar2.dll"

J2SE Runtime Environment 5.0 Update 4 1.5.0.40 ({3248F0A8-6813-11D6-A77B-00B0D0150040})
         version: 17104896
 version (major): 1
 version (minor): 5
  estimated size: 121289
    install date: 20070330
  install source: C:\Documents and Settings\maison\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150040}\
   uninstall cmd: MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150040}
       publisher: Sun Microsystems, Inc.
         contact: https://www.java.com/en/
       help link: https://www.java.com/en/
          readme: C:\Program Files\Java\jre1.5.0_04\README.txt

Java(TM) 6 Update 2 1.6.0.20 ({3248F0A8-6813-11D6-A77B-00B0D0160020})
         version: 17170432
 version (major): 1
 version (minor): 6
  estimated size: 113938
    install date: 20070721
  install source: http://javadl.sun.com/webapps/download/GetFile/1.6.0_02-b06/windows-i586/
   uninstall cmd: MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
       publisher: Sun Microsystems, Inc.
         contact: https://www.java.com/en/
       help link: https://www.java.com/en/
          readme: C:\Program Files\Java\jre1.6.0_02\README.txt

WebFldrs XP 9.50.6513 ({350C940c-3D7C-4EE8-BAA9-00BCB3D54227})
         version: 154278257
 version (major): 9
 version (minor): 50
  estimated size: 2652
    install date: 20070329
  install source: C:\WINDOWS\System32\
       publisher: Microsoft Corporation
       help link: https://www.microsoft.com/en-us/windows/

Windows Live Sign-in Assistant 4.100.313.1 ({49672EC2-171B-47B4-8CE7-50D7806360D7})
         version: 73662777
 version (major): 4
 version (minor): 100
  estimated size: 1240
    install date: 20070401
  install source: C:\DOCUME~1\maison\LOCALS~1\Temp\IXP000.TMP\
   uninstall cmd: MsiExec.exe /I{49672EC2-171B-47B4-8CE7-50D7806360D7}
       publisher: Microsoft Corporation

USB2.0 Web Camera  ({56A648C2-D185-46A9-BBFF-78AE7A501000})
   uninstall cmd: C:\WINDOWS\System\M1000Rmv.exe

Microsoft Works 08.04.0702 ({A059DE09-1B49-4450-B340-7AE097EC3F04})
         version: 134480574
 version (major): 8
 version (minor): 4
  estimated size: 296363
    install date: 20070330
install location: INSTALLDIR
  install source: D:\MSWORKS\
   uninstall cmd: MsiExec.exe /I{A059DE09-1B49-4450-B340-7AE097EC3F04}
       publisher: Microsoft Corporation
        comments: Microsoft Works 8.0 installation.
       help link: https://support.microsoft.com/en-us
  help telephone:  

Microsoft Visual C++ 2005 Redistributable 8.0.50727.42 ({A49F249F-0C91-497F-86DF-B2585E8E76B7})
         version: 134268455
 version (major): 8
  estimated size: 5192
    install date: 20071006
  install source: C:\DOCUME~1\maison\LOCALS~1\Temp\IXP000.TMP\
   uninstall cmd: MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
       publisher: Microsoft Corporation

Adobe Reader 7.0 - Français 7.0.0 ({AC76BA86-7AD7-1036-7B44-A70000000000})
         version: 117440512
 version (major): 7
  estimated size: 74744
    install date: 20070330
install location: C:\Program Files\Adobe\Acrobat 7.0\Reader\
  install source: C:\Program Files\Adobe\Acrobat 7.0\Setup Files\RdrBIG\FRA\
   uninstall cmd: MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A70000000000}
       publisher: Adobe Systems Incorporated
        comments:    
         contact:  
       help link: https://helpx.adobe.com/support.html
  help telephone:    
          readme: C:\Program Files\Adobe\Acrobat 7.0\Reader\Readme.htm

Spybot - Search & Destroy 1.5.1.15 ({B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1)
    install date: 20071202
install location: C:\Program Files\Spybot - Search & Destroy\
   uninstall cmd: "C:\Program Files\Spybot - Search & Destroy\unins000.exe"
       publisher: Safer Networking Limited
       help link: https://www.safer-networking.org/?page=support

Athlon 64 Processor Driver 1.2.2.2 ({C151CE54-E7EA-4804-854B-F515368B0798})
         version: 16908290
install location: C:\Program Files\AMD\Athlon 64 Processor Driver
   uninstall cmd: RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C151CE54-E7EA-4804-854B-F515368B0798}\setup.exe" -l0x40c 

WinZip 11.1 11.1.7466 ({CD95F661-A5C4-44F5-A6AA-ECDD91C240B5})
         version: 184622378
 version (major): 11
 version (minor): 1
  estimated size: 11558
    install date: 20071202
install location: C:\Program Files\WinZip\
  install source: C:\Documents and Settings\maison\Local Settings\Temporary Internet Files\Content.IE5\IZO7JS9C\
   uninstall cmd: MsiExec.exe /X{CD95F661-A5C4-44F5-A6AA-ECDD91C240B5}
       publisher: WinZip Computing, S.L. 
       help link: https://www.winzip.com/win/fr/contact.html

GEAR 32bit Driver Installer 2.005.1 ({E89B484C-B913-49A0-959B-89E836001658})
         version: 33882113
 version (major): 2
 version (minor): 5
  estimated size: 124
    install date: 20071006
install location: C:\Program Files\GEAR Software, Inc.\My Product Name\
  install source: C:\DOCUME~1\maison\LOCALS~1\Temp\_is5\
   uninstall cmd: MsiExec.exe /X{E89B484C-B913-49A0-959B-89E836001658}
       publisher: GEAR Software, Inc.
         contact: Technical Support
       help link: http://gearsoftware.com/support/online-support.php
  help telephone: +1 561-575-3247

Realtek High Definition Audio Driver 1.92 ({F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC})
         version: 22806528
    install date: 20070329
install location: C:\Program Files\Realtek\InstallShield\
  install source: D:\audio\HD_Audio\
   uninstall cmd: RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x40c  -removeonly
       publisher: Realtek Semiconductor Corp.

Windows Live Messenger 8.1.0178.00 ({F6326B60-1B1D-4ABF-BFCD-7B7404F44411})
         version: 134283442
 version (major): 8
 version (minor): 1
  estimated size: 32219
    install date: 20070401
  install source: C:\DOCUME~1\maison\LOCALS~1\Temp\IXP000.TMP\
   uninstall cmd: MsiExec.exe /I{F6326B60-1B1D-4ABF-BFCD-7B7404F44411}
       publisher: Microsoft Corporation



--- System Services ---
Service (registry key): Aavmker4
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: avast! Asynchronous Virus Monitor
   Control Set: CurrentControlSet
         Start: 1
          Type: 1
 Error Control: 1

Service (registry key): Abiosdsk
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 0

Service (registry key): abp480n5
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): ACPI
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote ACPI Microsoft
    Image path: System32\DRIVERS\ACPI.sys
    Image size: 0
     Image MD5: D41D8CD98F00B204E9800998ECF8427E
   Control Set: CurrentControlSet
         Start: 0
          Type: 1
 Error Control: 1

Service (registry key): ACPIEC
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): adpu160m
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): aec
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Suppresseur d'écho acoustique (Noyau Microsoft)
    Image path: system32\drivers\aec.sys
    Image size: 0
     Image MD5: D41D8CD98F00B204E9800998ECF8427E
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1

Service (registry key): AFD
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Environnement de prise en charge de réseau AFD
    Image path: \SystemRoot\System32\drivers\afd.sys
    Image size: 0
     Image MD5: D41D8CD98F00B204E9800998ECF8427E
   Control Set: CurrentControlSet
         Start: 2
          Type: 1
 Error Control: 1

Service (registry key): Aha154x
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): aic78u2
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): aic78xx
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): Alerter
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Avertissement
   Description: Informe les utilisateurs et les ordinateurs sélectionnés des alertes administratives. Si ce service est arrêté, les programmes qui utilisent les alertes administratives ne les recevront pas. Si ce service est désactivé, les services qui en dépendent ne pourront pas démarrer.
   Object name: NT AUTHORITY\LocalService
    Image path: %SystemRoot%\System32\svchost.exe -k LocalService
    Image size: 12800
     Image MD5: 333A4DB8410D8E24DB06D6AEBECDC7C2
   Control Set: CurrentControlSet
         Start: 3
          Type: 32
 Error Control: 1
 Depends On services: LanmanWorkstation

Service (registry key): ALG
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Service de la passerelle de la couche Application
   Description: Fournit la prise en charge des plugins de protocoles tiers pour le partage de connexion Internet et le pare-feu Internet.
   Object name: NT AUTHORITY\LocalService
    Image path: %SystemRoot%\System32\alg.exe
    Image size: 41984
     Image MD5: 292FBA8E83DB606519D45DD1FCBBD3B8
   Control Set: CurrentControlSet
         Start: 3
          Type: 16
 Error Control: 1

Service (registry key): AliIde
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): AmdK8
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote de processeur AMD
    Image path: System32\DRIVERS\AmdK8.sys
    Image size: 0
     Image MD5: D41D8CD98F00B204E9800998ECF8427E
   Control Set: CurrentControlSet
         Start: 1
          Type: 1
 Error Control: 1

Service (registry key): amsint
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): AppMgmt
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Gestion d'applications
   Description: Fournit des services d'installation de logiciels tels que Attribuer, Publier et Supprimer.
   Object name: LocalSystem
    Image path: %SystemRoot%\system32\svchost.exe -k netsvcs
    Image size: 12800
     Image MD5: 333A4DB8410D8E24DB06D6AEBECDC7C2
   Control Set: CurrentControlSet
         Start: 3
          Type: 32
 Error Control: 1

Service (registry key): Arp1394
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Protocole client ARP 1394
   Description: Protocole client ARP 1394
    Image path: System32\DRIVERS\arp1394.sys
    Image size: 0
     Image MD5: D41D8CD98F00B204E9800998ECF8427E
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1
 Depends On services: Tcpip

Service (registry key): asc
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): asc3350p
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): asc3550
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): aswMon2
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: avast! Standard Shield Support
   Control Set: CurrentControlSet
         Start: 2
          Type: 2
 Error Control: 1

Service (registry key): aswRdr
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: aswRdr
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1
 Depends On services: tcpip

Service (registry key): aswTdi
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: avast! Network Shield Support
   Control Set: CurrentControlSet
         Start: 1
          Type: 1
 Error Control: 1
 Depends On services: tcpip

Service (registry key): aswUpdSv
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: avast! iAVS4 Control Service
   Description: Fournit la mise à jour automatique pour l'antivirus avast!.
   Object name: LocalSystem
    Image path: "C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"
    Image size: 16248
     Image MD5: 765E0E2BDB83C58FFC411DA401D8BA66
   Control Set: CurrentControlSet
         Start: 2
          Type: 272
 Error Control: 1

Service (registry key): AsyncMac
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote de média asynchrone RAS
   Description: Pilote de média asynchrone RAS
    Image path: System32\DRIVERS\asyncmac.sys
    Image size: 0
     Image MD5: D41D8CD98F00B204E9800998ECF8427E
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1

Service (registry key): atapi
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Contrôleur de disque dur IDE/ESDI standard
    Image path: System32\DRIVERS\atapi.sys
    Image size: 0
     Image MD5: D41D8CD98F00B204E9800998ECF8427E
   Control Set: CurrentControlSet
         Start: 0
          Type: 1
 Error Control: 1

Service (registry key): Atdisk
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 0

Service (registry key): Ati HotKey Poller
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Object name: LocalSystem
    Image path: %SystemRoot%\System32\Ati2evxx.exe
    Image size: 376832
     Image MD5: 06B67E6A0B679D037D2D9E27A64CE90C
   Control Set: CurrentControlSet
         Start: 2
          Type: 272
 Error Control: 1

Service (registry key): ati2mtag
 Registry path: \SYSTEM\CurrentControlSet\Services\
    Image path: System32\DRIVERS\ati2mtag.sys
    Image size: 0
     Image MD5: D41D8CD98F00B204E9800998ECF8427E
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 0

Service (registry key): Atierecord
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 0
          Type: 0
 Error Control: 0

Service (registry key): atinrvxx
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: ATI WDM Rage Theater Video
    Image path: System32\DRIVERS\atinrvxx.sys
    Image size: 0
     Image MD5: D41D8CD98F00B204E9800998ECF8427E
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1

Service (registry key): Atmarpc
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Protocole client ATM ARP
   Description: Protocole client ATM ARP
    Image path: System32\DRIVERS\atmarpc.sys
    Image size: 0
     Image MD5: D41D8CD98F00B204E9800998ECF8427E
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1
 Depends On services: Tcpip

Service (registry key): AudioSrv
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Audio Windows
   Description: Gère les périphériques audio pour les programmes basés sur Windows. Si ce service est arrêté, les périphériques et les effets audio ne fonctionneront pas correctement. Si ce service est désactivé, les services en dépendant explicitement ne démarreront pas.
   Object name: LocalSystem
    Image path: %SystemRoot%\System32\svchost.exe -k netsvcs
    Image size: 12800
     Image MD5: 333A4DB8410D8E24DB06D6AEBECDC7C2
   Control Set: CurrentControlSet
         Start: 2
          Type: 32
 Error Control: 1
 Depends On services: PlugPlay,RpcSs

Service (registry key): audstub
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote audio Stub
    Image path: System32\DRIVERS\audstub.sys
    Image size: 0
     Image MD5: D41D8CD98F00B204E9800998ECF8427E
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1

Service (registry key): avast! Antivirus
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: avast! Antivirus
   Description: Gère et implémente les services de l'antivirus avast! pour cet ordinateur. Ceci inclut la protection résidente, la zone de quarantaine et le planificateur.
   Object name: LocalSystem
    Image path: "C:\Program Files\Alwil Software\Avast4\ashServ.exe"
    Image size: 132472
     Image MD5: 47DF7F40F77FCE0A134021C6BF0FF52A
   Control Set: CurrentControlSet
         Start: 2
          Type: 272
 Error Control: 1
 Depends On services: aswMon2,RpcSS

Service (registry key): avast! Mail Scanner
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: avast! Mail Scanner
   Description: Implémente l'analyse du courrier électronique pour l'antivirus avast!.
   Object name: LocalSystem
    Image path: "C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service
    Image size: 243064
     Image MD5: 3F4A782FECFA42AB86CEA759EB929106
   Control Set: CurrentControlSet
         Start: 3
          Type: 272
 Error Control: 1
 Depends On services: "avast! Antivirus"

Service (registry key): avast! Web Scanner
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: avast! Web Scanner
   Description: Implémente l'analyse du contenu web (HTTP) pour l'antivirus avast!.
   Object name: LocalSystem
    Image path: "C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service
    Image size: 345464
     Image MD5: CDED5892E327CDCBB64E598AE6C4E3E3
   Control Set: CurrentControlSet
         Start: 3
          Type: 272
 Error Control: 1
 Depends On services: "avast! Antivirus"

Service (registry key): AVG Anti-Spyware Driver
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: AVG Anti-Spyware Driver
    Image path: \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys
    Image size: 0
     Image MD5: D41D8CD98F00B204E9800998ECF8427E
   Control Set: CurrentControlSet
         Start: 1
          Type: 1
 Error Control: 1

Service (registry key): AVG Anti-Spyware Guard
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: AVG Anti-Spyware Guard
   Object name: LocalSystem
    Image path: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    Image size: 312880
     Image MD5: 5DCD235C061022BCDA9AA48670B64211
   Control Set: CurrentControlSet
         Start: 2
          Type: 16
 Error Control: 1

Service (registry key): AvgAsCln
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: AVG Anti-Spyware Clean Driver
    Image path: System32\DRIVERS\AvgAsCln.sys
    Image size: 0
     Image MD5: D41D8CD98F00B204E9800998ECF8427E
   Control Set: CurrentControlSet
         Start: 1
          Type: 1
 Error Control: 1

Service (registry key): BattC
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 0
          Type: 0
 Error Control: 0

Service (registry key): Beep
 Registry path: \SYSTEM\CurrentControlSet\Services\

Julien06 · Answer

re, voici le rapport de hijackthis...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:52:42, on 02/12/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {91AD9DC2-523A-47E2-A598-6C277F16CC50} - c:\windows\system32\aadcaad.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [M1000Mnt] M1000Rmv.exe /StartStillMnt
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\RunServices: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunServices: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/02084dfa22d225efae05/netzip/RdxIE601_fr.cab
O16 - DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} (NanoInstaller Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

jlpjlp · Answer

FAIT demarrer puis EXECUTER et tape sur entrée pour ouvrir une session

tape:

del c:\windows\system32\aadcaad.dll


et appuye sur entrée puis taper EXIT puis appyuer sur entrée pour quitter la session

_______________

remplace avast par antivir et colle un rapport

https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)

Julien06 · Answer

re, es ce que je met del devant le nom du fichier car dans executer il me dit que del c'est pas bon ?

jlpjlp · Answer

oui il faut mettre del pour qu'il le vire   (essaye sans espace apres le del  )

si ca marche pas passe a la suite

mallaury27 · Answer

Bonjour,

Cela fait maintenant 3 jours que mon ordi est infecté par la dernière version de Trojan.Zlob-X. 

J'ai Norton comme antivirus mais ça ne m'a pas protégé. J'ai installé avast et fait une analyse mais sans résultat. j'ai également utilisé Spyware Doctor et multi virus cleaner 2007, toujours sans résultat.

J'ai aussi utilisé SDFix et il me dit qu'il n'a pas trouvé de Trojan. voici le rapport :

SDFix: Version 1.116

Run by mallaury27  on 02/12/2007 at 20:37

Microsoft Windows XP [version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services: 


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files: 

No Trojan Files Found


Et pourtant le problème lié à ce Trojan persiste.

Comment faire ?

jlpjlp · Answer

slt mallaury27
cré ton propre post et on t'aidera

ou ecrit moi en pv et je te repondrai

 a plus

Julien06 · Answer

re, j'ai essayé sans l'espace avec le del et le nom du fichier dans executer mais il me dit que ce n'st pas possible.

Ensuite j'ai desintallé avast et j'ai installé antivir et j'ai redemarrer mon PC et maintenan antivir m'affiche des fenetre d'alerte comme quoi je suis infecté pas le meme fichier c:\windows\system32\aadcaad.dll.
Qu'est ce que je fais maintenant.?

jlpjlp · Answer

essaye de virer ce fichier en mode sans echec

_____________
puis 
scan avec antivir  en mode sans echec et colle moi le rapport 

puis un hijackthis

Mallaury27 · Answer

Bonjour,

Mon ordi est infecté depuis 3 jours par la dernière version de Trojan.Zlob-X.
J'ai pourtant Norton mais il ne m'a pas protédé de ce virus. j'ai téléchargé avast et après analyse il avait trouvé un fichier Trojan, je lui ai demandé de le supprimer mais ça n'a rien fait puisque je rencontre toujours le problème lié au Virus. j'ai utilisé Spyware Doctor, sans résultat. idem avec multi virus cleaner 2007.
En lisant le forum, j'ai vu qu'une personne avait utilisé SDFix pour se débarrasser de fichiers Trojan. j'ai fait de même mais sans résultat.

Comment faire pour me débarrasser du virus qui infecte mon ordi. D'autant que j'ai des fichiers dans Windows qui apparaissent avec des écritures bleues et je ne sais pas ce que cela signifie.

Merci de m'indiquer s'il existe un moyen de supprimer Trojan.Zlob-X, s'agissant (d'après ce que m'indique le message sur mon ordi) de la dernière version.

jlpjlp · Answer

slt mallaury27
cré ton propre post et on t'aidera

ou ecrit moi en pv et je te repondrai

a plus

Julien06 · Answer

re, voici le rapport de antivir 



AntiVir PersonalEdition Classic
Report file date: dimanche 2 décembre 2007  21:31

Scanning for 835736 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 1)  [5.1.2600]
Username:         maison
Computer name:    MAISON-6ZNO7WTT

Version information:
BUILD.DAT    : 270           15603 Bytes  19/09/2007 13:32:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes  23/08/2007 13:16:29
AVSCAN.DLL   : 7.0.6.0       49192 Bytes  16/08/2007 12:23:51
LUKE.DLL     : 7.0.5.3      147496 Bytes  14/08/2007 15:32:47
LUKERES.DLL  : 7.0.6.1       10280 Bytes  21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes  18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.0.0     1640448 Bytes  13/09/2007 14:26:55
ANTIVIR2.VDF : 7.0.0.1        2048 Bytes  13/09/2007 14:27:04
ANTIVIR3.VDF : 7.0.0.2        2048 Bytes  13/09/2007 14:27:13
AVEWIN32.DLL : 7.6.0.15    2806272 Bytes  17/09/2007 17:43:56
AVWINLL.DLL  : 1.0.0.7       14376 Bytes  26/02/2007 10:36:26
AVPREF.DLL   : 7.0.2.2       25640 Bytes  18/07/2007 07:39:17
AVREP.DLL    : 7.0.0.1      155688 Bytes  16/04/2007 13:16:24
AVPACK32.DLL : 7.3.0.15     360488 Bytes  03/08/2007 08:46:00
AVREG.DLL    : 7.0.1.6       30760 Bytes  18/07/2007 07:17:06
AVARKT.DLL   : 1.0.0.20     278568 Bytes  28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes  18/07/2007 07:10:18
NETNT.DLL    : 7.0.0.0        7720 Bytes  08/03/2007 11:09:42
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes  07/08/2007 12:38:13
RCTEXT.DLL   : 7.0.62.0      86056 Bytes  21/08/2007 12:50:37
SQLITE3.DLL  : 3.3.17.1     339968 Bytes  23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Local Drives
Configuration file...............: c:\program files\avira\antivir personaledition classic\alldrives.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: E:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: dimanche 2 décembre 2007  21:31

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned
Scan process 'Watch.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'PollingModule.exe' - '1' Module(s) have been scanned
Scan process 'ComComp.exe' - '1' Module(s) have been scanned
Scan process 'GestionnaireInternet.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'TaskBarIcon.exe' - '1' Module(s) have been scanned
Scan process 'WZQKPICK.EXE' - '1' Module(s) have been scanned
Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'Shareaza.exe' - '1' Module(s) have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avgas.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'zlclient.exe' - '0' Module(s) have been scanned
Scan process 'realsched.exe' - '1' Module(s) have been scanned
Scan process 'RTHDCPL.EXE' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'vsmon.exe' - '0' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
41 processes with 41 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
      [NOTE]      No virus was found!
Boot sector 'A:\'
      [NOTE]      In the drive 'A:\' no data medium is inserted!
Boot sector 'G:\'
      [NOTE]      In the drive 'G:\' no data medium is inserted!
Boot sector 'H:\'
      [NOTE]      In the drive 'H:\' no data medium is inserted!
Boot sector 'I:\'
      [NOTE]      In the drive 'I:\' no data medium is inserted!
Boot sector 'J:\'
      [NOTE]      In the drive 'J:\' no data medium is inserted!

Starting to scan the registry.
C:\WINDOWS\system32\1033v.exe
      [WARNING]   The file could not be opened!
C:\WINDOWS\system32\1033v.exe
      [WARNING]   The file could not be opened!
C:\WINDOWS\system32\1033v.exe
      [WARNING]   The file could not be opened!
C:\WINDOWS\system32\1033v.exe
      [WARNING]   The file could not be opened!
The registry was scanned ( '36' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
      [WARNING]   The file could not be opened!
C:\!KillBox\aadcaad.dll
      [DETECTION] Is the Trojan horse TR/Trash.Gen
      [INFO]      The file was moved to '47b716a0.qua'!
C:\Program Files\Trend Micro\HijackThis\backups\backup-20071019-212726-817.dll
      [DETECTION] Is the Trojan horse TR/Trash.Gen
      [INFO]      The file was moved to '47b61882.qua'!
C:\Program Files\Trend Micro\HijackThis\backups\backup-20071019-212741-634.dll
      [DETECTION] Is the Trojan horse TR/Trash.Gen
      [INFO]      The file was moved to '47b61885.qua'!
C:\Program Files\Trend Micro\HijackThis\backups\backup-20071019-212811-488.dll
      [DETECTION] Is the Trojan horse TR/Trash.Gen
      [INFO]      The file was moved to '47b61887.qua'!
C:\Program Files\Trend Micro\HijackThis\backups\backup-20071021-125123-177.dll
      [DETECTION] Is the Trojan horse TR/Trash.Gen
      [INFO]      The file was moved to '47b6188a.qua'!
C:\Program Files\Trend Micro\HijackThis\backups\backup-20071021-125210-478.dll
      [DETECTION] Is the Trojan horse TR/Trash.Gen
      [INFO]      The file was moved to '47b6188c.qua'!
C:\Program Files\Trend Micro\HijackThis\backups\backup-20071021-125238-683.dll
      [DETECTION] Is the Trojan horse TR/Trash.Gen
      [INFO]      The file was moved to '47b6188d.qua'!
C:\Program Files\Trend Micro\HijackThis\backups\backup-20071021-125247-562.dll
      [DETECTION] Is the Trojan horse TR/Trash.Gen
      [INFO]      The file was moved to '47b6188f.qua'!
C:\Program Files\Trend Micro\HijackThis\backups\backup-20071021-125335-832.dll
      [DETECTION] Is the Trojan horse TR/Trash.Gen
      [INFO]      The file was moved to '47b61890.qua'!
C:\Program Files\Trend Micro\HijackThis\backups\backup-20071021-125607-271.dll
      [DETECTION] Is the Trojan horse TR/Trash.Gen
      [INFO]      The file was moved to '47b61891.qua'!
C:\Program Files\Trend Micro\HijackThis\backups\backup-20071026-064059-727.dll
      [DETECTION] Is the Trojan horse TR/Trash.Gen
      [INFO]      The file was moved to '47b61893.qua'!
C:\Program Files\Trend Micro\HijackThis\backups\backup-20071026-064115-939.dll
      [DETECTION] Is the Trojan horse TR/Trash.Gen
      [INFO]      The file was moved to '47b61894.qua'!
C:\Program Files\Trend Micro\HijackThis\backups\backup-20071027-223219-785.dll
      [DETECTION] Is the Trojan horse TR/Trash.Gen
      [INFO]      The file was moved to '47b61899.qua'!
C:\Program Files\Trend Micro\HijackThis\backups\backup-20071103-100622-991.dll
      [DETECTION] Is the Trojan horse TR/Trash.Gen
      [INFO]      The file was moved to '4627ab62.qua'!
C:\Program Files\Trend Micro\HijackThis\backups\backup-20071103-100640-877.dll
      [DETECTION] Is the Trojan horse TR/Trash.Gen
      [INFO]      The file was moved to '47b6189a.qua'!
C:\Program Files\Trend Micro\HijackThis\backups\backup-20071129-171201-141.dll
      [DETECTION] Is the Trojan horse TR/Trash.Gen
      [INFO]      The file was moved to '4627ab63.qua'!
C:\Program Files\Trend Micro\HijackThis\backups\backup-20071202-001746-987.dll
      [DETECTION] Is the Trojan horse TR/Trash.Gen
      [INFO]      The file was moved to '47b6189c.qua'!
C:\Program Files\Trend Micro\HijackThis\backups\backup-20071202-183118-282.dll
      [DETECTION] Is the Trojan horse TR/Trash.Gen
      [INFO]      The file was moved to '4627ab65.qua'!
C:\Program Files\Trend Micro\HijackThis\backups\backup-20071202-192915-879.dll
      [DETECTION] Is the Trojan horse TR/Trash.Gen
      [INFO]      The file was moved to '47b6189b.qua'!
C:\Program Files\Trend Micro\HijackThis\backups\backup-20071202-193211-829.dll
      [DETECTION] Is the Trojan horse TR/Trash.Gen
      [INFO]      The file was moved to '4627ab64.qua'!
C:\Program Files\Trend Micro\HijackThis\backups\backup-20071202-193228-946.dll
      [DETECTION] Is the Trojan horse TR/Trash.Gen
      [INFO]      The file was moved to '47b6189d.qua'!
C:\WINDOWS\system32\1033v.exe
      [WARNING]   The file could not be opened!
C:\WINDOWS\system32\aadcaad.dll
      [DETECTION] Is the Trojan horse TR/Trash.Gen
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!
C:\WINDOWS\system32\config\systemprofile\Menu Démarrer\Programmes\Démarrage\system.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [INFO]      The file was moved to '47c61a69.qua'!
C:\WINDOWS\Temp\_avast4_\unp59633463.tmp
      [WARNING]   'Contains detection pattern of the Windows virus W95/Blumblebee.1738'. This detection is probably an error. Please send us this file immediately for further analysis.
Begin scan in 'A:\'
Search path A:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'G:\'
Search path G:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'H:\'
Search path H:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'I:\'
Search path I:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'J:\'
Search path J:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'D:\'
Search path D:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'E:\'
Search path E:\ could not be opened!
Le périphérique n'est pas prêt.



End of the scan: dimanche 2 décembre 2007  21:48
Used time: 17:00 min

The scan has been done completely.

   2748 Scanning directories
 112702 Files were scanned
     23 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
     22 files were moved to quarantine
      0 files were renamed
      6 Files cannot be scanned
 112679 Files not concerned
    852 Archives were scanned
      8 Warnings
      1 Notes

et le rapport de hijackthis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:55:45, on 02/12/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe
c:\program files\avira\antivir personaledition classic\avscan.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {91AD9DC2-523A-47E2-A598-6C277F16CC50} - c:\windows\system32\aadcaad.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [M1000Mnt] M1000Rmv.exe /StartStillMnt
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\RunServices: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunServices: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/02084dfa22d225efae05/netzip/RdxIE601_fr.cab
O16 - DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} (NanoInstaller Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Julien06 · Answer

re, au fait je n'ai pas reussi a virer ce satané fichier meme en mode sans echec desolé.
Que faire ?

Julien06 · Answer

re, desolé mais je commence a m'endormir devant le passer et je t'ai assez embeter ce soir lol alors je reviens demain dans la matinée en esperant ke tu pourra encore me conseiller. je te remerci. bonne soirée.
a Plus

jlpjlp · Answer

Téléchargez VundoFix -> http://www.atribune.org/ccount/click.php?id=4

lance Vundofix
* Ne clique pas sur "Scan for a vundo"
* Clique droit au milieu de la fenêtre
* Clique sur Add more files ?
* Copie/colle les fichiers ci-dessous ( un par case) :



C:\WINDOWS\system32\aadcaad.dll 


* Clique sur Add files
* Ensuite clique sur Close Windows
* Enfin, clique sur Remove Vundo ( les fichiers précédents doivent apparaitre dans la fenêtre principale)
* Si l'outils demande un redémarrage, accepte
* Poste le rapport Vundofix, ainsi qu'un nouveau log hijackthis

__________________

rescan avec antivir EN MODE SANS ECHEC SURTOUT

Julien06 · Answer

re, suis encore la.
J'ai fait ce que tu ma demandé avec vundofix mais il na pas trouvé le fichier C:\WINDOWS\system32\aadcaad.dll par contre pendant le scan de vundo antivir m'a alerté pour le fichier C:\WINDOWS\system32\aadcaad.dll avec un BIP insupportabble (pourrai tu me donner une astuce pour pouvoir desactivé ce BIP stp car il sonne a chaque  fois ke j'ouvre une page web)

Conclusion vundo n'a rien trouvé.

Log hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:18:56, on 02/12/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Gigabyte\ET5\GUI.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {91AD9DC2-523A-47E2-A598-6C277F16CC50} - c:\windows\system32\aadcaad.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [M1000Mnt] M1000Rmv.exe /StartStillMnt
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\RunServices: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunServices: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/02084dfa22d225efae05/netzip/RdxIE601_fr.cab
O16 - DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} (NanoInstaller Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

jlpjlp · Answer

as tu scanné aavec antivir en mode ssans echec( demarrer l'ordi en appuyatn sur F8 ou F5 en général)


______________________
refais otmovit en mode sans echec aussi


télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe (de Old_Timer) sur ton Bureau.
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

Citation :


c:\windows\system32\aadcaad.dll


clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

__________________

si ca persiste


AD AWARE: 
Pour télécharger :
https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/11643.html 


____________________
Colle le rapport :
Clean permettra de faire du nettoyage et supprimer des fichiers que des anti-virus et anti-spywares n'ont pas pu trouver. Le logiciel est régulièrement mis à jour, vous devrez donc le re-téléchargé pour obtenir une version plus récente.

&#61623;  Téléchargez clean.zip, décompressez-le sur votre bureau (clic droit / extraire tout), vous obtenez alors un dossier clean 
&#61623;  Démarrez Windows en mode sans échec : Guide pour redémarrer en mode sans échec 
&#61623;  Ouvrez le dossier clean qui se trouve sur ton bureau, et double-cliquez sur clean.cmd, une fenêtre noire va apparaître pendant un instant, laissez la ouverte jusqu'à ce qu'elle se ferme.
Manuel de clean :
http://kerio.probb.fr/tuto-Clean-h37.html

julien06 · Answer

re, sa va ?
Ecoute je ne serai pas chez moi mercredi soir ou jeudi matin a ce moment la je ferai ce que tu m'as demandé. Donc je te posterai tout sa des que je suis chez moi.
Desolé.
Aplus

jlpjlp · Answer

as tu scanné aavec antivir en mode ssans echec( demarrer l'ordi en appuyatn sur F8 ou F5 en général)


______________________
refais otmovit en mode sans echec aussi


télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe (de Old_Timer) sur ton Bureau.
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

Citation :


c:\windows\system32\aadcaad.dll


clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

__________________

scan avec
http://www.f-secure.com/tools/f-vmonde.zip
et
https://www.broadcom.com/support/security-center
__________________
si ca persiste


AD AWARE:
Pour télécharger :
https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/11643.html


____________________
Colle le rapport :
Clean permettra de faire du nettoyage et supprimer des fichiers que des anti-virus et anti-spywares n'ont pas pu trouver. Le logiciel est régulièrement mis à jour, vous devrez donc le re-téléchargé pour obtenir une version plus récente.

&#61623; Téléchargez clean.zip, décompressez-le sur votre bureau (clic droit / extraire tout), vous obtenez alors un dossier clean
&#61623; Démarrez Windows en mode sans échec : Guide pour redémarrer en mode sans échec
&#61623; Ouvrez le dossier clean qui se trouve sur ton bureau, et double-cliquez sur clean.cmd, une fenêtre noire va apparaître pendant un instant, laissez la ouverte jusqu'à ce qu'elle se ferme.
Manuel de clean :
http://kerio.probb.fr/tuto-Clean-h37.html

jlpjlp · Answer

si ca persiste:

O2 - BHO: (no name) - {91AD9DC2-523A-47E2-A598-6C277F16CC50} - c:\windows\system32\aadcaad.dll 


fais ceci


télécharge : process xp ici:
http://www.sysinternals.com/files/procexpnt.zip
decompresse le



Déconnecte toi
Ferme tous les programmes

double clic sur processxp.exe

* Dans la fenêtre principale de processxp double clic sur winlogon.exe
Dans la nouvelle fenêtre qui s'ouvre clique sur threads
sélectionne seulement les lignes qui contiennent la dll aadcaad.dll puis clique sur kill pour chacune des lignes trouvées.
une fois fait, valide avec ok

* Dans la fenêtre principale de processxp double clic sur explorer.exe
Dans la nouvelle fenêtre qui s'ouvre clique sur threads
sélectionner seulement les lignes qui contiennent la dll aadcaad.dll puis clique sur kill pour chacune des lignes trouvées.
une fois fait, valide avec ok


ensuite tu ouvre la kill box

Télécharge: Pocket Killbox ici
http://www.downloads.subratam.org/KillBox.exe


Démo d utilisation (merci a Balltrap34 pour cette réalisation) :
http://pageperso.aol.fr/balltrap34/killbox.htm

tu colle les dll suspectes et tu les effaces
Comme ceci:

Double clic sur killbox.exe (Pocket Killbox)

- coche: delete on reboot
- Dans "Full Path of File to Delete"
copie et colle: C:\windows\system32\aadcaad.dll 


- clique sur la croix rouge
- une fenêtre va apparaître pour confirmation clique sur YES
- une seconde fenêtre te demande si tu veux redémarrer clique sur YES

Laisse le pc redémarrer.
Et après reposte un log HijackThis.

Julien06 · Answer

salut,
Voici le rapport de antivir sans echec


AntiVir PersonalEdition Classic
Report file date: jeudi 6 décembre 2007  10:17

Scanning for 961900 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 1)  [5.1.2600]
Username:         maison
Computer name:    MAISON-6ZNO7WTT

Version information:
BUILD.DAT    : 270           15603 Bytes  19/09/2007 13:32:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes  23/08/2007 13:16:29
AVSCAN.DLL   : 7.0.6.0       49192 Bytes  16/08/2007 12:23:51
LUKE.DLL     : 7.0.5.3      147496 Bytes  14/08/2007 15:32:47
LUKERES.DLL  : 7.0.6.1       10280 Bytes  21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes  18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.0.0     1640448 Bytes  13/09/2007 14:26:55
ANTIVIR2.VDF : 7.0.1.30    1575424 Bytes  30/11/2007 20:16:38
ANTIVIR3.VDF : 7.0.1.50      89088 Bytes  06/12/2007 09:07:01
AVEWIN32.DLL : 7.6.0.34    3125760 Bytes  03/12/2007 20:16:38
AVWINLL.DLL  : 1.0.0.7       14376 Bytes  26/02/2007 10:36:26
AVPREF.DLL   : 7.0.2.2       25640 Bytes  18/07/2007 07:39:17
AVREP.DLL    : 7.0.0.1      155688 Bytes  16/04/2007 13:16:24
AVPACK32.DLL : 7.3.0.15     360488 Bytes  03/08/2007 08:46:00
AVREG.DLL    : 7.0.1.6       30760 Bytes  18/07/2007 07:17:06
AVARKT.DLL   : 1.0.0.20     278568 Bytes  28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes  18/07/2007 07:10:18
NETNT.DLL    : 7.0.0.0        7720 Bytes  08/03/2007 11:09:42
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes  07/08/2007 12:38:13
RCTEXT.DLL   : 7.0.62.0      86056 Bytes  21/08/2007 12:50:37
SQLITE3.DLL  : 3.3.17.1     339968 Bytes  23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: jeudi 6 décembre 2007  10:17

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
11 processes with 11 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
      [NOTE]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '36' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
      [WARNING]   The file could not be opened!
C:\Documents and Settings\maison\Local Settings\Temporary Internet Files\Content.IE5\W9MBOPE3\223[1].gif
      [DETECTION] The file contains an executable. This, however, is disguised by a harmless file extension (HIDDENEXT/Crypted)
      [INFO]      The file was deleted!
C:\qoobox\Quarantine\C\WINDOWSunsql.exe.vir
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
      [INFO]      The file was deleted!
C:\qoobox\Quarantine\C\WINDOWS\sv.exe.vir
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
      [INFO]      The file was deleted!
C:\qoobox\Quarantine\C\WINDOWS\svc.exe.vir
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
      [INFO]      The file was deleted!
C:\qoobox\Quarantine\C\WINDOWS\svhoster.exe.vir
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
      [INFO]      The file was deleted!
C:\qoobox\Quarantine\C\WINDOWS\svzip.exe.vir
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
      [INFO]      The file was deleted!
C:\WINDOWS	mp0884278.log
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
      [INFO]      The file was deleted!
C:\WINDOWS	mp3186777.log
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
      [INFO]      The file was deleted!
C:\WINDOWS	mp3652182.log
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
      [INFO]      The file was deleted!
C:\WINDOWS	mp3675413.log
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
      [INFO]      The file was deleted!
C:\WINDOWS	mp3759676.log
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
      [INFO]      The file was deleted!
C:\WINDOWS	mp5851290.log
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
      [INFO]      The file was deleted!
C:\WINDOWS	mp5898146.log
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
      [INFO]      The file was deleted!
C:\WINDOWS	mp6026791.log
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
      [INFO]      The file was deleted!
C:\WINDOWS	mp6717846.log
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
      [INFO]      The file was deleted!
C:\WINDOWS	mp7388487.log
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
      [INFO]      The file was deleted!
C:\WINDOWS	mp7592528.log
      [DETECTION] Contains detection pattern of the dropper DR/Delphi.Gen
      [INFO]      The file was deleted!


End of the scan: jeudi 6 décembre 2007  10:38
Used time: 20:47 min

The scan has been canceled!

   1953 Scanning directories
  90359 Files were scanned
     17 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
     17 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      1 Files cannot be scanned
  90342 Files not concerned
    720 Archives were scanned
      1 Warnings
      0 Notes
je te donne la suite....

Julien06 · Answer

re, voila la suite.....

LoadLibrary failed for c:\windows\system32\aadcaad.dll
c:\windows\system32\aadcaad.dll NOT unregistered.
File move failed. c:\windows\system32\aadcaad.dll scheduled to be moved on reboot.
 
Created on 12/06/2007 10:53:03


ensuite j'ai fait scan avec f.secur et il a rien trouvé.
et avec fixvundo le rapport est le suivant...
Symantec Trojan.Vundo Removal Tool 1.5.0
The process "IEXPLORE.EXE" might be affected by the threat. It has been suspended.
The process "IEXPLORE.EXE" might be affected by the threat. It has been terminated.

C:\System Volume Information: (not scanned)

Trojan.Vundo has been successfully removed from your computer!

Here is the report:

The total number of the scanned files: 25778
The number of deleted files: 0
The number of viral processes terminated: 1
The number of viral processes suspended: 1
The number of viral threads terminated: 0
The number of registry entries fixed: 0

Julien06 · Answer

re, ensuiute j'ai fait un scan avec ad adware il a trouvé une trentaine d'infection mais ensuite il est venu une fenetre avec ecrit error et il s'est fermé veux tu un rapport ?

La je vais untilisé clean en sansn echec.

Julien06 · Answer

re, voici les rapport de clean 
 06/12/2007 a 11:27:04,46 
 
*** Recherche des fichiers dans C: 
"C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage" FOUND 
 
*** Recherche des fichiers dans C:\WINDOWS\ 
 
*** Recherche des fichiers dans C:\WINDOWS\system32 
"C:\WINDOWS\Downloaded Program Files\CONFLICT.1" FOUND 
"C:\Documents and Settings\maison\1.exe" FOUND 
 
*** Recherche des fichiers dans C:\Program Files 
*** Fin du rapport !  

et ensuite le nettoyage

Script execute en mode sans echec 
Rapport clean par Malekal_morte - http://www.malekal.com 
Script execute en mode sans echec 06/12/2007 a 11:30:53,96 

Microsoft Windows XP [version 5.1.2600]
 
*** Suppression des fichiers dans C: 
tentative de suppression de "C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage" 
Impossible de supprimer "C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage"  
 
*** Suppression des fichiers dans C:\WINDOWS\ 
 
*** Suppression des fichiers dans C:\WINDOWS\system32 
tentative de suppression de "C:\WINDOWS\Downloaded Program Files\CONFLICT.1" 
tentative de suppression de "C:\Documents and Settings\maison\1.exe" 
 
*** Suppression des fichiers dans C:\Program Files 
 
*** Suppression des clefs du registre effectuee.. 
*** Fin du rapport !

Julien06 · Answer

re, vu que le fichier a resisté j'ai voulu faire ce que tu m'a demandé mais ton lien ne doit plus etre valide...

télécharge : process xp ici: 
http://www.sysinternals.com/files/procexpnt.zip 
decompresse le 
  alors j'atten ton prochain poste. Merci

djedje64 · Answer

Salut 
Si tu veux faire le GRAND nettoyage sur to pc ...n' hesites à telecharher quelques softs utiles ...quitte a les uninstall aprés...

-déjà 2 avis veulent mieux qu'1 aussi tu as déjà Avast ...Scan avec avg 7.5

-Utilise un nettoyeur de registre style CCleaner qui fonctionne bien...

-Et bien sur toute la panoplie anti-Spy /Spam / etc...

- le tout avec une bonne MAJ de windows 

En toute loguque, tu repars sur des bases propres ...

Nb ne desinstalle pas CCleaner c'est toujour utile pour faire le menage apres desinstall de tous les freewares ...

Bon courage ...

Ps: tant qu'on y'est mets à jour tous tes drivers et une Update Bios

Julien06 · Answer

Salut, je ne suispas trop doué en info tu n'aurais pas qql lien a me donner afin de faire le gran nettoyage... je te remercie d'avance.

jlpjlp · Answer

essaye killprocess pour virer le fichier

https://www.01net.com/telecharger/windows/Utilitaire/systeme/fiches/24439.html


recolle un rapport hijackthis

Julien06 · Answer

re, j'ai telechargé killprocess il a trouvé plusieur fichier et qu'est ce que je fais maintenan je met tuer ?? je voudrai pas faire d'erreur

jlpjlp · Answer

tu ca

c:\windows\system32\aadcaad.dll 



et les autres c'est quoi?

Julien06 · Answer

franchement il y'en a trop. il ya 37 nom de fichier avec exe qui contiennet eux meme des fichier exemple le nom souligner contient tous ceux d'en dessous...


Program: c:\windows\system32\svchost.exe
Snapshot: 06.12.2007 - 22:18:35

Module            Chemin                                                                Version          Date
------------------------------------------------------------------------------------------------------------------------------
advapi32.dll      c:\windows\system32                                                   5.1.2600.1106    29.08.2002 - 10:44:48
clbcatq.dll       c:\windows\system32                                                   2001.12.4414.42  28.08.2001 - 13:00:00
comctl32.dll      c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb58056.0.2800.1106    29.08.2002 - 10:44:46
comctl32.dll      c:\windows\system32                                                   5.82.2800.1106   29.08.2002 - 10:44:50
comres.dll        c:\windows\system32                                                   2001.12.4414.42  28.08.2001 - 13:00:00
crypt32.dll       c:\windows\system32                                                   5.131.2600.1106  29.08.2002 - 10:44:50
dnsapi.dll        c:\windows\system32                                                   5.1.2600.1863    26.06.2006 - 18:48:42
gdi32.dll         c:\windows\system32                                                   5.1.2600.1106    29.08.2002 - 10:44:52
icmp.dll          c:\windows\system32                                                   5.1.2600.0       28.08.2001 - 13:00:00
imagehlp.dll      c:\windows\system32                                                   5.1.2600.1106    29.08.2002 - 10:44:52
iphlpapi.dll      c:\windows\system32                                                   5.1.2600.2       29.08.2002 - 10:44:52
kernel32.dll      c:\windows\system32                                                   5.1.2600.1106    29.08.2002 - 10:44:52
msasn1.dll        c:\windows\system32                                                   5.1.2600.0       28.08.2001 - 13:00:00
msvcrt.dll        c:\windows\system32                                                   7.0.2600.1106    29.08.2002 - 10:44:52
mswsock.dll       c:\windows\system32                                                   5.1.2600.0       28.08.2001 - 13:00:00
msxml3.dll        c:\windows\system32                                                   8.40.9419.0      17.07.2003 - 08:23:14
netapi32.dll      c:\windows\system32                                                   5.1.2600.1106    29.08.2002 - 10:44:52
ntdll.dll         c:\windows\system32                                                   5.1.2600.1106    29.08.2002 - 10:44:42
ole32.dll         c:\windows\system32                                                   5.1.2600.1106    29.08.2002 - 10:44:56
oleaut32.dll      c:\windows\system32                                                   3.50.5016.0      29.08.2002 - 10:44:56
rasadhlp.dll      c:\windows\system32                                                   5.1.2600.1863    26.06.2006 - 18:48:42
rasapi32.dll      c:\windows\system32                                                   5.1.2600.1106    29.08.2002 - 10:44:56
rasman.dll        c:\windows\system32                                                   5.1.2600.1106    29.08.2002 - 10:44:56
rpcrt4.dll        c:\windows\system32                                                   5.1.2600.1106    29.08.2002 - 10:44:56
rtutils.dll       c:\windows\system32                                                   5.1.2600.0       28.08.2001 - 13:00:00
secur32.dll       c:\windows\system32                                                   5.1.2600.1106    29.08.2002 - 10:44:58
sensapi.dll       c:\windows\system32                                                   5.1.2600.1106    29.08.2002 - 10:44:58
shell32.dll       c:\windows\system32                                                   6.0.2800.1106    29.08.2002 - 10:45:00
shlwapi.dll       c:\windows\system32                                                   6.0.2800.1106    29.08.2002 - 10:45:00
svchost.exe       c:\windows\system32                                                   5.1.2600.0       28.08.2001 - 13:00:00
tapi32.dll        c:\windows\system32                                                   5.1.2600.1106    29.08.2002 - 10:45:06
user32.dll        c:\windows\system32                                                   5.1.2600.1634    02.03.2005 - 19:21:36
uxtheme.dll       c:\windows\system32                                                   6.0.2800.1106    29.08.2002 - 10:45:06
version.dll       c:\windows\system32                                                   5.1.2600.0       28.08.2001 - 13:00:00
wininet.dll       c:\windows\system32                                                   6.0.2800.1106    29.08.2002 - 10:45:06
winmm.dll         c:\windows\system32                                                   5.1.2600.1106    29.08.2002 - 10:45:06
winrnr.dll        c:\windows\system32                                                   5.1.2600.0       28.08.2001 - 13:00:00
wldap32.dll       c:\windows\system32                                                   5.1.2600.1106    29.08.2002 - 10:45:06
ws2_32.dll        c:\windows\system32                                                   5.1.2600.0       28.08.2001 - 13:00:00
ws2help.dll       c:\windows\system32                                                   5.1.2600.0       28.08.2001 - 13:00:00
wshtcpip.dll      c:\windows\system32                                                   5.1.2600.0       28.08.2001 - 13:00:00
------------------------------------------------------------------------------------------------------------------------------
KillProcess ==> Version: 5.0  -  Build: 5

Copyright by Kristian Költzsch
E-Mail: kristian@koeltzsch.com   -   Internet: www.koeltzsch.com

jlpjlp · Answer

vire que ca les autres fichiers sont de 2002 ou 2001 donc ton infection n'est pas la

c:\windows\system32\aadcaad.dll 





recolle hijackhtis

Julien06 · Answer

je ne trouve pas le fichier je l'ai tous fouiller

jlpjlp · Answer

colle un rapport hijackthis

antivir te donne encore des alertes?

Julien06 · Answer

re, rapport hijackthis 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:29:04, on 06/12/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Gigabyte\ET5\GUI.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\Kill Process\KillProcess.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {91AD9DC2-523A-47E2-A598-6C277F16CC50} - c:\windows\system32\aadcaad.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [M1000Mnt] M1000Rmv.exe /StartStillMnt
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKLM\..\RunServices: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKCU\..\RunServices: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/02084dfa22d225efae05/netzip/RdxIE601_fr.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe

jlpjlp · Answer

tu as bien scanné avec antivir mais en mode sans echec ????

Julien06 · Answer

oui mais je te le refais vaut mieux deux fois qu'une...

Julien06 · Answer

re voila le rapport de antivir 

AntiVir PersonalEdition Classic
Report file date: jeudi 6 décembre 2007  23:25

Scanning for 961900 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 1)  [5.1.2600]
Username:         maison
Computer name:    MAISON-6ZNO7WTT

Version information:
BUILD.DAT    : 270           15603 Bytes  19/09/2007 13:32:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes  23/08/2007 13:16:29
AVSCAN.DLL   : 7.0.6.0       49192 Bytes  16/08/2007 12:23:51
LUKE.DLL     : 7.0.5.3      147496 Bytes  14/08/2007 15:32:47
LUKERES.DLL  : 7.0.6.1       10280 Bytes  21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes  18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.0.0     1640448 Bytes  13/09/2007 14:26:55
ANTIVIR2.VDF : 7.0.1.30    1575424 Bytes  30/11/2007 20:16:38
ANTIVIR3.VDF : 7.0.1.50      89088 Bytes  06/12/2007 09:07:01
AVEWIN32.DLL : 7.6.0.34    3125760 Bytes  03/12/2007 20:16:38
AVWINLL.DLL  : 1.0.0.7       14376 Bytes  26/02/2007 10:36:26
AVPREF.DLL   : 7.0.2.2       25640 Bytes  18/07/2007 07:39:17
AVREP.DLL    : 7.0.0.1      155688 Bytes  16/04/2007 13:16:24
AVPACK32.DLL : 7.3.0.15     360488 Bytes  03/08/2007 08:46:00
AVREG.DLL    : 7.0.1.6       30760 Bytes  18/07/2007 07:17:06
AVARKT.DLL   : 1.0.0.20     278568 Bytes  28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes  18/07/2007 07:10:18
NETNT.DLL    : 7.0.0.0        7720 Bytes  08/03/2007 11:09:42
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes  07/08/2007 12:38:13
RCTEXT.DLL   : 7.0.62.0      86056 Bytes  21/08/2007 12:50:37
SQLITE3.DLL  : 3.3.17.1     339968 Bytes  23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: jeudi 6 décembre 2007  23:25

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '1' Module(s) have been scanned
Scan process 'aawservice.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
13 processes with 13 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
      [NOTE]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '33' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
      [WARNING]   The file could not be opened!
C:\WINDOWS\system32\aadcaad.dll
      [DETECTION] Is the Trojan horse TR/Trash.Gen
      [WARNING]   The file was ignored!
C:\WINDOWS\system32\aadcaad.dll.bak
      [DETECTION] Is the Trojan horse TR/Crypt.Morphine.Gen
      [WARNING]   The file was ignored!
C:\WINDOWS\system32\apmrwkrf.dll.bak
      [DETECTION] Is the Trojan horse TR/Delf.103242
      [WARNING]   The file was ignored!
C:\WINDOWS\system32\zgnlkjga.dll.bak
      [DETECTION] Is the Trojan horse TR/Crypt.Morphine.Gen
      [WARNING]   The file was ignored!


End of the scan: jeudi 6 décembre 2007  23:48
Used time: 23:05 min

The scan has been done completely.

   2483 Scanning directories
 112747 Files were scanned
      4 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      1 Files cannot be scanned
 112743 Files not concerned
    800 Archives were scanned
      5 Warnings
      0 Notes

jlpjlp · Answer

télécharges et installes : 

kill box 
https://www.bleepingcomputer.com/download/linux/ 


aide kill box 
http://perso.wanadoo.fr/jesses/Docs/Logiciels/KillBox.htm 


- Redémarre en mode sans échec, si tu sais pas comment on fait lis ceci 

- Double-clic sur fix.reg 

Ouvres killbox 
- Sélectionne "delete on reboot" 
- Clique sur le dossier jaune à droite et sélectionne le fichier : 

C:\WINDOWS\system32\aadcaad.dll

C:\WINDOWS\system32\aadcaad.dll.bak

C:\WINDOWS\system32\apmrwkrf.dll.bak

C:\WINDOWS\system32\zgnlkjga.dll.bak



- Clique sur la croix rouge et et blanche 
- Répond yes et laisse redémarrer ton pc. 
N'hésite pas à consulter l'Aide killbox 

________________

lance a squared

https://www.01net.com/telecharger/

____________________

combofix (colle le rapport)
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

__________________

 colle le rapport d'un scan en ligne 
avec un des suivants: 


bitdefender en ligne : 
http://www.bitdefender.fr/scan_fr/scan8/ie.html 

Panda en ligne : 
http://pandasoftware.fr

secuser en ligne :
http://www.secuser.com/outils/antivirus.htm

___________________

mettre a jour windows: DEMARRER puis WINDOWS UPDATE

Julien06 · Answer

Salut j'ai fait KIllbox en sans echec.
la je fais le scan avec a-square....

Je voulais savoir comment je fais pour faire windows update?

voici le rapport de a-square

Version - a-squared Free 3.0
Dernière mise à jour: 07/12/2007 11:12:56

Réglages Scan:

Objets: Mémoire, Traces, Cookies, C:\WINDOWS\, C:\Program Files
Scan archives: Marche
Heuristiques: Marche
Scan ADS: Marche

Début du scan:	07/12/2007 11:13:56

c:\windows\system32\ifhelper.dll 	Détecter: Trace.File.SearchCentrix
C:\Documents and Settings\maison\Cookies\maison@advertising[2].txt 	Détecter: Trace.TrackingCookie
C:\Documents and Settings\maison\Cookies\maison@atdmt[2].txt 	Détecter: Trace.TrackingCookie
C:\Documents and Settings\maison\Cookies\maison@bluestreak[1].txt 	Détecter: Trace.TrackingCookie
C:\Documents and Settings\maison\Cookies\maison@commentcamarche[2].txt 	Détecter: Trace.TrackingCookie
C:\Documents and Settings\maison\Cookies\maison@doubleclick[1].txt 	Détecter: Trace.TrackingCookie
C:\Documents and Settings\maison\Cookies\maison@hitbox[2].txt 	Détecter: Trace.TrackingCookie
C:\Documents and Settings\maison\Cookies\maison@mediaplex[1].txt 	Détecter: Trace.TrackingCookie
C:\Documents and Settings\maison\Cookies\maison@smartadserver[2].txt 	Détecter: Trace.TrackingCookie
C:\Documents and Settings\maison\Cookies\maison@specificclick[2].txt 	Détecter: Trace.TrackingCookie
C:\Documents and Settings\maison\Cookies\maison@weborama[1].txt 	Détecter: Trace.TrackingCookie
C:\WINDOWS\system32\Process.exe 	Détecter: Riskware.RiskTool.Win32.Processor.20

Scanné

Fichiers: 	60805
Traces: 	344395
Cookies: 	92
Processus: 	33

Trouver

Fichiers: 	1
Traces: 	1
Cookies: 	10
Processus: 	0
Clés de Registre: 	0

Fin du Scan:	2007-12-07 11:33:13
Temps du Scan:	00:19:17

C:\WINDOWS\system32\Process.exe	Supprimé Riskware.RiskTool.Win32.Processor.20
C:\Documents and Settings\maison\Cookies\maison@advertising[2].txt	Supprimé Trace.TrackingCookie
C:\Documents and Settings\maison\Cookies\maison@atdmt[2].txt	Supprimé Trace.TrackingCookie
C:\Documents and Settings\maison\Cookies\maison@bluestreak[1].txt	Supprimé Trace.TrackingCookie
C:\Documents and Settings\maison\Cookies\maison@commentcamarche[2].txt	Supprimé Trace.TrackingCookie
C:\Documents and Settings\maison\Cookies\maison@doubleclick[1].txt	Supprimé Trace.TrackingCookie
C:\Documents and Settings\maison\Cookies\maison@hitbox[2].txt	Supprimé Trace.TrackingCookie
C:\Documents and Settings\maison\Cookies\maison@mediaplex[1].txt	Supprimé Trace.TrackingCookie
C:\Documents and Settings\maison\Cookies\maison@smartadserver[2].txt	Supprimé Trace.TrackingCookie
C:\Documents and Settings\maison\Cookies\maison@specificclick[2].txt	Supprimé Trace.TrackingCookie
C:\Documents and Settings\maison\Cookies\maison@weborama[1].txt	Supprimé Trace.TrackingCookie
c:\windows\system32\ifhelper.dll	Supprimé Trace.File.SearchCentrix

Supprimé

Fichiers: 	1
Traces: 	1
Cookies: 	10

Julien06 · Answer

re, voila le rapport de combofix

ComboFix 07-12-07.3 - maison 2007-12-07 11:35:39.6 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.1.1252.1.1036.18.154 [GMT 1:00]
Running from: C:\Documents and Settings\maison\Bureau\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((( Fichiers créés 2007-11-07 to 2007-12-07 ))))))))))))))))))))))))))))))))))))
.

2007-12-07 11:11 . 2007-12-07 11:33 <REP> d-------- C:\Program Files\a-squared Free
2007-12-07 01:22 . 2007-12-07 01:22 <REP> d--h----- C:\WINDOWS\PIF
2007-12-07 00:48 . 2007-12-07 00:48 <REP> d-------- C:\WINDOWS\ERUNT
2007-12-06 23:17 . 2007-12-06 23:17 1,678 --a------ C:\WINDOWS\system32\tmp.reg
2007-12-06 22:15 . 2007-12-06 22:18 325 --a------ C:\WINDOWS\KillProcess.INI
2007-12-06 21:35 . 2007-12-06 21:35 <REP> d-------- C:\Program Files\Kill Process
2007-12-06 18:30 . 2007-12-02 18:48 1,500 --a------ C:\WINDOWS\system32\Copie de tmp.reg
2007-12-06 17:39 . 2007-12-06 18:06 <REP> d-------- C:\Program Files\a-squared Anti-Malware
2007-12-06 16:50 . 2007-12-06 17:06 <REP> d-------- C:\WINDOWS\BDOSCAN8
2007-12-06 16:14 . 2007-12-06 18:41 <REP> d-------- C:\Program Files\Yahoo!
2007-12-06 16:14 . 2007-12-06 16:14 <REP> d-------- C:\Program Files\CCleaner
2007-12-06 11:16 . 2007-12-06 11:16 <REP> d-------- C:\Program Files\Lavasoft
2007-12-06 11:16 . 2007-12-06 11:16 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2007-12-06 11:16 . 2007-12-06 11:16 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-02 23:07 . 2007-12-02 23:07 <REP> d-------- C:\VundoFix Backups
2007-12-02 21:15 . 2007-12-02 21:15 <REP> d-------- C:\Program Files\Avira
2007-12-02 21:15 . 2007-12-02 21:15 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2007-12-02 20:04 . 2007-12-02 20:04 <REP> d-------- C:\Documents and Settings\maison\Application Data\Grisoft
2007-12-02 20:04 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-12-02 20:01 . 2007-12-02 20:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-02 19:22 . 2007-12-02 19:25 <REP> d-------- C:\Program Files\RogueRemover FREE
2007-12-01 11:17 . 2007-12-01 11:17 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2007-11-30 14:40 . 2007-11-30 14:39 45,056 -r-hs---- C:\WINDOWS\system32\1033v.exe
2007-11-30 14:40 . 2007-11-30 14:40 144 --ahs---- C:\WINDOWS\system32\1549314879.dat

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-07 10:07 --------- d-----w C:\Program Files\Wanadoo
2007-12-06 20:59 3,310 ----a-w C:\Documents and Settings\maison\Application Data\wklnhst.dat
2007-12-06 17:05 --------- d-----w C:\Program Files\Navilog1
2007-12-02 23:07 --------- d-----w C:\Program Files\eMule
2007-12-02 18:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip
2007-10-25 09:26 53,248 ----a-w C:\WINDOWS\bdoscandel.exe
2007-10-18 20:26 --------- d-----w C:\Program Files\DivX
2007-10-17 04:54 --------- d-----w C:\Program Files\Zapu
2007-10-17 04:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\MailFrontier
2007-10-16 20:55 81,408 ----a-w C:\WINDOWS\system32\aadcaad.dll
2007-10-14 18:16 --------- d-----w C:\Program Files\Trend Micro
2007-10-14 17:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2007-10-14 06:41 17,792 ----a-w C:\WINDOWS\system32\drivers\miqvzwcl.dat
2007-10-12 17:07 --------- d-----w C:\Program Files\Fichiers communs\G DATA
2007-10-12 16:50 --------- d-----w C:\Documents and Settings\maison\Application Data\Lavasoft
2007-10-05 23:24 52,602 ----a-w C:\WINDOWS\system32\interceptor.sys
2007-10-03 22:36 25,600 ----a-w C:\WINDOWS\system32\WS2Fix.exe
.

((((((((((((((((((((((((((((( snapshot@2007-12-01_11.35.09,92 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-12-06 15:51:12 45,056 ----a-w C:\WINDOWS\BDOSCAN8\avxdisk.dll
+ 2007-12-06 15:51:12 10,240 ----a-w C:\WINDOWS\BDOSCAN8\avxs.dll
+ 2007-12-06 15:51:12 27,136 ----a-w C:\WINDOWS\BDOSCAN8\avxt.dll
+ 2007-12-06 15:51:14 181,760 ----a-w C:\WINDOWS\BDOSCAN8\bdcore.dll
+ 2007-10-25 09:26:48 118,784 ----a-w C:\WINDOWS\BDOSCAN8\bdupd.dll
+ 2007-10-25 09:26:48 53,248 ----a-w C:\WINDOWS\BDOSCAN8\ipsupd.dll
+ 2007-12-06 15:51:14 142,848 ----a-w C:\WINDOWS\BDOSCAN8\libfn.dll
+ 2007-12-06 15:51:12 86,016 ----a-w C:\WINDOWS\BDOSCAN8\librtvr.dll
- 2007-11-08 15:59:01 136,704 ----a-w C:\WINDOWS\catchme.exe
+ 2007-11-27 02:58:11 140,288 ----a-w C:\WINDOWS\catchme.exe
+ 2007-10-25 09:26:48 118,784 ----a-w C:\WINDOWS\Downloaded Program Files\bdupd.dll
+ 2007-10-25 09:26:48 53,248 ----a-w C:\WINDOWS\Downloaded Program Files\ipsupd.dll
+ 2007-12-05 19:19:42 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2007-12-06 23:48:14 3,899,392 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2007-12-06 23:48:14 245,760 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
+ 2007-12-05 19:19:42 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2007-12-06 23:48:09 3,899,392 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2007-12-06 23:48:09 245,760 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
- 2007-06-29 07:38:18 581,632 ----a-w C:\WINDOWS\gmer.exe
+ 2007-06-29 08:38:18 581,632 ----a-w C:\WINDOWS\gmer.exe
- 2007-10-05 20:17:40 632,320 ----a-r C:\WINDOWS\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C240B5}\IconCD95F66110.exe
+ 2007-12-02 18:38:11 632,320 ----a-r C:\WINDOWS\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C240B5}\IconCD95F66110.exe
- 2007-10-05 20:17:40 29,184 ----a-r C:\WINDOWS\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C240B5}\IconCD95F6617.exe
+ 2007-12-02 18:38:11 29,184 ----a-r C:\WINDOWS\Installer\{CD95F661-A5C4-44F5-A6AA-ECDD91C240B5}\IconCD95F6617.exe
+ 2007-12-06 10:17:00 1,038,336 ----a-r C:\WINDOWS\Installer\{E31C348B-63A9-4CBF-8D7F-D932ABB63244}\Icon0E6AB9FC.exe
+ 2007-12-06 10:17:00 178,688 ----a-r C:\WINDOWS\Installer\{E31C348B-63A9-4CBF-8D7F-D932ABB63244}\Icon0E6AB9FC1.exe
+ 2007-05-30 22:03:48 110,360 ----a-w C:\WINDOWS\LastGood\System32\drivers\kl1.sys
+ 2007-05-30 22:03:48 175,376 ----a-w C:\WINDOWS\LastGood\System32\drivers\klif.sys
+ 2007-08-09 12:04:11 40,768 ----a-w C:\WINDOWS\system32\drivers\avgntdd.sys
+ 2007-07-18 13:22:19 21,312 ----a-w C:\WINDOWS\system32\drivers\avgntmgr.sys
+ 2007-12-03 20:16:38 61,632 ----a-w C:\WINDOWS\system32\drivers\avipbb.sys
+ 2007-06-04 14:14:56 6,272 ----a-w C:\WINDOWS\system32\drivers\AWRTPD.sys
+ 2007-06-04 14:17:02 8,320 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
+ 2007-06-04 14:18:48 9,344 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
+ 2007-03-01 09:34:36 28,352 ----a-w C:\WINDOWS\system32\drivers\ssmdrv.sys
+ 2007-04-13 14:19:52 7,680 ----a-w C:\WINDOWS\system32\lsdelete.exe
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{91AD9DC2-523A-47E2-A598-6C277F16CC50}]
2007-10-16 21:55 81408 --a------ c:\windows\system32\aadcaad.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-11 15:33]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:55]
"UpdateWin"="C:\WINDOWS\System32\1033v.exe" [2007-11-30 14:39]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"UpdateWin"="C:\WINDOWS\System32\1033v.exe" [2007-11-30 14:39]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-12-03 21:16]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-09-02 11:25]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 16:07 C:\WINDOWS\system32\HdAShCut.exe]
"RTHDCPL"="RTHDCPL.EXE" [2005-07-13 03:37 C:\WINDOWS\RTHDCPL.EXE]
"EasyTuneV"="C:\Program Files\Gigabyte\ET5\GUI.exe" [2004-06-14 10:54]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 13:49]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 15:55]
"M1000Mnt"="M1000Rmv.exe" []
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" []
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" []
"UpdateWin"="C:\WINDOWS\System32\1033v.exe" [2007-11-30 14:39]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"UpdateWin"="C:\WINDOWS\System32\1033v.exe" [2007-11-30 14:39]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-08-29 10:45]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoWindowsUpdate"= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
UpdateWin REG_SZ C:\WINDOWS\System32\1033v.exe

R0 avgntmgr;avgntmgr;C:\WINDOWS\System32\DRIVERS\avgntmgr.sys
R0 nvrfhgrt;Microsoft RPC API Helper;C:\WINDOWS\System32\drivers\miqvzwcl.dat
R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys
R3 MarkFun_NT;MarkFun_NT;\??\C:\Program Files\Gigabyte\ET5\markfun.w32
S3 gdrv;gdrv;\??\C:\WINDOWS\gdrv.sys
S3 M1000Srv;M5603C USB2.0 Camera Driver;C:\WINDOWS\System32\Drivers\M1000KNT.sys

*Newly Created Service* - A2FREE
.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-07 11:36:48
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-07 11:37:19
C:\ComboFix3.txt ... 2007-11-04 20:20
.
--- E O F ---

jlpjlp · Answer

pour mettre a jour windows

mettre a jour windows: DEMARRER puis WINDOWS UPDATE

_______________

coller un rapport de scan en ligne et un nouveau hijackhtis

julien06 · Answer

ok  j'ai fait les mise a jour et voila le rapport de hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:57:04, on 07/12/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Gigabyte\ET5\GUI.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {91AD9DC2-523A-47E2-A598-6C277F16CC50} - c:\windows\system32\aadcaad.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [M1000Mnt] M1000Rmv.exe /StartStillMnt
O4 - HKLM\..\Run: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKLM\..\RunServices: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKCU\..\RunServices: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/02084dfa22d225efae05/netzip/RdxIE601_fr.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe

jlpjlp · Answer

Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) 


il n'est toujours pas a jour ton windows, il faut le faire jusqu'a l'installation du spé

________________


pour faire un scan en ligne tu clique sur un des liens suivant


bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html

Panda en ligne :
http://pandasoftware.fr

secuser en ligne :
http://www.secuser.com/outils/antivirus.htm

julien06 · Answer

tu as raison mais la im me di que ma copie ne peut pas etre validé et que la clé a eté bloquée ???
Pour info j'ai recup cette tour au boulot de mon beau pere je ne sais rien d'autre.

jlpjlp · Answer

colle  

 scan en ligne tu clique sur un des liens suivant


bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html

Panda en ligne :
http://pandasoftware.fr

secuser en ligne :
http://www.secuser.com/outils/antivirus.htm

Julien06 · Answer

j'ai fait un scan avec secuser en ligne et il n'a rien trouvé...
Est ce que le fait que antivir le met en quarantaine y joue dans le fait que le scan ne trouve rien ?

Julien06 · Answer

tu veux plus me repondre parce que j'ai fait d'autre post? desolé :-§

jlpjlp · Answer

non pas de pbs mais je suis aussi sur d'autres post que toi

analyse sur virus total et colle le rapport: de ce fichier

https://www.virustotal.com/gui/




c:\windows\system32\aadcaad.dll

Julien06 · Answer

desolé pour la remarque alors... j'avais peur d'avaoir fait des betises.

Sinon pour virustotal il me repond 0 bytes size received / Se ha recibido un archivo vacio

Julien06 · Answer

Comme j'ai ouvert plusieur topic et que sans savoir j'ai foutu le bordel (desolé) je vais rester sur le topic avec lyonnais comme me l'a dit g!rl alors on met celui la en resolu et desolé de t'avvoir derangé. Bonne continuation.

Lyonnais92 · Answer

Bonjour,

le post en question

http://www.commentcamarche.net/forum/affich 3717520 rapport mauvais#0

Systeme infecté

74 réponses

Discussions similaires

Newsletters