Spyware secure,autres fenetres.....

Résolu
Kriemilde -  
Bonjour,
J'ai moi aussi des problèmes avec la fenetre spyware secure, beaucoup de fenetres publicitaires
qui s'ouvrent, le resident spybot m'affiche des fenetres genre :
C:\Windows\system32\ctfmon.exe à autoriser ou refuser (je ne sais pas toujours quoi faire) (modification du registre)
et cet après midi, je n'avais plus d'icones ni rien sur mon bureau (apres avoir suivi vos conseils,
j'ai reussii à tout faire reapparaitre!!
Mais les problèmes persistent, je ne sais plus quoi faire.
J'ai fait le navilog1 et voilà ce qu'il affiche:

Search Navipromo version 3.6.0 commencé le 18/07/2008 à 0:09:25,93

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "Marilyn"

Mise à jour le 27.06.2008 à 23h00 par IL-MAFIOSO

Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11
Système de fichiers : FAT32

Recherche executé en mode normal

*** Recherche Programmes installés ***

*** Recherche dossiers dans "C:\WINDOWS" ***

*** Recherche dossiers dans "C:\Program Files" ***

*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***

*** Recherche dossiers dans "c:\docume~1\alluse~1\menudÉ~1\progra~1" ***

*** Recherche dossiers dans "C:\Documents and Settings\Marilyn\applic~1" ***

*** Recherche dossiers dans "C:\Documents and Settings\Marilyn\locals~1\applic~1" ***

*** Recherche dossiers dans "C:\Documents and Settings\Marilyn\menud+~1\progra~1" ***

*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Fichier(s) caché(s) :

C:\Documents and Settings\Marilyn\Local Settings\Application Data\yqkakwo.exe 393216 bytes
C:\Documents and Settings\Marilyn\Local Settings\Application Data\yqkakwo.dat 32768 bytes
C:\Documents and Settings\Marilyn\Local Settings\Application Data\yqkakwo_nav.dat 458752 bytes
C:\Documents and Settings\Marilyn\Local Settings\Application Data\yqkakwo_navps.dat 32768 bytes

*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

Fichiers suspects :

nsinet.exe trouvé !

* Recherche dans "C:\Documents and Settings\Marilyn\locals~1\applic~1" *

Fichiers trouvés :

yqkakwo.exe trouvé !

*** Recherche fichiers ***

C:\WINDOWS\Downloaded Program Files\IaLdr32.inf trouvé !

*** Recherche clés spécifiques dans le Registre ***

HKEY_CURRENT_USER\Software\Lanconfig trouvé !

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :

C:\WINDOWS\system32\nsinet.exe trouvé !

2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :

* Dans "C:\Documents and Settings\Marilyn\locals~1\applic~1" :

hnarjmr_navfx.dat trouvé !
yqkakwo.dat trouvé !

3)Recherche Certificats :

Certificat Egroup trouvé !
Certificat Electronic-Group trouvé !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :

C:\WINDOWS\system32\nWDLnUtv.ini2 trouvé ! infection Vundo possible non traitée par cet outil !

*** Analyse terminée le 18/07/2008 à 0:12:48,46 ***

j'ai aussi fait le hijackthis et voilà le bloc note:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:51:25, on 17/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\T-Mobile\web'n'walk Manager 1.6\web'n'walk Manager 1.6.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Marilyn\LOCALS~1\Temp\Rar$EX00.281\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\eoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {88508010-C4A2-4B52-B136-4BD6D5543150} - C:\WINDOWS\system32\vtUnLDWn.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {BE7E4CE1-8CBA-44A6-956F-462A667D3286} - C:\WINDOWS\system32\efcAPjkL.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [BM4652bfb2] Rundll32.exe "C:\WINDOWS\system32\vpbpaeuj.dll",s
O4 - HKLM\..\RunOnce: [SpybotDeletingC6936] cmd /c del "C:\Program Files\Instant Access\Center\tray1.ico"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Packard Bell Data Secure] C:\Program Files\Packard Bell Data Secure\PBDataSecure.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acer Empowering Technology.lnk = C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?b071f86a5c944704a41040076f743b14
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?b071f86a5c944704a41040076f743b14
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.cyberlink.com/winxp/CheckDVD.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.map4you.at/Mapguide/mgaxctrl.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://static.ak.studiqg.fr/photouploader/ImageUploader4.cab?nocache=20071219-1
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-e62295c5984f3013.spaces.live.com/PhotoUpload/MsnPUpld.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5D0C1072-9C49-4C61-BD8F-E5C649770BFD}: NameServer = 213.162.65.1 213.162.65.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: efcAPjkL - C:\WINDOWS\SYSTEM32\efcAPjkL.dll
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O24 - Desktop Component 0: (no name) - https://www.laposte.fr/

--
End of file - 10855 bytes

Mais avec tout ça je ne suis pas très avancé, car je ne sais pas quoi en faire maintenant.
Pourriez vous m'aider pour les prochaines étapes, je n'ose pas m'aventurer seule, je crois que j'ai dejà fait trop de bétises, aussi à cause du resident spybot.....
Depuis, mon Internet explorer7 ne fonctionne plus correctement, alors j'utilise Mozilla.

J'éspère que vous pourrez me souffler les bonnes réponses.
Configuration: Windows XP
Firefox 2.0.0.14


Là dessus je vous ajoute le log du resident spybot:

15/02/2008 00:13:09 Autorisé(e) (based on user decision) value "NavLogon" (new data: "") supprimé(e) in Winlogon Notifiers!
21/02/2008 23:20:02 Refusé(e) (based on user decision) value "{67DABFBF-D0AB-41FA-9C46-CC0F21721616}" (new data: "") ajouté(e) in ActiveX Distribution Unit!
01/03/2008 12:13:42 Refusé(e) (based on user decision) value "MsnMsgr" (new data: ""C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background") modifié(e) in System Startup user entry!
01/03/2008 12:14:59 Refusé(e) (based on user blacklist) value "MsnMsgr" (new data: ""C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background") modifié(e) in System Startup user entry!
01/03/2008 12:17:55 Autorisé(e) (based on user decision) value "{9030D464-4C02-4ABF-8ECC-5164760863C6}" (new data: "") supprimé(e) in Browser Helper Object!
01/03/2008 12:17:56 Autorisé(e) (based on user whitelist) value "{9030D464-4C02-4ABF-8ECC-5164760863C6}" (new data: "") ajouté(e) in Browser Helper Object!
01/03/2008 12:35:27 Refusé(e) (based on user blacklist) value "MsnMsgr" (new data: ""C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background") modifié(e) in System Startup user entry!
01/03/2008 15:23:38 Refusé(e) (based on user blacklist) value "MsnMsgr" (new data: ""C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background") modifié(e) in System Startup user entry!
01/03/2008 20:39:30 Refusé(e) (based on user decision) value "wextract_cleanup0" (new data: "rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\TEMP\IXP000.TMP\"") ajouté(e) in System Startup global entry!
01/03/2008 20:41:10 Refusé(e) (based on user blacklist) value "MsnMsgr" (new data: ""C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background") modifié(e) in System Startup user entry!
02/03/2008 01:27:08 Refusé(e) (based on user decision) value "KernelFaultCheck" (new data: "%systemroot%\system32\dumprep 0 -k") ajouté(e) in System Startup global entry!
02/03/2008 13:37:42 Refusé(e) (based on user blacklist) value "MsnMsgr" (new data: ""C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background") modifié(e) in System Startup user entry!
02/03/2008 19:09:01 Refusé(e) (based on user blacklist) value "MsnMsgr" (new data: ""C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background") modifié(e) in System Startup user entry!
03/03/2008 13:56:43 Refusé(e) (based on user blacklist) value "MsnMsgr" (new data: ""C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background") modifié(e) in System Startup user entry!
03/03/2008 20:30:14 Refusé(e) (based on user blacklist) value "MsnMsgr" (new data: ""C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background") modifié(e) in System Startup user entry!
04/03/2008 19:27:17 Refusé(e) (based on user blacklist) value "MsnMsgr" (new data: ""C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background") modifié(e) in System Startup user entry!
05/03/2008 00:30:09 Refusé(e) (based on user decision) value "vptray" (new data: "C:\Program Files\NavNT\vptray.exe") ajouté(e) in System Startup global entry!
05/03/2008 00:30:29 Refusé(e) (based on user decision) value "vptray" (new data: "C:\Program Files\NavNT\vptray.exe") ajouté(e) in System Startup global entry!
05/03/2008 13:58:22 Refusé(e) (based on user blacklist) value "MsnMsgr" (new data: ""C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background") modifié(e) in System Startup user entry!
05/03/2008 21:02:46 Refusé(e) (based on user blacklist) value "MsnMsgr" (new data: ""C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background") modifié(e) in System Startup user entry!
05/03/2008 21:11:40 Refusé(e) (based on user decision) value "vptray" (new data: "C:\Program Files\NavNT\vptray.exe") ajouté(e) in System Startup global entry!
06/03/2008 15:02:09 Refusé(e) (based on user blacklist) value "MsnMsgr" (new data: ""C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background") modifié(e) in System Startup user entry!
06/03/2008 19:21:20 Refusé(e) (based on user blacklist) value "MsnMsgr" (new data: ""C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background") modifié(e) in System Startup user entry!
07/03/2008 21:50:29 Refusé(e) (based on user blacklist) value "MsnMsgr" (new data: ""C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background") modifié(e) in System Startup user entry!
07/03/2008 23:24:27 Autorisé(e) (based on user decision) value "FlashPlayerUpdate" (new data: "C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe") ajouté(e) in System Startup user entry!
08/03/2008 13:03:11 Autorisé(e) (based on user decision) value "FlashPlayerUpdate" (new data: "") supprimé(e) in System Startup user entry!
09/03/2008 02:34:49 Refusé(e) (based on user blacklist) value "MsnMsgr" (new data: ""C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background") modifié(e) in System Startup user entry!
09/03/2008 13:25:05 Refusé(e) (based on user blacklist) value "MsnMsgr" (new data: ""C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background") modifié(e) in System Startup user entry!
10/03/2008 21:34:58 Refusé(e) (based on user blacklist) value "MsnMsgr" (new data: ""C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background") modifié(e) in System Startup user entry!
11/03/2008 20:38:18 Refusé(e) (based on user blacklist) value "MsnMsgr" (new data: ""C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background") modifié(e) in System Startup user entry!
11/03/2008 20:39:58 Refusé(e) (based on user blacklist) value "MsnMsgr" (new data: ""C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background") modifié(e) in System Startup user entry!
11/03/2008 20:40:18 Refusé(e) (based on user blacklist) value "MsnMsgr" (new data: ""C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background") modifié(e) in System Startup user entry!
11/03/2008 20:43:26 Refusé(e) (based on user blacklist) value "MsnMsgr" (new data: ""C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background") modifié(e) in System Startup user entry!
11/03/2008 20:46:32 Refusé(e) (based on user blacklist) value "MsnMsgr" (new data: ""C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background") modifié(e) in System Startup user entry!
11/03/2008 20:48:26 Refusé(e) (based on user blacklist) value "MsnMsgr" (new data: ""C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background") modifié(e) in System Startup user entry!
12/03/2008 13:31:08 Refusé(e) (based on user blacklist) value "MsnMsgr" (new data: ""C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background") modifié(e) in System Startup user entry!
12/03/2008 19:29:37 Refusé(e) (based on user blacklist) value "MsnMsgr" (new data: ""C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background") modifié(e) in System Startup user entry!
12/03/2008 22:45:33 Refusé(e) (based on user blacklist) value "KernelFaultCheck" (new data: "%systemroot%\system32\dumprep 0 -k") ajouté(e) in System Startup global entry!
12/03/2008 23:41:42 Refusé(e) (based on user blacklist) value "KernelFaultCheck" (new data: "%systemroot%\system32\dumprep 0 -k") ajouté(e) in System Startup global entry!
13/03/2008 00:50:25 Autorisé(e) (based on user decision) value "BootExecute" (new data: "autocheck autochk /r \??\C:
autocheck autochk *
") modifié(e) in Session manager!
13/03/2008 01:15:33 Autorisé(e) (based on user decision) value "SpybotSD TeaTimer" (new data: "") supprimé(e) in System Startup user entry!
13/03/2008 01:15:41 Autorisé(e) (based on user decision) value "{53707962-6F74-2D53-2644-206D7942484F}" (new data: "") supprimé(e) in Browser Helper Object!
13/03/2008 15:39:37 Refusé(e) (based on user decision) value "ImageItEncrypt" (new data: "C:\WINDOWS\system32\ImageItEncrypt.exe") ajouté(e) in System Startup user entry!
17/03/2008 16:39:21 Autorisé(e) (based on user decision) value "MsnMsgr" (new data: ""C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background") modifié(e) in System Startup user entry!
02/04/2008 00:54:09 Autorisé(e) (based on user decision) value "crhvezp" (new data: "c:\documents and settings\marilyn\local settings\application data\crhvezp.exe crhvezp") ajouté(e) in System Startup user entry!
02/04/2008 00:54:15 Autorisé(e) (based on user decision) value "crhvezp" (new data: "") supprimé(e) in System Startup user entry!
07/04/2008 18:16:41 Refusé(e) (based on user decision) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
10/04/2008 21:34:34 Refusé(e) (based on user decision) value "FlashPlayerUpdate" (new data: "C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe") ajouté(e) in System Startup user entry!
10/04/2008 21:34:46 Refusé(e) (based on user decision) value "FlashPlayerUpdate" (new data: "C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe") ajouté(e) in System Startup user entry!
11/04/2008 01:57:41 Refusé(e) (based on user decision) value "UPnPMonitor" (new data: "") supprimé(e) in Shell services!
13/04/2008 13:18:27 Refusé(e) (based on user decision) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 13:20:34 Refusé(e) (based on user decision) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 13:26:04 Refusé(e) (based on user decision) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 13:26:16 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 13:28:16 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 13:30:17 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 13:32:16 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 13:34:17 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 13:36:16 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 13:38:17 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 13:40:17 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 13:42:16 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 13:44:17 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 13:46:17 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 13:48:17 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 13:50:17 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 13:52:17 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 13:54:17 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 13:56:17 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 13:58:17 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:00:17 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:02:18 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:04:17 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:06:17 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:08:17 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:10:17 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:12:18 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:14:18 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:16:17 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:18:17 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:20:18 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:22:17 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:24:18 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:26:18 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:28:17 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:30:18 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:32:18 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:34:18 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:36:18 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:38:18 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:40:18 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:42:18 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:44:18 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:46:18 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:48:18 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:50:18 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:52:18 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:54:19 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:56:18 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 14:58:19 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:00:19 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:02:18 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:04:18 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:06:19 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:08:19 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:10:19 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:12:18 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:14:19 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:16:19 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:18:19 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:20:18 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:22:19 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:24:19 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:26:19 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:28:20 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:30:19 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:32:19 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:34:20 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:36:19 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:38:19 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:40:19 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:42:20 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:44:20 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:46:19 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:48:20 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:50:20 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:52:19 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:54:19 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:56:20 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 15:58:20 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:00:20 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:02:19 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:04:19 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:06:20 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:08:20 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:10:20 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:12:20 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:14:20 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:16:20 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:18:20 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:20:20 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:22:20 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:24:21 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:26:20 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:28:20 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:30:21 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:32:20 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:34:20 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:36:21 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:38:20 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:40:20 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:42:21 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:44:21 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:46:21 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:48:20 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:50:20 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:52:20 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:54:20 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:56:21 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 16:58:21 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:00:21 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:02:21 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:04:21 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:06:21 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:08:21 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:10:21 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:12:21 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:14:21 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:16:21 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:18:22 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:20:22 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:22:22 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:24:22 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:26:21 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:28:21 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:30:21 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:32:21 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:34:22 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:36:22 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:38:22 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:40:22 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:42:22 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:44:22 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:46:22 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:48:21 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:50:21 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:52:22 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:54:22 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:56:22 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 17:58:22 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 18:00:22 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 18:02:22 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 18:04:22 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 18:06:22 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 18:08:22 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 18:10:22 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 18:12:23 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 18:14:23 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 18:16:22 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 18:18:23 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdeay.exe zhrrpdeay") ajouté(e) in System Startup user entry!
13/04/2008 18:20:22 Refusé(e) (based on user blacklist) value "zhrrpdeay" (new data: "c:\documents and settings\marilyn\local settings\application data\zhrrpdea

40 réponses

Résumé de la discussion

Le fil porte sur des problèmes liés à la fenêtre Spyware Secure et à des publicités, avec des alertes du résident Spybot demandant d'autoriser ou refuser des éléments comme ctfmon.exe et des icônes disparues. Des analyses Navilog1 et HijackThis révèlent des fichiers ou entry suspects dans le système, tels que yqkakwo.exe et nsinet.exe, des modifications de registre et des composants démarrés automatiquement. Le fil note aussi qu'un message Navilog évoque une infection Vundo possible non traitée par l'outil, accentuant l’inquiétude sur les prochaines étapes à effectuer dans ce contexte précis. En cas de doute, la discussion évoque de solliciter l'avis d'un spécialiste et de privilégier une désinfection guidée; l'Internet Explorer peut être impacté et Mozilla est utilisé temporairement.

Bobot (l’IA à votre service)
  1. jorginho67 Contributeur sécurité
    bon, apparament, les " bugs " qui me faisaient c...r viennent de disparaitre, j'ai vu ton message, je rejete un oeil sur le toplard et reviens...

    @+
    0
    1. Kriemilde Auteur
      Coucou,
      j'ai laissé mon message il a 30 min donc je ne m'attendais pas à une réponse si rapide.
      Je n'ai pas eu de problemes spéciales avec le forum, voilà, je voulais donc juste te remercier pour tout! Ce que tu verras sur mon message s'il s'affiche!
      Mais si je dois faire une derniere manip', pas de probleme!
      Bye bye!
      0
      1. jorginho67 Contributeur sécurité
        Bonsoir et désolé pour le retard
        Tu as du remarquer quelques bugs sur le forum, d'ou l'absence de réponses de ma part...
        Je ne sais pas si ça và le faire, la je ne vois pas ton dernier message, je te laisse une manip' a faire dès que je le peux.

        @+
        0
        1. Kriemilde Auteur
          Bonjour jorginho!

          Desolé pour la réponse tardive!
          Maintenant que tout est réglé, et que je n'ai plus de problème, je voulais te remercier d'avoir pris le temps de si bien m'aider et pour tous les conseils!
          Bonne continuation et bonnne fin d'été!

          Merci!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

          Amitiés,
          Marilyn
          0
          2. jorginho67 Contributeur sécurité
            Yop' ;-))

            Sinon j'ai encore deux petites questions: je ne comprends pas bien ce que tu entends par :
            Si tu as un routeur (ou une box), as-tu changé le mot de passe par défaut ? Sinon, fais le rapidement

            Je parle du mot de passe instalé par défaut lors de la premiere instalation de la box...

            Si tu en as mis un toi même ça devrait aller.

            j'ai installé AVG, est ce que ça suffit comme antispyware et antivirus?

            Tu veux dire la suite AVG8 ? ( antivirus avec anti spywares inclus ) ?

            Oui, c'est pas mal...

            @+
            0
            1. Kriemilde Auteur
              Hello!

              Apres une semaine, je viens te donner quelques nouvelles.
              J'ai eu une mauvaise surprise en milieu de semaine, c'est à dire que tout à coup il n'y avait plus d'icones sur mon bureau, donc j'ai eu une petite frayeur, car mon probleme avait commencé par ça la derniere fois.
              En fait je pense que cela était du a une mauvaise utilisation de mon firewall.

              J'ai donc fait une restauration du systeme et tout est réapparu. J'ai ensuite quand meme passer l'antivirus AVG, et le MBAM, et il n'y avait rien du tout, donc soulagée.
              J'ai aussi changé l'antivirus Kerio pour Comodo, qui m'est plus simple d'utilisation, car il explique le genre de l'application a effectué! Je suis novice, il faut tout m'expliquer!!!! sinon je fais des betises.
              Depuis je n'ai pas de problemes.

              Sinon j'ai encore deux petites questions: je ne comprends pas bien ce que tu entends par :
              Si tu as un routeur (ou une box), as-tu changé le mot de passe par défaut ? Sinon, fais le rapidement

              Pour acceder a internet j'ai un petit modem de marque huawei que je connecte a l'ordi par usb, et là il me demande un mot de passe.
              est ce que tu parles de ce mot de passe?

              Et ensuite, j'ai installé AVG, est ce que ça suffit comme antispyware et antivirus?

              Merci
              0
              1. Kriemilde Auteur
                Merci jorginho!
                Pour toute l'aide et les conseils! J'ai aussi beaucoup appris, et j'ai pas fini d'en apprendre!

                Je reviens dans quelques jours dire si tout se passe bien.

                Bonne journée!
                0
                1. jorginho67 Contributeur sécurité
                  En effet, je l'ai vu sur le log HJT !

                  Les infections se sont retrouvées dans les suppressions effectuées avec OtmoveIt ==> ce qui est normal
                  fait ceci pour finir cela va supprimer les outils inutiles et OtmoveIt

                  * Lance OTMoveIt par un double-clic
                  * Clic sur CleanUp!
                  * un téléchargement a lieu
                  * A la fin => clic YES
                  * le scan est rapide
                  * Un message en anglais demandant le redémarrage du PC => clic:YES
                  * après redémarrage => vider la corbeille

                  ensuite :

                  # Maintenant que ton ordinateur est propre je te conseille de créer un point de restauration sain, comme ça en cas de probleme (bug , plantage ..ect) tu pourras toujours revenir en arriere

                  Désactive ta "Restauration du système" puis réactive la.

                  (1) Désactivation

                  Clique droit sur le "Poste de travail" > Propriétés > onglet "Restauration du système" > coche la case "Désactiver la Restauration du système sur tous les lecteurs" => Appliquer .

                  Patiente jusqu'a que cela soit marqué "désactivée" puis Ok.

                  (2) Activation

                  Suivre le même chemin . décoche la case "Désactiver la Restauration du système sur tous les lecteurs" => Appliquer
                  .
                  Attends que cela soit a nouveau sur "surveillance" puis Ok. Redémarre l'ordinateur !

                  Conseils de base pour surfer avec un maximum de sécurité

                  # Utiliser le navigateur Firefox plus sur que IE7

                  POURQUOI ? Lire Attentivement ceci
                  comment sécuriser Firefox

                  # Vérifie les mises a jours des différents softs régulièrement ici https://www.flexera.com/products/operations/software-vulnerability-management.html
                  Tuto https://www.malekal.com/tester-la-vulnerabilite-de-son-systeme-2/
                  Pour java il faut désinstaller les anciennes versions (de java) via panneau de config / ajouts et suppression de programme

                  # Ne pas telecharger n'importe quoi, eviter les programes gratuits genre smileys, Macrogaming\SweetIM, Boonty games ...ect

                  # Toujours analyser les fichiers telechargés depuis un peer to peer (emule ,Shareaza, kazza ... ect) avant de les executer
                  Un peu de lecture à ce sujet
                  # Ne pas ouvrir les pieces jointes d'un expediteur inconnu et toujours les analyser</gras> avant de les ouvrir

                  # Toujours analyser les fichiers reçus via MSN ou autre avec ton antivirus

                  # MSN PREVENTION
                  =============================================================================================
                  # Un très bon nettoyeur a avoir impérativement
                  Malwarebyte's antimalware ftp://ftp.commentcamarche.com/download/mbam-setup.exe

                  # Passe regulierement un antispywares, pense a le mettre a jour avant de le lancer c'est tres important

                  spybot 1.6.6 > http://ww.commentcamarche.net/telecharger/telechargement 122 spybot

                  A Squarred > ftp://ftp.commentcamarche.com/download/a2FreeSetup.exe

                  SUPERAntiSpyware 4.1.1046 <http://ww.commentcamarche.net/telecharger/telecharger 34055294 superantispyware
                  =============================================================================================
                  # Supprime regulierement les fichiers inutiles (fichiers temporaires , cookies .. ect) a l'aide de CCleaner 2.04.543

                  https://www.malekal.com/tutoriel-ccleaner/
                  ftp://ftp.commentcamarche.com/download/ccsetup208.exe

                  # Nettoie ta base de registre avec RegCleaner 4.3.0.780 https://www.malekal.com/nettoyer-sa-base-de-registre-avec-windows-registry-cleaner/

                  =============================================================================================
                  Il est possible de temps en temps de supprimer le contenu du dossier c/windows/prefetch pour accelerer le demarrage de windows , mais seulement le contenu non le dossier...
                  VIDE le !!!

                  # Clique sur l'icône Poste de travail
                  # Sélectionne le disque c:\
                  # Positionne toi dans le dossier c:\Windows\Prefetch
                  # Sélectionne le Menu Edition, Sélectionner tout
                  # Appuie sur le touche Suppr du clavier afin de vider ce dossier
                  =============================================================================================
                  # Pense a défragmenter ton Disque Dur au moins une fois par mois !
                  comment ? http://www.infetech.com/article.php3?id_article=69
                  =============================================================================================
                  Encore un peu de lecture : sécuriser son pc et connaitre les menaces
                  =============================================================================================
                  /!\ Très important /!\

                  Si tu as un routeur (ou une box), as-tu changé le mot de passe par défaut ? Sinon, fais le rapidement :
                  Un nouveau trojan s'attaque au mot de passe des routeurs en cherchant si le mot de passe ne figure pas dans une liste préétablie.
                  Si oui, il prend le contrôle de l'ordi (et de la totalité du réseau). Un bon mot de passe doit avoir au moins 8 caractères et comprendre des lettres (en majuscule et en minuscule), des chiffres et des caractères spéciaux (é, #, ...). Il doit être conservé soigneusement (pour être retrouvé en cas d'oubli) ailleurs que sur un support informatique.

                  Tu peux mettre en résolu stp

                  Reviens me voir dans 2/3 jours me dire si tout và bien ;-))

                  Merci et bon surf !

                  @ plus !
                  0
                  1. Kriemilde Auteur
                    Coucou ,
                    oui j'habite bien en Autriche. Pourquoi? ça apparait sur mon rapport HJT? hé hé!!!
                    Sinon j'ai installé hier le firewall Kerio, et l'anti virus AVG.
                    En passant celui ci , voilà ce qu'il a trouvé:

                    Scan "Scan specific files or folders" was finished.
                    Infections found:;"31"
                    Infected objects removed or healed:;"31"
                    Not removed or healed:;"0"
                    Spyware found:;"0"
                    Spyware removed:;"0"
                    Not removed:;"0"
                    Warnings count:;"0"
                    Information count:;"0"
                    Scan started:;"dimanche 27 juillet 2008, 01:44:35"
                    Scan finished:;"dimanche 27 juillet 2008, 03:16:10 (1 hour(s) 31 minute(s) 34 second(s))"
                    Total object scanned:;"286540"
                    User who launched the scan:;"Marilyn"

                    Infections
                    File;"Infection";"Result"
                    C:\_OTMoveIt\MovedFiles\07252008_235415\WINDOWS\system32\zjolvu.dll;"Trojan horse Vundo.U";"Moved to Virus Vault"
                    C:\Program Files\Navilog1\Backupnavi\nsinet.exe;"Trojan horse Dropper.Eesbin.H";"Moved to Virus Vault"
                    C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP11\A0003230.dll;"Trojan horse Vundo.U";"Moved to Virus Vault"
                    C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP5\A0001430.DLL;"Trojan horse Vundo.U";"Moved to Virus Vault"
                    C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP5\A0001432.DLL;"Trojan horse Vundo.U";"Moved to Virus Vault"
                    C:\WINDOWS\system32\bififvso.dll;"Trojan horse Generic10.AMUY";"Moved to Virus Vault"
                    C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP7\A0001952.DLL;"Trojan horse Vundo.U";"Moved to Virus Vault"
                    C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP7\A0001953.DLL;"Trojan horse Vundo.U";"Moved to Virus Vault"
                    C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP9\A0002012.dll;"Virus found Win32/Heur";"Moved to Virus Vault"
                    C:\WINDOWS\system32\pqehdgpc.dll;"Trojan horse Vundo.U";"Moved to Virus Vault"
                    C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP9\A0002015.DLL;"Trojan horse Vundo.U";"Moved to Virus Vault"
                    C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP9\A0002016.dll;"Virus found Win32/Heur";"Moved to Virus Vault"
                    C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP9\A0002019.DLL;"Trojan horse Vundo.U";"Moved to Virus Vault"
                    C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP9\A0002020.dll;"Trojan horse Vundo.U";"Moved to Virus Vault"
                    C:\WINDOWS\system32\swoopsia.dll;"Trojan horse Vundo.U";"Moved to Virus Vault"
                    C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP11\A0003232.dll;"Trojan horse Generic10.AMUY";"Moved to Virus Vault"
                    C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP11\A0003234.dll;"Trojan horse Vundo.U";"Moved to Virus Vault"
                    C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP11\A0003235.dll;"Trojan horse Vundo.U";"Moved to Virus Vault"
                    C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP11\A0003236.DLL;"Trojan horse Vundo.U";"Moved to Virus Vault"
                    C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP12\A0003291.exe;"Trojan horse Dropper.Eesbin.H";"Moved to Virus Vault"
                    C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP12\A0003460.dll;"Trojan horse Vundo.U";"Moved to Virus Vault"
                    C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP12\A0003590.dll;"Trojan horse Vundo.U";"Moved to Virus Vault"
                    C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP12\A0003592.dll;"Trojan horse Vundo.U";"Moved to Virus Vault"
                    C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP31\A0011275.dll;"Trojan horse Vundo.U";"Moved to Virus Vault"
                    C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP31\A0011276.dll;"Trojan horse Generic10.AMUY";"Moved to Virus Vault"
                    C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP31\A0011277.dll;"Trojan horse Vundo.U";"Moved to Virus Vault"
                    C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP31\A0011278.dll;"Trojan horse Vundo.U";"Moved to Virus Vault"
                    C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP31\A0011279.dll;"Trojan horse Generic10.AMUY";"Moved to Virus Vault"
                    C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP31\A0011280.exe;"Trojan horse Dropper.Eesbin.H";"Moved to Virus Vault"
                    C:\WINDOWS\system32\wojcnvnf.dll;"Trojan horse Generic10.AMUY";"Moved to Virus Vault"
                    C:\WINDOWS\system32\ypmvcces.dll;"Trojan horse Vundo.U";"Moved to Virus Vault"

                    et le rapport HJT ensuite donne ça:

                    Logfile of Trend Micro HijackThis v2.0.2
                    Scan saved at 12:54:53, on 27/07/2008
                    Platform: Windows XP SP3 (WinNT 5.01.2600)
                    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
                    Boot mode: Normal

                    Running processes:
                    C:\WINDOWS\System32\smss.exe
                    C:\WINDOWS\system32\winlogon.exe
                    C:\WINDOWS\system32\services.exe
                    C:\WINDOWS\system32\lsass.exe
                    C:\WINDOWS\system32\Ati2evxx.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\WINDOWS\system32\spoolsv.exe
                    C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
                    C:\WINDOWS\system32\Ati2evxx.exe
                    C:\WINDOWS\Explorer.EXE
                    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
                    C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
                    C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
                    C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
                    C:\Program Files\NavNT\defwatch.exe
                    C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
                    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                    C:\Program Files\QuickTime\qttask.exe
                    C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
                    C:\PROGRA~1\AVG\AVG8\avgtray.exe
                    C:\WINDOWS\system32\ctfmon.exe
                    C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
                    C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
                    C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                    C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
                    C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
                    C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe
                    C:\WINDOWS\system32\wbem\wmiapsrv.exe
                    C:\WINDOWS\system32\wbem\unsecapp.exe
                    C:\Program Files\T-Mobile\web'n'walk Manager 1.6\web'n'walk Manager 1.6.exe
                    C:\Program Files\Mozilla Firefox\firefox.exe
                    C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
                    C:\Documents and Settings\Marilyn\Bureau\HiJackThis.exe

                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
                    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
                    O2 - BHO: QFX Software KeyScrambler - {2B9F5787-88A5-4945-90E7-C4B18563BC5E} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll
                    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
                    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
                    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                    O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
                    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                    O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
                    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
                    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
                    O4 - HKCU\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t
                    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                    O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
                    O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
                    O4 - Global Startup: Acer Empowering Technology.lnk = C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
                    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                    O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?b071f86a5c944704a41040076f743b14
                    O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?b071f86a5c944704a41040076f743b14
                    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
                    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
                    O9 - Extra button: (no name) - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll
                    O9 - Extra 'Tools' menuitem: &KeyScrambler... - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll
                    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
                    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                    O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
                    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
                    O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.cyberlink.com/winxp/CheckDVD.cab
                    O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://www.catalog.update.microsoft.com/ClientControl/en/x86/MuCatalogWebControl.cab?1217002341593
                    O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.map4you.at/Mapguide/mgaxctrl.cab
                    O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://static.ak.studiqg.fr/photouploader/ImageUploader4.cab?nocache=20071219-1
                    O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-e62295c5984f3013.spaces.live.com/PhotoUpload/MsnPUpld.cab
                    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
                    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                    O20 - AppInit_DLLs: avgrsstx.dll
                    O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
                    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
                    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
                    O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
                    O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
                    O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
                    O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
                    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
                    O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                    O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
                    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                    O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
                    O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
                    O24 - Desktop Component 0: (no name) - https://www.laposte.fr/
                    0
                    1. jorginho67 Contributeur sécurité
                      Tu t'es bien débrouillé ;-))

                      Une question :

                      Tu es en Autriche ?
                      0
                      1. Kriemilde Auteur
                        Hello jorginho!

                        Voilà lr drnier HJT que tu m'as demandé.
                        J'ai aussi enlevé le Java.

                        Logfile of Trend Micro HijackThis v2.0.2
                        Scan saved at 23:03:45, on 26/07/2008
                        Platform: Windows XP SP3 (WinNT 5.01.2600)
                        MSIE: Internet Explorer v7.00 (7.00.6000.16674)
                        Boot mode: Normal

                        Running processes:
                        C:\WINDOWS\System32\smss.exe
                        C:\WINDOWS\system32\winlogon.exe
                        C:\WINDOWS\system32\services.exe
                        C:\WINDOWS\system32\lsass.exe
                        C:\WINDOWS\system32\Ati2evxx.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\WINDOWS\system32\spoolsv.exe
                        C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
                        C:\WINDOWS\system32\Ati2evxx.exe
                        C:\WINDOWS\Explorer.EXE
                        C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
                        C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
                        C:\Program Files\NavNT\defwatch.exe
                        C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
                        C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                        C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                        C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                        C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                        C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
                        C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
                        C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
                        C:\Program Files\QuickTime\qttask.exe
                        C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
                        C:\WINDOWS\system32\ctfmon.exe
                        C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
                        C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe
                        C:\WINDOWS\system32\wbem\wmiapsrv.exe
                        C:\WINDOWS\system32\wbem\unsecapp.exe
                        C:\Program Files\T-Mobile\web'n'walk Manager 1.6\web'n'walk Manager 1.6.exe
                        C:\Program Files\Mozilla Firefox\firefox.exe
                        C:\Documents and Settings\Marilyn\Bureau\HiJackThis.exe

                        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                        F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
                        O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
                        O2 - BHO: QFX Software KeyScrambler - {2B9F5787-88A5-4945-90E7-C4B18563BC5E} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll
                        O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                        O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                        O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                        O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
                        O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                        O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
                        O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                        O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
                        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
                        O4 - HKCU\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t
                        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                        O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
                        O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
                        O4 - Global Startup: Acer Empowering Technology.lnk = C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
                        O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                        O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?b071f86a5c944704a41040076f743b14
                        O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?b071f86a5c944704a41040076f743b14
                        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
                        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
                        O9 - Extra button: (no name) - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll
                        O9 - Extra 'Tools' menuitem: &KeyScrambler... - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll
                        O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                        O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
                        O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                        O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
                        O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
                        O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.cyberlink.com/winxp/CheckDVD.cab
                        O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://www.catalog.update.microsoft.com/ClientControl/en/x86/MuCatalogWebControl.cab?1217002341593
                        O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.map4you.at/Mapguide/mgaxctrl.cab
                        O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://static.ak.studiqg.fr/photouploader/ImageUploader4.cab?nocache=20071219-1
                        O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-e62295c5984f3013.spaces.live.com/PhotoUpload/MsnPUpld.cab
                        O17 - HKLM\System\CCS\Services\Tcpip\..\{5D0C1072-9C49-4C61-BD8F-E5C649770BFD}: NameServer = 213.162.65.1 213.162.65.2
                        O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                        O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
                        O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
                        O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                        O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
                        O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
                        O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
                        O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
                        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
                        O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                        O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                        O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
                        O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                        O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
                        O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
                        O24 - Desktop Component 0: (no name) - https://www.laposte.fr/
                        0
                        1. Kriemilde Auteur
                          Hello!!

                          Je ne comprends pas tres bien ce passage:

                          Choisis la première ligne de téléchargement puis installe java.
                          En fin d'installation, revient sur la page pour vérifier ton installation.

                          J'ai bien installé Java mais sur qulle page dois je revenir, et comment dois vérifier l'installation s删ur la page?

                          Dans le panneau de config , j'ai trouvé : J2SE runtime environnement
                          Il n'y a que ça qui designe un élément Java. Est ça que je dois l'enlever?

                          Merci
                          0
                          1. jorginho67 Contributeur sécurité
                            Salut !

                            Si si, c'est ok....

                            On va pouvoir fignoler a présent !

                            La console Java n'est pas à jour: Faille de sécurité !!!
                            Voir ici pourquoi
                            Clique sur Download Latest Version

                            Choisis la première ligne de téléchargement puis installe java.
                            En fin d'installation, revient sur la page pour vérifier ton installation.
                            Quand l'installation a réussi, ouvre le panneau de configuration >
                            Ajout/suppression de programmes et supprimes les anciennes versions (de java) afin d’éliminer les failles de sécurité présentes dans ces anciennes versions.
                            Fais cela pour chacune d'elle, une a une, fais redémarrer ton PC quand cela te le sera demandé .
                            Tu gardes la Java\1.6.0.7 !

                            ===============================

                            Tu sembles ne pas avoir de parefeu contrôlant les connexions sortantes, ce qui est un risque de sécurité.
                            Tu DOIS ABSOLUMENT installer un vrai FIREWALL ( pare feu autre que celui de Windows qui est une vrai passoire ) .
                            Tu as le choix entre ces possibilités :

                            ========== /!\ Bien lire les Tutos pour un parametrage optimal /!\ ==========

                            * Zone Alarm En Français et le plus simple d'utilisation.

                            * Tuto et lien de téléchargement
                            ---------------------------------------------------------------------------------------
                            * Kerio Efficace mais un poil plus compliqué.

                            * Tuto et lien de téléchargement
                            autre lien
                            ---------------------------------------------------------------------------------------
                            * ComodoFirewallPro 2.4 En Français et simple aussi.

                            * ComodoFirewallPro 2.4
                            * Téléchargement de Comodo
                            * Tuto de config'
                            * ou encore ici

                            Attention la 3.0 est en anglais uniquement et est plus difficile a paramétrer
                            * Tuto de config'
                            ---------------------------------------------------------------------------------------
                            * Outpost

                            * Téléchargement d'Outpost
                            * Tuto de config'
                            ---------------------------------------------------------------------------------------
                            * Jetico, dont j'ai entendu que du bien :

                            * Téléchargement de Jetico
                            * Tuto de config'
                            ---------------------------------------------------------------------------------------
                            Il faut que tu désactives le parefeu de Windows (panneau de configuration, parefeu de Windows) après le téléchargement, et avant l'installation (déconnecte toi du Net à ce moment là).
                            =======================================

                            Quand tu auras installé le pare feu, et fais ces MàJ, reposte moi un dernier Hijackthis et on en finira avec la suppréssion des logiciels téléchargés pendant la désinfection.

                            @+
                            0
                            1. Kriemilde Auteur
                              Je viens de finir les demarches. Voilà les rapports, on verra ça demain.
                              J'ai juste l'impression que le fix cheked de HJT n'a pas correctement marché.

                              Logfile of Trend Micro HijackThis v2.0.2
                              Scan saved at 01:47:12, on 26/07/2008
                              Platform: Windows XP SP3 (WinNT 5.01.2600)
                              MSIE: Internet Explorer v7.00 (7.00.6000.16674)
                              Boot mode: Normal

                              Running processes:
                              C:\WINDOWS\System32\smss.exe
                              C:\WINDOWS\system32\winlogon.exe
                              C:\WINDOWS\system32\services.exe
                              C:\WINDOWS\system32\lsass.exe
                              C:\WINDOWS\system32\Ati2evxx.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\WINDOWS\System32\svchost.exe
                              C:\WINDOWS\system32\spoolsv.exe
                              C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
                              C:\WINDOWS\system32\Ati2evxx.exe
                              C:\WINDOWS\Explorer.EXE
                              C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
                              C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
                              C:\Program Files\NavNT\defwatch.exe
                              C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
                              C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                              C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                              C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                              C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
                              C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
                              C:\WINDOWS\system32\wbem\wmiapsrv.exe
                              C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
                              C:\WINDOWS\system32\wbem\unsecapp.exe
                              C:\Program Files\RegCleaner\RegCleanr.exe
                              C:\Program Files\RegCleaner\RegCleanr.exe
                              C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
                              C:\WINDOWS\system32\ctfmon.exe
                              C:\WINDOWS\system32\NOTEPAD.EXE
                              C:\Documents and Settings\Marilyn\Bureau\HiJackThis.exe

                              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                              R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                              R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                              F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
                              O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
                              O2 - BHO: QFX Software KeyScrambler - {2B9F5787-88A5-4945-90E7-C4B18563BC5E} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll
                              O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                              O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
                              O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                              O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                              O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
                              O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                              O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
                              O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                              O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
                              O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                              O4 - HKCU\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t
                              O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                              O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
                              O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
                              O4 - Global Startup: Acer Empowering Technology.lnk = C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
                              O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                              O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                              O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?b071f86a5c944704a41040076f743b14
                              O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?b071f86a5c944704a41040076f743b14
                              O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
                              O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
                              O9 - Extra button: (no name) - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll
                              O9 - Extra 'Tools' menuitem: &KeyScrambler... - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll
                              O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                              O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                              O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                              O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                              O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                              O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
                              O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                              O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
                              O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
                              O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.cyberlink.com/winxp/CheckDVD.cab
                              O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://www.catalog.update.microsoft.com/ClientControl/en/x86/MuCatalogWebControl.cab?1217002341593
                              O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.map4you.at/Mapguide/mgaxctrl.cab
                              O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://static.ak.studiqg.fr/photouploader/ImageUploader4.cab?nocache=20071219-1
                              O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-e62295c5984f3013.spaces.live.com/PhotoUpload/MsnPUpld.cab
                              O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                              O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
                              O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
                              O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                              O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
                              O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
                              O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
                              O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
                              O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                              O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
                              O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                              O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                              O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
                              O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                              O24 - Desktop Component 0: (no name) - https://www.laposte.fr/
                              0
                              1. Kriemilde Auteur
                                Ok , je vais faire ça. Et j'envoie les rapports pour demain.
                                Bonne nuit.
                                0
                                1. jorginho67 Contributeur sécurité
                                  Relance HijackThis, choisis "do a scan only"
                                  coche la case devant les lignes ci-dessous et clic en bas sur "fix checked".

                                  O2 - BHO: {158db079-0ce5-2feb-8374-65aa5a03999f} - {f99930a5-aa56-4738-bef2-5ec0970bd851} - C:\WINDOWS\system32\zjolvu.dll (file missing)
                                  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                                  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                                  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                                  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                                  O9 - Extra button: (no name) - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file)

                                  Comment fixer les lignes et Générer un rapport

                                  Femer HJT .

                                  Pour finir.... tu peux le faire tranquilement, et tu me postes les rapports demain..
                                  Ensuite, on nettoira les outils que je t'ai fait télécharger..

                                  Afin de suivre la procédure correctement, je te conseille d'enregistrer la page en sélectionnant toutes les lignes puis de copier cette sélection dans un fichier texte sur ton PC pour pouvoir appliquer la procédure correctement.
                                  Il faut exécuter toutes les étapes, sans interruption, dans l'ordre exact indiqué ci-dessous.
                                  Si un élément te paraît obscur, demande des explications avant de commencer la désinfection.

                                  1) Télécharge et installe

                                  # CCleaner
                                  https://www.ccleaner.com/ccleaner/download
                                  Choisi la version SLIM-No Toolbar.
                                  Installe-le en prenant soin de décocher les diverses options dont la barre Yahoo et la mise à jour.
                                  Lance CCleaner puis Clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures".
                                  Pour les autres paramètres, laisse-le avec ses réglages par défaut.
                                  Ferme le programme pour l’instant.

                                  2) Scan avec Malwarebyte's Anti-Malware

                                  Lance Malwarebyte's Anti-Malware
                                  Onglet "Recherche" >>> coche Executer un examen complet >>> Rechercher sélectionne tes disques durs puis clique sur Lancer l’examen
                                  A la fin du scan >>> clique sur Afficher les résultats puis sur Enregistrer le rapport
                                  Suppression des éléments détectés >>>> clique sur Supprimer la sélection
                                  S'il t'es demandé de redémarrer >>> clique sur "Yes"

                                  Un rapport de scan s'ouvre, enregistre sur ton Bureau.
                                  Puis ferme Malwarebyte's Anti-Malware

                                  3) Suppression de fichiers inutiles avec CCleaner

                                  Lance CCleaner en double-cliquant sur son raccourci sur le bureau.
                                  Puis dans le menu Nettoyeur
                                  Clique sur Analyse (laisser travailler cela peut durer longtemps la 1ere fois)
                                  Clique sur le bouton Lancer le nettoyage.
                                  Clique une seconde fois sur le bouton Lancer le nettoyage puis ferme CCleaner.

                                  4) Rapports

                                  Poste en réponse :
                                  * Un nouveau rapport HijackThis
                                  * Le rapport de Malwarebyte's Anti-Malware que tu as sauvegardé sur ton Bureau.

                                  Bon courage

                                  @+

                                  Tuto Malwarebyte's Anti-Malware
                                  0
                                  1. Kriemilde Auteur
                                    J'ai comme l'impression qu'il y a plus de ligne que tout à l'heure....
                                    Peut etre dû aux mises à jours?
                                    0
                                    1. Kriemilde Auteur
                                      Voilà le rapport HJT tout neuf:

                                      Logfile of Trend Micro HijackThis v2.0.2
                                      Scan saved at 00:07:11, on 26/07/2008
                                      Platform: Windows XP SP3 (WinNT 5.01.2600)
                                      MSIE: Internet Explorer v7.00 (7.00.6000.16674)
                                      Boot mode: Normal

                                      Running processes:
                                      C:\WINDOWS\System32\smss.exe
                                      C:\WINDOWS\system32\winlogon.exe
                                      C:\WINDOWS\system32\services.exe
                                      C:\WINDOWS\system32\lsass.exe
                                      C:\WINDOWS\system32\Ati2evxx.exe
                                      C:\WINDOWS\system32\svchost.exe
                                      C:\WINDOWS\System32\svchost.exe
                                      C:\WINDOWS\system32\spoolsv.exe
                                      C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
                                      C:\WINDOWS\system32\Ati2evxx.exe
                                      C:\WINDOWS\Explorer.EXE
                                      C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
                                      C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
                                      C:\Program Files\NavNT\defwatch.exe
                                      C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
                                      C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                                      C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                                      C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                                      C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                                      C:\WINDOWS\system32\svchost.exe
                                      C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
                                      C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
                                      C:\WINDOWS\system32\wbem\wmiapsrv.exe
                                      C:\Program Files\QuickTime\qttask.exe
                                      C:\WINDOWS\system32\ctfmon.exe
                                      C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
                                      C:\WINDOWS\system32\wbem\unsecapp.exe
                                      C:\Program Files\RegCleaner\RegCleanr.exe
                                      C:\Program Files\T-Mobile\web'n'walk Manager 1.6\web'n'walk Manager 1.6.exe
                                      C:\Program Files\Mozilla Firefox\firefox.exe
                                      C:\Program Files\RegCleaner\RegCleanr.exe
                                      C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                                      C:\Documents and Settings\Marilyn\Bureau\HiJackThis.exe

                                      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                                      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                      F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
                                      O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
                                      O2 - BHO: QFX Software KeyScrambler - {2B9F5787-88A5-4945-90E7-C4B18563BC5E} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll
                                      O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                                      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
                                      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                                      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                                      O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
                                      O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                                      O2 - BHO: {158db079-0ce5-2feb-8374-65aa5a03999f} - {f99930a5-aa56-4738-bef2-5ec0970bd851} - C:\WINDOWS\system32\zjolvu.dll (file missing)
                                      O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
                                      O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                                      O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
                                      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                                      O4 - HKCU\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t
                                      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                                      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                                      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                                      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                                      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                                      O4 - Global Startup: Acer Empowering Technology.lnk = C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
                                      O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                                      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                                      O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?b071f86a5c944704a41040076f743b14
                                      O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?b071f86a5c944704a41040076f743b14
                                      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
                                      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
                                      O9 - Extra button: (no name) - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll
                                      O9 - Extra 'Tools' menuitem: &KeyScrambler... - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll
                                      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                                      O9 - Extra button: (no name) - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file)
                                      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                                      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                                      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                      O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
                                      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                                      O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
                                      O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
                                      O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.cyberlink.com/winxp/CheckDVD.cab
                                      O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://www.catalog.update.microsoft.com/ClientControl/en/x86/MuCatalogWebControl.cab?1217002341593
                                      O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.map4you.at/Mapguide/mgaxctrl.cab
                                      O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://static.ak.studiqg.fr/photouploader/ImageUploader4.cab?nocache=20071219-1
                                      O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-e62295c5984f3013.spaces.live.com/PhotoUpload/MsnPUpld.cab
                                      O17 - HKLM\System\CCS\Services\Tcpip\..\{5D0C1072-9C49-4C61-BD8F-E5C649770BFD}: NameServer = 213.162.65.1 213.162.65.2
                                      O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                                      O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
                                      O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
                                      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                                      O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
                                      O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
                                      O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
                                      O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
                                      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                                      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
                                      O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                                      O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                                      O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
                                      O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                                      O24 - Desktop Component 0: (no name) - https://www.laposte.fr/
                                      0
                                      1. jorginho67 Contributeur sécurité
                                        Bien, refais moi un rapport HJT tout neuf !

                                        Relance Hijackthis en double cliquant sur son raccourci sur le Bureau.
                                        Choisis l'option "Do a system scan and save a log file"
                                        Clique sur "Save log" pour enregistrer le rapport qui s'ouvrira avec le bloc-note
                                        Clique sur "Edition" ->> "Sélectionner tout", puis sur "Edition" ->> Copier" pour copier tout le contenu du rapport ici
                                        0
                                        1. Kriemilde Auteur
                                          Bonsoir Jorginho!

                                          Voilà le rapport:

                                          DllUnregisterServer procedure not found in C:\WINDOWS\system32\zjolvu.dll
                                          C:\WINDOWS\system32\zjolvu.dll NOT unregistered.
                                          C:\WINDOWS\system32\zjolvu.dll moved successfully.

                                          OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 07252008_235415

                                          J'espere que ça resoudra ce probleme de MS Juan (si le probleme est là)
                                          Merci
                                          0
                                          • 1
                                          • 2

                                          Discussions similaires

                                          suite au message "secure boot violation" impossible d'accéder à window
                                          Walloute

                                          9 réponses
                                          Problème de clavier, des fenêtre s'ouvrent !!
                                          Lyon691D

                                          5 réponses
                                          Identifiant freewifi secure
                                          David

                                          2 réponses
                                          Security boot fail lors du démarrage
                                          Steu

                                          5 réponses
                                          Comment se débarrasser d'avast browser en cours d'installation
                                          VELUSINE

                                          11 réponses