Rapport hijackthis fenetres pub imtempestives

Résolu

goldarus -

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:07:04, on 26/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\SYSINFO\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\PowerKey.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\CtrlVol.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\documents and settings\stéphane\local settings\application data\vdlaa.exe
C:\Program Files\MessengerSkinner\MessengerSkinner.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [RemoteControl] C:\SYSINFO\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [LaunchApp] LaunApp
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\HotkeyApp.exe
O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSDCtrl.exe
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [vdlaa] c:\documents and settings\stéphane\local settings\application data\vdlaa.exe vdlaa
O4 - HKCU\..\Run: [messengerskinner] C:\Program Files\MessengerSkinner\MessengerSkinner.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

--
End of file - 7822 bytes

Configuration: Windows XP
Internet Explorer 7.0

Afficher la suite

A voir également

Rapport hijackthis fenetres pub imtempestives
Hijackthis - Télécharger - Antivirus & Antimalwares
Plan rapport de stage - Guide
Pub par sms - Guide
Youtube sans pub - Guide
Musique tu tu tu lu tu tu tu pub - Forum Musique / Radio / Clip

37 réponses

Résumé de la discussion

Le fil évoque l’analyse d’un journal Trend Micro HijackThis v2.0.2 sur Windows XP, mettant en lumière des éléments d’exécution et des modules potentiellement indésirables détectés dans le profil utilisateur. Plusieurs éléments à nettoyer apparaissent, notamment des modules de navigation (BHO), des programmes lancés au démarrage et des outils tiers comme Google et Java. La solution préconisée consiste à utiliser HijackThis pour fixer les lignes clés (O2, O4, O9 notamment), afin de neutraliser les éléments indésirables et de gérer les programmes qui se lancent en arrière-plan. En complément, des recommandations évoquent le soin des composants comme Acrobat, QuickTime ou iTunes, la vérification des outils de sécurité et l’usage d’antivirus et pare-feu actualisés pour prévenir d’éventuelles infections.

Réponse 1 / 37
g!rly Contributeur
cool gaeloutia ;-)

bon week end`

@+
0
Réponse 2 / 37
g!rly Contributeur
Ok gaeloutia,

Oui tu peux garder mon pseudo en memoire; je viendrais hanter tes nuits en secret lol

Dernier truc :

Pour supprimer les outils utiliser :

Télécharge ToolsCleaner sur ton bureau.
--> http://www.commentcamarche.net/telecharger/telechargement 34055291 toolsclean(...)
# Clique sur Recherche et laisse le scan agir ...
# Clique sur Suppression pour finaliser.
# Tu peux, si tu le souhaites, te servir des Options facultatives.
# Clique sur Quitter pour obtenir le rapport.
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

Ps : pas la peine de me poster le rapport si tu voies que tout a ete supprimé...

Bonne continuation`

Bye`

g!rly`
0
1. gaeloutia
  
  C'est déja fait!! lol
  
  J'ai regardé tes anciens messages sur ce forum.
  
  A bientot
  
  0
Réponse 3 / 37
g!rly Contributeur
De rien gaeloutia ;-)

on considere le probleme resolu ?

@+
0
1. gaeloutia
  
  Pour moi c'est résolu. Enfin j'espère!!!!!!!
  Si ça ne te dérange pas je garde ton pseudo en mémoire si jamais j'ai encore besoin d'une aide précieuse.
  
  Bonne route
  salut
  
  0
Réponse 4 / 37
g!rly Contributeur
ok

A l´aide de hijack this coche et fix la ligne suivante :

O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - https://www.eset.com/

bon en faite on avait deja du fixer les lignes superflues

instale un par feu :

Comodo 3 pro :

http://www.commentcamarche.net/telecharger/telecharger 34055041 comodo firewall pro

tuto : https://www.malekal.com/tutorial-comodo-firewall/

Online armor :

http://www.commentcamarche.net/telecharger/telecharger 34055356 online armor personal firewall

tuto : https://www.malekal.com/tutorial-online-armor-free/

ou

zone alarm plus facil a configurer mais moins performant

https://www.malekal.com/tutoriel-zonealarm-firewall/

puis

spywareblaster :

http://www.brightfort.com/spywareblaster.html

c´est un resident, il suffit de le mettre a jour de temps en temps car la version gratuite ne le fait pas toute seul , une fois installé et mis a jour tu mets toutes les protections sur "enable"

tuto : https://www.malekal.com/tutorial-spywareblaster/

pourquoi ne pas surfer avec firefox? = plus sur, tout en gardant ie 7.0 pour les mises a jour windows car impossible a effectuer sous firefox

http://www.mozilla-europe.org/fr/

plugins : ad block plus, no script ect...

https://www.hugedomains.com/domain_profile.cfm?d=geckozone&e=org

voila

si tu as des questions n´hesites pas

@+
0
1. gaeloutia
  
  Encore merci !!!!!
  
  A+
  
  0
Vous n’avez pas trouvé la réponse que vous recherchez ?

La communauté CCM répond en moyenne en moins de 2h.

Posez votre question
Réponse 5 / 37
g!rly Contributeur
oui ca m´a l´air ok

post un dernier hijack this pour optimiser un peu tout ca et pour me permettre de te donner les derniers conseils pour que tu soies plus en securité...

@+
0
1. gaeloutia
  
  et voila
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 21:56:00, on 22/05/2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16640)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Windows Sidebar\sidebar.exe
  C:\Program Files\UberIcon\UberIcon Manager.exe
  C:\Windows\System32\VisualTaskTips.exe
  C:\Program Files\styler\Styler.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\WINDOWS\system32\RUNDLL32.EXE
  C:\WINDOWS\system32\LVCOMSX.EXE
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Messenger\MSMSGS.EXE
  C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
  C:\Program Files\Windows Sidebar\sidebar.exe
  C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
  C:\WINDOWS\system32\nvsvc32.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\devldr32.exe
  C:\Program Files\Logitech\Video\CameraAssistant.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
  C:\PROGRA~1\MSNMES~1\msnmsgr.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
  C:\Program Files\internet explorer\iexplore.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.fr/keyword/%s
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
  O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\styler\TB\StylerTB.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
  O4 - HKLM\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
  O4 - HKLM\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe"
  O4 - HKLM\..\Run: [VisualTaskTips] C:\Windows\System32\VisualTaskTips.exe
  O4 - HKLM\..\Run: [Vistadrv] C:\WINDOWS\system32\Vistadrive\vsdrv.exe
  O4 - HKLM\..\Run: [TransBar] C:\WINDOWS\system32\transbar.exe /s
  O4 - HKLM\..\Run: [Styler] C:\Program Files\styler\Styler.exe
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
  O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Logitech\Video\CameraAssistant.exe
  O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Logitech\Video\InstallHelper.exe /inspect
  O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
  O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
  O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
  O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
  O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
  O4 - HKUS\S-1-5-19\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [nltide2] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-20\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SERVICE RÉSEAU')
  O4 - HKUS\S-1-5-18\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'Default user')
  O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
  O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - https://www.eset.com/
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
  O17 - HKLM\System\CCS\Services\Tcpip\..\{FA461808-97E5-4AC2-A684-A907C46229C7}: NameServer = 192.168.1.1
  O18 - Protocol: bw+0 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw+0s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw-0 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw-0s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw00 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw00s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw10 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw10s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw20 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw20s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw30 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw30s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw40 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw40s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw50 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw50s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw60 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw60s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw70 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw70s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw80 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw80s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw90 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw90s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwa0 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwa0s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwb0 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwb0s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwc0 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwc0s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwd0 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwd0s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwe0 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwe0s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwf0 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwf0s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
  O18 - Protocol: bwg0 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwg0s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwh0 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwh0s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwi0 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwi0s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwj0 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwj0s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwk0 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwk0s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwl0 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwl0s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwm0 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwm0s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwn0 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwn0s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwo0 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwo0s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwp0 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwp0s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwq0 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwq0s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwr0 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwr0s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bws0 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bws0s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwt0 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwt0s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwu0 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwu0s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwv0 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwv0s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bww0 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bww0s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwx0 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwx0s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwy0 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwy0s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwz0 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwz0s - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: offline-8876480 - {A4B28840-4B1F-46EB-87AD-9C079EDC54C3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
  O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
  
  0
Réponse 6 / 37
g!rly Contributeur
Bonsoir,

bon il n´y a rien d´infectieux...

@+
0
1. gaeloutia
  
  ca veut dire que tout est rentré dans l'ordre?
  
  Je te remercie trés sincèrement de ton aide si précieuse.
  
  a+
  
  0
Réponse 7 / 37
gaeloutia
bonsoir,

Avira AntiVir Personal
Report file date: jeudi 22 mai 2008 19:00

Scanning for 1165085 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: AA4698449DD84CE

Version information:
BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00
AVSCAN.EXE : 8.1.2.12 311553 Bytes 18/03/2008 09:02:56
AVSCAN.DLL : 8.1.1.0 53505 Bytes 07/02/2008 08:43:37
LUKE.DLL : 8.1.2.9 151809 Bytes 28/02/2008 08:41:23
LUKERES.DLL : 8.1.2.1 12033 Bytes 21/02/2008 08:28:40
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34
ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 13:08:58
ANTIVIR2.VDF : 7.0.3.62 337408 Bytes 21/03/2008 19:12:34
ANTIVIR3.VDF : 7.0.3.68 57856 Bytes 25/03/2008 08:27:50
Engineversion : 8.1.0.28
AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21
AESCRIPT.DLL : 8.1.0.19 229754 Bytes 07/04/2008 15:34:44
AESCN.DLL : 8.1.0.12 115060 Bytes 07/04/2008 15:34:44
AERDL.DLL : 8.1.0.19 418164 Bytes 07/04/2008 15:34:44
AEPACK.DLL : 8.1.1.0 364918 Bytes 18/03/2008 11:20:42
AEOFFICE.DLL : 8.1.0.15 192889 Bytes 07/04/2008 15:34:44
AEHEUR.DLL : 8.1.0.15 1147253 Bytes 07/04/2008 15:34:44
AEHELP.DLL : 8.1.0.11 115061 Bytes 07/04/2008 15:34:43
AEGEN.DLL : 8.1.0.15 299379 Bytes 07/04/2008 15:34:43
AEEMU.DLL : 8.1.0.5 430450 Bytes 07/04/2008 15:34:43
AECORE.DLL : 8.1.0.25 168309 Bytes 08/04/2008 09:58:32
AVWINLL.DLL : 1.0.0.7 14593 Bytes 23/01/2008 17:07:53
AVPREF.DLL : 8.0.0.1 25857 Bytes 18/02/2008 10:37:50
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:26:47
AVREG.DLL : 8.0.0.0 30977 Bytes 23/01/2008 17:07:49
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28/02/2008 08:31:31
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23/01/2008 17:08:39
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 10/03/2008 14:37:25
RCTEXT.DLL : 8.0.32.0 86273 Bytes 06/03/2008 12:02:11

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: jeudi 22 mai 2008 19:00

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'CameraAssistant.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'devldr32.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'mdm.exe' - '1' Module(s) have been scanned
Scan process 'ijplmsvc.exe' - '1' Module(s) have been scanned
Scan process 'sidebar.exe' - '1' Module(s) have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
Scan process 'msmsgs.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'LVCOMSX.EXE' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'MSASCui.exe' - '1' Module(s) have been scanned
Scan process 'Styler.exe' - '1' Module(s) have been scanned
Scan process 'VisualTaskTips.exe' - '1' Module(s) have been scanned
Scan process 'UberIcon Manager.exe' - '1' Module(s) have been scanned
Scan process 'sidebar.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'LVPrcSrv.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'MsMpEng.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
39 processes with 39 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
[WARNING] Le périphérique n'est pas prêt.
Master boot sector HD2
[INFO] No virus was found!
[WARNING] Le périphérique n'est pas prêt.
Master boot sector HD3
[INFO] No virus was found!
[WARNING] Le périphérique n'est pas prêt.
Master boot sector HD4
[INFO] No virus was found!
[WARNING] Le périphérique n'est pas prêt.

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '44' files ).

Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!

End of the scan: jeudi 22 mai 2008 19:28
Used time: 28:01 min

The scan has been canceled!

2161 Scanning directories
89940 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
89940 Files not concerned
954 Archives were scanned
5 Warnings
0 Notes

Merci encore
0
Réponse 8 / 37
g!rly Contributeur
Salut gaeloutia,
peux tu me poster le rapport d´antivir stp
tu click sur l´onglet rapport et recherche scan puis enrregistre le rappport et le post ici.
@+
0
Réponse 9 / 37
g!rly Contributeur
La desinfection ca ne s´improvise pas... tu n´as aucune raison de te sentir "nul" comme tu dis ;)

clean n´ a rien a signaler...plutot bon signe...

comment ca va de ton coté ?
0
1. gaeloutia
  
  Bonjour,
  
  Hier soir aprés mon dernier message j'ai refait un scan avec antivir, j'ai 5 warnings et il m'a encore detécté un virus. Ca a l'air plutot bon signe car avant j'en trouvais au moins 4 ou 5. Y a t'il encore des étapes à effectuées?
  
  Bonne journée
  
  0
Réponse 10 / 37
g!rly Contributeur
et bien c est du rapide !

il a bien scanné 130463 Files...

peux tu encore passer ceci juste pour voir :

Télécharge Clean:

-> http://www.malekal.com/download/clean.zip

-> Dézippe tout le contenu dans un dossier que tu auras cré au préalable (sur ton bureau par exemple). Double clic sur clean ou clean.cmd choisie l'option 1.

Un rapport va s'ouvrir, copie et colle le contenu sur le forum.

-> pour ceux ou celles qui auraient un doute sur comment deziper un fichier :

http://www.tutopat.com/viewtopic.php?t=933&sid=34215b238376bfb22ef9e8eca9995914

@+
0
1. gaeloutia
  
  je dois prendre des cours d'informatique je suis vraiment nul
  
  j'ai eu un petit rapport, j'attends tes critiques lol
  
  21/05/2008 a 23:11:10,85
  
  *** Recherche des fichiers dans C:
  
  *** Recherche des fichiers dans C:\WINDOWS\
  
  *** Recherche des fichiers dans C:\WINDOWS\system32
  
  *** Recherche des fichiers dans C:\Program Files
  *** Fin du rapport !
  
  0
Réponse 11 / 37
g!rly Contributeur
c´est bien ce que je me disais, il a scanné 2 fichiers...
sur la fenetre principal du programme click sur scan system now; ca doit durer plus de 5 minutes...
bonne soirée
@+
0
1. gaeloutia
  
  Voila ce que ça me donne:
  
  Avira AntiVir Personal
  Report file date: mercredi 21 mai 2008 22:20
  
  Scanning for 1165085 virus strains and unwanted programs.
  
  Licensed to: Avira AntiVir PersonalEdition Classic
  Serial number: 0000149996-ADJIE-0001
  Platform: Windows XP
  Windows version: (Service Pack 2) [5.1.2600]
  Boot mode: Save mode
  Username: Gaelle
  Computer name: AA4698449DD84CE
  
  Version information:
  BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00
  AVSCAN.EXE : 8.1.2.12 311553 Bytes 18/03/2008 09:02:56
  AVSCAN.DLL : 8.1.1.0 53505 Bytes 07/02/2008 08:43:37
  LUKE.DLL : 8.1.2.9 151809 Bytes 28/02/2008 08:41:23
  LUKERES.DLL : 8.1.2.1 12033 Bytes 21/02/2008 08:28:40
  ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34
  ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 13:08:58
  ANTIVIR2.VDF : 7.0.3.62 337408 Bytes 21/03/2008 19:12:34
  ANTIVIR3.VDF : 7.0.3.68 57856 Bytes 25/03/2008 08:27:50
  Engineversion : 8.1.0.28
  AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21
  AESCRIPT.DLL : 8.1.0.19 229754 Bytes 07/04/2008 15:34:44
  AESCN.DLL : 8.1.0.12 115060 Bytes 07/04/2008 15:34:44
  AERDL.DLL : 8.1.0.19 418164 Bytes 07/04/2008 15:34:44
  AEPACK.DLL : 8.1.1.0 364918 Bytes 18/03/2008 11:20:42
  AEOFFICE.DLL : 8.1.0.15 192889 Bytes 07/04/2008 15:34:44
  AEHEUR.DLL : 8.1.0.15 1147253 Bytes 07/04/2008 15:34:44
  AEHELP.DLL : 8.1.0.11 115061 Bytes 07/04/2008 15:34:43
  AEGEN.DLL : 8.1.0.15 299379 Bytes 07/04/2008 15:34:43
  AEEMU.DLL : 8.1.0.5 430450 Bytes 07/04/2008 15:34:43
  AECORE.DLL : 8.1.0.25 168309 Bytes 08/04/2008 09:58:32
  AVWINLL.DLL : 1.0.0.7 14593 Bytes 23/01/2008 17:07:53
  AVPREF.DLL : 8.0.0.1 25857 Bytes 18/02/2008 10:37:50
  AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:26:47
  AVREG.DLL : 8.0.0.0 30977 Bytes 23/01/2008 17:07:49
  AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
  AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28/02/2008 08:31:31
  SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
  SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23/01/2008 17:08:39
  NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
  RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 10/03/2008 14:37:25
  RCTEXT.DLL : 8.0.32.0 86273 Bytes 06/03/2008 12:02:11
  
  Configuration settings for the scan:
  Jobname..........................: Complete system scan
  Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
  Logging..........................: low
  Primary action...................: interactive
  Secondary action.................: ignore
  Scan master boot sector..........: on
  Scan boot sector.................: on
  Boot sectors.....................: C:,
  Scan memory......................: on
  Process scan.....................: on
  Scan registry....................: on
  Search for rootkits..............: off
  Scan all files...................: Intelligent file selection
  Scan archives....................: on
  Recursion depth..................: 20
  Smart extensions.................: on
  Macro heuristic..................: on
  File heuristic...................: medium
  
  Start of the scan: mercredi 21 mai 2008 22:20
  
  The scan of running processes will be started
  Scan process 'avscan.exe' - '1' Module(s) have been scanned
  Scan process 'avconfig.exe' - '1' Module(s) have been scanned
  Scan process 'avcenter.exe' - '1' Module(s) have been scanned
  Scan process 'explorer.exe' - '1' Module(s) have been scanned
  Scan process 'svchost.exe' - '1' Module(s) have been scanned
  Scan process 'MsMpEng.exe' - '1' Module(s) have been scanned
  Scan process 'svchost.exe' - '1' Module(s) have been scanned
  Scan process 'svchost.exe' - '1' Module(s) have been scanned
  Scan process 'lsass.exe' - '1' Module(s) have been scanned
  Scan process 'services.exe' - '1' Module(s) have been scanned
  Scan process 'winlogon.exe' - '1' Module(s) have been scanned
  Scan process 'csrss.exe' - '1' Module(s) have been scanned
  Scan process 'smss.exe' - '1' Module(s) have been scanned
  13 processes with 13 modules were scanned
  
  Starting master boot sector scan:
  Master boot sector HD0
  [INFO] No virus was found!
  Master boot sector HD1
  [INFO] No virus was found!
  [WARNING] Le périphérique n'est pas prêt.
  Master boot sector HD2
  [INFO] No virus was found!
  [WARNING] Le périphérique n'est pas prêt.
  Master boot sector HD3
  [INFO] No virus was found!
  [WARNING] Le périphérique n'est pas prêt.
  Master boot sector HD4
  [INFO] No virus was found!
  [WARNING] Le périphérique n'est pas prêt.
  
  Start scanning boot sectors:
  Boot sector 'C:\'
  [INFO] No virus was found!
  
  Starting to scan the registry.
  The registry was scanned ( '28' files ).
  
  Starting the file scan:
  
  Begin scan in 'C:\'
  C:\pagefile.sys
  [WARNING] The file could not be opened!
  
  End of the scan: mercredi 21 mai 2008 22:32
  Used time: 11:48 min
  
  The scan has been done completely.
  
  3600 Scanning directories
  130463 Files were scanned
  0 viruses and/or unwanted programs were found
  0 Files were classified as suspicious:
  0 files were deleted
  0 files were repaired
  0 files were moved to quarantine
  0 files were renamed
  1 Files cannot be scanned
  130463 Files not concerned
  1204 Archives were scanned
  5 Warnings
  0 Notes
  
  Merci et bonne soirée à toi aussi
  
  0
Réponse 12 / 37
g!rly Contributeur
le rapport est dans l´onglet du meme nom : rapport.
tu veux clicker sur la ligne qui dit scan puis dans la nouvelle petite fenetre (mince je me souviens plus) enfin tu verras c´est evident il y a deux choix tu click et le rapport va s´ouvrir
@+
0
1. gaeloutia
  
  Ca donne ça:
  
  Avira AntiVir Personal
  Report file date: mercredi 21 mai 2008 21:48
  
  Scanning for 1165085 virus strains and unwanted programs.
  
  Licensed to: Avira AntiVir PersonalEdition Classic
  Serial number: 0000149996-ADJIE-0001
  Platform: Windows XP
  Windows version: (Service Pack 2) [5.1.2600]
  Boot mode: Normally booted
  Username: SYSTEM
  Computer name: AA4698449DD84CE
  
  Version information:
  BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00
  AVSCAN.EXE : 8.1.2.12 311553 Bytes 18/03/2008 09:02:56
  AVSCAN.DLL : 8.1.1.0 53505 Bytes 07/02/2008 08:43:37
  LUKE.DLL : 8.1.2.9 151809 Bytes 28/02/2008 08:41:23
  LUKERES.DLL : 8.1.2.1 12033 Bytes 21/02/2008 08:28:40
  ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34
  ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 13:08:58
  ANTIVIR2.VDF : 7.0.3.62 337408 Bytes 21/03/2008 19:12:34
  ANTIVIR3.VDF : 7.0.3.68 57856 Bytes 25/03/2008 08:27:50
  Engineversion : 8.1.0.28
  AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21
  AESCRIPT.DLL : 8.1.0.19 229754 Bytes 07/04/2008 15:34:44
  AESCN.DLL : 8.1.0.12 115060 Bytes 07/04/2008 15:34:44
  AERDL.DLL : 8.1.0.19 418164 Bytes 07/04/2008 15:34:44
  AEPACK.DLL : 8.1.1.0 364918 Bytes 18/03/2008 11:20:42
  AEOFFICE.DLL : 8.1.0.15 192889 Bytes 07/04/2008 15:34:44
  AEHEUR.DLL : 8.1.0.15 1147253 Bytes 07/04/2008 15:34:44
  AEHELP.DLL : 8.1.0.11 115061 Bytes 07/04/2008 15:34:43
  AEGEN.DLL : 8.1.0.15 299379 Bytes 07/04/2008 15:34:43
  AEEMU.DLL : 8.1.0.5 430450 Bytes 07/04/2008 15:34:43
  AECORE.DLL : 8.1.0.25 168309 Bytes 08/04/2008 09:58:32
  AVWINLL.DLL : 1.0.0.7 14593 Bytes 23/01/2008 17:07:53
  AVPREF.DLL : 8.0.0.1 25857 Bytes 18/02/2008 10:37:50
  AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:26:47
  AVREG.DLL : 8.0.0.0 30977 Bytes 23/01/2008 17:07:49
  AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
  AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28/02/2008 08:31:31
  SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
  SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23/01/2008 17:08:39
  NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
  RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 10/03/2008 14:37:25
  RCTEXT.DLL : 8.0.32.0 86273 Bytes 06/03/2008 12:02:11
  
  Configuration settings for the scan:
  Jobname..........................: Complete system scan
  Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
  Logging..........................: low
  Primary action...................: interactive
  Secondary action.................: ignore
  Scan master boot sector..........: on
  Scan boot sector.................: on
  Boot sectors.....................: C:,
  Scan memory......................: on
  Process scan.....................: on
  Scan registry....................: on
  Search for rootkits..............: off
  Scan all files...................: Intelligent file selection
  Scan archives....................: on
  Recursion depth..................: 20
  Smart extensions.................: on
  Macro heuristic..................: on
  File heuristic...................: medium
  
  Start of the scan: mercredi 21 mai 2008 21:48
  
  The scan of running processes will be started
  Scan process 'avscan.exe' - '1' Module(s) have been scanned
  Scan process 'infocard.exe' - '1' Module(s) have been scanned
  3 processes with 2 modules were scanned
  
  End of the scan: mercredi 21 mai 2008 21:48
  Used time: 00:05 min
  
  The scan has been canceled!
  
  0 Scanning directories
  2 Files were scanned
  0 viruses and/or unwanted programs were found
  0 Files were classified as suspicious:
  0 files were deleted
  0 files were repaired
  0 files were moved to quarantine
  0 files were renamed
  0 Files cannot be scanned
  2 Files not concerned
  0 Archives were scanned
  0 Warnings
  0 Notes
  
  0
Réponse 13 / 37
g!rly Contributeur
tu as deja fait un scan complet ?
ca m´etonnerais...
tu as le rapport?
0
1. gaeloutia
  
  j'ai suivi tes consignes. Avant de faire n'importe quoi je le trouve où le rapport? Dans overview - reports et je selectionne le rapport?
  
  0
Réponse 14 / 37
g!rly Contributeur
re,

en faite rootkit search est sur la premiere page, pass dans l´expert mode de la configuration

sur la page d´acceuil tu deploie "locale protection" click sur scanner > la tu va voire rrotkit search tu deploie grace au petit + et tu coche les case devant tes disques...

tu as la version 8 ou 7 ?

@+
0
1. gaeloutia
  
  C'est bon j'ai réussi. En mode sans échec aucun virus n'a été detécté. J'espère que c'est bon signe. J'ai fais un nouveau rapport sur hijackthis:
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 21:47:13, on 21/05/2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16640)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Windows Sidebar\sidebar.exe
  C:\Program Files\UberIcon\UberIcon Manager.exe
  C:\Windows\System32\VisualTaskTips.exe
  C:\Program Files\styler\Styler.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\WINDOWS\system32\RUNDLL32.EXE
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Messenger\MSMSGS.EXE
  C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
  C:\WINDOWS\system32\nvsvc32.exe
  C:\Program Files\Windows Sidebar\sidebar.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\devldr32.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.fr/keyword/%s
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
  O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\styler\TB\StylerTB.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
  O4 - HKLM\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
  O4 - HKLM\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe"
  O4 - HKLM\..\Run: [VisualTaskTips] C:\Windows\System32\VisualTaskTips.exe
  O4 - HKLM\..\Run: [Vistadrv] C:\WINDOWS\system32\Vistadrive\vsdrv.exe
  O4 - HKLM\..\Run: [TransBar] C:\WINDOWS\system32\transbar.exe /s
  O4 - HKLM\..\Run: [Styler] C:\Program Files\styler\Styler.exe
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
  O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
  O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
  O4 - HKUS\S-1-5-19\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [nltide2] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-20\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SERVICE RÉSEAU')
  O4 - HKUS\S-1-5-18\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'Default user')
  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
  O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - https://www.eset.com/
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
  O17 - HKLM\System\CCS\Services\Tcpip\..\{FA461808-97E5-4AC2-A684-A907C46229C7}: NameServer = 192.168.1.1
  O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
  
  0
Réponse 15 / 37
g!rly Contributeur
ok tres bien alors si tu as tout supprimé ;)

maintenant tu es bon pour me faire un scan avec antivir

fais le en mode sans echec :

Comment redémarrer en mode sans echec?

Tu redemarre le pc et tapote la touche F8 des le début de l allumage sans t´arrêter.
Une fenêtre sur fond noir va s’ouvrir, tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
Une fois sur le bureau si il n y a pas toutes les couleurs et autres c´est normal!
Ps : si F8 ne marche pas utilise la touche F5.

Voici les réglages que j´utilise :

une fois antivir ouvert click surconfiguration et coche la case "expert mode" puis sur l´onglet scanner dans la fenetre du dessous tu va voir : rootkit search click sur le petit + pour deployer et coche la case a coté de ton disk dur
puis click sur configuration en haut a droite; dans la nouvelle fenetre a gauche >scanner > coche "scan all files" et en dessous >scanner priority = High
coche : allow stopping the scanner, comme cela tu peux faire une pause pendant le scan si tu le desir.
puis sur la droite coche les case suivantes :
scan boot sectors of selected drives
scan master boot sectors
scan memory
search foe rootkit before scan
decoche :
ignore off line files
toujours a gauche > scan > deploie > heuristique > macrovirus heuristic = coché et en dessous > win32 heuristic la case coché et high detection level

Bon courrage, je sais c´est long...

@+
0
1. gaeloutia
  
  désolé je trouve pas rootkit search
  
  En dessous de la case "expert mode" j'ai:
  
  + Scanner
  +Scan
  action for concerning files
  further actions
  archives
  exception
  Heuristic
  +guard
  +scan
  action for concerning files
  exception
  heuristci
  +report
  +general
  
  Que choisir?
  
  0
Réponse 16 / 37
g!rly Contributeur
ok

tu as supprimé tout ce qui a été trouvé ?

post un nouveau rapport hijack this stp

@+
0
1. gaeloutia
  
  oui j'ai tout supprimé
  
  rapport hijackthis:
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 20:36:53, on 21/05/2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16640)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
  C:\WINDOWS\system32\nvsvc32.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Sidebar\sidebar.exe
  C:\Program Files\UberIcon\UberIcon Manager.exe
  C:\Windows\System32\VisualTaskTips.exe
  C:\Program Files\styler\Styler.exe
  C:\WINDOWS\system32\devldr32.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\WINDOWS\system32\RUNDLL32.EXE
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Messenger\MSMSGS.EXE
  C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
  C:\Program Files\Windows Sidebar\sidebar.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\WINDOWS\explorer.exe
  C:\Program Files\internet explorer\iexplore.exe
  C:\PROGRA~1\MSNMES~1\msnmsgr.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.fr/keyword/%s
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
  O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\styler\TB\StylerTB.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
  O4 - HKLM\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
  O4 - HKLM\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe"
  O4 - HKLM\..\Run: [VisualTaskTips] C:\Windows\System32\VisualTaskTips.exe
  O4 - HKLM\..\Run: [Vistadrv] C:\WINDOWS\system32\Vistadrive\vsdrv.exe
  O4 - HKLM\..\Run: [TransBar] C:\WINDOWS\system32\transbar.exe /s
  O4 - HKLM\..\Run: [Styler] C:\Program Files\styler\Styler.exe
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
  O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
  O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
  O4 - HKUS\S-1-5-19\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [nltide2] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-20\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SERVICE RÉSEAU')
  O4 - HKUS\S-1-5-18\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'Default user')
  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
  O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - https://www.eset.com/
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
  O17 - HKLM\System\CCS\Services\Tcpip\..\{FA461808-97E5-4AC2-A684-A907C46229C7}: NameServer = 192.168.1.1
  O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
  
  0
Réponse 17 / 37
g!rly Contributeur
Salut,

c´est deja mieux maintenant ;-)

Fais un scan avec cet antispyware :

Telecharge malwarebytes + tutoriel :

-> https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

Tu l´instale; le programme va se mettre automatiquement a jour.

Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".

Click maintenant sur l´onglet recherche et coche la case : "executer un examun complet".

Puis click sur "rechercher".

Laisse le scanner le pc...

Si des elements on ete trouvés > click sur supprimer la selection.

si il t´es demandé de redemarrer > click sur "yes".

A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.

Copie et colle le rapport stp.

@+
0
1. gaeloutia
  
  resalut c'est encore moi!!!!
  
  le rapport:
  
  Malwarebytes' Anti-Malware 1.12
  Version de la base de données: 774
  
  Type de recherche: Examen complet (C:\|)
  Eléments examinés: 74881
  Temps écoulé: 12 minute(s), 18 second(s)
  
  Processus mémoire infecté(s): 0
  Module(s) mémoire infecté(s): 0
  Clé(s) du Registre infectée(s): 6
  Valeur(s) du Registre infectée(s): 0
  Elément(s) de données du Registre infecté(s): 0
  Dossier(s) infecté(s): 0
  Fichier(s) infecté(s): 21
  
  Processus mémoire infecté(s):
  (Aucun élément nuisible détecté)
  
  Module(s) mémoire infecté(s):
  (Aucun élément nuisible détecté)
  
  Clé(s) du Registre infectée(s):
  HKEY_LOCAL_MACHINE\SOFTWARE\AXPDefender (Rogue.AdvancedXPDefender) -> No action taken.
  HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> No action taken.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> No action taken.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> No action taken.
  HKEY_CLASSES_ROOT\pvnsmfor.brpn (Trojan.FakeAlert) -> No action taken.
  HKEY_CLASSES_ROOT\pvnsmfor.toolbar.1 (Trojan.FakeAlert) -> No action taken.
  
  Valeur(s) du Registre infectée(s):
  (Aucun élément nuisible détecté)
  
  Elément(s) de données du Registre infecté(s):
  (Aucun élément nuisible détecté)
  
  Dossier(s) infecté(s):
  (Aucun élément nuisible détecté)
  
  Fichier(s) infecté(s):
  C:\QooBox\Quarantine\C\WINDOWS\system32\ctfmonb.bmp.vir (Malware.Trace) -> No action taken.
  C:\QooBox\Quarantine\C\WINDOWS\system32\ginadwny.dll.vir (Trojan.Vundo) -> No action taken.
  C:\QooBox\Quarantine\C\WINDOWS\system32\pkhvvmhr.dll.vir (Trojan.Vundo) -> No action taken.
  C:\QooBox\Quarantine\C\WINDOWS\system32\wrshdbhl.dll.vir (Trojan.Vundo) -> No action taken.
  C:\System Volume Information\_restore{BA272CFE-37DF-4402-BCAD-0B7F918BA48B}\RP48\A0006098.scr (Trojan.Agent) -> No action taken.
  C:\System Volume Information\_restore{BA272CFE-37DF-4402-BCAD-0B7F918BA48B}\RP50\A0006117.scr (Trojan.Agent) -> No action taken.
  C:\System Volume Information\_restore{BA272CFE-37DF-4402-BCAD-0B7F918BA48B}\RP50\A0007117.scr (Trojan.Agent) -> No action taken.
  C:\System Volume Information\_restore{BA272CFE-37DF-4402-BCAD-0B7F918BA48B}\RP50\A0007123.exe (Trojan.Agent) -> No action taken.
  C:\System Volume Information\_restore{BA272CFE-37DF-4402-BCAD-0B7F918BA48B}\RP51\A0007251.scr (Trojan.Agent) -> No action taken.
  C:\System Volume Information\_restore{BA272CFE-37DF-4402-BCAD-0B7F918BA48B}\RP51\A0007257.exe (Rogue.AdvancedXPDefender) -> No action taken.
  C:\System Volume Information\_restore{BA272CFE-37DF-4402-BCAD-0B7F918BA48B}\RP51\A0008233.exe (Trojan.Agent) -> No action taken.
  C:\System Volume Information\_restore{BA272CFE-37DF-4402-BCAD-0B7F918BA48B}\RP51\A0010351.dll (Trojan.Vundo) -> No action taken.
  C:\System Volume Information\_restore{BA272CFE-37DF-4402-BCAD-0B7F918BA48B}\RP61\A0011912.dll (Trojan.Vundo) -> No action taken.
  C:\System Volume Information\_restore{BA272CFE-37DF-4402-BCAD-0B7F918BA48B}\RP61\A0011951.dll (Trojan.Vundo) -> No action taken.
  C:\System Volume Information\_restore{BA272CFE-37DF-4402-BCAD-0B7F918BA48B}\RP63\A0012031.dll (Trojan.Vundo) -> No action taken.
  C:\System Volume Information\_restore{BA272CFE-37DF-4402-BCAD-0B7F918BA48B}\RP67\A0013271.dll (Trojan.Vundo) -> No action taken.
  C:\System Volume Information\_restore{BA272CFE-37DF-4402-BCAD-0B7F918BA48B}\RP67\A0013272.dll (Trojan.Vundo) -> No action taken.
  C:\System Volume Information\_restore{BA272CFE-37DF-4402-BCAD-0B7F918BA48B}\RP68\A0014352.dll (Trojan.Vundo) -> No action taken.
  C:\System Volume Information\_restore{BA272CFE-37DF-4402-BCAD-0B7F918BA48B}\RP68\A0014356.dll (Trojan.Vundo) -> No action taken.
  C:\System Volume Information\_restore{BA272CFE-37DF-4402-BCAD-0B7F918BA48B}\RP71\A0014655.dll (Trojan.Vundo) -> No action taken.
  C:\WINDOWS\system32\blackster.scr (Trojan.Agent) -> No action taken.
  
  0
Réponse 18 / 37
g!rly Contributeur
Salut gaeloutia,

la suite :

Copie le texte ci-dessous :

File::
C:\WINDOWS\system32\drivers\ryF40.sys
C:\WINDOWS\system32\drivers\ahM41.sys
C:\WINDOWS\system32\drivers\elR63.sys
C:\WINDOWS\system32\drivers\ipV52.sys
C:\WINDOWS\system32\drivers\xfL27.sys
C:\WINDOWS\system32\drivers\vdJ17.sys
C:\WINDOWS\system32\drivers\wfL52.sys
C:\WINDOWS\system32\drivers\ygM63.sys
C:\sqmnoopt10.sqm
C:\sqmdata10.sqm
C:\sqmdata09.sqm
C:\sqmdata08.sqm
C:\sqmdata07.sqm
C:\sqmdata06.sqm
C:\sqmdata05.sqm
C:\sqmdata04.sqm
C:\sqmdata03.sqm
C:\sqmdata02.sqm
C:\sqmdata01.sqm
C:\sqmdata00.sqm
C:\sqmnoopt09.sqm
C:\sqmnoopt08.sqm
C:\sqmnoopt07.sqm
C:\sqmnoopt06.sqm
C:\sqmnoopt05.sqm
C:\sqmnoopt04.sqm
C:\sqmnoopt03.sqm
C:\sqmnoopt02.sqm
C:\sqmnoopt01.sqm
C:\sqmnoopt00.sqm
C:\WINDOWS\pvnsmfor.dll
C:\WINDOWS\exrk.exe
C:\WINDOWS\oadkxrts.exe
C:\WINDOWS\system32\ssqPffGv.dll
C:\WINDOWS\system32\efcYQhHY.dll
C:\WINDOWS\system32\pkhvvmhr.dll
C:\WINDOWS\system32\wrshdbhl.dll
C:\WINDOWS\system32\lhbdhsrw.ini
C:\WINDOWS\system32\efcDTJdE.dll
C:\WINDOWS\system32\efcYQhHY.dll
C:\WINDOWS\system32\qoMdDuuR.dll
C:\WINDOWS\system32\efcDTJdE.dll
C:\WINDOWS\pvnsmfor.dll
C:\WINDOWS\vbksrofa.dll
C:\WINDOWS\mpfanvqg.dll
C:\WINDOWS\system32\efcDTJdE.dll
C:\WINDOWS\system32\WinCtrl32.dll
C:\WINDOWS\system32\WinCtrl32(2).dll
C:\WINDOWS\system32\WinCtrl32.dl_
C:\WINDOWS\system32\ctfmonb.bmp
C:\WINDOWS\system32\qoMdDuuR

Driver::
ahM41
elR63
ipV52
ryF40
vdJ17
wfL52
xfL27
ygM63

Folder::
C:\Documents and Settings\All Users\Application Data\TEMP
C:\Documents and Settings\Gaelle\Application Data\AXPDefender

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{78998B80-6F10-4598-B0C6-F62C2E06D843}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8565412C-D124-492C-A53B-B093BD250F3B}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EF4CC146-43C9-4741-8D21-EB5035A4EBEC}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{DD8FEC5A-8976-438D-B6C9-F10CE205D78F}"=-
[-HKEY_CLASSES_ROOT\clsid\{dd8fec5a-8976-438d-b6c9-f10ce205d78f}]
[-HKEY_CLASSES_ROOT\pvnsmfor.1]
[-HKEY_CLASSES_ROOT\TypeLib\{FB9DC4B4-2D1E-4D4F-A03D-C80F2E9F29BC}]
[-HKEY_CLASSES_ROOT\pvnsmfor]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"3456b848"=-
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{EF4CC146-43C9-4741-8D21-EB5035A4EBEC}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"vbksrofa"=-
"mpfanvqg"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcDTJdE]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WinCtrl32]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ahM41.sys]
@=""
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ahM41.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\elR63.sys]
@=""
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\elR63.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ipV52.sys]
@=""
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ipV52.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ryF40.sys]
@=""
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ryF40.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vdJ17.sys]
@=""
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vdJ17.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wfL52.sys]
@=""
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wfL52.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\xfL27.sys]
@=""
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\xfL27.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ygM63.sys]
@=""
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ygM63.sys]

Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

http://sd-1.archive-host.com/membres/up/1366464061/CFScript.gif

Cela va relancer Combofix,

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.

S'il n'y a pas de rédémarrage, poste quand même les rapports.

@+
0
Réponse 19 / 37
g!rly Contributeur
Salut,

Télécharge combofix.exe (par sUBs) sur ton Bureau.

-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe

-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

Avant d'utiliser ComboFix :

-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.

-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.

Une fois fait, sur ton bureau double-clic sur Combofix.exe.

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.

- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)

-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

-> Tutoriel https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

Post également un nouveau rapport hijack this stp

@+
0
1. gaeloutia
  
  Bonsoir,
  
  Tout d'abord merci pour ton aide.
  Comme tu me l'as demandé voici le rapport de combofix:
  
  ComboFix 08-05-19.4 - Gaelle 2008-05-20 19:53:49.1 - NTFSx86
  Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.118 [GMT 2:00]
  Endroit: C:\Documents and Settings\Gaelle\Bureau\ComboFix.exe
  * Création d'un nouveau point de restauration
  
  [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
  .
  
  (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
  .
  
  C:\WINDOWS\cookies.ini
  c:\windows\system32\Drivers\ryF63.sys
  C:\WINDOWS\system32\fdvibbhh.ini
  C:\WINDOWS\system32\lbccdjsf.ini
  C:\WINDOWS\system32\lhbdhsrw.ini
  C:\WINDOWS\system32\mcrh.tmp
  C:\WINDOWS\system32\rhmvvhkp.ini
  C:\WINDOWS\system32\rooufasa.ini
  C:\WINDOWS\system32\YHhQYcfe.ini
  C:\WINDOWS\system32\YHhQYcfe.ini2
  
  .
  ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
  .
  
  -------\Legacy_RYF63
  -------\Service_ryF63
  
  ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-04-20 to 2008-05-20 ))))))))))))))))))))))))))))))))))))
  .
  
  2008-05-20 19:57 . 29,056 C:\WINDOWS\system32\drivers\ryF40.sys
  2008-05-20 19:57 . 2008-05-20 19:57 14,336 --a------ C:\WINDOWS\system32\WinCtrl32.dl_
  2008-05-20 19:57 . 2008-05-20 19:57 294 ---hs---- C:\WINDOWS\system32\lhbdhsrw.ini
  2008-05-20 19:55 . 2008-05-20 19:55 244 --ah----- C:\sqmnoopt10.sqm
  2008-05-20 19:55 . 2008-05-20 19:55 232 --ah----- C:\sqmdata10.sqm
  2008-05-20 19:49 . 2008-05-20 19:50 91,264 --a------ C:\WINDOWS\system32\wrshdbhl.dll
  2008-05-19 20:15 . 2008-05-17 02:23 <REP> d-------- C:\SDFix
  2008-05-19 19:25 . 2008-05-19 19:25 244 --ah----- C:\sqmnoopt09.sqm
  2008-05-19 19:25 . 2008-05-19 19:25 232 --ah----- C:\sqmdata09.sqm
  2008-05-19 18:02 . 2008-05-19 18:02 <REP> d-------- C:\Program Files\Avira
  2008-05-19 17:47 . 2008-05-20 19:53 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\NtUser.dat.LOG
  2008-05-18 23:15 . 2008-05-18 23:15 244 --ah----- C:\sqmnoopt08.sqm
  2008-05-18 23:15 . 2008-05-18 23:15 232 --ah----- C:\sqmdata08.sqm
  2008-05-17 18:02 . 2008-05-17 18:02 244 --ah----- C:\sqmnoopt07.sqm
  2008-05-17 18:02 . 2008-05-17 18:02 232 --ah----- C:\sqmdata07.sqm
  2008-05-17 17:22 . 2008-05-17 17:22 244 --ah----- C:\sqmnoopt06.sqm
  2008-05-17 17:22 . 2008-05-17 17:22 232 --ah----- C:\sqmdata06.sqm
  2008-05-17 17:18 . 2008-05-17 17:18 91,264 --a------ C:\WINDOWS\system32\pkhvvmhr.dll
  2008-05-17 14:35 . 2008-05-17 14:35 <REP> d-------- C:\Program Files\Trend Micro
  2008-05-17 14:03 . 2008-05-17 14:23 <REP> d-------- C:\Program Files\EsetOnlineScanner
  2008-05-17 12:55 . 2008-05-17 12:55 244 --ah----- C:\sqmnoopt05.sqm
  2008-05-17 12:55 . 2008-05-17 12:55 232 --ah----- C:\sqmdata05.sqm
  2008-05-17 12:53 . 2008-05-17 12:53 244 --ah----- C:\sqmnoopt04.sqm
  2008-05-17 12:53 . 2008-05-17 12:53 244 --ah----- C:\sqmnoopt03.sqm
  2008-05-17 12:53 . 2008-05-17 12:53 232 --ah----- C:\sqmdata04.sqm
  2008-05-17 12:53 . 2008-05-17 12:53 232 --ah----- C:\sqmdata03.sqm
  2008-05-17 01:17 . 2008-05-17 15:01 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
  2008-05-16 23:55 . 2008-05-19 18:02 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
  2008-05-16 23:54 . 2008-05-16 23:54 317,824 --a------ C:\WINDOWS\system32\efcYQhHY.dll
  2008-05-16 23:50 . 2008-05-16 23:50 <REP> d-------- C:\Documents and Settings\Gaelle\Application Data\AXPDefender
  2008-05-16 23:48 . 2008-05-16 23:48 29,824 --a------ C:\WINDOWS\system32\ssqPffGv.dll
  2008-05-16 23:48 . 2008-05-16 23:48 244 --ah----- C:\sqmnoopt02.sqm
  2008-05-16 23:48 . 2008-05-16 23:48 232 --ah----- C:\sqmdata02.sqm
  2008-05-16 23:47 . 2008-05-16 18:33 155,648 --a------ C:\WINDOWS\pvnsmfor.dll
  2008-05-16 23:47 . 2008-05-16 18:33 94,208 --a------ C:\WINDOWS\exrk.exe
  2008-05-16 23:47 . 2008-05-16 18:33 81,920 --a------ C:\WINDOWS\oadkxrts.exe
  2008-05-16 23:47 . 2008-05-20 19:49 14,336 --a------ C:\WINDOWS\system32\WinCtrl32.dll
  2008-05-16 23:47 . 2008-05-18 22:57 14,336 --a------ C:\WINDOWS\system32\WinCtrl32(2).dll
  2008-05-16 23:45 . 2008-05-17 00:54 269,334 --a------ C:\WINDOWS\system32\ctfmonb.bmp
  2008-05-16 23:45 . 2008-05-17 00:55 160,256 --a------ C:\WINDOWS\system32\blackster.scr
  2008-05-16 23:45 . 2008-05-16 23:45 29,824 --a------ C:\WINDOWS\system32\efcDTJdE.dll
  2008-05-16 22:24 . 2008-05-16 22:24 244 --ah----- C:\sqmnoopt01.sqm
  2008-05-16 22:24 . 2008-05-16 22:24 244 --ah----- C:\sqmnoopt00.sqm
  2008-05-16 22:24 . 2008-05-16 22:24 232 --ah----- C:\sqmdata01.sqm
  2008-05-16 22:24 . 2008-05-16 22:24 232 --ah----- C:\sqmdata00.sqm
  2008-05-16 18:40 . 2008-05-16 18:41 <REP> d-------- C:\Program Files\Google
  2008-05-16 18:25 . 2008-05-16 18:25 <REP> d--hs---- C:\WINDOWS\ftpcache
  2008-05-16 18:25 . 2008-05-16 18:25 <REP> d-------- C:\Program Files\Free
  2008-05-16 18:22 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
  2008-05-16 18:22 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
  
  .
  (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2008-05-18 21:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Downloaded Installations
  2008-05-17 15:42 --------- d--h--w C:\Program Files\InstallShield Installation Information
  2008-05-17 15:42 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
  2008-04-07 18:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\CanonIJPLM
  2008-03-29 17:23 --------- d-----w C:\Documents and Settings\Gaelle\Application Data\Samsung
  2008-03-29 17:16 --------- d-----w C:\Program Files\Samsung
  2008-03-29 17:15 --------- d-----w C:\Program Files\Fichiers communs\Adobe
  2008-03-28 20:14 --------- d-----w C:\Documents and Settings\Gaelle\Application Data\Ahead
  2008-03-28 20:11 --------- d-----w C:\Program Files\Fichiers communs\Ahead
  2008-03-28 20:11 --------- d-----w C:\Program Files\Ahead
  2007-12-27 02:28 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
  2007-12-27 02:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
  2007-12-27 02:27 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012007122720071228\index.dat
  2007-12-27 02:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
  .
  
  ------- Sigcheck -------
  
  2004-08-28 15:00 579072 4d88aaf39adabfe45958ea1384e2c4ff C:\WINDOWS\system32\user32.dll
  
  2007-10-11 01:22 825344 871ae10d6ae8877e9636ae5017953d52 C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\wininet.dll
  2004-08-28 15:00 876544 78188fb53c96e0636de67d6dd6ae4725 C:\WINDOWS\ie7updates\KB942615-IE7\wininet.dll
  2008-03-01 14:58 826368 8e027981ddffa690d456fe18b37415a0 C:\WINDOWS\SoftwareDistribution\Download\d9b3df0a44600204bf9ee7786a8c068c\SP2GDR\wininet.dll
  2008-03-01 14:34 827392 5a0093f59b505c008ed0cee615563c72 C:\WINDOWS\SoftwareDistribution\Download\d9b3df0a44600204bf9ee7786a8c068c\SP2QFE\wininet.dll
  2004-08-28 15:00 876544 78188fb53c96e0636de67d6dd6ae4725 C:\WINDOWS\system32\wininet.dll
  2007-10-11 01:49 824832 bc5119c53bdd48dabc628d448a3bdccb C:\WINDOWS\system32\dllcache\wininet.dll
  
  2007-10-30 19:20 360064 90caff4b094573449a0872a0f919b178 C:\WINDOWS\SoftwareDistribution\Download\2505e060ecbf87977746a5abaaa7bc96\SP2GDR\tcpip.sys
  2007-10-30 18:53 360832 64798ecfa43d78c7178375fcdd16d8c8 C:\WINDOWS\SoftwareDistribution\Download\2505e060ecbf87977746a5abaaa7bc96\SP2QFE\tcpip.sys
  2004-08-28 15:00 360576 c7be59b07c6eb74bea6fd67c1b164015 C:\WINDOWS\system32\drivers\tcpip.sys
  
  2004-08-28 15:00 507904 fb66744d525ea5df9a719f1db9b2dff4 C:\WINDOWS\system32\winlogon.exe
  
  2004-08-28 15:00 182656 bc84c4f67d0e880b0c46dc0ce2b8cbaa C:\WINDOWS\system32\drivers\ndis.sys
  
  2004-08-28 15:00 2479872 37cf5612cd0b972a6a9e5a1ec4219e47 C:\WINDOWS\system32\ntkrnlpa.exe
  
  2004-08-28 15:00 2347392 c23532a465a0b2ea4fc35b494bff5524 C:\WINDOWS\system32\ntoskrnl.exe
  
  2004-08-28 15:00 1789952 addc47dfd517f2143d71e9310e414b50 C:\WINDOWS\explorer.exe
  
  2004-08-28 15:00 25088 43836cffabac8d6779e8ee55e308df2c C:\WINDOWS\system32\ctfmon.exe
  .
  ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  REGEDIT4
  *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{78998B80-6F10-4598-B0C6-F62C2E06D843}]
  2008-05-16 23:54 317824 --a------ C:\WINDOWS\system32\efcYQhHY.dll
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8565412C-D124-492C-A53B-B093BD250F3B}]
  2008-05-20 19:58 319360 --a------ C:\WINDOWS\system32\qoMdDuuR.dll
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EF4CC146-43C9-4741-8D21-EB5035A4EBEC}]
  2008-05-16 23:45 29824 --a------ C:\WINDOWS\system32\efcDTJdE.dll
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  "{DD8FEC5A-8976-438D-B6C9-F10CE205D78F}"= "C:\WINDOWS\pvnsmfor.dll" [2008-05-16 18:33 155648]
  
  [HKEY_CLASSES_ROOT\clsid\{dd8fec5a-8976-438d-b6c9-f10ce205d78f}]
  [HKEY_CLASSES_ROOT\pvnsmfor.1]
  [HKEY_CLASSES_ROOT\TypeLib\{FB9DC4B4-2D1E-4D4F-A03D-C80F2E9F29BC}]
  [HKEY_CLASSES_ROOT\pvnsmfor]
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-28 15:00 25088]
  "MSMSGS"="C:\Program Files\Messenger\MSMSGS.exe" [2003-04-14 21:05 1498032]
  "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [ ]
  "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-05-16 18:41 171448]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2007-01-10 22:59 1235456]
  "UberIcon"="C:\Program Files\UberIcon\UberIcon Manager.exe" [2006-07-18 00:16 122880]
  "VisualTaskTips"="C:\Windows\System32\VisualTaskTips.exe" [2004-08-28 15:00 36864]
  "Vistadrv"="C:\WINDOWS\system32\Vistadrive\vsdrv.exe" [2006-07-30 04:37 121089]
  "TransBar"="C:\WINDOWS\system32\transbar.exe" [2004-08-28 15:00 139264]
  "Styler"="C:\Program Files\styler\Styler.exe" [2006-05-03 12:48 307200]
  "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 20:20 866584]
  "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-31 08:35 7634944]
  "nwiz"="nwiz.exe" [2006-10-31 08:35 1622016 C:\WINDOWS\system32\nwiz.exe]
  "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-31 08:35 86016]
  "NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
  "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
  "WIAWizardMenu"="C:\WINDOWS\system32\sti_ci.dll" [2004-08-28 15:00 678912]
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
  "TSClientMSIUninstaller"="cmd.exe" [2004-08-28 15:00 403968 C:\WINDOWS\system32\cmd.exe]
  "tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-28 15:00 44544]
  "nltide3"="cmd.exe" [2004-08-28 15:00 403968 C:\WINDOWS\system32\cmd.exe]
  "nltide2"="cmd.exe" [2004-08-28 15:00 403968 C:\WINDOWS\system32\cmd.exe]
  "nltide_2"="regsvr32 /s /n /i:U shell32" []
  "nltide_3"="advpack.dll" [2004-08-28 15:00 124928 C:\WINDOWS\system32\advpack.dll]
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
  "NoUserNameInStartMenu"= 1 (0x1)
  "NoSMHelp"= 1 (0x1)
  
  [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
  "NoUserNameInStartMenu"= 1 (0x1)
  "NoSMHelp"= 1 (0x1)
  
  [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
  "{EF4CC146-43C9-4741-8D21-EB5035A4EBEC}"= C:\WINDOWS\system32\efcDTJdE.dll [2008-05-16 23:45 29824]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  "vbksrofa"= {B47C72E7-AECC-4420-B2D7-A2FE26FA09CE} - C:\WINDOWS\vbksrofa.dll [ ]
  "mpfanvqg"= {B7C5A673-53A7-484A-B733-2DAEBAD587CA} - C:\WINDOWS\mpfanvqg.dll [ ]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcDTJdE]
  efcDTJdE.dll 2008-05-16 23:45 29824 C:\WINDOWS\system32\efcDTJdE.dll
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WinCtrl32]
  WinCtrl32.dll 2008-05-20 19:49 14336 C:\WINDOWS\system32\WinCtrl32.dll
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
  "aux"= ctwdm32.dll
  
  [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
  Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\qoMdDuuR
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ahM41.sys]
  @="Driver"
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\elR63.sys]
  @="Driver"
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ipV52.sys]
  @="Driver"
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ryF40.sys]
  @="Driver"
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vdJ17.sys]
  @="Driver"
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wfL52.sys]
  @="Driver"
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\xfL27.sys]
  @="Driver"
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ygM63.sys]
  @="Driver"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
  "AntiVirusDisableNotify"=dword:00000001
  "AntiVirusOverride"=dword:00000001
  "FirewallOverride"=dword:00000001
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
  "%windir%\\system32\\sessmgr.exe"=
  "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
  "C:\\Program Files\\MSN Messenger\\livecall.exe"=
  "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
  "C:\\Program Files\\Messenger\\msmsgs.exe"=
  
  R0 Si3112;Si3112;C:\WINDOWS\system32\drivers\Si3112.sys [2004-08-28 15:00]
  R0 Si3124;Si3124;C:\WINDOWS\system32\drivers\Si3124.sys [2004-08-28 15:00]
  R0 Si3132r5;Si3132r5;C:\WINDOWS\system32\drivers\Si3132r5.sys [2004-08-28 15:00]
  R0 Si3531;Si3531;C:\WINDOWS\system32\drivers\Si3531.sys [2004-08-28 15:00]
  R2 IJPLMSVC;PIXMA Extended Survey Program;C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2006-11-10 17:12]
  R3 usbstor;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-12-29 01:58]
  S0 ahM41;ahM41;C:\WINDOWS\system32\Drivers\ahM41.sys []
  S0 elR63;elR63;C:\WINDOWS\system32\Drivers\elR63.sys []
  S0 ipV52;ipV52;C:\WINDOWS\system32\Drivers\ipV52.sys []
  S0 ryF40;ryF40;C:\WINDOWS\system32\Drivers\ryF40.sys []
  S0 vdJ17;vdJ17;C:\WINDOWS\system32\Drivers\vdJ17.sys []
  S0 wfL52;wfL52;C:\WINDOWS\system32\Drivers\wfL52.sys []
  S0 xfL27;xfL27;C:\WINDOWS\system32\Drivers\xfL27.sys []
  S0 ygM63;ygM63;C:\WINDOWS\system32\Drivers\ygM63.sys []
  S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 23:58]
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5fc59197-b4a7-11dc-b5d8-001bb9ba4ab1}]
  \Shell\AutoRun\command - I:\start.exe
  \Shell\FramaKey\command - I:\start.exe
  
  .
  Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
  "2008-05-20 17:59:43 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
  - C:\Program Files\Windows Defender\MpCmdRun.exe
  .
  **************************************************************************
  
  catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2008-05-20 19:56:59
  Windows 5.1.2600 Service Pack 2 NTFS
  
  Balayage processus cach‚s ...
  
  Balayage cach‚ autostart entries ...
  
  Balayage des fichiers cach‚s ...
  
  C:\WINDOWS\system32\WinCtrl32.dl_ 14336 bytes executable
  C:\WINDOWS\system32\qoMdDuuR.dll 319360 bytes executable
  
  Scan termin‚ avec succŠs
  Les fichiers cach‚s: 2
  
  **************************************************************************
  .
  --------------------- DLLs a charg‚ sous des processus courants ---------------------
  
  PROCESS: C:\WINDOWS\system32\winlogon.exe
  -> C:\WINDOWS\system32\efcDTJdE.dll
  -> C:\WINDOWS\system32\WinCtrl32.dll
  
  PROCESS: C:\WINDOWS\explorer.exe
  -> C:\WINDOWS\system32\vobjhllm.dll
  -> C:\Program Files\UberIcon\UberIcon.dll
  -> C:\Windows\System32\VttHooks.dll
  .
  ------------------------ Other Running Processes ------------------------
  .
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
  C:\WINDOWS\system32\nvsvc32.exe
  C:\WINDOWS\system32\rundll32.exe
  C:\WINDOWS\system32\devldr32.exe
  C:\WINDOWS\system32\rundll32.exe
  C:\WINDOWS\system32\rundll32.exe
  .
  **************************************************************************
  .
  Temps d'accomplissement: 2008-05-20 20:00:24 - machine was rebooted
  ComboFix-quarantined-files.txt 2008-05-20 18:00:18
  
  Pre-Run: 149,237,133,312 octets libres
  Post-Run: 149,586,329,600 octets libres
  
  264 --- E O F --- 2008-05-16 20:20:00
  
  Aini qu'un nouveau rapport 'Hijackthis:
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 21:20:10, on 20/05/2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.20627)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Windows Sidebar\sidebar.exe
  C:\Program Files\UberIcon\UberIcon Manager.exe
  C:\Windows\System32\VisualTaskTips.exe
  C:\Program Files\styler\Styler.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\WINDOWS\system32\RUNDLL32.EXE
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Messenger\MSMSGS.EXE
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
  C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
  C:\WINDOWS\system32\nvsvc32.exe
  C:\Program Files\Windows Sidebar\sidebar.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\devldr32.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\internet explorer\iexplore.exe
  C:\WINDOWS\system32\rundll32.exe
  C:\WINDOWS\system32\rundll32.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.fr/keyword/%s
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\styler\TB\StylerTB.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
  O3 - Toolbar: pvnsmfor - {DD8FEC5A-8976-438D-B6C9-F10CE205D78F} - C:\WINDOWS\pvnsmfor.dll
  O4 - HKLM\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
  O4 - HKLM\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe"
  O4 - HKLM\..\Run: [VisualTaskTips] C:\Windows\System32\VisualTaskTips.exe
  O4 - HKLM\..\Run: [Vistadrv] C:\WINDOWS\system32\Vistadrive\vsdrv.exe
  O4 - HKLM\..\Run: [TransBar] C:\WINDOWS\system32\transbar.exe /s
  O4 - HKLM\..\Run: [Styler] C:\Program Files\styler\Styler.exe
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
  O4 - HKLM\..\Run: [3456b848] rundll32.exe "C:\WINDOWS\system32\ginadwny.dll",b
  O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
  O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
  O4 - HKUS\S-1-5-19\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [nltide2] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-20\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SERVICE RÉSEAU')
  O4 - HKUS\S-1-5-18\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'Default user')
  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
  O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - https://www.eset.com/
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
  O17 - HKLM\System\CCS\Services\Tcpip\..\{FA461808-97E5-4AC2-A684-A907C46229C7}: NameServer = 192.168.1.1
  O21 - SSODL: vbksrofa - {B47C72E7-AECC-4420-B2D7-A2FE26FA09CE} - C:\WINDOWS\vbksrofa.dll (file missing)
  O21 - SSODL: mpfanvqg - {B7C5A673-53A7-484A-B733-2DAEBAD587CA} - C:\WINDOWS\mpfanvqg.dll (file missing)
  O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
  
  0
2. gaeloutia
  
  rebonsoir,
  
  Rapport combofix:
  
  ComboFix 08-05-19.4 - Gaelle 2008-05-20 23:26:45.2 - NTFSx86
  Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.53 [GMT 2:00]
  Endroit: C:\Documents and Settings\Gaelle\Bureau\ComboFix.exe
  Command switches used :: C:\Documents and Settings\Gaelle\CFScript.txt
  * Création d'un nouveau point de restauration
  
  [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
  
  FILE ::
  C:\sqmdata00.sqm
  C:\sqmdata01.sqm
  C:\sqmdata02.sqm
  C:\sqmdata03.sqm
  C:\sqmdata04.sqm
  C:\sqmdata05.sqm
  C:\sqmdata06.sqm
  C:\sqmdata07.sqm
  C:\sqmdata08.sqm
  C:\sqmdata09.sqm
  C:\sqmdata10.sqm
  C:\sqmnoopt00.sqm
  C:\sqmnoopt01.sqm
  C:\sqmnoopt02.sqm
  C:\sqmnoopt03.sqm
  C:\sqmnoopt04.sqm
  C:\sqmnoopt05.sqm
  C:\sqmnoopt06.sqm
  C:\sqmnoopt07.sqm
  C:\sqmnoopt08.sqm
  C:\sqmnoopt09.sqm
  C:\sqmnoopt10.sqm
  C:\WINDOWS\exrk.exe
  C:\WINDOWS\mpfanvqg.dll
  C:\WINDOWS\oadkxrts.exe
  C:\WINDOWS\pvnsmfor.dll
  C:\WINDOWS\system32\ctfmonb.bmp
  C:\WINDOWS\system32\drivers\ahM41.sys
  C:\WINDOWS\system32\drivers\elR63.sys
  C:\WINDOWS\system32\drivers\ipV52.sys
  C:\WINDOWS\system32\drivers\ryF40.sys
  C:\WINDOWS\system32\drivers\vdJ17.sys
  C:\WINDOWS\system32\drivers\wfL52.sys
  C:\WINDOWS\system32\drivers\xfL27.sys
  C:\WINDOWS\system32\drivers\ygM63.sys
  C:\WINDOWS\system32\efcDTJdE.dll
  C:\WINDOWS\system32\efcYQhHY.dll
  C:\WINDOWS\system32\lhbdhsrw.ini
  C:\WINDOWS\system32\pkhvvmhr.dll
  C:\WINDOWS\system32\qoMdDuuR
  C:\WINDOWS\system32\qoMdDuuR.dll
  C:\WINDOWS\system32\ssqPffGv.dll
  C:\WINDOWS\system32\WinCtrl32(2).dll
  C:\WINDOWS\system32\WinCtrl32.dl_
  C:\WINDOWS\system32\WinCtrl32.dll
  C:\WINDOWS\system32\wrshdbhl.dll
  C:\WINDOWS\vbksrofa.dll
  .
  
  (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
  .
  
  C:\Documents and Settings\All Users\Application Data\TEMP
  C:\Documents and Settings\Gaelle\Application Data\AXPDefender
  C:\sqmdata00.sqm
  C:\sqmdata01.sqm
  C:\sqmdata02.sqm
  C:\sqmdata03.sqm
  C:\sqmdata04.sqm
  C:\sqmdata05.sqm
  C:\sqmdata06.sqm
  C:\sqmdata07.sqm
  C:\sqmdata08.sqm
  C:\sqmdata09.sqm
  C:\sqmdata10.sqm
  C:\sqmnoopt00.sqm
  C:\sqmnoopt01.sqm
  C:\sqmnoopt02.sqm
  C:\sqmnoopt03.sqm
  C:\sqmnoopt04.sqm
  C:\sqmnoopt05.sqm
  C:\sqmnoopt06.sqm
  C:\sqmnoopt07.sqm
  C:\sqmnoopt08.sqm
  C:\sqmnoopt09.sqm
  C:\sqmnoopt10.sqm
  C:\WINDOWS\cookies.ini
  C:\WINDOWS\exrk.exe
  C:\WINDOWS\oadkxrts.exe
  C:\WINDOWS\pvnsmfor.dll
  C:\WINDOWS\system32\ctfmonb.bmp
  C:\WINDOWS\system32\efcDTJdE.dll
  C:\WINDOWS\system32\efcYQhHY.dll
  C:\WINDOWS\system32\lhbdhsrw.ini
  C:\WINDOWS\system32\mllhjbov.ini
  C:\WINDOWS\system32\pkhvvmhr.dll
  C:\WINDOWS\system32\ssqPffGv.dll
  C:\WINDOWS\system32\WinCtrl32(2).dll
  C:\WINDOWS\system32\WinCtrl32.dl_
  C:\WINDOWS\system32\WinCtrl32.dll
  C:\WINDOWS\system32\wrshdbhl.dll
  C:\WINDOWS\system32\YHhQYcfe.ini
  C:\WINDOWS\system32\YHhQYcfe.ini2
  C:\WINDOWS\system32\ynwdanig.ini
  
  .
  ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
  .
  
  -------\Legacy_AHM41
  -------\Legacy_ELR63
  -------\Legacy_IPV52
  -------\Legacy_XFL27
  -------\Service_ahM41
  -------\Service_elR63
  -------\Service_ipV52
  -------\Service_ryF40
  -------\Service_vdJ17
  -------\Service_wfL52
  -------\Service_xfL27
  -------\Service_ygM63
  
  ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-04-20 to 2008-05-20 ))))))))))))))))))))))))))))))))))))
  .
  
  2008-05-20 23:22 . 2008-05-20 23:22 244 --ah----- C:\sqmnoopt13.sqm
  2008-05-20 23:22 . 2008-05-20 23:22 232 --ah----- C:\sqmdata13.sqm
  2008-05-20 21:18 . 2008-05-20 21:18 91,264 --a------ C:\WINDOWS\system32\ginadwny.dll
  2008-05-20 21:01 . 2008-05-20 21:01 244 --ah----- C:\sqmnoopt12.sqm
  2008-05-20 21:01 . 2008-05-20 21:01 232 --ah----- C:\sqmdata12.sqm
  2008-05-20 20:20 . 2008-05-20 20:20 244 --ah----- C:\sqmnoopt11.sqm
  2008-05-20 20:20 . 2008-05-20 20:20 232 --ah----- C:\sqmdata11.sqm
  2008-05-19 20:15 . 2008-05-17 02:23 <REP> d-------- C:\SDFix
  2008-05-19 18:02 . 2008-05-19 18:02 <REP> d-------- C:\Program Files\Avira
  2008-05-19 17:47 . 2008-05-20 19:53 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\NtUser.dat.LOG
  2008-05-17 14:35 . 2008-05-17 14:35 <REP> d-------- C:\Program Files\Trend Micro
  2008-05-17 14:03 . 2008-05-17 14:23 <REP> d-------- C:\Program Files\EsetOnlineScanner
  2008-05-16 23:55 . 2008-05-19 18:02 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
  2008-05-16 23:45 . 2008-05-17 00:55 160,256 --a------ C:\WINDOWS\system32\blackster.scr
  2008-05-16 18:40 . 2008-05-16 18:41 <REP> d-------- C:\Program Files\Google
  2008-05-16 18:25 . 2008-05-16 18:25 <REP> d--hs---- C:\WINDOWS\ftpcache
  2008-05-16 18:25 . 2008-05-16 18:25 <REP> d-------- C:\Program Files\Free
  2008-05-16 18:22 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
  2008-05-16 18:22 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
  
  .
  (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2008-05-18 21:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Downloaded Installations
  2008-05-17 15:42 --------- d--h--w C:\Program Files\InstallShield Installation Information
  2008-05-17 15:42 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
  2008-04-07 18:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\CanonIJPLM
  2008-03-29 17:23 --------- d-----w C:\Documents and Settings\Gaelle\Application Data\Samsung
  2008-03-29 17:16 --------- d-----w C:\Program Files\Samsung
  2008-03-29 17:15 --------- d-----w C:\Program Files\Fichiers communs\Adobe
  2008-03-28 20:14 --------- d-----w C:\Documents and Settings\Gaelle\Application Data\Ahead
  2008-03-28 20:11 --------- d-----w C:\Program Files\Fichiers communs\Ahead
  2008-03-28 20:11 --------- d-----w C:\Program Files\Ahead
  2007-12-27 02:28 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
  2007-12-27 02:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
  2007-12-27 02:27 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012007122720071228\index.dat
  2007-12-27 02:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
  .
  
  ------- Sigcheck -------
  
  2004-08-28 15:00 579072 4d88aaf39adabfe45958ea1384e2c4ff C:\WINDOWS\system32\user32.dll
  
  2007-10-11 01:22 825344 871ae10d6ae8877e9636ae5017953d52 C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\wininet.dll
  2004-08-28 15:00 876544 78188fb53c96e0636de67d6dd6ae4725 C:\WINDOWS\ie7updates\KB942615-IE7\wininet.dll
  2008-03-01 14:58 826368 8e027981ddffa690d456fe18b37415a0 C:\WINDOWS\SoftwareDistribution\Download\d9b3df0a44600204bf9ee7786a8c068c\SP2GDR\wininet.dll
  2008-03-01 14:34 827392 5a0093f59b505c008ed0cee615563c72 C:\WINDOWS\SoftwareDistribution\Download\d9b3df0a44600204bf9ee7786a8c068c\SP2QFE\wininet.dll
  2004-08-28 15:00 876544 78188fb53c96e0636de67d6dd6ae4725 C:\WINDOWS\system32\wininet.dll
  2007-10-11 01:49 824832 bc5119c53bdd48dabc628d448a3bdccb C:\WINDOWS\system32\dllcache\wininet.dll
  
  2007-10-30 19:20 360064 90caff4b094573449a0872a0f919b178 C:\WINDOWS\SoftwareDistribution\Download\2505e060ecbf87977746a5abaaa7bc96\SP2GDR\tcpip.sys
  2007-10-30 18:53 360832 64798ecfa43d78c7178375fcdd16d8c8 C:\WINDOWS\SoftwareDistribution\Download\2505e060ecbf87977746a5abaaa7bc96\SP2QFE\tcpip.sys
  2004-08-28 15:00 360576 c7be59b07c6eb74bea6fd67c1b164015 C:\WINDOWS\system32\drivers\tcpip.sys
  
  2004-08-28 15:00 507904 fb66744d525ea5df9a719f1db9b2dff4 C:\WINDOWS\system32\winlogon.exe
  
  2004-08-28 15:00 182656 bc84c4f67d0e880b0c46dc0ce2b8cbaa C:\WINDOWS\system32\drivers\ndis.sys
  
  2004-08-28 15:00 2479872 37cf5612cd0b972a6a9e5a1ec4219e47 C:\WINDOWS\system32\ntkrnlpa.exe
  
  2004-08-28 15:00 2347392 c23532a465a0b2ea4fc35b494bff5524 C:\WINDOWS\system32\ntoskrnl.exe
  
  2004-08-28 15:00 1789952 addc47dfd517f2143d71e9310e414b50 C:\WINDOWS\explorer.exe
  
  2004-08-28 15:00 25088 43836cffabac8d6779e8ee55e308df2c C:\WINDOWS\system32\ctfmon.exe
  .
  ((((((((((((((((((((((((((((( snapshot@2008-05-20_19.59.59.12 )))))))))))))))))))))))))))))))))))))))))
  .
  - 2008-05-20 17:56:32 2,048 --s-a-w C:\WINDOWS\bootstat.dat
  + 2008-05-20 21:29:23 2,048 --s-a-w C:\WINDOWS\bootstat.dat
  .
  ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  REGEDIT4
  *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-28 15:00 25088]
  "MSMSGS"="C:\Program Files\Messenger\MSMSGS.exe" [2003-04-14 21:05 1498032]
  "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [ ]
  "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-05-16 18:41 171448]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2007-01-10 22:59 1235456]
  "UberIcon"="C:\Program Files\UberIcon\UberIcon Manager.exe" [2006-07-18 00:16 122880]
  "VisualTaskTips"="C:\Windows\System32\VisualTaskTips.exe" [2004-08-28 15:00 36864]
  "Vistadrv"="C:\WINDOWS\system32\Vistadrive\vsdrv.exe" [2006-07-30 04:37 121089]
  "TransBar"="C:\WINDOWS\system32\transbar.exe" [2004-08-28 15:00 139264]
  "Styler"="C:\Program Files\styler\Styler.exe" [2006-05-03 12:48 307200]
  "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 20:20 866584]
  "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-31 08:35 7634944]
  "nwiz"="nwiz.exe" [2006-10-31 08:35 1622016 C:\WINDOWS\system32\nwiz.exe]
  "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-31 08:35 86016]
  "NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
  "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
  "WIAWizardMenu"="C:\WINDOWS\system32\sti_ci.dll" [2004-08-28 15:00 678912]
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
  "TSClientMSIUninstaller"="cmd.exe" [2004-08-28 15:00 403968 C:\WINDOWS\system32\cmd.exe]
  "tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-28 15:00 44544]
  "nltide3"="cmd.exe" [2004-08-28 15:00 403968 C:\WINDOWS\system32\cmd.exe]
  "nltide2"="cmd.exe" [2004-08-28 15:00 403968 C:\WINDOWS\system32\cmd.exe]
  "nltide_2"="regsvr32 /s /n /i:U shell32" []
  "nltide_3"="advpack.dll" [2004-08-28 15:00 124928 C:\WINDOWS\system32\advpack.dll]
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
  "NoUserNameInStartMenu"= 1 (0x1)
  "NoSMHelp"= 1 (0x1)
  
  [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
  "NoUserNameInStartMenu"= 1 (0x1)
  "NoSMHelp"= 1 (0x1)
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
  "aux"= ctwdm32.dll
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\lrX41.sys]
  @="Driver"
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ubH41.sys]
  @="Driver"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
  "AntiVirusDisableNotify"=dword:00000001
  "AntiVirusOverride"=dword:00000001
  "FirewallOverride"=dword:00000001
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
  "%windir%\\system32\\sessmgr.exe"=
  "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
  "C:\\Program Files\\MSN Messenger\\livecall.exe"=
  "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
  "C:\\Program Files\\Messenger\\msmsgs.exe"=
  
  R0 Si3112;Si3112;C:\WINDOWS\system32\drivers\Si3112.sys [2004-08-28 15:00]
  R0 Si3124;Si3124;C:\WINDOWS\system32\drivers\Si3124.sys [2004-08-28 15:00]
  R0 Si3132r5;Si3132r5;C:\WINDOWS\system32\drivers\Si3132r5.sys [2004-08-28 15:00]
  R0 Si3531;Si3531;C:\WINDOWS\system32\drivers\Si3531.sys [2004-08-28 15:00]
  R2 IJPLMSVC;PIXMA Extended Survey Program;C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2006-11-10 17:12]
  R3 usbstor;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-12-29 01:58]
  S0 lrX41;lrX41;C:\WINDOWS\system32\Drivers\lrX41.sys []
  S0 ubH41;ubH41;C:\WINDOWS\system32\Drivers\ubH41.sys []
  S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 23:58]
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5fc59197-b4a7-11dc-b5d8-001bb9ba4ab1}]
  \Shell\AutoRun\command - I:\start.exe
  \Shell\FramaKey\command - I:\start.exe
  
  .
  Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
  "2008-05-20 21:32:32 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
  - C:\Program Files\Windows Defender\MpCmdRun.exe
  .
  **************************************************************************
  
  catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2008-05-20 23:29:43
  Windows 5.1.2600 Service Pack 2 NTFS
  
  Balayage processus cach‚s ...
  
  Balayage cach‚ autostart entries ...
  
  Balayage des fichiers cach‚s ...
  
  Scan termin‚ avec succŠs
  Les fichiers cach‚s: 0
  
  **************************************************************************
  .
  --------------------- DLLs a charg‚ sous des processus courants ---------------------
  
  PROCESS: C:\WINDOWS\explorer.exe
  -> C:\Program Files\UberIcon\UberIcon.dll
  -> C:\Windows\System32\VttHooks.dll
  .
  ------------------------ Other Running Processes ------------------------
  .
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
  C:\WINDOWS\system32\nvsvc32.exe
  C:\WINDOWS\system32\rundll32.exe
  C:\WINDOWS\system32\devldr32.exe
  .
  **************************************************************************
  .
  Temps d'accomplissement: 2008-05-20 23:32:54 - machine was rebooted [Gaelle]
  ComboFix-quarantined-files.txt 2008-05-20 21:32:41
  ComboFix2.txt 2008-05-20 18:00:25
  
  Pre-Run: 149,557,653,504 octets libres
  Post-Run: 149,550,063,616 octets libres
  
  281 --- E O F --- 2008-05-16 20:20:00
  
  Rapport hijackthis:
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 23:42:39, on 20/05/2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.20627)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
  C:\WINDOWS\system32\nvsvc32.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Sidebar\sidebar.exe
  C:\Program Files\UberIcon\UberIcon Manager.exe
  C:\Windows\System32\VisualTaskTips.exe
  C:\Program Files\styler\Styler.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\WINDOWS\system32\RUNDLL32.EXE
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Messenger\MSMSGS.EXE
  C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
  C:\WINDOWS\system32\devldr32.exe
  C:\Program Files\Windows Sidebar\sidebar.exe
  C:\WINDOWS\explorer.exe
  C:\WINDOWS\system32\notepad.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\internet explorer\iexplore.exe
  C:\PROGRA~1\MSNMES~1\msnmsgr.exe
  C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.fr/keyword/%s
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
  O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\styler\TB\StylerTB.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
  O4 - HKLM\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
  O4 - HKLM\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe"
  O4 - HKLM\..\Run: [VisualTaskTips] C:\Windows\System32\VisualTaskTips.exe
  O4 - HKLM\..\Run: [Vistadrv] C:\WINDOWS\system32\Vistadrive\vsdrv.exe
  O4 - HKLM\..\Run: [TransBar] C:\WINDOWS\system32\transbar.exe /s
  O4 - HKLM\..\Run: [Styler] C:\Program Files\styler\Styler.exe
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
  O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
  O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
  O4 - HKUS\S-1-5-19\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [nltide2] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-20\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SERVICE RÉSEAU')
  O4 - HKUS\S-1-5-18\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'Default user')
  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
  O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - https://www.eset.com/
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
  O17 - HKLM\System\CCS\Services\Tcpip\..\{FA461808-97E5-4AC2-A684-A907C46229C7}: NameServer = 192.168.1.1
  O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
  
  0
3. g!rly Contributeur
  
  @gaeloutiaSalut gaeloutia,
  
  on dirait qu´il nous fait de la resistance; quelques nouveaux fichiers sont apparus...
  
  Copie le texte ci-dessous :
  
  File::
  C:\sqmnoopt13.sqm
  C:\sqmdata13.sqm
  C:\sqmnoopt12.sqm
  C:\sqmdata12.sqm
  C:\sqmnoopt11.sqm
  C:\sqmdata11.sqm
  C:\WINDOWS\system32\ginadwny.dll
  C:\WINDOWS\system32\Drivers\lrX41.sys
  C:\WINDOWS\system32\Drivers\ubH41.sys
  
  Driver::
  lrX41
  ubH41
  
  Registry::
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\lrX41.sys]
  @=""
  [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\lrX41.sys]
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ubH41.sys]
  @=""
  [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ubH41.sys]
  
  Ouvre le Bloc-Notes puis colle le texte copié.
  (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
  Sauvegarde ce fichier sous le nom de CFScript.txt.
  
  Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :
  
  http://sd-1.archive-host.com/membres/up/1366464061/CFScript.gif
  
  Cela va relancer Combofix,
  
  Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
  
  Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
  
  Ne touche à rien tant que le scan n'est pas terminé.
  
  Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.
  
  S'il n'y a pas de rédémarrage, poste quand même les rapports.
  
  @+
  
  0
4. gaeloutia
  
  @g!rlyBonsoir,
  
  Vraiment merci pour ton aide mais penses tu que ce virus sera détruit un jour?
  
  Voila le rapport combofix:
  
  ComboFix 08-05-19.4 - Gaelle 2008-05-21 19:04:37.3 - NTFSx86
  Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.100 [GMT 2:00]
  Endroit: C:\Documents and Settings\Gaelle\Bureau\ComboFix.exe
  Command switches used :: C:\Documents and Settings\Gaelle\Bureau\CFScript.txt
  * Création d'un nouveau point de restauration
  
  [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
  
  FILE ::
  C:\sqmdata11.sqm
  C:\sqmdata12.sqm
  C:\sqmdata13.sqm
  C:\sqmnoopt11.sqm
  C:\sqmnoopt12.sqm
  C:\sqmnoopt13.sqm
  C:\WINDOWS\system32\Drivers\lrX41.sys
  C:\WINDOWS\system32\Drivers\ubH41.sys
  C:\WINDOWS\system32\ginadwny.dll
  .
  
  (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
  .
  
  C:\sqmdata11.sqm
  C:\sqmdata12.sqm
  C:\sqmdata13.sqm
  C:\sqmnoopt11.sqm
  C:\sqmnoopt12.sqm
  C:\sqmnoopt13.sqm
  C:\WINDOWS\system32\ginadwny.dll
  
  .
  ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
  .
  
  -------\Legacy_LRX41
  -------\Legacy_UBH41
  -------\Service_lrX41
  -------\Service_ubH41
  
  ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-04-21 to 2008-05-21 ))))))))))))))))))))))))))))))))))))
  .
  
  2008-05-21 19:04 . 2008-05-21 19:04 244 --ah----- C:\sqmnoopt01.sqm
  2008-05-21 19:04 . 2008-05-21 19:04 232 --ah----- C:\sqmdata01.sqm
  2008-05-20 23:44 . 2008-05-20 23:44 244 --ah----- C:\sqmnoopt00.sqm
  2008-05-20 23:44 . 2008-05-20 23:44 232 --ah----- C:\sqmdata00.sqm
  2008-05-19 20:15 . 2008-05-17 02:23 <REP> d-------- C:\SDFix
  2008-05-19 18:02 . 2008-05-19 18:02 <REP> d-------- C:\Program Files\Avira
  2008-05-19 17:47 . 2008-05-20 19:53 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\NtUser.dat.LOG
  2008-05-17 14:35 . 2008-05-17 14:35 <REP> d-------- C:\Program Files\Trend Micro
  2008-05-17 14:03 . 2008-05-17 14:23 <REP> d-------- C:\Program Files\EsetOnlineScanner
  2008-05-16 23:55 . 2008-05-19 18:02 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
  2008-05-16 23:45 . 2008-05-17 00:55 160,256 --a------ C:\WINDOWS\system32\blackster.scr
  2008-05-16 18:40 . 2008-05-16 18:41 <REP> d-------- C:\Program Files\Google
  2008-05-16 18:36 . 2008-03-20 10:09 1,845,376 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys
  2008-05-16 18:36 . 2007-10-30 19:20 360,064 -----c--- C:\WINDOWS\system32\dllcache\tcpip.sys
  2008-05-16 18:36 . 2007-12-18 11:51 179,584 -----c--- C:\WINDOWS\system32\dllcache\mrxdav.sys
  2008-05-16 18:29 . 2008-03-01 14:58 347,136 -----c--- C:\WINDOWS\system32\dllcache\dxtmsft.dll
  2008-05-16 18:29 . 2008-03-01 14:58 44,544 -----c--- C:\WINDOWS\system32\dllcache\pngfilt.dll
  2008-05-16 18:25 . 2008-05-16 18:25 <REP> d--hs---- C:\WINDOWS\ftpcache
  2008-05-16 18:25 . 2008-05-16 18:25 <REP> d-------- C:\Program Files\Free
  2008-05-16 18:22 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
  2008-05-16 18:22 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
  
  .
  (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2008-05-20 21:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
  2008-05-18 21:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Downloaded Installations
  2008-05-17 15:42 --------- d--h--w C:\Program Files\InstallShield Installation Information
  2008-05-17 15:42 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
  2008-04-07 18:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\CanonIJPLM
  2008-03-29 17:23 --------- d-----w C:\Documents and Settings\Gaelle\Application Data\Samsung
  2008-03-29 17:16 --------- d-----w C:\Program Files\Samsung
  2008-03-29 17:15 --------- d-----w C:\Program Files\Fichiers communs\Adobe
  2008-03-28 20:14 --------- d-----w C:\Documents and Settings\Gaelle\Application Data\Ahead
  2008-03-28 20:11 --------- d-----w C:\Program Files\Fichiers communs\Ahead
  2008-03-28 20:11 --------- d-----w C:\Program Files\Ahead
  2007-12-27 02:28 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
  2007-12-27 02:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
  2007-12-27 02:27 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012007122720071228\index.dat
  2007-12-27 02:28 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
  .
  
  ------- Sigcheck -------
  
  2004-08-28 15:00 579072 4d88aaf39adabfe45958ea1384e2c4ff C:\WINDOWS\system32\user32.dll
  
  2007-10-11 01:22 825344 871ae10d6ae8877e9636ae5017953d52 C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\wininet.dll
  2008-03-01 14:34 827392 5a0093f59b505c008ed0cee615563c72 C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\wininet.dll
  2004-08-28 15:00 876544 78188fb53c96e0636de67d6dd6ae4725 C:\WINDOWS\ie7updates\KB942615-IE7\wininet.dll
  2004-08-28 15:00 876544 78188fb53c96e0636de67d6dd6ae4725 C:\WINDOWS\ie7updates\KB947864-IE7\wininet.dll
  2008-03-01 14:58 826368 8e027981ddffa690d456fe18b37415a0 C:\WINDOWS\SoftwareDistribution\Download\d9b3df0a44600204bf9ee7786a8c068c\SP2GDR\wininet.dll
  2008-03-01 14:34 827392 5a0093f59b505c008ed0cee615563c72 C:\WINDOWS\SoftwareDistribution\Download\d9b3df0a44600204bf9ee7786a8c068c\SP2QFE\wininet.dll
  2004-08-28 15:00 876544 78188fb53c96e0636de67d6dd6ae4725 C:\WINDOWS\system32\wininet.dll
  2008-03-01 14:58 826368 8e027981ddffa690d456fe18b37415a0 C:\WINDOWS\system32\dllcache\wininet.dll
  
  2004-08-28 15:00 507904 fb66744d525ea5df9a719f1db9b2dff4 C:\WINDOWS\system32\winlogon.exe
  
  2004-08-28 15:00 182656 bc84c4f67d0e880b0c46dc0ce2b8cbaa C:\WINDOWS\system32\drivers\ndis.sys
  
  2004-08-28 15:00 2479872 37cf5612cd0b972a6a9e5a1ec4219e47 C:\WINDOWS\system32\ntkrnlpa.exe
  
  2004-08-28 15:00 2347392 c23532a465a0b2ea4fc35b494bff5524 C:\WINDOWS\system32\ntoskrnl.exe
  
  2004-08-28 15:00 1789952 addc47dfd517f2143d71e9310e414b50 C:\WINDOWS\explorer.exe
  
  2004-08-28 15:00 25088 43836cffabac8d6779e8ee55e308df2c C:\WINDOWS\system32\ctfmon.exe
  .
  ((((((((((((((((((((((((((((( snapshot@2008-05-20_19.59.59.12 )))))))))))))))))))))))))))))))))))))))))
  .
  - 2008-05-20 17:56:32 2,048 --s-a-w C:\WINDOWS\bootstat.dat
  + 2008-05-21 17:06:52 2,048 --s-a-w C:\WINDOWS\bootstat.dat
  + 2004-08-28 13:00:00 124,928 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\advpack.dll
  + 2004-08-28 13:00:00 346,624 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\dxtmsft.dll
  + 2007-10-10 23:49:42 214,528 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\dxtrans.dll
  + 2007-10-10 23:49:42 132,608 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\extmgr.dll
  + 2007-10-10 23:49:42 63,488 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\icardie.dll
  + 2007-10-10 11:00:41 70,656 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ie4uinit.exe
  + 2007-10-10 23:49:42 153,088 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieakeng.dll
  + 2007-10-10 23:49:42 230,400 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieaksie.dll
  + 2007-10-10 05:46:55 161,792 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieakui.dll
  + 2007-10-10 23:49:42 383,488 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieapfltr.dll
  + 2007-10-10 23:49:42 384,512 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\iedkcs32.dll
  + 2004-08-28 13:00:00 6,953,472 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieframe.dll
  + 2007-10-10 23:49:43 44,544 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\iernonce.dll
  + 2004-08-28 13:00:00 267,776 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\iertutil.dll
  + 2007-10-10 10:59:40 13,824 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\ieudinit.exe
  + 2004-08-28 13:00:00 625,152 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\iexplore.exe
  + 2007-10-10 23:49:44 27,648 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\jsproxy.dll
  + 2004-08-28 13:00:00 459,264 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\msfeeds.dll
  + 2004-08-28 13:00:00 52,224 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\msfeedsbs.dll
  + 2004-08-28 13:00:00 3,933,184 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\mshtml.dll
  + 2004-08-28 13:00:00 477,696 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\mshtmled.dll
  + 2007-10-10 23:49:44 193,024 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\msrating.dll
  + 2007-10-10 23:49:45 671,232 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\mstime.dll
  + 2007-10-10 23:49:45 102,400 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\occache.dll
  + 2004-08-28 13:00:00 44,544 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\pngfilt.dll
  + 2007-03-06 01:34:38 216,800 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe
  + 2007-03-06 01:35:48 394,976 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\updspapi.dll
  + 2004-08-28 13:00:00 68,608 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\url.dll
  + 2004-08-28 13:00:00 1,280,512 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\urlmon.dll
  + 2004-08-28 13:00:00 344,064 -c----w C:\WINDOWS\ie7updates\KB947864-IE7\webcheck.dll
  + 2007-08-28 22:19:32 136,064 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109110000000000000000F01FEC\12.0.6215\CONTAB32.DLL
  + 2007-08-24 03:49:12 89,976 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109110000000000000000F01FEC\12.0.6215\DLGSETP.DLL
  + 2007-10-05 19:37:38 17,927,192 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109110000000000000000F01FEC\12.0.6215\EXCEL.EXE
  + 2007-08-24 03:49:40 342,888 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109110000000000000000F01FEC\12.0.6215\MIMEDIR.DLL
  + 2007-08-28 22:38:10 500,648 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109110000000000000000F01FEC\12.0.6215\MORPH9.DLL
  + 2007-08-28 22:38:46 9,584,512 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109110000000000000000F01FEC\12.0.6215\MSPUB.EXE
  + 2007-08-28 22:20:20 2,949,512 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109110000000000000000F01FEC\12.0.6215\OLMAPI32.DLL
  + 2007-08-24 04:42:40 663,432 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109110000000000000000F01FEC\12.0.6215\OMSMAIN.DLL
  + 2007-08-24 04:42:44 195,480 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109110000000000000000F01FEC\12.0.6215\OMSXP32.DLL
  + 2007-08-28 22:20:44 600,992 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109110000000000000000F01FEC\12.0.6215\OUTLMIME.DLL
  + 2007-09-06 17:01:10 12,836,728 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109110000000000000000F01FEC\12.0.6215\OUTLOOK.EXE
  + 2007-08-28 22:22:04 180,128 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109110000000000000000F01FEC\12.0.6215\OUTLPH.DLL
  + 2007-08-24 02:43:28 138,648 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109110000000000000000F01FEC\12.0.6215\PRTF9.DLL
  + 2007-08-24 03:51:48 416,112 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109110000000000000000F01FEC\12.0.6215\PSTPRX32.DLL
  + 2007-08-28 22:39:14 625,560 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109110000000000000000F01FEC\12.0.6215\PTXT9.DLL
  + 2007-08-24 02:43:36 593,296 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109110000000000000000F01FEC\12.0.6215\PUBCONV.DLL
  + 2007-08-24 03:52:08 266,160 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109110000000000000000F01FEC\12.0.6215\SCNPST32.DLL
  + 2007-08-24 03:52:10 275,896 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109110000000000000000F01FEC\12.0.6215\SCNPST64.DLL
  + 2007-08-28 22:16:00 350,064 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109110000000000000000F01FEC\12.0.6215\WINWORD.EXE
  + 2007-09-06 17:03:02 4,280,176 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109110000000000000000F01FEC\12.0.6215\WRD12CNV.DLL
  + 2007-08-28 23:07:58 24,928 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109110000000000000000F01FEC\12.0.6215\WRD12EXE.EXE
  + 2007-09-06 16:56:32 17,490,800 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109110000000000000000F01FEC\12.0.6215\WWLIB.DLL
  + 2007-10-02 19:00:06 14,708,760 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109110000000000000000F01FEC\12.0.6215\XL12CNV.EXE
  + 2007-08-24 04:14:14 13,712 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002109110000000000000000F01FEC\12.0.6215\XLCALL32.DLL
  - 2007-12-27 19:03:30 1,165,584 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\accicons.exe
  + 2008-05-20 21:49:32 1,165,584 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\accicons.exe
  - 2007-12-27 19:03:31 20,240 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\cagicon.exe
  + 2008-05-20 21:49:32 20,240 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\cagicon.exe
  - 2007-12-27 19:03:31 159,504 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\inficon.exe
  + 2008-05-20 21:49:32 159,504 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\inficon.exe
  - 2007-12-27 19:03:31 217,864 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\misc.exe
  + 2008-05-20 21:49:32 217,864 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\misc.exe
  - 2007-12-27 19:03:32 18,704 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\mspicons.exe
  + 2008-05-20 21:49:32 18,704 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\mspicons.exe
  - 2007-12-27 19:03:32 35,088 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\oisicon.exe
  + 2008-05-20 21:49:32 35,088 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\oisicon.exe
  - 2007-12-27 19:03:31 845,584 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\outicon.exe
  + 2008-05-20 21:49:32 845,584 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\outicon.exe
  - 2007-12-27 19:03:31 922,384 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\pptico.exe
  + 2008-05-20 21:49:32 922,384 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\pptico.exe
  - 2007-12-27 19:03:31 272,648 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\pubs.exe
  + 2008-05-20 21:49:32 272,648 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\pubs.exe
  - 2007-12-27 19:03:32 888,080 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\wordicon.exe
  + 2008-05-20 21:49:32 888,080 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\wordicon.exe
  - 2007-12-27 19:03:31 1,172,240 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\xlicons.exe
  + 2008-05-20 21:49:32 1,172,240 ----a-r C:\WINDOWS\Installer\{90120000-0011-0000-0000-0000000FF1CE}\xlicons.exe
  - 2007-10-10 23:49:42 124,928 -c----w C:\WINDOWS\system32\dllcache\advpack.dll
  + 2008-03-01 12:58:06 124,928 -c----w C:\WINDOWS\system32\dllcache\advpack.dll
  + 2008-03-25 04:50:25 554,008 -c----w C:\WINDOWS\system32\dllcache\dao360.dll
  + 2008-02-20 05:35:05 148,992 -c----w C:\WINDOWS\system32\dllcache\dnsapi.dll
  + 2008-02-20 05:35:05 45,568 -c----w C:\WINDOWS\system32\dllcache\dnsrslvr.dll
  - 2007-10-10 23:49:42 214,528 -c----w C:\WINDOWS\system32\dllcache\dxtrans.dll
  + 2008-03-01 12:58:06 214,528 -c----w C:\WINDOWS\system32\dllcache\dxtrans.dll
  - 2007-10-10 23:49:42 132,608 -c----w C:\WINDOWS\system32\dllcache\extmgr.dll
  + 2008-03-01 12:58:06 133,120 -c----w C:\WINDOWS\system32\dllcache\extmgr.dll
  + 2008-02-20 06:51:00 282,624 -c----w C:\WINDOWS\system32\dllcache\gdi32.dll
  - 2007-10-10 23:49:42 63,488 -c----w C:\WINDOWS\system32\dllcache\icardie.dll
  + 2008-03-01 12:58:06 63,488 -c----w C:\WINDOWS\system32\dllcache\icardie.dll
  - 2007-10-10 11:00:41 70,656 -c----w C:\WINDOWS\system32\dllcache\ie4uinit.exe
  + 2008-02-29 08:56:41 70,656 -c----w C:\WINDOWS\system32\dllcache\ie4uinit.exe
  - 2007-10-10 23:49:42 153,088 -c----w C:\WINDOWS\system32\dllcache\ieakeng.dll
  + 2008-03-01 12:58:06 153,088 -c----w C:\WINDOWS\system32\dllcache\ieakeng.dll
  - 2007-10-10 23:49:42 230,400 -c----w C:\WINDOWS\system32\dllcache\ieaksie.dll
  + 2008-03-01 12:58:06 230,400 -c----w C:\WINDOWS\system32\dllcache\ieaksie.dll
  - 2007-10-10 05:46:55 161,792 -c----w C:\WINDOWS\system32\dllcache\ieakui.dll
  + 2008-02-15 05:44:25 161,792 -c----w C:\WINDOWS\system32\dllcache\ieakui.dll
  - 2007-10-10 23:49:42 383,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll
  + 2008-03-01 12:58:07 383,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll
  - 2007-10-10 23:49:42 384,512 -c----w C:\WINDOWS\system32\dllcache\iedkcs32.dll
  + 2008-03-01 12:58:07 384,512 -c----w C:\WINDOWS\system32\dllcache\iedkcs32.dll
  - 2007-10-10 23:49:43 6,065,664 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll
  + 2008-03-01 12:58:08 6,066,176 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll
  - 2007-10-10 23:49:43 44,544 -c----w C:\WINDOWS\system32\dllcache\iernonce.dll
  + 2008-03-01 12:58:08 44,544 -c----w C:\WINDOWS\system32\dllcache\iernonce.dll
  - 2007-10-10 23:49:43 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll
  + 2008-03-01 12:58:08 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll
  - 2007-10-10 10:59:40 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe
  + 2008-02-22 10:00:51 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe
  - 2007-10-10 11:00:59 625,152 -c----w C:\WINDOWS\system32\dllcache\iexplore.exe
  + 2008-02-29 08:57:05 625,664 -c----w C:\WINDOWS\system32\dllcache\iexplore.exe
  - 2007-10-10 23:49:44 27,648 -c----w C:\WINDOWS\system32\dllcache\jsproxy.dll
  + 2008-03-01 12:58:08 27,648 -c----w C:\WINDOWS\system32\dllcache\jsproxy.dll
  + 2007-11-07 09:28:31 728,576 -c----w C:\WINDOWS\system32\dllcache\lsasrv.dll
  + 2008-03-25 04:50:28 518,944 -c----w C:\WINDOWS\system32\dllcache\msexch40.dll
  + 2008-03-25 04:50:30 326,432 -c----w C:\WINDOWS\system32\dllcache\msexcl40.dll
  - 2007-10-10 23:49:44 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll
  + 2008-03-01 12:58:08 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll
  - 2007-10-10 23:49:44 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
  + 2008-03-01 12:58:08 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
  - 2007-10-31 03:53:50 3,590,656 -c----w C:\WINDOWS\system32\dllcache\mshtml.dll
  + 2008-03-01 16:28:10 3,591,680 -c----w C:\WINDOWS\system32\dllcache\mshtml.dll
  - 2007-10-10 23:49:44 478,208 -c----w C:\WINDOWS\system32\dllcache\mshtmled.dll
  + 2008-03-01 12:58:09 478,208 -c----w C:\WINDOWS\system32\dllcache\mshtmled.dll
  + 2008-03-25 04:50:34 1,516,568 -c----w C:\WINDOWS\system32\dllcache\msjet40.dll
  + 2008-03-25 04:50:40 355,112 -c----w C:\WINDOWS\system32\dllcache\msjetol1.dll
  + 2008-03-25 04:51:08 194,144 -c----w C:\WINDOWS\system32\dllcache\msjint40.dll
  + 2008-03-25 04:50:42 60,192 -c----w C:\WINDOWS\system32\dllcache\msjter40.dll
  + 2008-03-25 04:50:42 248,608 -c----w C:\WINDOWS\system32\dllcache\msjtes40.dll
  + 2008-03-25 08:20:46 219,936 -c----w C:\WINDOWS\system32\dllcache\msltus40.dll
  + 2008-03-25 04:50:45 355,104 -c----w C:\WINDOWS\system32\dllcache\mspbde40.dll
  - 2007-10-10 23:49:44 193,024 -c----w C:\WINDOWS\system32\dllcache\msrating.dll
  + 2008-03-01 12:58:10 193,024 -c----w C:\WINDOWS\system32\dllcache\msrating.dll
  + 2008-03-25 04:50:47 432,928 -c----w C:\WINDOWS\system32\dllcache\msrd2x40.dll
  + 2008-03-25 04:50:49 322,336 -c----w C:\WINDOWS\system32\dllcache\msrd3x40.dll
  + 2008-03-25 04:50:52 559,904 -c----w C:\WINDOWS\system32\dllcache\msrepl40.dll
  + 2008-03-25 04:50:55 264,992 -c----w C:\WINDOWS\system32\dllcache\mstext40.dll
  - 2007-10-10 23:49:45 671,232 -c----w C:\WINDOWS\system32\dllcache\mstime.dll
  + 2008-03-01 12:58:10 671,232 -c----w C:\WINDOWS\system32\dllcache\mstime.dll
  + 2008-03-25 04:50:57 838,432 -c----w C:\WINDOWS\system32\dllcache\mswdat10.dll
  + 2008-03-25 04:51:09 621,344 -c----w C:\WINDOWS\system32\dllcache\mswstr10.dll
  + 2008-03-25 04:50:58 355,104 -c----w C:\WINDOWS\system32\dllcache\msxbde40.dll
  - 2007-10-10 23:49:45 102,400 -c----w C:\WINDOWS\system32\dllcache\occache.dll
  + 2008-03-01 12:58:10 102,912 -c----w C:\WINDOWS\system32\dllcache\occache.dll
  + 2007-12-04 18:41:36 550,912 -c----w C:\WINDOWS\system32\dllcache\oleaut32.dll
  - 2007-10-10 23:49:45 105,984 -c----w C:\WINDOWS\system32\dllcache\url.dll
  + 2008-03-01 12:58:10 105,984 -c----w C:\WINDOWS\system32\dllcache\url.dll
  - 2007-10-10 23:49:45 1,159,680 -c----w C:\WINDOWS\system32\dllcache\urlmon.dll
  + 2008-03-01 12:58:10 1,159,680 -c----w C:\WINDOWS\system32\dllcache\urlmon.dll
  - 2007-10-10 23:49:45 232,960 -c----w C:\WINDOWS\system32\dllcache\webcheck.dll
  + 2008-03-01 12:58:11 233,472 -c----w C:\WINDOWS\system32\dllcache\webcheck.dll
  - 2004-08-28 13:00:00 147,456 ----a-w C:\WINDOWS\system32\dnsapi.dll
  + 2008-02-20 05:35:05 148,992 ----a-w C:\WINDOWS\system32\dnsapi.dll
  - 2004-08-28 13:00:00 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
  + 2008-02-20 05:35:05 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
  - 2004-08-28 13:00:00 181,248 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys
  + 2007-12-18 09:51:35 179,584 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys
  - 2004-08-28 13:00:00 360,576 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
  + 2007-10-30 17:20:55 360,064 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
  - 2004-08-28 13:00:00 346,624 ----a-w C:\WINDOWS\system32\dxtmsft.dll
  + 2008-03-01 12:58:06 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll
  - 2007-10-10 23:49:42 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll
  + 2008-03-01 12:58:06 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll
  - 2007-10-10 23:49:42 132,608 ----a-w C:\WINDOWS\system32\extmgr.dll
  + 2008-03-01 12:58:06 133,120 ----a-w C:\WINDOWS\system32\extmgr.dll
  - 2007-12-28 17:55:14 819,432 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
  + 2008-05-21 16:59:46 819,432 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
  - 2004-08-28 13:00:00 282,112 ----a-w C:\WINDOWS\system32\gdi32.dll
  + 2008-02-20 06:51:00 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
  - 2007-10-10 23:49:42 63,488 ----a-w C:\WINDOWS\system32\icardie.dll
  + 2008-03-01 12:58:06 63,488 ----a-w C:\WINDOWS\system32\icardie.dll
  - 2007-10-10 11:00:41 70,656 ----a-w C:\WINDOWS\system32\ie4uinit.exe
  + 2008-02-29 08:56:41 70,656 ----a-w C:\WINDOWS\system32\ie4uinit.exe
  - 2007-10-10 23:49:42 153,088 ----a-w C:\WINDOWS\system32\ieakeng.dll
  + 2008-03-01 12:58:06 153,088 ----a-w C:\WINDOWS\system32\ieakeng.dll
  - 2007-10-10 23:49:42 230,400 ----a-w C:\WINDOWS\system32\ieaksie.dll
  + 2008-03-01 12:58:06 230,400 ----a-w C:\WINDOWS\system32\ieaksie.dll
  - 2007-10-10 05:46:55 161,792 ----a-w C:\WINDOWS\system32\ieakui.dll
  + 2008-02-15 05:44:25 161,792 ----a-w C:\WINDOWS\system32\ieakui.dll
  - 2007-10-10 23:49:42 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll
  + 2008-03-01 12:58:07 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll
  - 2007-10-10 23:49:42 384,512 ----a-w C:\WINDOWS\system32\iedkcs32.dll
  + 2008-03-01 12:58:07 384,512 ----a-w C:\WINDOWS\system32\iedkcs32.dll
  - 2007-10-10 23:49:43 44,544 ----a-w C:\WINDOWS\system32\iernonce.dll
  + 2008-03-01 12:58:08 44,544 ----a-w C:\WINDOWS\system32\iernonce.dll
  - 2007-10-10 10:59:40 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
  + 2008-02-22 10:00:51 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
  - 2007-10-10 23:49:44 27,648 ----a-w C:\WINDOWS\system32\jsproxy.dll
  + 2008-03-01 12:58:08 27,648 ----a-w C:\WINDOWS\system32\jsproxy.dll
  - 2004-08-28 13:00:00 733,184 ----a-w C:\WINDOWS\system32\lsasrv.dll
  + 2007-11-07 09:28:31 728,576 ----a-w C:\WINDOWS\system32\lsasrv.dll
  - 2007-12-02 14:00:06 18,684,536 ----a-w C:\WINDOWS\system32\mrt.exe
  + 2008-05-09 12:35:06 16,863,864 ----a-w C:\WINDOWS\system32\mrt.exe
  - 2004-08-28 13:00:00 512,029 ----a-w C:\WINDOWS\system32\msexch40.dll
  + 2008-03-25 04:50:28 518,944 ----a-w C:\WINDOWS\system32\msexch40.dll
  - 2004-08-28 13:00:00 319,517 ----a-w C:\WINDOWS\system32\msexcl40.dll
  + 2008-03-25 04:50:30 326,432 ----a-w C:\WINDOWS\system32\msexcl40.dll
  - 2004-08-28 13:00:00 477,696 ------w C:\WINDOWS\system32\mshtmled.dll
  + 2008-03-01 12:58:09 478,208 ------w C:\WINDOWS\system32\mshtmled.dll
  - 2004-08-28 13:00:00 1,507,356 ----a-w C:\WINDOWS\system32\msjet40.dll
  + 2008-03-25 04:50:34 1,516,568 ----a-w C:\WINDOWS\system32\msjet40.dll
  - 2004-08-28 13:00:00 358,976 ----a-w C:\WINDOWS\system32\msjetoledb40.dll
  + 2008-03-25 04:50:40 355,112 ----a-w C:\WINDOWS\system32\msjetoledb40.dll
  - 2004-08-28 13:00:00 184,351 ----a-w C:\WINDOWS\system32\msjint40.dll
  + 2008-03-25 04:51:08 194,144 ----a-w C:\WINDOWS\system32\msjint40.dll
  - 2004-08-28 13:00:00 53,279 ----a-w C:\WINDOWS\system32\msjter40.dll
  + 2008-03-25 04:50:42 60,192 ----a-w C:\WINDOWS\system32\msjter40.dll
  - 2004-08-28 13:00:00 241,693 ----a-w C:\WINDOWS\system32\msjtes40.dll
  + 2008-03-25 04:50:42 248,608 ----a-w C:\WINDOWS\system32\msjtes40.dll
  - 2004-08-28 13:00:00 213,023 ----a-w C:\WINDOWS\system32\msltus40.dll
  + 2008-03-25 08:20:46 219,936 ----a-w C:\WINDOWS\system32\msltus40.dll
  - 2004-08-28 13:00:00 348,189 ----a-w C:\WINDOWS\system32\mspbde40.dll
  + 2008-03-25 04:50:45 355,104 ----a-w C:\WINDOWS\system32\mspbde40.dll
  - 2007-10-10 23:49:44 193,024 ----a-w C:\WINDOWS\system32\msrating.dll
  + 2008-03-01 12:58:10 193,024 ----a-w C:\WINDOWS\system32\msrating.dll
  - 2004-08-28 13:00:00 421,919 ----a-w C:\WINDOWS\system32\msrd2x40.dll
  + 2008-03-25 04:50:47 432,928 ----a-w C:\WINDOWS\system32\msrd2x40.dll
  - 2004-08-28 13:00:00 315,423 ----a-w C:\WINDOWS\system32\msrd3x40.dll
  + 2008-03-25 04:50:49 322,336 ----a-w C:\WINDOWS\system32\msrd3x40.dll
  - 2004-08-28 13:00:00 552,989 ----a-w C:\WINDOWS\system32\msrepl40.dll
  + 2008-03-25 04:50:52 559,904 ----a-w C:\WINDOWS\system32\msrepl40.dll
  - 2004-08-28 13:00:00 258,077 ----a-w C:\WINDOWS\system32\mstext40.dll
  + 2008-03-25 04:50:55 264,992 ----a-w C:\WINDOWS\system32\mstext40.dll
  - 2007-10-10 23:49:45 671,232 ----a-w C:\WINDOWS\system32\mstime.dll
  + 2008-03-01 12:58:10 671,232 ----a-w C:\WINDOWS\system32\mstime.dll
  - 2004-08-28 13:00:00 838,360 ----a-w C:\WINDOWS\system32\mswdat10.dll
  + 2008-03-25 04:50:57 838,432 ----a-w C:\WINDOWS\system32\mswdat10.dll
  - 2004-08-28 13:00:00 621,272 ----a-w C:\WINDOWS\system32\mswstr10.dll
  + 2008-03-25 04:51:09 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
  - 2004-08-28 13:00:00 348,189 ----a-w C:\WINDOWS\system32\msxbde40.dll
  + 2008-03-25 04:50:58 355,104 ----a-w C:\WINDOWS\system32\msxbde40.dll
  - 2007-10-10 23:49:45 102,400 ----a-w C:\WINDOWS\system32\occache.dll
  + 2008-03-01 12:58:10 102,912 ----a-w C:\WINDOWS\system32\occache.dll
  - 2004-08-28 13:00:00 549,888 ----a-w C:\WINDOWS\system32\oleaut32.dll
  + 2007-12-04 18:41:36 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
  - 2004-08-28 13:00:00 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll
  + 2008-03-01 12:58:10 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll
  - 2006-06-29 12:07:36 14,048 ------w C:\WINDOWS\system32\spmsg2.dll
  + 2006-06-29 11:07:36 14,048 ------w C:\WINDOWS\system32\spmsg2.dll
  - 2004-08-28 13:00:00 344,064 ------w C:\WINDOWS\system32\webcheck.dll
  + 2008-03-01 12:58:11 233,472 ------w C:\WINDOWS\system32\webcheck.dll
  - 2004-08-28 13:00:00 1,844,096 ----a-w C:\WINDOWS\system32\win32k.sys
  + 2008-03-20 08:09:22 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
  .
  -- Snapshot reset to current date --
  .
  ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  REGEDIT4
  *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-28 15:00 25088]
  "MSMSGS"="C:\Program Files\Messenger\MSMSGS.exe" [2003-04-14 21:05 1498032]
  "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [ ]
  "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-05-16 18:41 171448]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2007-01-10 22:59 1235456]
  "UberIcon"="C:\Program Files\UberIcon\UberIcon Manager.exe" [2006-07-18 00:16 122880]
  "VisualTaskTips"="C:\Windows\System32\VisualTaskTips.exe" [2004-08-28 15:00 36864]
  "Vistadrv"="C:\WINDOWS\system32\Vistadrive\vsdrv.exe" [2006-07-30 04:37 121089]
  "TransBar"="C:\WINDOWS\system32\transbar.exe" [2004-08-28 15:00 139264]
  "Styler"="C:\Program Files\styler\Styler.exe" [2006-05-03 12:48 307200]
  "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 20:20 866584]
  "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-31 08:35 7634944]
  "nwiz"="nwiz.exe" [2006-10-31 08:35 1622016 C:\WINDOWS\system32\nwiz.exe]
  "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-31 08:35 86016]
  "NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
  "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
  "WIAWizardMenu"="C:\WINDOWS\system32\sti_ci.dll" [2004-08-28 15:00 678912]
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
  "TSClientMSIUninstaller"="cmd.exe" [2004-08-28 15:00 403968 C:\WINDOWS\system32\cmd.exe]
  "tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-28 15:00 44544]
  "nltide3"="cmd.exe" [2004-08-28 15:00 403968 C:\WINDOWS\system32\cmd.exe]
  "nltide2"="cmd.exe" [2004-08-28 15:00 403968 C:\WINDOWS\system32\cmd.exe]
  "nltide_2"="regsvr32 /s /n /i:U shell32" []
  "nltide_3"="advpack.dll" [2004-08-28 15:00 124928 C:\WINDOWS\system32\advpack.dll]
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
  "NoUserNameInStartMenu"= 1 (0x1)
  "NoSMHelp"= 1 (0x1)
  
  [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
  "NoUserNameInStartMenu"= 1 (0x1)
  "NoSMHelp"= 1 (0x1)
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
  "aux"= ctwdm32.dll
  
  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
  "AntiVirusDisableNotify"=dword:00000001
  "AntiVirusOverride"=dword:00000001
  "FirewallOverride"=dword:00000001
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
  "%windir%\\system32\\sessmgr.exe"=
  "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
  "C:\\Program Files\\MSN Messenger\\livecall.exe"=
  "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
  "C:\\Program Files\\Messenger\\msmsgs.exe"=
  
  R0 Si3112;Si3112;C:\WINDOWS\system32\drivers\Si3112.sys [2004-08-28 15:00]
  R0 Si3124;Si3124;C:\WINDOWS\system32\drivers\Si3124.sys [2004-08-28 15:00]
  R0 Si3132r5;Si3132r5;C:\WINDOWS\system32\drivers\Si3132r5.sys [2004-08-28 15:00]
  R0 Si3531;Si3531;C:\WINDOWS\system32\drivers\Si3531.sys [2004-08-28 15:00]
  R2 IJPLMSVC;PIXMA Extended Survey Program;C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2006-11-10 17:12]
  R3 usbstor;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-12-29 01:58]
  S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 23:58]
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5fc59197-b4a7-11dc-b5d8-001bb9ba4ab1}]
  \Shell\AutoRun\command - I:\start.exe
  \Shell\FramaKey\command - I:\start.exe
  
  .
  Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
  "2008-05-21 17:03:03 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
  - C:\Program Files\Windows Defender\MpCmdRun.exe
  .
  **************************************************************************
  
  catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2008-05-21 19:07:08
  Windows 5.1.2600 Service Pack 2 NTFS
  
  Balayage processus cach‚s ...
  
  Balayage cach‚ autostart entries ...
  
  Balayage des fichiers cach‚s ...
  
  Scan termin‚ avec succŠs
  Les fichiers cach‚s: 0
  
  **************************************************************************
  .
  ------------------------ Other Running Processes ------------------------
  .
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
  C:\WINDOWS\system32\nvsvc32.exe
  C:\WINDOWS\system32\devldr32.exe
  C:\WINDOWS\system32\rundll32.exe
  .
  **************************************************************************
  .
  Temps d'accomplissement: 2008-05-21 19:09:43 - machine was rebooted
  ComboFix-quarantined-files.txt 2008-05-21 17:09:39
  ComboFix2.txt 2008-05-20 21:32:56
  ComboFix3.txt 2008-05-20 18:00:25
  
  Pre-Run: 149,027,221,504 octets libres
  Post-Run: 149,019,668,480 octets libres
  
  436 --- E O F --- 2008-05-20 21:49:35
  
  Et le rapport hijackthis:
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 19:14:14, on 21/05/2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16640)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
  C:\WINDOWS\system32\nvsvc32.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Sidebar\sidebar.exe
  C:\Program Files\UberIcon\UberIcon Manager.exe
  C:\Windows\System32\VisualTaskTips.exe
  C:\Program Files\styler\Styler.exe
  C:\WINDOWS\system32\devldr32.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\WINDOWS\system32\RUNDLL32.EXE
  C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Messenger\MSMSGS.EXE
  C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
  C:\Program Files\Windows Sidebar\sidebar.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\WINDOWS\explorer.exe
  C:\Program Files\internet explorer\iexplore.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.fr/keyword/%s
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
  O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\styler\TB\StylerTB.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
  O4 - HKLM\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
  O4 - HKLM\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe"
  O4 - HKLM\..\Run: [VisualTaskTips] C:\Windows\System32\VisualTaskTips.exe
  O4 - HKLM\..\Run: [Vistadrv] C:\WINDOWS\system32\Vistadrive\vsdrv.exe
  O4 - HKLM\..\Run: [TransBar] C:\WINDOWS\system32\transbar.exe /s
  O4 - HKLM\..\Run: [Styler] C:\Program Files\styler\Styler.exe
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
  O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
  O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
  O4 - HKUS\S-1-5-19\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [nltide2] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-20\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SERVICE RÉSEAU')
  O4 - HKUS\S-1-5-18\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'Default user')
  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
  O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - https://www.eset.com/
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
  O17 - HKLM\System\CCS\Services\Tcpip\..\{FA461808-97E5-4AC2-A684-A907C46229C7}: NameServer = 192.168.1.1
  O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
  
  0
Réponse 20 / 37
gaeloutia
Bonjour,
Je suis un peu débutante dans le domaine des virus dont je suis atteinte lol. Ce site est trés bien fait. Aprés plusieurs lectures, j'ai plus ou moins compris qu'il fallait que j'utilise le logiciel hijackthis pour en sortir un rapport que voici:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:56:50, on 19/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20627)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\UberIcon\UberIcon Manager.exe
C:\Windows\System32\VisualTaskTips.exe
C:\Program Files\styler\Styler.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.fr/keyword/%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.fr/toolbar/ie8/sidebar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/toolbar/ie8/sidebar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Ultimate Edition
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O1 - Hosts: ::1 localhost
O1 - Hosts: 66.249.93.99 www.google.fr
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\styler\TB\StylerTB.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: pvnsmfor - {DD8FEC5A-8976-438D-B6C9-F10CE205D78F} - C:\WINDOWS\pvnsmfor.dll
O4 - HKLM\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKLM\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe"
O4 - HKLM\..\Run: [VisualTaskTips] C:\Windows\System32\VisualTaskTips.exe
O4 - HKLM\..\Run: [Vistadrv] C:\WINDOWS\system32\Vistadrive\vsdrv.exe
O4 - HKLM\..\Run: [TransBar] C:\WINDOWS\system32\transbar.exe /s
O4 - HKLM\..\Run: [Styler] C:\Program Files\styler\Styler.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [advap32] C:\DOCUME~1\Gaelle\LOCALS~1\Temp\stdcons.exe/r
O4 - HKLM\..\Run: [3456b848] rundll32.exe "C:\WINDOWS\system32\asafuoor.dll",b
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide2] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - https://www.eset.com/
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/default.aspx
O17 - HKLM\System\CCS\Services\Tcpip\..\{FA461808-97E5-4AC2-A684-A907C46229C7}: NameServer = 192.168.1.1
O21 - SSODL: vbksrofa - {B47C72E7-AECC-4420-B2D7-A2FE26FA09CE} - C:\WINDOWS\vbksrofa.dll (file missing)
O21 - SSODL: mpfanvqg - {B7C5A673-53A7-484A-B733-2DAEBAD587CA} - C:\WINDOWS\mpfanvqg.dll (file missing)
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

End of file - 8003 bytes

Bien sur pour moi ce n'est que du charabia alors est ce que quelqu'un pourrait m'aider. en vous remerciant par avance
0
- 1
- 2
Suivant

Rapport hijackthis fenetres pub imtempestives

37 réponses

Discussions similaires

Newsletters