reste problème???

Question

Bonjour,

j ai recu une alerte de virus en mettant une clé USB sur mon ordi.
 j aimerai juste savoir si il reste quelque chose d inquietant sur mon ordi

Si vous pouviez m aider SVP 

Je vous envoie donc ce rapport 

Logfile of HijackThis v1.99.1
Scan saved at 20:08:26, on 17/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
C:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
C:\Program Files\AntivirusFirewall\Common\FSMB32.EXE
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fssm32.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\AntivirusFirewall\Common\FCH32.EXE
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsqh.exe
C:\Program Files\AntivirusFirewall\Common\FAMEH32.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fsrw.exe
C:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Apps\Powercinema\PCMService.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\AntivirusFirewall\Common\FSM32.EXE
C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\PROGRA~1\ANTIVI~1\ANTI-S~1\fsaw.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\AntivirusFirewall\FSGUI\fsguidll.exe
C:\Program Files\Wanadoo\GestionnaireInternet.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Wanadoo\Watch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\Documents and Settings\Hélène\Mes documents\Alain SIMONNET\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://french.ircfast2.com/index.php?rvs=hompag
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\AntivirusFirewall\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\AntivirusFirewall\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunOnce: [HDReg] c:\Apps\HDReg\HDRegApp.exe -r
O4 - Global Startup: Antivirus Firewall.lnk = C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
O8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\AntivirusFirewall\Anti-Spyware\blockpopups.htm
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Antivirus Firewall (BackWeb Plug-in - 6588780) - Securitoo Portal - C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: MySqlInventime - Unknown owner - c:\mysql\bin\mysqld-max-nt.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe

merci

jlpjlp · Answer

slt,

desinstalle via ton panneau de configuration:

VMN Toolbar

________________

branche la clé usb en question sur ton orid:
puis:

# Téléchargez ce tool de sUBs : http://www.techsupportforum.com/sectools/sUBs/Flash_Disinfector.exe
# Double-cliquez dessus et laissez-vous guider.

_____________



Colle le rapport :
Clean permettra de faire du nettoyage et supprimer des fichiers que des anti-virus et anti-spywares n'ont pas pu trouver. Le logiciel est régulièrement mis à jour, vous devrez donc le re-téléchargé pour obtenir une version plus récente.

&#61623;  Téléchargez clean.zip, décompressez-le sur votre bureau (clic droit / extraire tout), vous obtenez alors un dossier clean 
&#61623;  Démarrez Windows en mode sans échec : Guide pour redémarrer en mode sans échec 
&#61623;  Ouvrez le dossier clean qui se trouve sur ton bureau, et double-cliquez sur clean.cmd, une fenêtre noire va apparaître pendant un instant, laissez la ouverte jusqu'à ce qu'elle se ferme.
Manuel de clean :
http://kerio.probb.fr/tuto-Clean-h37.html
https://kerio.probb.fr/
_______________


 colle le rapport d'un scan en ligne 
avec un des suivants: 


bitdefender en ligne : 
http://www.bitdefender.fr/scan_fr/scan8/ie.html 

Panda en ligne : 
http://pandasoftware.fr

secuser en ligne :
http://www.secuser.com/outils/antivirus.htm


a plus

KADIE · Answer

bonjour, merci d avoir accepter de m aider.

* Pour la clé ce n est pas possible car elle n etait pas a moi.

* pour clean il refuse de fonctionner, apres avoir choisi l option 1 il réflechi mais la fenetre s eteint aussitot.
je lai donc supprimer et retélécharger mais toujours rien a faire.

* Mais voici l analyse panda :

;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-01-20 21:06:42
PROTECTIONS: 2
MALWARE: 2
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;===================================================================================================================================================================================
Norton Internet Security                     2005                          Yes       Yes
AntiVirus Firewall 6.15                      6.15                          Yes       Yes
;===================================================================================================================================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;===================================================================================================================================================================================
00096188  spyware/searchcentrix              Spyware             No        1         Yes            No           hkey_current_user\software\dynamic toolbar
01262593  Application/NirCmd.A               HackTools           No        0         Yes            No           C:\WINDOWS
ircmd.exe
;===================================================================================================================================================================================
SUSPECTS
Location
;===================================================================================================================================================================================
;===================================================================================================================================================================================

jlpjlp · Answer

AVG antispyware

https://www.01net.com/telecharger/

Tuto : 
http://www.kachouri.com/tuto/tuto-161-avg-anti-spyware-75-pour-votre-securite.html


->Relance AVG AS -> "Analyse" ->"Paramètres" 

Sous la question "Comment réagir ?" : 

-> clique sur "Actions recommandées" et choisis "Quarantaines" 
-> Re-clique sur l'onglet "Analyse" puis réalise une "Analyse complète du système" 

Si un fichier est infecté en fin d'analyse 

->Clique sur "Appliquer toutes les actions " 

->Clique sur "Enregistrer le rapport" puis sur "Enregistrer le rapport sous". 

->Enregistre ce fichier texte sur ton bureau ensuite colle le rapport ici

_________________

combofix (colle le rapport)
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

__________________
mets a jour internet explorer ici


https://www.01net.com/telecharger/windows/Internet/navigateur/fiches/33081.html

KADIE · Answer

Salut Voici le rapport AVG : --------------------------------------------------------- AVG Anti-Spyware - Rapport d'analyse --------------------------------------------------------- + Créé à: 16:32:52 21/01/2008 + Résultat de l'analyse: C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP182\A0049859.exe -> Not-A-Virus.Adware.Agent : Nettoyé et sauvegardé (mise en quarantaine). Fin du rapport ________________________________________________________________________________________ Voici le rapport de combofix: ComboFix 08-01-20.1 - Hélène 2008-01-21 16:34:41.6 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.421 [GMT 1:00] Running from: C:\DOCUME~1\HLNE~1\MESDOC~1\ALAINS~1\combofix.exe * Created a new restore point . ((((((((((((((((((((((((((((( Fichiers créés 2007-12-21 to 2008-01-21 )))))))))))))))))))))))))))))))))))) . 2008-01-21 14:40 . 2008-01-21 14:40 d-------- C:\Documents and Settings\Hélène\Application Data\Grisoft 2008-01-21 14:40 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2008-01-20 20:25 . 2008-01-20 20:25 d-------- C:\Program Files\Panda Security 2008-01-20 17:21 . 2007-07-02 20:52 d--h----- C:\Documents and Settings\Administrateur\Voisinage réseau 2008-01-20 17:21 . 2007-07-02 20:52 d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression 2008-01-20 17:21 . 2007-07-02 20:55 d--h----- C:\Documents and Settings\Administrateur\Modèles 2008-01-20 17:21 . 2007-07-02 20:55 dr------- C:\Documents and Settings\Administrateur\Mes documents 2008-01-20 17:21 . 2007-07-02 20:55 dr------- C:\Documents and Settings\Administrateur\Menu Démarrer 2008-01-20 17:21 . 2007-07-02 20:55 dr------- C:\Documents and Settings\Administrateur\Favoris 2008-01-20 17:21 . 2007-07-02 20:52 dr------- C:\Documents and Settings\Administrateur\Bureau 2008-01-20 17:21 . 2007-07-02 20:52 d-------- C:\Documents and Settings\Administrateur\Application Data\You've Got Pictures Screensaver 2008-01-20 17:21 . 2007-07-02 20:52 d-------- C:\Documents and Settings\Administrateur\Application Data\Symantec 2008-01-19 23:00 . 2008-01-19 23:09 d-------- C:\Documents and Settings\Hélène\.housecall6.6 2008-01-19 23:00 . 2008-01-19 23:09 d-------- C:\Documents and Settings\Hélène\.housecall6.6 2008-01-19 22:58 . 2008-01-19 22:58 40 --a------ C:\WINDOWS\TSC.INI 2008-01-19 22:57 . 2008-01-19 22:57 507,904 --a------ C:\WINDOWS\TMUPDATE.DLL 2008-01-19 22:57 . 2008-01-19 22:57 286,720 --a------ C:\WINDOWS\PATCH.EXE 2008-01-19 22:57 . 2008-01-19 22:57 69,689 --a------ C:\WINDOWS\UNZIP.DLL 2008-01-19 21:47 . 2008-01-19 22:56 d-------- C:\WINDOWS\BDOSCAN8 2008-01-04 22:59 . 2008-01-04 22:59 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe 2008-01-04 22:59 . 2008-01-04 22:59 9,878 --a------ C:\WINDOWS\system32\dsm_fr.qm 2008-01-04 22:59 . 2008-01-04 22:59 4,816 --a------ C:\WINDOWS\system32\divxsm.tlb 2008-01-04 22:58 . 2008-01-04 22:58 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2008-01-04 22:58 . 2008-01-04 22:58 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll 2008-01-04 22:58 . 2008-01-04 22:58 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll 2008-01-04 22:56 . 2008-01-04 22:56 156,992 --a------ C:\WINDOWS\system32\DivXCodecVersionChecker.exe 2008-01-04 22:56 . 2008-01-04 22:56 12,288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll 2008-01-04 22:56 . 2008-01-04 22:56 8,835 --a------ C:\WINDOWS\system32\dpufr.qm 2008-01-04 22:56 . 2008-01-04 22:56 3,162 --a------ C:\WINDOWS\system32\dtu_fr.qm 2007-12-29 16:18 . 2007-12-29 16:18 d-------- C:\Documents and Settings\Hélène\LimeWire Store Purchased 2007-12-29 16:18 . 2007-12-29 16:18 d-------- C:\Documents and Settings\Hélène\LimeWire Store Purchased 2007-12-29 16:18 . 2008-01-20 20:17 d-------- C:\Documents and Settings\Hélène\LimeWire Saved 2007-12-29 16:18 . 2008-01-20 20:17 d-------- C:\Documents and Settings\Hélène\LimeWire Saved . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-21 15:37 --------- d-----w C:\Program Files\Wanadoo 2008-01-20 17:49 --------- d-----w C:\Documents and Settings\Hélène\Application Data\LimeWire 2008-01-20 17:47 --------- d-----w C:\Program Files\eMule 2008-01-16 21:00 7,322 ----a-w C:\Documents and Settings\Hélène\Application Data\wklnhst.dat 2008-01-11 19:08 --------- d-----w C:\Program Files\DivX 2008-01-08 21:23 --------- d-----w C:\Program Files\LimeWire 2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll 2008-01-04 21:57 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll 2008-01-04 21:57 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll 2008-01-04 21:57 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll 2008-01-04 21:57 682,496 ----a-w C:\WINDOWS\system32\DivX.dll 2008-01-04 21:57 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll 2008-01-04 21:57 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll 2008-01-04 21:57 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll 2008-01-04 21:57 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll 2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll 2008-01-04 21:57 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll 2008-01-04 21:57 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll 2007-12-31 15:51 120 ----a-w C:\drmHeader.bin 2007-12-29 18:08 --------- d-----w C:\Program Files\Windows Live Toolbar 2007-12-29 15:41 --------- d-----w C:\Program Files\Windows Live 2007-12-29 15:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2007-12-21 19:42 --------- d-----w C:\Program Files\Messenger Plus! Live 2007-12-20 18:07 --------- d-----w C:\Program Files\Shareaza 2007-12-19 18:19 --------- d-----w C:\Program Files\Yahoo! 2007-12-19 17:29 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-12-19 17:28 --------- d-----w C:\Program Files\Serif 2007-12-19 17:24 --------- d-----w C:\Program Files\Visicom Media 2007-12-19 16:18 13 ---h--w C:\Documents and Settings\All Users\Application Data\1ÌØ13.sys 2007-12-19 16:18 --------- d-----w C:\Program Files\CoffeeCup Software 2007-12-15 20:46 87,528 ----a-w C:\Documents and Settings\Hélène\Application Data\GDIPFONTCACHEV1.DAT 2007-12-15 00:03 --------- d-----w C:\Program Files\CCleaner 2007-12-10 21:44 --------- d-----w C:\Program Files\AxBx 2007-12-10 16:05 --------- d-----w C:\Documents and Settings\Hélène\Application Data\AdobeUM 2007-11-28 17:10 --------- d-----w C:\Program Files\Java 2007-11-14 07:28 450,560 ------w C:\WINDOWS\system32\dllcache\jscript.dll 2007-11-07 09:28 728,576 ----a-w C:\WINDOWS\system32\lsasrv.dll 2007-11-07 09:28 728,576 ------w C:\WINDOWS\system32\dllcache\lsasrv.dll 2007-10-30 17:20 360,064 ------w C:\WINDOWS\system32\dllcache\tcpip.sys 2007-10-30 10:18 3,079,680 ------w C:\WINDOWS\system32\dllcache\mshtml.dll 2007-10-29 22:43 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll 2007-10-29 22:43 1,293,824 ------w C:\WINDOWS\system32\dllcache\quartz.dll 2007-10-25 16:56 8,510,976 ------w C:\WINDOWS\system32\dllcache\shell32.dll 2007-10-25 08:28 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll 2007-10-25 08:28 222,720 ------w C:\WINDOWS\system32\dllcache\wmasf.dll . ((((((((((((((((((((((((((((( snapshot@2007-12-12_23.27.33,32 ))))))))))))))))))))))))))))))))))))))))) . + 2007-10-29 22:36:31 1,293,824 ----a-w C:\WINDOWS\$hf_mig$\KB941568\SP2QFE\quartz.dll + 2007-03-06 01:34:33 15,072 ----a-w C:\WINDOWS\$hf_mig$\KB941568\spmsg.dll + 2007-03-06 01:34:38 216,800 ----a-w C:\WINDOWS\$hf_mig$\KB941568\spuninst.exe + 2007-03-06 01:34:31 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB941568\update\spcustom.dll + 2007-03-06 01:34:56 727,776 ----a-w C:\WINDOWS\$hf_mig$\KB941568\update\update.exe + 2007-03-06 01:35:48 394,976 ----a-w C:\WINDOWS\$hf_mig$\KB941568\update\updspapi.dll + 2007-10-11 05:59:18 1,024,512 ----a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\browseui.dll + 2007-10-11 05:59:18 152,064 ----a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\cdfview.dll + 2007-10-11 05:59:21 1,056,768 ----a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\danim.dll + 2007-10-11 05:59:22 357,888 ----a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\dxtmsft.dll + 2007-10-11 05:59:22 205,824 ----a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\dxtrans.dll + 2007-10-11 05:59:22 55,808 ----a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\extmgr.dll + 2007-10-10 10:48:23 18,432 ----a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\iedw.exe + 2007-10-11 05:59:22 251,904 ----a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\iepeers.dll + 2007-10-11 05:59:22 96,768 ----a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\inseng.dll + 2007-10-11 05:59:22 16,384 ----a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\jsproxy.dll + 2007-10-30 09:57:54 3,086,848 ----a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\mshtml.dll + 2007-10-11 05:59:26 449,024 ----a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\mshtmled.dll + 2007-10-11 05:59:26 146,432 ----a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\msrating.dll + 2007-10-11 05:59:27 532,480 ----a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\mstime.dll + 2007-10-11 05:59:27 39,424 ----a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\pngfilt.dll + 2007-10-11 05:59:28 1,498,624 ----a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\shdocvw.dll + 2007-10-11 05:59:28 474,624 ----a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\shlwapi.dll + 2007-10-10 23:36:44 369,152 ----a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\spru040c.dll + 2007-10-11 05:59:29 620,032 ----a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\urlmon.dll + 2007-10-11 05:59:29 670,208 ----a-w C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\wininet.dll + 2007-03-06 01:34:33 15,072 ----a-w C:\WINDOWS\$hf_mig$\KB942615\spmsg.dll + 2007-03-06 01:34:38 216,800 ----a-w C:\WINDOWS\$hf_mig$\KB942615\spuninst.exe + 2007-03-06 01:34:31 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB942615\update\spcustom.dll + 2007-03-06 01:34:56 727,776 ----a-w C:\WINDOWS\$hf_mig$\KB942615\update\update.exe + 2007-03-06 01:35:48 394,976 ----a-w C:\WINDOWS\$hf_mig$\KB942615\update\updspapi.dll + 2007-11-13 11:02:46 60,416 ----a-w C:\WINDOWS\$hf_mig$\KB942763\SP2QFE\tzchange.exe + 2007-03-06 01:34:33 15,072 ----a-w C:\WINDOWS\$hf_mig$\KB942763\spmsg.dll + 2007-03-06 01:34:38 216,800 ----a-w C:\WINDOWS\$hf_mig$\KB942763\spuninst.exe + 2007-03-06 01:34:31 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB942763\update\spcustom.dll + 2007-03-06 01:34:56 727,776 ----a-w C:\WINDOWS\$hf_mig$\KB942763\update\update.exe + 2007-03-06 01:35:48 394,976 ----a-w C:\WINDOWS\$hf_mig$\KB942763\update\updspapi.dll + 2007-11-14 07:19:25 450,560 ----a-w C:\WINDOWS\$hf_mig$\KB942840\SP2QFE\jscript.dll + 2007-03-06 01:34:33 15,072 ----a-w C:\WINDOWS\$hf_mig$\KB942840\spmsg.dll + 2007-03-06 01:34:38 216,800 ----a-w C:\WINDOWS\$hf_mig$\KB942840\spuninst.exe + 2007-03-06 01:34:31 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB942840\update\spcustom.dll + 2007-03-06 01:34:56 727,776 ----a-w C:\WINDOWS\$hf_mig$\KB942840\update\update.exe + 2007-03-06 01:35:48 394,976 ----a-w C:\WINDOWS\$hf_mig$\KB942840\update\updspapi.dll + 2007-11-13 08:47:45 20,480 ----a-w C:\WINDOWS\$hf_mig$\KB944653\SP2QFE\secdrv.sys + 2007-03-06 01:34:33 15,072 ----a-w C:\WINDOWS\$hf_mig$\KB944653\spmsg.dll + 2007-03-06 01:34:38 216,800 ----a-w C:\WINDOWS\$hf_mig$\KB944653\spuninst.exe + 2007-03-06 01:34:31 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB944653\update\spcustom.dll + 2007-03-06 01:34:56 727,776 ----a-w C:\WINDOWS\$hf_mig$\KB944653\update\update.exe + 2007-03-06 01:35:48 394,976 ----a-w C:\WINDOWS\$hf_mig$\KB944653\update\updspapi.dll + 2005-08-30 03:55:44 1,293,312 -c----w C:\WINDOWS\$NtUninstallKB941568$\quartz.dll + 2007-03-06 01:34:38 216,800 -c----w C:\WINDOWS\$NtUninstallKB941568$\spuninst\spuninst.exe + 2007-03-06 01:35:48 394,976 -c----w C:\WINDOWS\$NtUninstallKB941568$\spuninst\updspapi.dll + 2005-06-28 09:23:40 216,800 -c----w C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe + 2005-06-28 09:23:54 371,424 -c----w C:\WINDOWS\$NtUninstallKB941569$\spuninst\updspapi.dll + 2006-10-18 19:47:18 222,208 -c----w C:\WINDOWS\$NtUninstallKB941569$\wmasf.dll + 2007-08-22 13:13:05 1,023,488 -c----w C:\WINDOWS\$NtUninstallKB942615$\browseui.dll + 2007-08-22 13:13:05 152,064 -c----w C:\WINDOWS\$NtUninstallKB942615$\cdfview.dll + 2007-08-22 13:13:05 1,056,768 -c----w C:\WINDOWS\$NtUninstallKB942615$\danim.dll + 2007-08-22 13:13:05 357,888 -c----w C:\WINDOWS\$NtUninstallKB942615$\dxtmsft.dll + 2007-08-22 13:13:05 205,312 -c----w C:\WINDOWS\$NtUninstallKB942615$\dxtrans.dll + 2007-08-22 13:13:05 55,808 -c----w C:\WINDOWS\$NtUninstallKB942615$\extmgr.dll + 2007-08-21 10:30:45 18,432 -c----w C:\WINDOWS\$NtUninstallKB942615$\iedw.exe + 2007-08-22 13:13:05 251,392 -c----w C:\WINDOWS\$NtUninstallKB942615$\iepeers.dll + 2007-08-22 13:13:06 96,768 -c----w C:\WINDOWS\$NtUninstallKB942615$\inseng.dll + 2007-08-22 13:13:06 16,384 -c----w C:\WINDOWS\$NtUninstallKB942615$\jsproxy.dll + 2007-08-22 13:13:07 3,079,168 -c----w C:\WINDOWS\$NtUninstallKB942615$\mshtml.dll + 2007-08-22 13:13:07 449,024 -c----w C:\WINDOWS\$NtUninstallKB942615$\mshtmled.dll + 2007-08-22 13:13:07 146,432 -c----w C:\WINDOWS\$NtUninstallKB942615$\msrating.dll + 2007-08-22 13:13:07 532,480 -c----w C:\WINDOWS\$NtUninstallKB942615$\mstime.dll + 2007-08-22 13:13:07 39,424 -c----w C:\WINDOWS\$NtUninstallKB942615$\pngfilt.dll + 2007-08-22 13:13:08 1,495,040 -c----w C:\WINDOWS\$NtUninstallKB942615$\shdocvw.dll + 2007-08-22 13:13:08 474,624 -c----w C:\WINDOWS\$NtUninstallKB942615$\shlwapi.dll + 2007-03-06 01:34:38 216,800 -c----w C:\WINDOWS\$NtUninstallKB942615$\spuninst\spuninst.exe + 2007-03-06 01:35:48 394,976 -c----w C:\WINDOWS\$NtUninstallKB942615$\spuninst\updspapi.dll + 2007-08-22 13:13:08 617,472 -c----w C:\WINDOWS\$NtUninstallKB942615$\urlmon.dll + 2007-08-22 13:13:08 663,040 -c----w C:\WINDOWS\$NtUninstallKB942615$\wininet.dll + 2007-03-06 01:34:38 216,800 -c----w C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe + 2007-03-06 01:35:48 394,976 -c----w C:\WINDOWS\$NtUninstallKB942763$\spuninst\updspapi.dll + 2007-07-18 12:42:22 60,416 -c----w C:\WINDOWS\$NtUninstallKB942763$\tzchange.exe + 2006-05-18 05:31:21 450,560 -c----w C:\WINDOWS\$NtUninstallKB942840$\jscript.dll + 2007-03-06 01:34:38 216,800 -c----w C:\WINDOWS\$NtUninstallKB942840$\spuninst\spuninst.exe + 2007-03-06 01:35:48 394,976 -c----w C:\WINDOWS\$NtUninstallKB942840$\spuninst\updspapi.dll + 2004-08-05 12:00:00 27,440 -c----w C:\WINDOWS\$NtUninstallKB944653$\secdrv.sys + 2007-03-06 01:34:38 216,800 -c----w C:\WINDOWS\$NtUninstallKB944653$\spuninst\spuninst.exe + 2007-03-06 01:35:48 394,976 -c----w C:\WINDOWS\$NtUninstallKB944653$\spuninst\updspapi.dll + 2008-01-19 20:47:53 45,056 ----a-w C:\WINDOWS\BDOSCAN8\avxdisk.dll + 2008-01-19 20:47:53 10,240 ----a-w C:\WINDOWS\BDOSCAN8\avxs.dll + 2008-01-19 20:47:54 27,136 ----a-w C:\WINDOWS\BDOSCAN8\avxt.dll + 2008-01-19 20:48:04 181,760 ----a-w C:\WINDOWS\BDOSCAN8\bdcore.dll + 2006-05-25 00:21:00 118,784 ----a-w C:\WINDOWS\BDOSCAN8\bdupd.dll + 2006-05-25 00:21:14 53,248 ----a-w C:\WINDOWS\BDOSCAN8\ipsupd.dll + 2008-01-19 20:48:08 142,848 ----a-w C:\WINDOWS\BDOSCAN8\libfn.dll + 2008-01-19 20:47:55 86,016 ----a-w C:\WINDOWS\BDOSCAN8\librtvr.dll + 2006-05-25 00:22:06 53,248 ----a-w C:\WINDOWS\bdoscandel.exe + 2008-01-20 21:01:31 4,132 ----a-w C:\WINDOWS\bthservsdp.dat + 2007-08-21 13:37:26 124,208 ----a-w C:\WINDOWS\Downloaded Program Files\ascstubie.dll + 2006-05-25 00:21:00 118,784 ----a-w C:\WINDOWS\Downloaded Program Files\bdupd.dll + 2006-05-25 00:21:14 53,248 ----a-w C:\WINDOWS\Downloaded Program Files\ipsupd.dll + 2007-07-18 13:49:56 12,592 ----a-w C:\WINDOWS\Downloaded Program Files\libcomm.dll + 2007-08-13 16:03:08 476,160 ----a-w C:\WINDOWS\Downloaded Program Files\PPClean.exe + 2007-08-13 16:03:08 800,272 ----a-w C:\WINDOWS\Downloaded Program Files\ppctl.dll + 2007-08-13 16:03:08 30,763 ----a-w C:\WINDOWS\Downloaded Program Files\ppsrindex.dat + 2000-08-31 07:00:00 163,328 ----a-w C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE + 2008-01-21 15:33:55 233,472 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-01-21 15:33:55 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000002\UsrClass.dat + 2008-01-21 15:33:55 233,472 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000003\NTUSER.DAT + 2008-01-21 15:33:55 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000004\UsrClass.dat + 2008-01-21 15:33:55 4,956,160 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000005\NTUSER.DAT + 2008-01-21 15:33:56 274,432 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000006\UsrClass.dat + 2002-10-15 13:29:40 77,824 ----a-w C:\WINDOWS\loadhttp.dll - 2007-06-16 23:11:58 51,200 ----a-w C:\WINDOWS\nircmd.exe + 2000-08-31 07:00:00 51,200 ----a-w C:\WINDOWS\nircmd.exe + 2001-12-14 12:34:46 164,864 ----a-w C:\WINDOWS\patchw32.dll + 1998-12-08 19:53:58 212,480 ------w C:\WINDOWS\pcdlib32.dll + 2005-11-02 17:07:12 99,328 ----a-w C:\WINDOWS\runtsckl.exe - 2007-08-22 13:13:05 1,023,488 ----a-w C:\WINDOWS\system32\browseui.dll + 2007-10-11 06:13:38 1,024,000 ----a-w C:\WINDOWS\system32\browseui.dll - 2007-08-22 13:13:05 152,064 ----a-w C:\WINDOWS\system32\cdfview.dll + 2007-10-11 06:13:38 152,064 ----a-w C:\WINDOWS\system32\cdfview.dll - 2007-12-11 01:50:41 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2008-01-17 19:55:36 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2007-12-11 01:50:41 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat + 2008-01-17 19:55:36 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat - 2007-12-11 01:50:41 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2008-01-17 19:55:36 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat - 2007-08-22 13:13:05 1,056,768 ----a-w C:\WINDOWS\system32\danim.dll + 2007-10-11 06:13:38 1,056,768 ----a-w C:\WINDOWS\system32\danim.dll - 2007-08-22 13:13:05 1,023,488 ------w C:\WINDOWS\system32\dllcache\browseui.dll + 2007-10-11 06:13:38 1,024,000 ------w C:\WINDOWS\system32\dllcache\browseui.dll - 2007-08-22 13:13:05 152,064 ------w C:\WINDOWS\system32\dllcache\cdfview.dll + 2007-10-11 06:13:38 152,064 ------w C:\WINDOWS\system32\dllcache\cdfview.dll - 2007-08-22 13:13:05 1,056,768 ------w C:\WINDOWS\system32\dllcache\danim.dll + 2007-10-11 06:13:38 1,056,768 ------w C:\WINDOWS\system32\dllcache\danim.dll - 2007-08-22 13:13:05 357,888 ------w C:\WINDOWS\system32\dllcache\dxtmsft.dll + 2007-10-11 06:13:39 357,888 ------w C:\WINDOWS\system32\dllcache\dxtmsft.dll - 2007-08-22 13:13:05 205,312 ------w C:\WINDOWS\system32\dllcache\dxtrans.dll + 2007-10-11 06:13:39 205,312 ------w C:\WINDOWS\system32\dllcache\dxtrans.dll - 2007-08-22 13:13:05 55,808 ------w C:\WINDOWS\system32\dllcache\extmgr.dll + 2007-10-11 06:13:39 55,808 ------w C:\WINDOWS\system32\dllcache\extmgr.dll - 2007-08-21 10:30:45 18,432 ------w C:\WINDOWS\system32\dllcache\iedw.exe + 2007-10-10 11:16:27 18,432 ------w C:\WINDOWS\system32\dllcache\iedw.exe - 2007-08-22 13:13:05 251,392 ------w C:\WINDOWS\system32\dllcache\iepeers.dll + 2007-10-11 06:13:39 251,392 ------w C:\WINDOWS\system32\dllcache\iepeers.dll - 2007-08-22 13:13:06 96,768 ------w C:\WINDOWS\system32\dllcache\inseng.dll + 2007-10-11 06:13:39 96,768 ------w C:\WINDOWS\system32\dllcache\inseng.dll - 2007-08-22 13:13:06 16,384 ------w C:\WINDOWS\system32\dllcache\jsproxy.dll + 2007-10-11 06:13:39 16,384 ------w C:\WINDOWS\system32\dllcache\jsproxy.dll - 2007-08-22 13:13:07 449,024 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll + 2007-10-11 06:13:40 449,024 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll - 2007-08-22 13:13:07 146,432 ------w C:\WINDOWS\system32\dllcache\msrating.dll + 2007-10-11 06:13:40 146,432 ------w C:\WINDOWS\system32\dllcache\msrating.dll - 2007-08-22 13:13:07 532,480 ------w C:\WINDOWS\system32\dllcache\mstime.dll + 2007-10-11 06:13:40 532,480 ------w C:\WINDOWS\system32\dllcache\mstime.dll - 2007-08-22 13:13:07 39,424 ------w C:\WINDOWS\system32\dllcache\pngfilt.dll + 2007-10-11 06:13:40 39,424 ------w C:\WINDOWS\system32\dllcache\pngfilt.dll - 2007-08-22 13:13:08 1,495,040 ------w C:\WINDOWS\system32\dllcache\shdocvw.dll + 2007-10-11 06:13:40 1,495,040 ------w C:\WINDOWS\system32\dllcache\shdocvw.dll - 2007-08-22 13:13:08 474,624 ------w C:\WINDOWS\system32\dllcache\shlwapi.dll + 2007-10-11 06:13:41 474,624 ------w C:\WINDOWS\system32\dllcache\shlwapi.dll - 2007-08-22 13:13:08 617,472 ------w C:\WINDOWS\system32\dllcache\urlmon.dll + 2007-10-11 06:13:41 617,472 ------w C:\WINDOWS\system32\dllcache\urlmon.dll - 2007-08-22 13:13:08 663,040 ------w C:\WINDOWS\system32\dllcache\wininet.dll + 2007-10-11 06:13:41 663,552 ------w C:\WINDOWS\system32\dllcache\wininet.dll - 2004-08-05 12:00:00 27,440 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys + 2007-11-13 10:25:54 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys - 2006-04-20 11:51:50 359,808 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys + 2007-10-30 17:20:55 360,064 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys - 2007-08-22 13:13:05 357,888 ----a-w C:\WINDOWS\system32\dxtmsft.dll + 2007-10-11 06:13:39 357,888 ----a-w C:\WINDOWS\system32\dxtmsft.dll - 2007-08-22 13:13:05 205,312 ----a-w C:\WINDOWS\system32\dxtrans.dll + 2007-10-11 06:13:39 205,312 ----a-w C:\WINDOWS\system32\dxtrans.dll - 2007-08-22 13:13:05 55,808 ----a-w C:\WINDOWS\system32\extmgr.dll + 2007-10-11 06:13:39 55,808 ----a-w C:\WINDOWS\system32\extmgr.dll - 2007-08-22 13:13:05 251,392 ----a-w C:\WINDOWS\system32\iepeers.dll + 2007-10-11 06:13:39 251,392 ----a-w C:\WINDOWS\system32\iepeers.dll - 2007-08-22 13:13:06 96,768 ----a-w C:\WINDOWS\system32\inseng.dll + 2007-10-11 06:13:39 96,768 ----a-w C:\WINDOWS\system32\inseng.dll - 2006-05-18 05:31:21 450,560 ----a-w C:\WINDOWS\system32\jscript.dll + 2007-11-14 07:28:02 450,560 ----a-w C:\WINDOWS\system32\jscript.dll - 2007-08-22 13:13:06 16,384 ----a-w C:\WINDOWS\system32\jsproxy.dll + 2007-10-11 06:13:39 16,384 ----a-w C:\WINDOWS\system32\jsproxy.dll - 2007-11-02 07:12:57 18,238,072 ----a-w C:\WINDOWS\system32\MRT.exe + 2008-01-02 18:21:36 17,642,616 ----a-w C:\WINDOWS\system32\MRT.exe - 2007-08-22 13:13:07 3,079,168 ----a-w C:\WINDOWS\system32\mshtml.dll + 2007-10-30 10:18:16 3,079,680 ----a-w C:\WINDOWS\system32\mshtml.dll - 2007-08-22 13:13:07 449,024 ----a-w C:\WINDOWS\system32\mshtmled.dll + 2007-10-11 06:13:40 449,024 ----a-w C:\WINDOWS\system32\mshtmled.dll - 2007-08-22 13:13:07 146,432 ----a-w C:\WINDOWS\system32\msrating.dll + 2007-10-11 06:13:40 146,432 ----a-w C:\WINDOWS\system32\msrating.dll - 2007-08-22 13:13:07 532,480 ----a-w C:\WINDOWS\system32\mstime.dll + 2007-10-11 06:13:40 532,480 ----a-w C:\WINDOWS\system32\mstime.dll - 2007-11-28 21:13:03 53,098 ----a-w C:\WINDOWS\system32\perfc009.dat + 2008-01-20 19:49:54 53,098 ----a-w C:\WINDOWS\system32\perfc009.dat - 2007-11-28 21:13:03 64,052 ----a-w C:\WINDOWS\system32\perfc00C.dat + 2008-01-20 19:49:54 64,052 ----a-w C:\WINDOWS\system32\perfc00C.dat - 2007-11-28 21:13:03 380,684 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-01-20 19:49:54 380,684 ----a-w C:\WINDOWS\system32\perfh009.dat - 2007-11-28 21:13:03 445,672 ----a-w C:\WINDOWS\system32\perfh00C.dat + 2008-01-20 19:49:54 445,672 ----a-w C:\WINDOWS\system32\perfh00C.dat - 2007-08-22 13:13:07 39,424 ----a-w C:\WINDOWS\system32\pngfilt.dll + 2007-10-11 06:13:40 39,424 ----a-w C:\WINDOWS\system32\pngfilt.dll - 2007-08-22 13:13:08 1,495,040 ----a-w C:\WINDOWS\system32\shdocvw.dll + 2007-10-11 06:13:40 1,495,040 ----a-w C:\WINDOWS\system32\shdocvw.dll - 2007-08-22 13:13:08 474,624 ----a-w C:\WINDOWS\system32\shlwapi.dll + 2007-10-11 06:13:41 474,624 ----a-w C:\WINDOWS\system32\shlwapi.dll - 2007-07-22 17:39:27 279,552 ----a-w C:\WINDOWS\system32\swreg.exe + 2000-08-31 07:00:00 156,160 ----a-w C:\WINDOWS\system32\swreg.exe - 2007-07-18 12:42:22 60,416 ------w C:\WINDOWS\system32\tzchange.exe + 2007-11-13 11:31:11 60,416 ------w C:\WINDOWS\system32\tzchange.exe - 2007-08-22 13:13:08 617,472 ----a-w C:\WINDOWS\system32\urlmon.dll + 2007-10-11 06:13:41 617,472 ----a-w C:\WINDOWS\system32\urlmon.dll - 2007-08-22 13:13:08 663,040 ----a-w C:\WINDOWS\system32\wininet.dll + 2007-10-11 06:13:41 663,552 ----a-w C:\WINDOWS\system32\wininet.dll . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-03-04 10:13 102490] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-03-04 10:12 708698] "Raccourci vers la page des propriétés de High Definition Audio"="HDAShCut.exe" [2005-01-07 16:07 61952 C:\WINDOWS\system32\HdAShCut.exe] "RTHDCPL"="RTHDCPL.EXE" [2005-04-12 22:21 14156800 C:\WINDOWS\RTHDCPL.EXE] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-22 20:05 339968] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "PCMService"="c:\Apps\Powercinema\PCMService.exe" [2005-05-11 12:48 127118] "WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 13:49 20480] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-05 13:00 110592 C:\WINDOWS\system32\bthprops.cpl] "F-Secure Manager"="C:\Program Files\AntivirusFirewall\Common\FSM32.exe" [2005-10-26 02:51 122929] "F-Secure TNB"="C:\Program Files\AntivirusFirewall\TNB\TNBUtil.exe" [2005-07-18 15:51 700416] "F-Secure Startup Wizard"="C:\Program Files\AntivirusFirewall\FSGUI\FSSW.exe" [2005-10-18 09:29 372736] "News Service"="C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe" [2005-05-31 13:45 356352] "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-07-02 22:36 185896] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-03-28 08:52 98304] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "HDReg"="c:\Apps\HDReg\HDRegApp.exe" [2004-10-15 17:25 16384] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00 15360] "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184] R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2005-11-18 16:04] R2 BackWeb Plug-in - 6588780;Antivirus Firewall;C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE [2007-10-10 11:30] R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\AntivirusFirewall\Anti-Virus\Win2K\FSfilter.sys [2004-09-10 16:14] R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\AntivirusFirewall\Anti-Virus\Win2K\FSgk.sys [2007-10-10 11:55] R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\AntivirusFirewall\Anti-Virus\Win2K\FSrec.sys [2004-06-01 10:03] R2 MTC0001_RMC;Remove Control Device;C:\WINDOWS\system32\drivers\RMC.sys [2005-04-22 14:24] R3 Slazldrv;SmartLink AMR_PCI Driver;C:\WINDOWS\system32\DRIVERS\SLDRV\slazldrv.sys [2005-01-05 01:48] R3 ULI5261;ULi Based Ethernet NT Driver;C:\WINDOWS\system32\DRIVERS\ULILAN.SYS [2004-12-31 14:24] S2 Planificateur LiveUpdate automatique;Planificateur LiveUpdate automatique;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" [] *Newly Created Service* - AVG_ANTI-SPYWARE_GUARD . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2008-01-21 15:30:00 C:\WINDOWS\Tasks\HDReg.job" - c:\Apps\HDReg\HDRegRem.exe "2008-01-21 11:38:30 C:\WINDOWS\Tasks\Scheduled scanning task.job" - C:\PROGRA~1\ANTIVI~1\ANTI-V~1\fsav.exeZ /HARD /ARCHIVE /DISINF /SCHED /NOBREAK /REPORT=C:\PROGRA~1\ANTIVI~1\ANTI-V~1\report.txt . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-21 16:38:57 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-21 16:40:00 ComboFix-quarantined-files.txt 2008-01-21 15:39:54 . 2008-01-10 02:04:17 --- E O F ---

jlpjlp · Answer

désactive la restauration système pour purger les virus qui seraient dedans (dans DEMARRER puis TOUS LES PROGRAMMES puis ACCESSOIRE puis OUTILS SYSTEME puis RESTAURATION SYSTEME puis paramètre) puis réactive la

__________________

nettoie ton registre avec regcleaner

http://manuelsdaide.com/RegCleaner/RegCleaner.htm

_______________

colle le rapport d'un scan en ligne
avec un des suivants:


bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html

Panda en ligne :
http://pandasoftware.fr

secuser en ligne :
http://www.secuser.com/outils/antivirus.htm

KADIE · Answer

Slt,

;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-01-21 21:38:34
PROTECTIONS: 2
MALWARE: 3
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;===================================================================================================================================================================================
Norton Internet Security                     2005                          Yes       Yes
AntiVirus Firewall 6.15                      6.15                          Yes       Yes
;===================================================================================================================================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;===================================================================================================================================================================================
00096188  spyware/searchcentrix              Spyware             No        1         Yes            No           hkey_current_user\software\dynamic toolbar
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\Documents and Settings\HÃ©lÃ¨ne\Cookies\hÃ©lÃ¨ne@xiti[1].txt
01262593  Application/NirCmd.A               HackTools           No        0         Yes            No           C:\WINDOWS
ircmd.exe
;===================================================================================================================================================================================
SUSPECTS
Location
;===================================================================================================================================================================================
;===================================================================================================================================================================================

KADIE · Answer

slt,

desolé je me suis tromper de rapport

voici le bon rapport fait avec panda:

;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-01-21 23:27:26
PROTECTIONS: 2
MALWARE: 4
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;===================================================================================================================================================================================
Norton Internet Security                     2005                          Yes       Yes
AntiVirus Firewall 6.15                      6.15                          Yes       Yes
;===================================================================================================================================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;===================================================================================================================================================================================
00096188  spyware/searchcentrix              Spyware             No        1         Yes            No           hkey_current_user\software\dynamic toolbar
00238695  Application/Pskill.K               HackTools           No        0         Yes            No           C:\Documents and Settings\HÃ©lÃ¨ne\Bureau\Nouveau dossier\clean\pskill.exe
00238695  Application/Pskill.K               HackTools           No        0         Yes            No           C:\Documents and Settings\HÃ©lÃ¨ne\Bureau\Nouveau dossier\clean.zip[clean/pskill.exe]
00366244  Application/NirCmd.A               HackTools           No        0         Yes            No           C:\fixwareout\FindT
ircmd.exe
01262593  Application/NirCmd.A               HackTools           No        0         No             No           C:\Documents and Settings\HÃ©lÃ¨ne\Mes documents\Alain SIMONNET\combofix.exe[nircmd.cfexe]
01262593  Application/NirCmd.A               HackTools           No        0         Yes            No           C:\WINDOWS
ircmd.exe
01262593  Application/NirCmd.A               HackTools           No        0         No             No           C:\Documents and Settings\HÃ©lÃ¨ne\Mes documents\Alain SIMONNET\combofix.exe[nircmd.com]
;===================================================================================================================================================================================
SUSPECTS
Location
;===================================================================================================================================================================================
;===================================================================================================================================================================================

jlpjlp · Answer

recolle un rapport hijackthis

KADIE · Answer

ok le voici,

Logfile of HijackThis v1.99.1
Scan saved at 14:36:47, on 22/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\FSGK32.EXE
C:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
C:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
C:\Program Files\AntivirusFirewall\Common\FSMB32.EXE
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fssm32.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\AntivirusFirewall\Common\FCH32.EXE
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\AntivirusFirewall\Common\FAMEH32.EXE
C:\Program Files\AntivirusFirewall\Anti-Virus\fsqh.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsrw.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Apps\Powercinema\PCMService.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\AntivirusFirewall\Anti-Virus\fsav32.exe
C:\Program Files\AntivirusFirewall\Common\FSM32.EXE
C:\PROGRA~1\ANTIVI~1\ANTI-S~1\fsaw.exe
C:\Program Files\AntivirusFirewall\FSGUI\fsguidll.exe
C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Wanadoo\GestionnaireInternet.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Wanadoo\Watch.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\Documents and Settings\Hélène\Mes documents\Alain SIMONNET\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\AntivirusFirewall\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\AntivirusFirewall\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunOnce: [HDReg] c:\Apps\HDReg\HDRegApp.exe -r
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Antivirus Firewall.lnk = C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
O8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\AntivirusFirewall\Anti-Spyware\blockpopups.htm
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Antivirus Firewall (BackWeb Plug-in - 6588780) - Securitoo Portal - C:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: MySqlInventime - Unknown owner - c:\mysql\bin\mysqld-max-nt.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe

jlpjlp · Answer

une derniere verif:

Télécharge RavAntivirus d'Evosla :
http://ww25.evosla.com/compteur.php?soft=rav_antivirus

# Si tu as une clé USB, disque dur externe, etc, branche-les sans les ouvrir avant de lancer ce FIX
# Fais un clic droit sur le fichier .ZIP > Extraire sur > le Bureau
# Doucle-clique sur >> RAV.exe << afin de lancer l'outil.
# Une fois RAV ANTIVIRUS lancé, laisse-le réagir , il scanne automatiquement tout les lecteurs (disques fixes et amovibles)
# Si infection > un log s'établira, sinon le soft affichera (très rapide) ==>Votre Ordinateur est sain .
# Retire tes disques amovibles et redémarrez votre ordinateur.
# Poste le rapport, si infection!

_________________

Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked".

R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

KADIE · Answer

OK  c'est  fait

jlpjlp · Answer

ok c'est bon

KADIE · Answer

c vrai de vrai ?

Merci bocou pour ton aide!!!!!!! 
C est tres simpas!!!

Reste problème???

13 réponses

Discussions similaires

Newsletters