Win32.worm.bagle

Résolu
Ccarino -  
Bonjour,
Tout d'abord je tiens a preciser que je suis debutant en informatique.

Voila mon probleme :
Depuis peu mon ordinateur a un probleme en effet je ne peut plus installer d'antivirus, je perd ma connexion internet regulierement.
Tous les nouveaux programmes installés, un message arrive lors du lancement :
"chemin de l'application n'est pas une application win32 valide".

Meme message pour lancé Hijackthis.

Seul malwarebytes a pu etre installé correctement. Après un scan il n'a pas pu effacer deux choses :
C:\windows\system32\wintems.exe
C:\windows\system32\drivers\hldrrr.exe

Voila vous savez tous.
Merci pour votre aide.
Configuration: Windows XP
Internet Explorer 7.0

46 réponses

Résumé de la discussion

Infection par un malware sur Windows XP empêche l’installation d’antivirus et provoque des déconnexions réseau, avec des messages indiquant que le chemin d’application n’est pas une application Win32 valide et des symptômes similaires. Des solutions de désinfection s'appuient sur Malwarebytes pour le scan et FindyKill pour supprimer les fichiers et clefs malveillants dans Windows XP, notamment wintems.exe et hldrrr.exe. En parallèle, des étapes de nettoyage du registre et un passage par le mode sans échec sont préconisés, puis l'installation ou la mise à jour d'un antivirus comme Kaspersky pour stabiliser la protection. D'autres évoquent une étape ultérieure avec Combofix pour approfondir le nettoyage et confirmer l'absence de résidus, en complément de FindyKill et Malwarebytes pour une restauration du système.

Bobot (l’IA à votre service)
  2. Ccarino Auteur
    nan sa a l'air bon comme tu di par contre juste pour savoir dans le scan de antivir il me met 2 warning
    c'est grave ou c'est normal
    2. Ccarino Auteur
      Avira AntiVir Personal
      Report file date: vendredi 10 octobre 2008 23:15

      Scanning for 1675978 virus strains and unwanted programs.

      Licensed to: Avira AntiVir PersonalEdition Classic
      Serial number: 0000149996-ADJIE-0001
      Platform: Windows XP
      Windows version: (Service Pack 3) [5.1.2600]
      Boot mode: Normally booted
      Username: SYSTEM
      Computer name: YOUR-E7F2723B7A

      Version information:
      BUILD.DAT : 8.1.0.331 16934 Bytes 12/08/2008 11:46:00
      AVSCAN.EXE : 8.1.4.7 315649 Bytes 26/06/2008 08:57:53
      AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40
      LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19
      LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52
      ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34
      ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 13:54:15
      ANTIVIR2.VDF : 7.0.7.12 4066816 Bytes 08/10/2008 12:07:02
      ANTIVIR3.VDF : 7.0.7.25 105984 Bytes 10/10/2008 12:07:04
      Engineversion : 8.1.1.35
      AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21
      AESCRIPT.DLL : 8.1.0.76 319867 Bytes 10/10/2008 12:07:23
      AESCN.DLL : 8.1.0.23 119156 Bytes 10/07/2008 12:44:49
      AERDL.DLL : 8.1.1.2 438644 Bytes 10/10/2008 12:07:21
      AEPACK.DLL : 8.1.2.3 364918 Bytes 10/10/2008 12:07:19
      AEOFFICE.DLL : 8.1.0.25 196986 Bytes 10/10/2008 12:07:16
      AEHEUR.DLL : 8.1.0.59 1438071 Bytes 10/10/2008 12:07:15
      AEHELP.DLL : 8.1.0.15 115063 Bytes 10/07/2008 12:44:48
      AEGEN.DLL : 8.1.0.36 315764 Bytes 10/10/2008 12:07:08
      AEEMU.DLL : 8.1.0.7 430452 Bytes 31/07/2008 08:33:21
      AECORE.DLL : 8.1.1.11 172406 Bytes 10/10/2008 12:07:06
      AEBB.DLL : 8.1.0.1 53617 Bytes 10/07/2008 12:44:48
      AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05
      AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01
      AVREP.DLL : 8.0.0.2 98344 Bytes 10/10/2008 12:07:04
      AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40
      AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
      AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49
      SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
      SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40
      NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
      RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07
      RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37

      Configuration settings for the scan:
      Jobname..........................: Complete system scan
      Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
      Logging..........................: low
      Primary action...................: interactive
      Secondary action.................: ignore
      Scan master boot sector..........: on
      Scan boot sector.................: on
      Boot sectors.....................: C:,
      Process scan.....................: on
      Scan registry....................: on
      Search for rootkits..............: off
      Scan all files...................: Intelligent file selection
      Scan archives....................: on
      Recursion depth..................: 20
      Smart extensions.................: on
      Macro heuristic..................: on
      File heuristic...................: medium

      Start of the scan: vendredi 10 octobre 2008 23:15

      The scan of running processes will be started
      Scan process 'avscan.exe' - '1' Module(s) have been scanned
      Scan process 'avcenter.exe' - '1' Module(s) have been scanned
      Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
      Scan process 'explorer.exe' - '1' Module(s) have been scanned
      Scan process 'alg.exe' - '1' Module(s) have been scanned
      Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
      Scan process 'iPodService.exe' - '1' Module(s) have been scanned
      Scan process 'NMIndexStoreSvr.exe' - '1' Module(s) have been scanned
      Scan process 'NMIndexingService.exe' - '1' Module(s) have been scanned
      Scan process 'hpqwmiex.exe' - '1' Module(s) have been scanned
      Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
      Scan process 'NBService.exe' - '1' Module(s) have been scanned
      Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned
      Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
      Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
      Scan process 'avguard.exe' - '1' Module(s) have been scanned
      Scan process 'hpqimzone.exe' - '1' Module(s) have been scanned
      Scan process 'sched.exe' - '1' Module(s) have been scanned
      Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
      Scan process 'soffice.bin' - '1' Module(s) have been scanned
      Scan process 'soffice.exe' - '1' Module(s) have been scanned
      Scan process 'NMBgMonitor.exe' - '1' Module(s) have been scanned
      Scan process 'daemon.exe' - '1' Module(s) have been scanned
      Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
      Scan process 'avgnt.exe' - '1' Module(s) have been scanned
      Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned
      Scan process 'QLBCTRL.exe' - '1' Module(s) have been scanned
      Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned
      Scan process 'QPService.exe' - '1' Module(s) have been scanned
      Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned
      Scan process 'jusched.exe' - '1' Module(s) have been scanned
      Scan process 'aawservice.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'lsass.exe' - '1' Module(s) have been scanned
      Scan process 'services.exe' - '1' Module(s) have been scanned
      Scan process 'winlogon.exe' - '1' Module(s) have been scanned
      Scan process 'csrss.exe' - '1' Module(s) have been scanned
      Scan process 'smss.exe' - '1' Module(s) have been scanned
      43 processes with 43 modules were scanned

      Starting master boot sector scan:
      Master boot sector HD0
      [INFO] No virus was found!

      Start scanning boot sectors:
      Boot sector 'C:\'
      [INFO] No virus was found!

      Starting to scan the registry.
      The registry was scanned ( '58' files ).

      Starting the file scan:

      Begin scan in 'C:\'
      C:\hiberfil.sys
      [WARNING] The file could not be opened!
      C:\pagefile.sys
      [WARNING] The file could not be opened!

      End of the scan: vendredi 10 octobre 2008 23:53
      Used time: 38:07 Minute(s)

      The scan has been done completely.

      7224 Scanning directories
      416109 Files were scanned
      0 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      2 Files cannot be scanned
      416107 Files not concerned
      9617 Archives were scanned
      2 Warnings
      0 Notes
      3. Ccarino Auteur
        ComboFix 08-10-10.01 - GUERIN 2008-10-10 23:04:28.1 - NTFSx86
        Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.628 [GMT 2:00]
        Lancé depuis: C:\Documents and Settings\GUERIN\Bureau\ComboFix.exe
        * Un nouveau point de restauration a été créé

        [COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
        .

        ((((((((((((((((((((((((((((( Fichiers créés du 2008-09-10 au 2008-10-10 ))))))))))))))))))))))))))))))))))))
        .

        2008-10-10 23:01 . 2008-10-10 23:01 <REP> d-------- C:\ERDNT
        2008-10-10 14:05 . 2008-10-10 14:05 <REP> d-------- C:\Program Files\Avira
        2008-10-10 14:05 . 2008-10-10 14:05 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
        2008-10-10 13:52 . 2008-10-10 13:52 <REP> d-------- C:\Documents and Settings\All Users\Application Data\NortonInstaller
        2008-10-09 23:16 . 2008-10-09 23:45 <REP> d-------- C:\WINDOWS\BDOSCAN8
        2008-10-09 22:53 . 2008-10-09 22:53 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
        2008-10-09 22:03 . 2008-10-10 22:22 <REP> d-------- C:\Program Files\FindyKill
        2008-10-09 17:30 . 2008-10-10 14:28 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
        2008-10-09 17:30 . 2008-10-09 17:30 <REP> d-------- C:\Documents and Settings\GUERIN\Application Data\Malwarebytes
        2008-10-09 17:30 . 2008-10-09 17:30 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
        2008-10-09 17:30 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
        2008-10-09 17:30 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
        2008-10-08 20:27 . 2008-10-10 15:30 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
        2008-10-08 18:05 . 2008-10-08 18:39 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
        2008-10-08 18:05 . 2008-10-08 18:29 78,415 --a------ C:\WINDOWS\system32\drivers\klif.cab
        2008-10-08 02:30 . 2008-10-08 02:46 81,984 --a------ C:\WINDOWS\system32\bdod.bin
        2008-10-08 02:19 . 2008-10-08 02:19 <REP> d-------- C:\Program Files\Softwin
        2008-10-08 02:19 . 2008-10-08 02:19 <REP> d-------- C:\Program Files\Fichiers communs\Softwin
        2008-10-07 08:10 . 2008-04-13 20:47 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
        2008-10-07 08:10 . 2008-04-13 20:47 25,856 --a------ C:\WINDOWS\system32\dllcache\usbprint.sys
        2008-09-15 23:24 . 2008-09-15 23:24 <REP> d--hs---- C:\Documents and Settings\NetworkService\Temporary Internet Files
        2008-09-15 23:24 . 2008-09-15 23:24 <REP> d--hs---- C:\Documents and Settings\NetworkService\Historique
        2008-09-13 15:18 . 2008-09-13 15:18 538,123 --a------ C:\WINDOWS\h_eJay5.inf
        2008-09-12 19:14 . 2008-09-12 19:14 <REP> d-------- C:\Program Files\Windows Media Components
        2008-09-12 19:13 . 2008-09-12 19:14 <REP> d--h----- C:\WINDOWS\msdownld.tmp

        .
        (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-10-10 21:00 --------- d-----w C:\Documents and Settings\GUERIN\Application Data\OpenOffice.org2
        2008-10-10 16:23 --------- d-----w C:\Program Files\eMule
        2008-10-10 13:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
        2008-10-10 11:54 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
        2008-10-08 20:56 --------- d-----w C:\Documents and Settings\GUERIN\Application Data\temp
        2008-10-08 16:37 --------- d-----w C:\Documents and Settings\GUERIN\Application Data\uTorrent
        2008-09-22 18:58 --------- d-----w C:\Program Files\bwin
        2008-09-08 19:05 --------- d-----w C:\Program Files\EA SPORTS
        2008-09-07 23:21 --------- d-----w C:\Program Files\Fichiers communs\Adobe
        2008-09-07 23:21 --------- d-----w C:\Documents and Settings\GUERIN\Application Data\AdobeUM
        2008-09-07 21:05 --------- d-----w C:\Documents and Settings\GUERIN\Application Data\Universal Boxing Manager
        2008-09-07 14:07 --------- d-----w C:\Program Files\CDex_170b2
        2008-09-07 10:55 --------- d-----w C:\Program Files\HighGrow
        2008-09-06 19:30 --------- d-----w C:\Documents and Settings\GUERIN\Application Data\Pro Cycling Manager 2008
        2008-09-05 16:48 --------- d-----w C:\Program Files\Windows Media Connect 2
        2008-09-04 01:03 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
        2008-08-20 00:58 65,536 ----a-w C:\WINDOWS\DTDraw.dll
        2008-08-20 00:58 --------- d-----w C:\Program Files\DesktopPlant
        2008-08-20 00:58 --------- d-----w C:\Documents and Settings\GUERIN\Application Data\DeskSoft
        2008-08-11 15:09 0 ----a-w C:\Documents and Settings\GUERIN\Application Data\wklnhst.dat
        2008-08-11 15:09 --------- d-----w C:\Documents and Settings\GUERIN\Application Data\Template
        2008-08-10 09:21 --------- d-----w C:\Documents and Settings\GUERIN\Application Data\Nero
        2008-08-10 09:20 --------- d-----w C:\Program Files\Fichiers communs\Nero
        2008-08-10 09:18 --------- d-----w C:\Program Files\Nero
        2008-08-10 09:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
        2008-07-20 16:22 304,528 ----a-w C:\WINDOWS\system32\appdrvrem01.exe
        2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll
        2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
        2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
        2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
        2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
        2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
        2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\dllcache\wups.dll
        2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
        2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll
        2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
        2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll
        2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
        2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll
        2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
        2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
        2008-07-18 20:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
        2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
        .

        ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
        REGEDIT4

        [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
        "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2008-07-16 1266992]

        [HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
        [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
        [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
        [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
        "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-07-17 490952]
        "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
        "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe" [2007-09-20 202024]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
        "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-04-15 7561216]
        "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-04-16 86016]
        "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-04 761948]
        "QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2006-04-11 102400]
        "HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 49152]
        "QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-03-07 131072]
        "Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2006-02-22 40960]
        "AppleSyncNotifier"="C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 116040]
        "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-27 413696]
        "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 289064]
        "NeroFilterCheck"="C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
        "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 1836328]
        "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
        "nwiz"="nwiz.exe" [2006-04-15 C:\WINDOWS\system32\nwiz.exe]
        "High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-04-18 C:\WINDOWS\system32\CHDAudPropShortcut.exe]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]

        C:\Documents and Settings\GUERIN\Menu D‚marrer\Programmes\D‚marrage\
        OpenOffice.org 2.4.lnk - C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216]

        C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
        D‚marrage rapide de HP Photosmart Premier.lnk - C:\Program Files\Hp\Digital Imaging\bin\hpqthb08.exe [2005-09-24 73728]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
        "VIDC.YV12"= yv12vfw.dll

        [HKEY_LOCAL_MACHINE\software\microsoft\security center]
        "AntiVirusDisableNotify"=dword:00000001

        [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
        "DisableMonitoring"=dword:00000001

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
        "EnableFirewall"= 0 (0x0)

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=
        "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
        "C:\\Program Files\\uTorrent\\uTorrent.exe"=
        "C:\\Program Files\\Messenger\\msmsgs.exe"=
        "C:\\Program Files\\Cyanide\\GameCenter\\GameCenter.exe"=
        "C:\\Program Files\\Cyanide\\Pro Cycling Manager - Season 2008\\PCM.exe"=
        "C:\\Program Files\\Cyanide\\Pro Cycling Manager - Season 2008\\Autorun\\Exe\\Autorun.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
        "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
        "C:\\Program Files\\iTunes\\iTunes.exe"=
        "C:\\Program Files\\eMule\\emule.exe"=

        R1 appdrv01;Application Driver (01);C:\WINDOWS\system32\Drivers\appdrv01.sys [2008-07-20 2915944]
        S2 appdrvrem01;Application Driver Auto Removal Service (01);C:\WINDOWS\System32\appdrvrem01.exe svc [ ]
        S2 Wlansvc;@%SystemRoot%\System32\wlansvc.dll,-257;C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]

        *Newly Created Service* - PROCEXP90
        .
        - - - - ORPHELINS SUPPRIMES - - - -

        HKLM-Run-hpWirelessAssistant - C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
        HKLM-Run-RecGuard - C:\Windows\SMINST\RecGuard.exe
        HKLM-Run-Reminder - C:\Windows\CREATOR\Remind_XP.exe

        .
        ------- Examen supplémentaire -------
        .
        R1 -: HKCU-Internet Settings,ProxyOverride = *.local
        O8 -: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html

        O16 -: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
        C:\WINDOWS\Downloaded Program Files\oscan8.inf
        C:\WINDOWS\bdoscandellang.ini
        C:\WINDOWS\bdoscandel.exe
        C:\WINDOWS\Downloaded Program Files\live.ini
        C:\WINDOWS\Downloaded Program Files\scanoptions.tsi
        C:\WINDOWS\Downloaded Program Files\lang.ini
        C:\WINDOWS\Downloaded Program Files\ipsupd.dll
        C:\WINDOWS\Downloaded Program Files\bdupd.dll
        C:\WINDOWS\Downloaded Program Files\libfn.dll
        C:\WINDOWS\Downloaded Program Files\bdcore.dll
        C:\WINDOWS\Downloaded Program Files\oscan8.ocx
        .

        **************************************************************************

        catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-10-10 23:06:42
        Windows 5.1.2600 Service Pack 3 NTFS

        Recherche de processus cachés ...

        Recherche d'éléments en démarrage automatique cachés ...

        HKLM\Software\Microsoft\Windows\CurrentVersion\Run
        Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe?????? ???@???????????????@? ???PZ??????(?@???????@

        Recherche de fichiers cachés ...

        Scan terminé avec succès
        Fichiers cachés: 0

        **************************************************************************
        .
        Heure de fin: 2008-10-10 23:07:37

        Avant-CF: 39 825 895 424 octets libres
        Après-CF: 39,816,290,304 octets libres

        183 --- E O F --- 2008-09-10 11:55:47
        1. Ccarino Auteur
          Fichier MRT.exe reçu le 2008.10.05 13:24:13 (CET)
          Situation actuelle: terminé

          Résultat: 0/36 (0.00%)
          Formaté Impression des résultats
          Antivirus Version Dernière mise à jour Résultat
          AhnLab-V3 2008.10.3.2 2008.10.03 -
          AntiVir 7.8.1.34 2008.10.04 -
          Authentium 5.1.0.4 2008.10.04 -
          Avast 4.8.1248.0 2008.10.04 -
          AVG 8.0.0.161 2008.10.04 -
          BitDefender 7.2 2008.10.05 -
          CAT-QuickHeal 9.50 2008.10.04 -
          ClamAV 0.93.1 2008.10.04 -
          DrWeb 4.44.0.09170 2008.10.05 -
          eSafe 7.0.17.0 2008.10.02 -
          eTrust-Vet 31.6.6129 2008.10.04 -
          Ewido 4.0 2008.10.05 -
          F-Prot 4.4.4.56 2008.10.04 -
          F-Secure 8.0.14332.0 2008.10.05 -
          Fortinet 3.113.0.0 2008.10.04 -
          GData 19 2008.10.05 -
          Ikarus T3.1.1.34.0 2008.10.05 -
          K7AntiVirus 7.10.484 2008.10.04 -
          Kaspersky 7.0.0.125 2008.10.05 -
          McAfee 5398 2008.10.04 -
          Microsoft 1.4005 2008.10.05 -
          NOD32 3495 2008.10.04 -
          Norman 5.80.02 2008.10.03 -
          Panda 9.0.0.4 2008.10.05 -
          PCTools 4.4.2.0 2008.10.05 -
          Prevx1 V2 2008.10.05 -
          Rising 20.63.62.00 2008.09.28 -
          SecureWeb-Gateway 6.7.6 2008.10.05 -
          Sophos 4.34.0 2008.10.05 -
          Sunbelt 3.1.1675.1 2008.09.27 -
          Symantec 10 2008.10.05 -
          TheHacker 6.3.1.0.101 2008.10.04 -
          TrendMicro 8.700.0.1004 2008.10.03 -
          VBA32 3.12.8.6 2008.10.04 -
          ViRobot 2008.10.4.1406 2008.10.04 -
          VirusBuster 4.5.11.0 2008.10.04 -
          Information additionnelle
          File size: 16208504 bytes
          MD5...: f5a3e4b4bcf683ebfd3948acfdee3ed2
          SHA1..: aa618c03b10d8b3643a9bd53475538707f54d573
          SHA256: bd348be960a9da217dd0c7a279e14ebda5e08b19c40b5c4d62771d6ea771c67e
          SHA512: d886fb0fa00001c1024653c2badebee7c847b2ceb65ce2b4df02b2f20f894085
          86442e4f72604731b8edad08473f2de912268db167a963e5e71eeb217ce327a7
          PEiD..: -
          TrID..: File type identification
          Win64 Executable Generic (46.2%)
          Win32 EXE PECompact compressed (generic) (22.4%)
          Win32 Executable MS Visual C++ (generic) (20.3%)
          Win32 Executable Generic (4.6%)
          Win32 Dynamic Link Library (generic) (4.0%)
          PEInfo: PE Structure information

          ( base data )
          entrypointaddress.: 0x100e7a4
          timedatestamp.....: 0x48b4664b (Tue Aug 26 20:23:39 2008)
          machinetype.......: 0x14c (I386)

          ( 4 sections )
          name viradd virsiz rawdsiz ntrpy md5
          .text 0x1000 0x3aa46 0x3ac00 6.45 b5b48b824e9ed996bc00679e630ac500
          .data 0x3c000 0x1970 0xa00 5.90 bec1577b6f66d8a9924b3991c6025efa
          .rsrc 0x3e000 0xf2a000 0xf29e00 7.28 71ed8d77b77dd936be12f36392b9cc26
          .reloc 0xf68000 0xd4a8 0xd600 2.22 2c575d6b146d79d63ca56f265b8d2087

          ( 13 imports )
          > ADVAPI32.dll: TraceEvent, GetTraceEnableFlags, GetTraceEnableLevel, GetTraceLoggerHandle, RegisterTraceGuidsW, UnregisterTraceGuids, CryptCreateHash, CryptHashData, CryptGetHashParam, CryptDestroyHash, LookupPrivilegeValueW, AdjustTokenPrivileges, RegOpenKeyW, RegCreateKeyExW, RegOpenKeyExW, RegDeleteValueW, RegSetValueExW, RegQueryValueExW, AllocateAndInitializeSid, CheckTokenMembership, CryptGenRandom, CryptReleaseContext, CryptAcquireContextW, FreeSid, OpenProcessToken, RegCloseKey
          > KERNEL32.dll: GetSystemInfo, GetProcessHeap, HeapFree, GlobalFree, SetEndOfFile, GetSystemTime, InitializeCriticalSection, TryEnterCriticalSection, LocalFree, LocalAlloc, FreeLibrary, GetProcAddress, GetWindowsDirectoryW, WritePrivateProfileSectionW, MoveFileW, SetFilePointer, GetSystemWindowsDirectoryW, FlushFileBuffers, FileTimeToSystemTime, GetLogicalDrives, GetDriveTypeW, GetExitCodeProcess, GetPrivateProfileStringW, GetPrivateProfileIntW, WritePrivateProfileStringW, WideCharToMultiByte, MultiByteToWideChar, GetSystemDefaultLCID, GetFileSize, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, HeapDestroy, HeapReAlloc, HeapValidate, HeapSize, HeapCreate, LeaveCriticalSection, EnterCriticalSection, FindResourceW, LoadResource, LockResource, SizeofResource, GetVersionExW, CreateProcessW, ExpandEnvironmentStringsW, GetFileAttributesW, CreateDirectoryW, SetFilePointerEx, ReadFile, GetModuleFileNameW, CloseHandle, InterlockedDecrement, InterlockedIncrement, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetCurrentProcessId, GetCurrentThreadId, GetTickCount, QueryPerformanceCounter, GetModuleHandleA, SetUnhandledExceptionFilter, RtlUnwind, OutputDebugStringA, GetStartupInfoW, InterlockedCompareExchange, Sleep, InterlockedExchange, LoadLibraryW, CompareStringW, GetLastError, GetModuleHandleW, SetErrorMode, GetCommandLineW, FormatMessageW, GetTimeFormatW, SystemTimeToFileTime, GetLocalTime, FileTimeToLocalFileTime, GetSystemTimeAsFileTime, ResumeThread, SuspendThread, WaitForSingleObject, CreateThread, lstrlenW, lstrcmpW, SetLastError, MulDiv, GetDiskFreeSpaceExW, lstrlenA, WriteFile, CreateFileW, DeleteFileW, GetTempFileNameW, GetTempPathW, HeapAlloc
          > GDI32.dll: CreateSolidBrush, CreateCompatibleDC, CreateCompatibleBitmap, DeleteDC, GetTextColor, SetBkMode, SelectObject, GetTextMetricsW, SetTextColor, GetTextExtentExPointW, DeleteObject, CreateFontIndirectW, GetObjectW, GetBkColor, ExtTextOutW
          > USER32.dll: SetDlgItemTextW, SetWindowLongW, SendMessageW, PostMessageW, GetDlgItem, GetWindowLongW, GetParent, SendDlgItemMessageW, DestroyIcon, EnableWindow, GetDlgItemTextW, ShowWindow, LoadImageW, EndDialog, LoadIconW, SetWindowTextW, ExitWindowsEx, MessageBoxW, MapWindowPoints, DialogBoxParamW, UnregisterClassW, LoadCursorW, CharNextW, LoadStringW, PtInRect, GetKeyState, ReleaseDC, IntersectRect, DrawFocusRect, FrameRect, OffsetRect, SetRect, GetSysColor, GetFocus, GetDC, GetClientRect, SetCapture, InvalidateRect, SetFocus, SetCursor, UpdateWindow, IsWindowEnabled, GetWindowTextW, GetWindowTextLengthW, ReleaseCapture, EndPaint, BeginPaint, DefWindowProcW, RegisterClassExW, PostQuitMessage, RegisterClassW, DispatchMessageW, TranslateMessage, GetMessageW, CreateWindowExW
          > msvcrt.dll: __1exception@@UAE@XZ, __0exception@@QAE@ABV0@@Z, free, _CxxThrowException, malloc, __wgetmainargs, _cexit, _exit, _XcptFilter, exit, _wcmdln, _initterm, _amsg_exit, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, __set_app_type, __1type_info@@UAE@XZ, memmove, _what@exception@@UBEPBDXZ, _terminate@@YAXXZ, _controlfp, _unlock, __dllonexit, _lock, _wcsicmp, _purecall, memcpy, wcsrchr, __0exception@@QAE@ABQBD@Z, __RTDynamicCast, _ltow, _wcsnicmp, mktime, time, strtol, _wctime, bsearch, _waccess, qsort, __0exception@@QAE@XZ, __mb_cur_max, iswctype, _onexit, calloc, isdigit, mbtowc, _vsnwprintf, memset, isleadbyte, isxdigit, localeconv, wctomb, wcstombs, realloc, wcsncmp, __CxxFrameHandler, _errno, __badioinfo, __pioinfo, _read, _fileno, ungetc, _wcslwr, _wcsupr, wcschr, _vsnprintf
          > COMCTL32.dll: CreatePropertySheetPageW, PropertySheetW, DestroyPropertySheetPage, InitCommonControlsEx
          > SHLWAPI.dll: PathRemoveFileSpecW, StrStrW, StrStrIW
          > SHELL32.dll: SHGetFolderPathW, SHGetFolderLocation, SHBrowseForFolderW, SHGetPathFromIDListW, Shell_NotifyIconW, ShellExecuteExW, CommandLineToArgvW, ShellExecuteW
          > ole32.dll: StringFromGUID2, CoTaskMemFree, CoInitialize, CoUninitialize, CoCreateGuid
          > WININET.dll: InternetOpenA, InternetConnectA, HttpOpenRequestA, HttpSendRequestA, HttpQueryInfoA, InternetCloseHandle, InternetCrackUrlA
          > RPCRT4.dll: RpcStringFreeW, UuidToStringW, UuidCreate, UuidFromStringW
          > WINHTTP.dll: WinHttpSetStatusCallback, WinHttpQueryDataAvailable, WinHttpReadData, WinHttpSendRequest, WinHttpAddRequestHeaders, WinHttpOpenRequest, WinHttpSetOption, WinHttpQueryOption, WinHttpWriteData, WinHttpQueryHeaders, WinHttpReceiveResponse, WinHttpOpen, WinHttpGetIEProxyConfigForCurrentUser, WinHttpGetProxyForUrl, WinHttpConnect, WinHttpCrackUrl, WinHttpSetTimeouts, WinHttpCloseHandle
          > urlmon.dll: IsValidURL

          ( 0 exports )
          1. jlpjlp Contributeur sécurité
            fais tout et quand j'ai le temps je regarderai

            analyse ceci sur virus total et colle le rapport: https://www.virustotal.com/gui/

            C:\WINDOWS\system32\MRT.exe

            ____________
            vire ce crack si present:
            C:\Documents and Settings\GUERIN\Application Data\uTorrent\Kaspersky Internet Security 8.0.0.454-WINALLCRACKED.rar.torrent

            _____________

            télécharge combofix (par sUBs) ici :

            http://download.bleepingcomputer.com/sUBs/ComboFix.exe

            et enregistre le sur le bureau.

            déconnecte toi d'internet et ferme toutes tes applications.

            désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)

            double-clique sur combofix.exe et suis les instructions

            à la fin, il va produire un rapport C:\ComboFix.txt

            réactive ton parefeu, ton antivirus, la garde de ton antispyware

            copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

            Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

            Tu as un tutoriel complet ici :

            http://www.bleepingcomputer.com/combofix/fr/comment-utiliser­-combofix
            ______________________

            recolle un rapport antivir et dis tes soucis actuels
            2. Ccarino Auteur
              ----------------- FindyKill V3.O85 ------------------

              * User : GUERIN - YOUR-E7F2723B7A
              * Emplacement : C:\Program Files\FindyKill\FindyKill.cmd
              * Outils Mis a jours le 02/10/08 par Chiquitine29
              * Suppression effectuée à 22:20:30 le 10/10/2008
              * Windows XP - Internet Explorer 7.0.5730.13

              ((((((((((((((( *** Suppression *** ))))))))))))))))))

              »»»» Suppression des fichiers dans C:

              Supprimé ! - C:\InfoSat.txt

              »»»» Suppression des fichiers dans C:\WINDOWS

              »»»» Suppression des fichiers dans C:\WINDOWS\Prefetch

              Supprimé ! - C:\WINDOWS\Prefetch\LUCOMS~1.EXE-02DB5950.pf
              Supprimé ! - C:\WINDOWS\Prefetch\REGSVR32.EXE-25EEFE2F.pf
              Supprimé ! - C:\WINDOWS\Prefetch\RUNDLL32.EXE-147710F4.pf
              Supprimé ! - C:\WINDOWS\Prefetch\RUNDLL32.EXE-26C2C861.pf
              Supprimé ! - C:\WINDOWS\Prefetch\RUNDLL32.EXE-2CBA7525.pf
              Supprimé ! - C:\WINDOWS\Prefetch\RUNDLL32.EXE-4489B61B.pf
              Supprimé ! - C:\WINDOWS\Prefetch\UNINS000.EXE-260D7493.pf

              »»»» Suppression des fichiers dans C:\WINDOWS\system32

              »»»» Suppression des fichiers dans C:\WINDOWS\system32\drivers

              »»»» Suppression des fichiers dans C:\Documents and Settings\GUERIN\Application Data

              »»»» Suppression des fichiers dans C:\DOCUME~1\GUERIN\LOCALS~1\Temp

              »»»» Suppression des clefs du registre..

              Supprimé ! - HKEY_CURRENT_CONFIG\System\CurrentControlSet\Enum\ROOT\LEGACY_SROSA

              »»»» Suppression des clefs du registre effectuée !

              »»»» Mode sans echec restauré !

              »»»» Services de securité Windows redemarré !

              »»»» Suppression des fichiers dans Support amovible :

              »»»» Necessite une interpretation :

              Suspect ! - C:\WINDOWS\system32\MRT.exe

              »»»» Recherche Cracks Keygen... :

              C:\Documents and Settings\GUERIN\Application Data\uTorrent\Kaspersky Internet Security 8.0.0.454-WINALLCRACKED.rar.torrent

              ---------------- ! Fin du rapport ! ------------------

              Impossible de trouver :
              C:\Documents and Settings\GUERIN\Application Data\uTorrent\Kaspersky Internet Security 8.0.0.454-WINALLCRACKED.rar.torrent

              il a été effacé ou pas
              1. jlpjlp Contributeur sécurité
                refais findykill option 2

                _________________

                télécharge combofix (par sUBs) ici :

                http://download.bleepingcomputer.com/sUBs/ComboFix.exe

                et enregistre le sur le bureau.

                déconnecte toi d'internet et ferme toutes tes applications.

                désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)

                double-clique sur combofix.exe et suis les instructions

                à la fin, il va produire un rapport C:\ComboFix.txt

                réactive ton parefeu, ton antivirus, la garde de ton antispyware

                copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

                Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

                Tu as un tutoriel complet ici :

                https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
                ______________________

                recolle un rapport antivir et dis tes soucis actuels

                rq:

                pour protéger gratos ton ordi

                https://www.commentcamarche.net/telecharger/ 4 securite

                mettre un antivirus

                AVAST en français ou ANTIVIR (en anglais mais très efficace)
                https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)
                -------------
                des anti-espions :
                MALWAREBYTE ANTIMALWARE+ SPYBOT

                +
                SPYWAREBLASTER pour immuniser le système contre vundo notamment mais en anglais (mais facile d'utilisation : il suffit de faire "update" pour mettre à jour tous les mois et ensuite" enable all protection" pour immuniser)...

                Rq : spybot et ad-aware on sorti de nouvelles versions cette année vérifiez que vous avez la dernière version
                --------
                un pare feu :
                celui de Windows ou mieux COMODO ou KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit)

                https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
                https://manuelsdaide.com/contact/
                http://www.open-files.com/forum/index.php?showtopic=29277
                https://www.commentcamarche.net/telecharger/ 157 zonealarm

                -----------

                CCLEANER pour effacer les traces de surf
                1. Ccarino Auteur
                  ----------------- FindyKill V3.095 ------------------

                  * User : GUERIN - YOUR-E7F2723B7A
                  * Emplacement : C:\Program Files\FindyKill
                  * Outils Mis a jours le 02/10/08 par Chiquitine29
                  * Recherche effectuée à 19:22:26 le 10/10/2008
                  * Windows XP - Internet Explorer 7.0.5730.13

                  ((((((((((((((((( *** Recherche *** ))))))))))))))))))

                  »»»» Presence des fichiers dans C:

                  Présent ! - C:\InfoSat.txt

                  »»»» Presence des fichiers dans C:\WINDOWS

                  »»»» Presence des fichiers dans C:\WINDOWS\Prefetch

                  »»»» Presence des fichiers dans C:\WINDOWS\system32

                  »»»» Presence des fichiers dans C:\WINDOWS\system32\drivers

                  »»»» Presence des fichiers dans C:\Documents and Settings\GUERIN\Application Data

                  »»»» Presence des fichiers dans C:\DOCUME~1\GUERIN\LOCALS~1\Temp

                  »»»» Registre :

                  ! REG.EXE VERSION 3.0

                  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
                  SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
                  hpWirelessAssistant REG_SZ C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
                  NvCplDaemon REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                  NvMediaCenter REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                  nwiz REG_SZ nwiz.exe /installquiet /nodetect
                  High Definition Audio Property Page Shortcut REG_SZ CHDAudPropShortcut.exe
                  SynTPEnh REG_SZ C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                  QPService REG_SZ "C:\Program Files\HP\QuickPlay\QPService.exe"
                  HP Software Update REG_SZ C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
                  QlbCtrl REG_EXPAND_SZ %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
                  Cpqset REG_SZ C:\Program Files\HPQ\Default Settings\cpqset.exe
                  RecGuard REG_SZ C:\Windows\SMINST\RecGuard.exe
                  Reminder REG_SZ C:\Windows\CREATOR\Remind_XP.exe
                  AppleSyncNotifier REG_SZ C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
                  QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
                  iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe"
                  NeroFilterCheck REG_SZ C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
                  NBKeyScan REG_SZ "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
                  avgnt REG_SZ "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

                  ! REG.EXE VERSION 3.0

                  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
                  CTFMON.EXE REG_SZ C:\WINDOWS\system32\ctfmon.exe
                  DAEMON Tools Lite REG_SZ "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
                  MsnMsgr REG_SZ "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                  BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} REG_SZ "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"

                  Présent ! - HKEY_USERS\S-1-5-21-4249026958-4253344006-4105985583-1006\Software\bisoft
                  Présent ! - HKEY_CURRENT_USER\Software\bisoft

                  »»»» Presence d infections dans Support amovible :

                  ----------------- ! Fin du rapport ! ------------------
                  1. jlpjlp Contributeur sécurité
                    ok il faut virer les cracks car si il en reste des infectés bagle revient... Désactive ta restauration puis redémarre ton ordi puis réactive la . Vire ce qui est en quarantaine dans antivir et malwarebyte. Recolle un rapport findykill option 1. Ét dis si encore des soucis
                    1. Ccarino Auteur
                      Malwarebytes' Anti-Malware 1.28
                      Version de la base de données: 1248
                      Windows 5.1.2600 Service Pack 3

                      10/10/2008 15:23:22
                      mbam-log-2008-10-10 (15-23-22).txt

                      Type de recherche: Examen complet (C:\|)
                      Eléments examinés: 114434
                      Temps écoulé: 32 minute(s), 33 second(s)

                      Processus mémoire infecté(s): 0
                      Module(s) mémoire infecté(s): 0
                      Clé(s) du Registre infectée(s): 0
                      Valeur(s) du Registre infectée(s): 0
                      Elément(s) de données du Registre infecté(s): 0
                      Dossier(s) infecté(s): 1
                      Fichier(s) infecté(s): 0

                      Processus mémoire infecté(s):
                      (Aucun élément nuisible détecté)

                      Module(s) mémoire infecté(s):
                      (Aucun élément nuisible détecté)

                      Clé(s) du Registre infectée(s):
                      (Aucun élément nuisible détecté)

                      Valeur(s) du Registre infectée(s):
                      (Aucun élément nuisible détecté)

                      Elément(s) de données du Registre infecté(s):
                      (Aucun élément nuisible détecté)

                      Dossier(s) infecté(s):
                      C:\WINDOWS\system32\drivers\downld (Trojan.Agent) -> Quarantined and deleted successfully.

                      Fichier(s) infecté(s):
                      (Aucun élément nuisible détecté)

                      et voila
                      1. Ccarino Auteur
                        Avira AntiVir Personal
                        Report file date: vendredi 10 octobre 2008 14:08

                        Scanning for 1675978 virus strains and unwanted programs.

                        Licensed to: Avira AntiVir PersonalEdition Classic
                        Serial number: 0000149996-ADJIE-0001
                        Platform: Windows XP
                        Windows version: (Service Pack 3) [5.1.2600]
                        Boot mode: Normally booted
                        Username: SYSTEM
                        Computer name: YOUR-E7F2723B7A

                        Version information:
                        BUILD.DAT : 8.1.0.331 16934 Bytes 12/08/2008 11:46:00
                        AVSCAN.EXE : 8.1.4.7 315649 Bytes 26/06/2008 08:57:53
                        AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40
                        LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19
                        LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52
                        ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34
                        ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 13:54:15
                        ANTIVIR2.VDF : 7.0.7.12 4066816 Bytes 08/10/2008 12:07:02
                        ANTIVIR3.VDF : 7.0.7.25 105984 Bytes 10/10/2008 12:07:04
                        Engineversion : 8.1.1.35
                        AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21
                        AESCRIPT.DLL : 8.1.0.76 319867 Bytes 10/10/2008 12:07:23
                        AESCN.DLL : 8.1.0.23 119156 Bytes 10/07/2008 12:44:49
                        AERDL.DLL : 8.1.1.2 438644 Bytes 10/10/2008 12:07:21
                        AEPACK.DLL : 8.1.2.3 364918 Bytes 10/10/2008 12:07:19
                        AEOFFICE.DLL : 8.1.0.25 196986 Bytes 10/10/2008 12:07:16
                        AEHEUR.DLL : 8.1.0.59 1438071 Bytes 10/10/2008 12:07:15
                        AEHELP.DLL : 8.1.0.15 115063 Bytes 10/07/2008 12:44:48
                        AEGEN.DLL : 8.1.0.36 315764 Bytes 10/10/2008 12:07:08
                        AEEMU.DLL : 8.1.0.7 430452 Bytes 31/07/2008 08:33:21
                        AECORE.DLL : 8.1.1.11 172406 Bytes 10/10/2008 12:07:06
                        AEBB.DLL : 8.1.0.1 53617 Bytes 10/07/2008 12:44:48
                        AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05
                        AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01
                        AVREP.DLL : 8.0.0.2 98344 Bytes 10/10/2008 12:07:04
                        AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40
                        AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
                        AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49
                        SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
                        SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40
                        NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
                        RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07
                        RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37

                        Configuration settings for the scan:
                        Jobname..........................: Complete system scan
                        Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
                        Logging..........................: low
                        Primary action...................: interactive
                        Secondary action.................: ignore
                        Scan master boot sector..........: on
                        Scan boot sector.................: on
                        Boot sectors.....................: C:,
                        Process scan.....................: on
                        Scan registry....................: on
                        Search for rootkits..............: off
                        Scan all files...................: Intelligent file selection
                        Scan archives....................: on
                        Recursion depth..................: 20
                        Smart extensions.................: on
                        Macro heuristic..................: on
                        File heuristic...................: medium

                        Start of the scan: vendredi 10 octobre 2008 14:08

                        The scan of running processes will be started
                        Scan process 'avscan.exe' - '1' Module(s) have been scanned
                        Scan process 'avcenter.exe' - '1' Module(s) have been scanned
                        Scan process 'avgnt.exe' - '1' Module(s) have been scanned
                        Scan process 'avguard.exe' - '1' Module(s) have been scanned
                        Scan process 'sched.exe' - '1' Module(s) have been scanned
                        Scan process 'alg.exe' - '1' Module(s) have been scanned
                        Scan process 'iPodService.exe' - '1' Module(s) have been scanned
                        Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
                        Scan process 'NMIndexStoreSvr.exe' - '1' Module(s) have been scanned
                        Scan process 'NMIndexingService.exe' - '1' Module(s) have been scanned
                        Scan process 'hpqwmiex.exe' - '1' Module(s) have been scanned
                        Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
                        Scan process 'WLLoginProxy.exe' - '1' Module(s) have been scanned
                        Scan process 'NBService.exe' - '1' Module(s) have been scanned
                        Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned
                        Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
                        Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
                        Scan process 'hpqimzone.exe' - '1' Module(s) have been scanned
                        Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
                        Scan process 'soffice.bin' - '1' Module(s) have been scanned
                        Scan process 'iexplore.exe' - '1' Module(s) have been scanned
                        Scan process 'soffice.exe' - '1' Module(s) have been scanned
                        Scan process 'NMBgMonitor.exe' - '1' Module(s) have been scanned
                        Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
                        Scan process 'daemon.exe' - '1' Module(s) have been scanned
                        Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
                        Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned
                        Scan process 'QLBCTRL.exe' - '1' Module(s) have been scanned
                        Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned
                        Scan process 'QPService.exe' - '1' Module(s) have been scanned
                        Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned
                        Scan process 'jusched.exe' - '1' Module(s) have been scanned
                        Scan process 'explorer.exe' - '1' Module(s) have been scanned
                        Scan process 'aawservice.exe' - '1' Module(s) have been scanned
                        Scan process 'svchost.exe' - '1' Module(s) have been scanned
                        Scan process 'svchost.exe' - '1' Module(s) have been scanned
                        Scan process 'svchost.exe' - '1' Module(s) have been scanned
                        Scan process 'svchost.exe' - '1' Module(s) have been scanned
                        Scan process 'svchost.exe' - '1' Module(s) have been scanned
                        Scan process 'svchost.exe' - '1' Module(s) have been scanned
                        Scan process 'lsass.exe' - '1' Module(s) have been scanned
                        Scan process 'services.exe' - '1' Module(s) have been scanned
                        Scan process 'winlogon.exe' - '1' Module(s) have been scanned
                        Scan process 'csrss.exe' - '1' Module(s) have been scanned
                        Scan process 'smss.exe' - '1' Module(s) have been scanned
                        45 processes with 45 modules were scanned

                        Starting master boot sector scan:
                        Master boot sector HD0
                        [INFO] No virus was found!

                        Start scanning boot sectors:
                        Boot sector 'C:\'
                        [INFO] No virus was found!

                        Starting to scan the registry.
                        The registry was scanned ( '58' files ).

                        Starting the file scan:

                        Begin scan in 'C:\'
                        C:\hiberfil.sys
                        [WARNING] The file could not be opened!
                        C:\pagefile.sys
                        [WARNING] The file could not be opened!
                        C:\Program Files\eMule\Incoming\Nero 8 Fr + Keygen.rar
                        [DETECTION] Contains recognition pattern of the DR/Agent.HA dropper
                        [NOTE] The file was moved to '49614927.qua'!
                        C:\Program Files\eMule\Incoming\[PC GAME Crack] Pro Cycling Manager - Tour De France 2008 (Crack NO CD + Serial).rar
                        [0] Archive type: RAR
                        --> [PC GAME Crack] Pro Cycling Manager - Tour De France 2008 (Crack NO CD + Serial)\Crack.exe
                        [DETECTION] Is the TR/Drop.Agent.xbc Trojan
                        [NOTE] The file was deleted!
                        C:\Program Files\Malwarebytes' Anti-Malware\mbam-dor.exe
                        [DETECTION] Is the TR/Drop.Agent.ckm Trojan
                        [NOTE] The file was moved to '49504ad2.qua'!
                        C:\System Volume Information\_restore{B0D22BE2-A227-4068-A48A-E6B79217B4BA}\RP2\A0000067.exe
                        [DETECTION] Is the TR/Drop.Agent.ckm Trojan
                        [NOTE] The file was moved to '491f4cd7.qua'!
                        C:\WINDOWS\system32\drivers\sptd.sys
                        [WARNING] The file could not be opened!

                        End of the scan: vendredi 10 octobre 2008 14:48
                        Used time: 40:31 Minute(s)

                        The scan has been done completely.

                        7270 Scanning directories
                        418757 Files were scanned
                        4 viruses and/or unwanted programs were found
                        0 Files were classified as suspicious:
                        1 files were deleted
                        0 files were repaired
                        3 files were moved to quarantine
                        0 files were renamed
                        3 Files cannot be scanned
                        418750 Files not concerned
                        9636 Archives were scanned
                        3 Warnings
                        4 Notes

                        je fais malware et je colle le rapport
                        1. jlpjlp Contributeur sécurité
                          de rien . On verra avec antivir et malwarebyte si c'est bon
                          1. Ccarino Auteur
                            je tiens a te remercier pour le temps que tu ma consacré hier puis aujourd'hui

                            chapeau

                            merci
                            1. jlpjlp Contributeur sécurité
                              ok le rapport est bon. Fais la suite et réinstalle adaware et spybot car bagle avait du les abimes . À plus
                              1. Ccarino Auteur
                                Logfile of Trend Micro HijackThis v2.0.2
                                Scan saved at 13:57:42, on 10/10/2008
                                Platform: Windows XP SP3 (WinNT 5.01.2600)
                                MSIE: Internet Explorer v7.00 (7.00.6000.16705)
                                Boot mode: Normal

                                Running processes:
                                C:\WINDOWS\System32\smss.exe
                                C:\WINDOWS\system32\winlogon.exe
                                C:\WINDOWS\system32\services.exe
                                C:\WINDOWS\system32\lsass.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\WINDOWS\System32\svchost.exe
                                C:\WINDOWS\System32\svchost.exe
                                C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
                                C:\WINDOWS\Explorer.EXE
                                C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
                                C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                                C:\Program Files\HP\QuickPlay\QPService.exe
                                C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
                                C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
                                C:\Program Files\iTunes\iTunesHelper.exe
                                C:\WINDOWS\system32\ctfmon.exe
                                C:\Program Files\DAEMON Tools Lite\daemon.exe
                                C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
                                C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
                                C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
                                C:\Program Files\Internet Explorer\iexplore.exe
                                C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
                                C:\WINDOWS\system32\spoolsv.exe
                                C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
                                C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                                C:\Program Files\Bonjour\mDNSResponder.exe
                                C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                                C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
                                C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
                                C:\WINDOWS\system32\nvsvc32.exe
                                C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
                                C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
                                C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
                                C:\Program Files\iPod\bin\iPodService.exe
                                C:\Documents and Settings\GUERIN\Bureau\HiJackThis.exe
                                C:\WINDOWS\system32\wuauclt.exe

                                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                                R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
                                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll
                                O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
                                O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
                                O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                                O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                                O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                                O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                                O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
                                O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
                                O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
                                O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
                                O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
                                O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
                                O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                                O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                                O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
                                O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
                                O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                                O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
                                O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
                                O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
                                O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
                                O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
                                O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
                                O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
                                O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                                O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                                O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
                                O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
                                O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                                O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
                                O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                                O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
                                O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                                O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                                O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                                O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                                O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                                O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
                                O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqthb08.exe
                                O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
                                O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                                O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                                O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                                O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                                O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                                O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                                O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                                O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                                O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
                                O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                                O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                                O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
                                O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
                                O23 - Service: Application Driver Auto Removal Service (01) (appdrvrem01) - Protection Technology - C:\WINDOWS\System32\appdrvrem01.exe
                                O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                                O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
                                O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                                O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
                                O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                                O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                                O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                                O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
                                O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
                                O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                                O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
                                1. jlpjlp Contributeur sécurité
                                  puis tu fais le reste demandé

                                  dès que dispo je poursuis
                                  • 1
                                  • 2
                                  • 3

                                  Discussions similaires

                                  Problème avec "PUADIManager:Win32/OfferCore
                                  Knaki

                                  3 réponses
                                  PUADlManager:Win32/OfferCore
                                  tenmalade

                                  2 réponses
                                  PUADlManager:Win32/OfferCore
                                  bernardarrad

                                  3 réponses
                                  Pb Windows 7, .EXE n'est pas app win32 valide
                                  Witeric

                                  15 réponses
                                  PUA:Win32/InstallCore detecté par windows sécurité
                                  thetib

                                  11 réponses