Heur.Downloader

Question

Bonjour,


J'ai un souci, je n'arrive pas a me débarrasser d'un Trojan, Heur Downloader, que Kapersky déteste depuis un moment et qui rallenti considérablement ma connexion internet et peut -être même bloque l'insatllation de logiciel comme internet expl 8. Je suis sur windows XP

Si vous pouvez m'aider ce serait génial car là ça me saoule.

Un grand merci par avance

franny12772 · Accepted Answer

Voilà pour le nettoyage. -----------\ ToolBar S&D 1.2.2 XP/Vista Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3 X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU 4400 @ 2.00GHz ) BIOS : BIOS Date: 01/30/07 15:09:48 Ver: 08.00.12 USER : Francine ( Administrator ) BOOT : Normal boot Antivirus : Kaspersky Internet Security 8.0.0.454 (Not Activated) Firewall : Kaspersky Internet Security 8.0.0.454 (Not Activated) A:\ (USB) D:\ (CD or DVD) H:\ (USB) I:\ (Local Disk) - NTFS - Total : 149 Go Free : 64 Go J:\ (Local Disk) - NTFS - Total : 465 Go Free : 73 Go "I:\ToolBar SD" ( MAJ : 04-10-2008|21:00 ) Option : [2] ( 21/10/2008|13:41 ) -----------\ SUPPRESSION Supprime! - I:\DOCUME~1\Francine\LOCALS~1\Temp\NERO14768\Toolbar.exe Supprime! - I:\Program Files\AskSBar\bar Supprime! - I:\Program Files\AskSBar\SrchAstt Supprime! - I:\DOCUME~1\ALLUSE~1\APPLIC~1\Starware316\buttons Supprime! - I:\DOCUME~1\ALLUSE~1\APPLIC~1\Starware316\contexts Supprime! - I:\DOCUME~1\ALLUSE~1\APPLIC~1\Starware316\images Supprime! - I:\DOCUME~1\ALLUSE~1\APPLIC~1\Starware316\SimpleUpdate Supprime! - I:\DOCUME~1\Francine\APPLIC~1\Starware316\BrowserSearch Supprime! - I:\DOCUME~1\Francine\APPLIC~1\Starware316\Configurator Supprime! - I:\DOCUME~1\Francine\APPLIC~1\Starware316\ErrorSearch Supprime! - I:\DOCUME~1\Francine\APPLIC~1\Starware316\Free_Credit_Score Supprime! - I:\DOCUME~1\Francine\APPLIC~1\Starware316\Free_Music Supprime! - I:\DOCUME~1\Francine\APPLIC~1\Starware316\Layouts Supprime! - I:\DOCUME~1\Francine\APPLIC~1\Starware316\Manager Supprime! - I:\DOCUME~1\Francine\APPLIC~1\Starware316\Reference Supprime! - I:\DOCUME~1\Francine\APPLIC~1\Starware316\RelatedSearch Supprime! - I:\DOCUME~1\Francine\APPLIC~1\Starware316\Ringtones Supprime! - I:\DOCUME~1\Francine\APPLIC~1\Starware316\Screensavers Supprime! - I:\DOCUME~1\Francine\APPLIC~1\Starware316\Toolbar Supprime! - I:\DOCUME~1\Francine\APPLIC~1\Starware316\ToolbarLogo Supprime! - I:\DOCUME~1\Francine\APPLIC~1\Starware316\ToolbarSearch Supprime! - I:\DOCUME~1\Francine\APPLIC~1\Starware316\TravelSearch Supprime! - I:\DOCUME~1\Francine\APPLIC~1\Starware316\Weather Supprime! - I:\Program Files\Mozilla Firefox\plugins\NPAskSBr.dll Supprime! - I:\Program Files\AskSBar Supprime! - I:\Program Files\Hotbar Supprime! - I:\DOCUME~1\ALLUSE~1\APPLIC~1\Starware316 Supprime! - I:\DOCUME~1\Francine\APPLIC~1\Starware316 -----------\ Recherche de Fichiers / Dossiers ... -----------\ [..\Internet Explorer\Main] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Local Page"="I:\WINDOWS\system32\blank.htm" "SearchMigratedDefaultURL"="https://www.google.com/webhp?gws_rd=ssl{searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8" "Start Page"="https://www.aufeminin.com/" "Url"="http://www.microsoft.com/athome/community/rss.xml" "Url"="http://rss.msn.com/en-us/?feedoutput=rss&ocid=iehrs&unsub=true" "Url"="http://www.microsoft.com/atwork/community/rss.xml" [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main] "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp" "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF" "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF" "Start Page"="https://www.msn.com/fr-fr/" --------------------\ Recherche d'autres infections I:\DOCUME~1\Francine\LOCALS~1\APPLIC~1 osot.dat I:\DOCUME~1\Francine\LOCALS~1\APPLIC~1 osot_nav.dat I:\DOCUME~1\Francine\LOCALS~1\APPLIC~1 osot_navps.dat [b]==> EGDACCESS <==/b I:\WINDOWS\system32\qYFiQqru.ini I:\WINDOWS\system32\qYFiQqru.ini2 [b]==> VUNDO <==/b --------------------\ Cracks & Keygens .. I:\DOCUME~1\Francine\Bureau\keygen.exe 1 - "I:\ToolBar SD\TB_1.txt" - 21/10/2008|13:28 - Option : [1] 2 - "I:\ToolBar SD\TB_2.txt" - 21/10/2008|13:43 - Option : [2] -----------\ Fin du rapport a 13:43:28,31 Voici également le rapport hijackthis Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:46:30, on 21/10/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: I:\WINDOWS\System32\smss.exe I:\WINDOWS\system32\winlogon.exe I:\WINDOWS\system32\services.exe I:\WINDOWS\system32\lsass.exe I:\WINDOWS\system32\Ati2evxx.exe I:\WINDOWS\system32\svchost.exe I:\WINDOWS\System32\svchost.exe I:\WINDOWS\system32\Ati2evxx.exe I:\WINDOWS\system32\spoolsv.exe I:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe I:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe I:\Program Files\Bonjour\mDNSResponder.exe I:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe I:\WINDOWS\system32\cisvc.exe I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe I:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE I:\WINDOWS\system32\HPZipm12.exe I:\WINDOWS\system32\svchost.exe I:\WINDOWS\system32\SearchIndexer.exe I:\WINDOWS\System32\svchost.exe I:\WINDOWS\system32\cidaemon.exe I:\WINDOWS\Explorer.EXE I:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe I:\Program Files\Java\jre1.6.0_07\bin\jusched.exe I:\Program Files\Analog Devices\Core\smax4pnp.exe I:\Program Files\Analog Devices\SoundMAX\Smax4.exe I:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe I:\Program Files\HP\HP Software Update\HPWuSchd2.exe I:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe I:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe I:\Program Files\iTunes\iTunesHelper.exe I:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe I:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe I:\WINDOWS\system32\ctfmon.exe I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe I:\Program Files\Windows Live\Messenger\MsnMsgr.Exe I:\Program Files\Nosibay\VPbubble\launcher.exe I:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe I:\Program Files\iPod\bin\iPodService.exe I:\Program Files\Windows Desktop Search\WindowsSearch.exe I:\Documents and Settings\Francine\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe I:\Documents and Settings\Francine\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe I:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe I:\Program Files\Windows Live\Contacts\wlcomm.exe I:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe I:\Program Files\Nosibay\VPbubble\VPbubble.exe I:\WINDOWS\system32 undll32.exe I:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe I:\WINDOWS\system32\cmd.exe I:\Program Files\Windows Live\Toolbar\wltuser.exe I:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe I:\WINDOWS\system32\NOTEPAD.EXE I:\Program Files\Internet Explorer\IEXPLORE.EXE I:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.aufeminin.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.yahoo.com/?p=us R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - I:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - I:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - I:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - I:\Program Files\BitComet ools\BitCometBHO_1.2.8.7.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - I:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - I:\Program Files\Windows Live\Messenger\wlchtc.dll O2 - BHO: (no name) - {613E416F-BCB6-43AD-B0FC-DF7B0D5A70BF} - (no file) O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - I:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - I:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - I:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - I:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll O2 - BHO: (no name) - {B7DBCD27-56B4-47D2-935C-B98A0DDA2821} - (no file) O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - I:\Program Files\MSN\Toolbar\3.0.0311.0\msneshellx.dll O2 - BHO: Windows Live Toolbar Beta - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - I:\Program Files\Windows Live\Toolbar\wltcore.dll O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - I:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - I:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - I:\Program Files\MSN\Toolbar\3.0.0311.0\msneshellx.dll O3 - Toolbar: &Windows Live Toolbar Beta - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - I:\Program Files\Windows Live\Toolbar\wltcore.dll O4 - HKLM\..\Run: [NeroCheck] I:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [AudioDeck] I:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe 1 O4 - HKLM\..\Run: [SunJavaUpdateSched] "I:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [JMB36X IDE Setup] I:\WINDOWS\JM\JMInsIDE.exe O4 - HKLM\..\Run: [JMB36X Configure] I:\WINDOWS\system32\JMRaidTool.exe boot O4 - HKLM\..\Run: [SoundMAXPnP] I:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SoundMAX] "I:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [Ai Nap] "I:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe" O4 - HKLM\..\Run: [HP Software Update] I:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [basicsmssmenu] "I:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe" O4 - HKLM\..\Run: [HydraVisionDesktopManager] "I:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe" O4 - HKLM\..\Run: [AVP] "I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" O4 - HKLM\..\Run: [iTunesHelper] "I:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Canal Widget] "I:\Program Files\Canal\Canal Widget\Launcher.exe" O4 - HKLM\..\Run: [Google Desktop Search] "I:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon O4 - HKLM\..\Run: [QuickTime Task] "I:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [AppleSyncNotifier] I:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "I:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [StartCCC] "I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKCU\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "I:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [VPbubble] "I:\Program Files\Nosibay\VPbubble\launcher.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Outil de notification Live Search.lnk = I:\Documents and Settings\Francine\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = I:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = I:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Windows Search.lnk = I:\Program Files\Windows Desktop Search\WindowsSearch.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://I:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://I:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://I:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - I:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - I:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - I:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - I:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://I:\Program Files\BitComet ools\BitCometBHO_1.2.8.7.dll/206 (file missing) O9 - Extra button: Sélection intelligente HP - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - I:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: *.canal-plus.com (HKLM) O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - I:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5036.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/... O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab O20 - AppInit_DLLs: I:\PROGRA~1\KASPER~1\KASPER~1\MZVKBD.DLL,I:\PROGRA~1\KASPER~1\KASPER~1\ADIALHK.DLL,I:\PROGRA~1\KASPER~1\KASPER~1\KLOEHK.DLL I:\PROGRA~1\KASPER~1\KASPER~1\MZVKBD3.DLL I:\PROGRA~1\GOOGLE\GOOGLE~3\GOEC62~1.DLL O20 - Winlogon Notify: efcBqpOH - I:\WINDOWS\ O23 - Service: Apple Mobile Device - Apple Inc. - I:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - I:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - I:\WINDOWS\system32\ati2sgag.exe O23 - Service: Kaspersky Internet Security (avp) - Kaspersky Lab - I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe O23 - Service: Basics Service - Seagate Technology LLC - I:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - I:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: CanalPlus.VOD - Canal+ Active - I:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - I:\Program Files\NOS\bin\getPlus_HelperSvc.exe O23 - Service: Google Desktop Manager 5.8.809.23506 (GoogleDesktopManager-092308-165331) - Google - I:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HP Port Resolver - Hewlett-Packard Company - I:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE O23 - Service: HP Status Server - Hewlett-Packard Company - I:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - I:\Program Files\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - I:\WINDOWS\system32\HPZipm12.exe O23 - Service: WZCBDL Service (WZCBDLService) - Unknown owner - I:\Program Files\WZCBDL Service\WZCBDLS.exe (file missing) O24 - Desktop Component 0: (no name) - http://wallpapers.boolsite.net/...

Utilisateur anonyme · Answer

Salut,

télécharge [url=http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe hijackthis]
->  enregistre la cible sous .... le bureau 


-> Fais un double-clic sur HJTInstall.exe afin de lancer l'installation

-> Clique sur Install ensuite sur I Accept

-> Clique sur Do a scan system and save log file

-> Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse 


Note : Avant tout emploi de logiciel, s’assurer que les protections de registres tel que le Tea Timer de spybot sont désactivées (notamment lors de l’emploi d’HijackThis)
Spybot >mode avancé> outils > résident
Décocher la case résident "tea timer"
Refermer Spybot.

Utilisateur anonyme · Answer

Re,

alors oui tu es infecter.

Commences par ceci :

Télécharges [ http://eric.71.mespages.googlepages.com/ToolBarSD.exeToolBar S&D ( de Eric_71/Team IDN ) ]:
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

( Tuto : https://sites.google.com/site/toolbarsd/aideenimages )

!! Déconnectes toi et fermes toute tes applications en cours le temps de la manipe !!

* double-cliques sur l'.exe pour lancer l'installe et laisses toi guider ...
* Une fois fait, cliques sur le raccourci créé sur ton bureau pour lancer l'outil .
* Choisis l'option 1 ( "recherche") et tapes "entrée" .
* Une fois le scan finit , un rapport va apparaître, copie/colles l'intégralité
de son contenu dans ta prochaine réponse ...
( le rapport est en outre sauvegardé ici -> C:\TB.txt )

Utilisateur anonyme · Answer

Re,

Fais ceci maintenant :


Nettoyage avec ToolBar S&D :

!! Déconnectes toi et fermes toute tes applications en cours le temps de la manipe !!

Relances Toolbar-S&D en double-cliquant sur le raccourci.
-->Tapes sur l'option 2 ( "nettoyage" ) puis tapes sur "Entrée".

Note : ne touches à rien lors de la suppression !

Un rapport sera généré à la fin du processus : postes son contenu dans ta prochaine réponse
accompagné d'un nouveau rapport hijackthis pour analyse ...

Utilisateur anonyme · Answer

Re,

maintenant fait ceci:

-Télécharge et installe MalwareByte's Anti-Malware
http://www.malwarebytes.org/mbam/program/mbam-setup.exe

- Mets le à jour

---

- Redémarre en mode sans échec :

Au redémarrage de ton PC tapote sur la touche F8 ou F5 sur l'écran suivant déplace toi avec les flèches de direction et choisis Mode sans échec. Choisis ta session habituelle et non la session Administrateur

---

- Double clique sur le raccourci de MalwareByte's Anti-Malware qui est sur le bureau.
- Sélectionne Exécuter un examen complet si ce n'est pas déjà fait
- clique sur Rechercher

- Une fois le scan terminé, une fenêtre s'ouvre, clique sur sur Ok

- Si MalwareByte's n'a rien détecté, clique sur Ok Un rapport va apparaître ferme-le.

- Si MalwareByte's a détecté des infections, clique sur Afficher les résultats ensuite sur Supprimer la sélection

- Enregistre le rapport sur ton Bureau comme cela il sera plus facile à retrouver, poste ensuite ce rapport.

Note : Si MalwareByte's a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok

Tutoriel pour MalwareByte's ici :
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/­­

franny12772 · Answer

cher goldorak 59,


je n'arrive pas à redemarrer mon PC en mode sans échec car quand je clic pour ouvrir ma session, il redemarre tout seul.
que dois-je faire?

Utilisateur anonyme · Answer

Re,

tu as fait le scan est tout le tintouin ou pas?

@+

franny12772 · Answer

Re-,


le scan est enfin terminé voici le rapport:

Malwarebytes' Anti-Malware 1.29
Version de la base de données: 1300
Windows 5.1.2600 Service Pack 3

21/10/2008 16:25:54
mbam-log-2008-10-21 (16-25-54).txt

Type de recherche: Examen complet (I:\|J:\|)
Eléments examinés: 168809
Temps écoulé: 1 hour(s), 52 minute(s), 28 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 8
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 12
Fichier(s) infecté(s): 14

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\AXPFixer (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\The Weather Channel (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Weather Services (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\starware316 (Adware.Starware) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Screensavers.com (Adware.Comet) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cpls\wxfw.dll (Adware.Hotbar) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
I:\Documents and Settings\Francine\Application Data\AXPFixer (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
I:\Documents and Settings\Francine\Application Data\AXPFixer\AXPFixer (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
I:\Documents and Settings\Francine\Application Data\AXPFixer\AXPFixer\Quarantine (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
I:\Documents and Settings\Francine\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
I:\Documents and Settings\Francine\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\HKCU (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
I:\Documents and Settings\Francine\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\HKCU\RunOnce (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
I:\Documents and Settings\Francine\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\HKLM (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
I:\Documents and Settings\Francine\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\HKLM\RunOnce (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
I:\Documents and Settings\Francine\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\StartMenuAllUsers (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
I:\Documents and Settings\Francine\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\StartMenuCurrentUser (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
I:\Documents and Settings\Francine\Application Data\AXPFixer\AXPFixer\Quarantine\BrowserObjects (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
I:\Documents and Settings\Francine\Application Data\AXPFixer\AXPFixer\Quarantine\Packages (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
I:\Documents and Settings\Francine\Local Settings\Application Data\rosot_navps.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
I:\Documents and Settings\Francine\Local Settings\Application Data\rosot_nav.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
I:\Documents and Settings\Francine\Local Settings\Application Data\rosot.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
I:\Documents and Settings\PTK\Local Settings\Temp\GLK8C.tmp (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
I:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe (Adware.Hotbar) -> Quarantined and deleted successfully.
I:\Program Files\The Weather Channel FW\Framework\TheWeatherChannelNE.exe (Adware.Hotbar) -> Quarantined and deleted successfully.
I:\Program Files\The Weather Channel FW\Framework\TheWeatherChannelQC.exe (Adware.Hotbar) -> Quarantined and deleted successfully.
I:\Program Files\The Weather Channel FW\Framework\TheWeatherChannelqx.exe (Adware.Hotbar) -> Quarantined and deleted successfully.
I:\Program Files\The Weather Channel FW\Framework\TheWeatherChannelSlnchr.exe (Adware.Hotbar) -> Quarantined and deleted successfully.
I:\Program Files\The Weather Channel FW\Framework\TheWeatherChannelUpdate.exe (Adware.Hotbar) -> Quarantined and deleted successfully.
I:\Program Files\The Weather Channel FW\Framework\WiseInstallUtility.dll (Adware.Hotbar) -> Quarantined and deleted successfully.
I:\Program Files\The Weather Channel FW\Framework\wxfw.dll (Adware.Hotbar) -> Quarantined and deleted successfully.
I:\WINDOWS\system32\blackster.scr (Trojan.Agent) -> Quarantined and deleted successfully.
I:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.

franny12772 · Answer

Re-,


le scan est enfin terminé voici le rapport:

Malwarebytes' Anti-Malware 1.29
Version de la base de données: 1300
Windows 5.1.2600 Service Pack 3

21/10/2008 16:25:54
mbam-log-2008-10-21 (16-25-54).txt

Type de recherche: Examen complet (I:\|J:\|)
Eléments examinés: 168809
Temps écoulé: 1 hour(s), 52 minute(s), 28 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 8
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 12
Fichier(s) infecté(s): 14

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\AXPFixer (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\The Weather Channel (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Weather Services (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\starware316 (Adware.Starware) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Screensavers.com (Adware.Comet) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cpls\wxfw.dll (Adware.Hotbar) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
I:\Documents and Settings\Francine\Application Data\AXPFixer (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
I:\Documents and Settings\Francine\Application Data\AXPFixer\AXPFixer (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
I:\Documents and Settings\Francine\Application Data\AXPFixer\AXPFixer\Quarantine (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
I:\Documents and Settings\Francine\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
I:\Documents and Settings\Francine\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\HKCU (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
I:\Documents and Settings\Francine\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\HKCU\RunOnce (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
I:\Documents and Settings\Francine\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\HKLM (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
I:\Documents and Settings\Francine\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\HKLM\RunOnce (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
I:\Documents and Settings\Francine\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\StartMenuAllUsers (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
I:\Documents and Settings\Francine\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\StartMenuCurrentUser (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
I:\Documents and Settings\Francine\Application Data\AXPFixer\AXPFixer\Quarantine\BrowserObjects (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
I:\Documents and Settings\Francine\Application Data\AXPFixer\AXPFixer\Quarantine\Packages (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
I:\Documents and Settings\Francine\Local Settings\Application Data\rosot_navps.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
I:\Documents and Settings\Francine\Local Settings\Application Data\rosot_nav.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
I:\Documents and Settings\Francine\Local Settings\Application Data\rosot.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
I:\Documents and Settings\PTK\Local Settings\Temp\GLK8C.tmp (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
I:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe (Adware.Hotbar) -> Quarantined and deleted successfully.
I:\Program Files\The Weather Channel FW\Framework\TheWeatherChannelNE.exe (Adware.Hotbar) -> Quarantined and deleted successfully.
I:\Program Files\The Weather Channel FW\Framework\TheWeatherChannelQC.exe (Adware.Hotbar) -> Quarantined and deleted successfully.
I:\Program Files\The Weather Channel FW\Framework\TheWeatherChannelqx.exe (Adware.Hotbar) -> Quarantined and deleted successfully.
I:\Program Files\The Weather Channel FW\Framework\TheWeatherChannelSlnchr.exe (Adware.Hotbar) -> Quarantined and deleted successfully.
I:\Program Files\The Weather Channel FW\Framework\TheWeatherChannelUpdate.exe (Adware.Hotbar) -> Quarantined and deleted successfully.
I:\Program Files\The Weather Channel FW\Framework\WiseInstallUtility.dll (Adware.Hotbar) -> Quarantined and deleted successfully.
I:\Program Files\The Weather Channel FW\Framework\wxfw.dll (Adware.Hotbar) -> Quarantined and deleted successfully.
I:\WINDOWS\system32\blackster.scr (Trojan.Agent) -> Quarantined and deleted successfully.
I:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.

Utilisateur anonyme · Answer

Re,

alors tu es trés infecter .Fait ces manip dans l'ordre trés important si tu as un problème dit le avant de commencer quoi que ce soit.

Alors te conseil de supprimer les malware en faisant cela:

clique sur Afficher les résultats ensuite sur Supprimer la sélection .

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
• Redémarre ton ordinateur
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
• Choisis ton compte.

• Puis, ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
• Appuie sur une touche pour commencer le processus de nettoyage.
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
• Appuie sur une touche pour redémarrer le PC.
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
• Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.

• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum

Ensuite,

Combofix. Attention, ce logiciel est très puissant, une mauvaise utilisation peut faire des dégâts...

Fais exactement ce qui suit :

Télécharge ComboFix (de sUBs) sur ton Bureau (et pas ailleurs !) :
Fais un clic droit sur ce lien et choisis "enregistrer la cible sous ... " : dans la fenêtre qui s'ouvre tape C-Fix, choisis le bureau comme destination et valide : 
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

--------------------------------------------- [ ! ATTENTION ! ] ----------------------------------------------------------
!! déconnecte toi, ferme toutes tes applications en cours et DESACTIVE TOUTES TES DEFENCES (anti-virus, antispyware, pare-feu) le temps de la manipulation (si jamais tu en as et que je ne les ai pas vu sur le rapport hijackthis....)

---> Surtout, si tu rencontres des difficultés à ce niveau là, dis le moi avant de poursuivre...

Tuto ici : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
---------------------------------------------------------------------------------------------------------------------------------

Ensuite :
double-clique sur C-Fix.exe (= combofix.exe ) .

Appuie sur une touche pour démarrer le scan .

Attention : n'utilise pas ta souris ni ton clavier pendant que le programme tourne. Cela pourrait figer l'ordi ---> si un message d'erreur windows apparait à un moment : clique sur la croix rouge en haut à droite de la fenêtre pour la fermer

Le rapport sera crée dans: C:\Combofix.txt , poste le ici stp

franny12772 · Answer

impossible de passer en mode sans échec.
qd je veux ouvrir ma session, l'ordi redemarre.

Utilisateur anonyme · Answer

Re,

alors fait combofix en premier et post le rapport .

pour l'autres log on verras ensuite.

@+

franny12772 · Answer

Re-, voilà le rapport de comboFix: ComboFix 08-10-19.04 - Francine 2008-10-21 17:34:49.1 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.1457 [GMT 2:00] Lancé depuis: I:\Documents and Settings\Francine\Bureau\C-Fiix.exe [COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . I:\Documents and Settings\PTK\Local Settings\Temporary Internet Files\SuggestedSites.dat I:\WINDOWS\IE4 Error Log.txt I:\WINDOWS\system32\qYFiQqru.ini I:\WINDOWS\system32\qYFiQqru.ini2 J:\Autorun.inf . ((((((((((((((((((((((((((((( Fichiers créés du 2008-09-21 au 2008-10-21 )))))))))))))))))))))))))))))))))))) . 2008-10-21 17:20 . 2008-10-21 17:20 1,552,080 --a------ I:\SDFix.exe 2008-10-21 17:18 . 2008-10-16 12:17 d-------- I:\SDFix 2008-10-21 13:59 . 2008-10-21 13:59 d-------- I:\Program Files\Malwarebytes' Anti-Malware 2008-10-21 13:59 . 2008-10-21 13:59 d-------- I:\Documents and Settings\Francine\Application Data\Malwarebytes 2008-10-21 13:59 . 2008-10-21 13:59 d-------- I:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-10-21 13:59 . 2008-10-16 20:25 38,496 --a------ I:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-10-21 13:59 . 2008-10-16 20:25 15,504 --a------ I:\WINDOWS\system32\drivers\mbam.sys 2008-10-21 13:28 . 2008-10-21 13:42 4,822 --a------ I:\Documents and Settings\Orph.egd 2008-10-21 13:26 . 2008-10-21 13:43 d-------- I:\ToolBar SD 2008-10-21 13:16 . 2008-10-21 13:16 d-------- I:\Program Files\Trend Micro 2008-10-16 15:52 . 2008-10-16 15:52 d-------- I:\Program Files\NOS 2008-10-16 15:52 . 2008-10-16 15:57 d-------- I:\Documents and Settings\All Users\Application Data\NOS 2008-10-15 02:37 . 2008-09-08 12:41 333,824 -----c--- I:\WINDOWS\system32\dllcache\srv.sys 2008-10-15 02:35 . 2008-08-14 15:23 2,068,096 -----c--- I:\WINDOWS\system32\dllcache tkrnlpa.exe 2008-10-15 02:35 . 2008-09-15 17:26 1,846,528 -----c--- I:\WINDOWS\system32\dllcache\win32k.sys 2008-10-15 02:34 . 2008-08-14 15:23 2,025,984 -----c--- I:\WINDOWS\system32\dllcache tkrpamp.exe 2008-10-11 21:12 . 2008-10-11 21:12 d-------- I:\Documents and Settings\All Users\Application Data\ATI 2008-10-07 22:50 . 2008-10-07 22:50 d-------- I:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-10-07 22:38 . 2008-10-07 22:38 d-------- I:\Program Files\Windows Installer Clean Up 2008-10-07 11:20 . 2008-10-07 11:23 d-------- I:\Documents and Settings\Francine\Application Data\Multi-Note 2008-10-03 06:13 . 2008-10-03 06:13 d-------- I:\Documents and Settings\PTK\Application Data\Windows Search 2008-10-02 06:52 . 2008-10-18 23:55 d-------- I:\Documents and Settings\Francine\Tracing 2008-10-02 06:45 . 2008-09-04 22:03 56,344 --a------ I:\WINDOWS\system32\drivers\fssfltr.sys 2008-10-02 06:42 . 2008-10-02 06:42 d-------- I:\Program Files\Microsoft 2008-10-02 06:30 . 2008-10-02 06:30 d-------- I:\Program Files\Fichiers communs\Windows Live 2008-10-01 14:44 . 2008-10-01 14:44 d-------- I:\Program Files\Windows Resource Kits 2008-09-30 12:27 . 2008-09-30 12:27 d-------- I:\Documents and Settings\Francine\Application Data\Windows Search 2008-09-28 04:23 . 2008-09-28 04:23 d-------- I:\Documents and Settings\PTK\Application Data\Windows Desktop Search 2008-09-27 15:45 . 2008-09-27 15:45 d-------- I:\WINDOWS\system32\GroupPolicy 2008-09-27 15:45 . 2008-09-27 15:45 d-------- I:\Program Files\Windows Desktop Search 2008-09-27 15:45 . 2008-09-27 15:45 d-------- I:\Documents and Settings\Francine\Application Data\Windows Desktop Search 2008-09-27 15:44 . 2008-03-07 19:02 192,000 -----c--- I:\WINDOWS\system32\dllcache\offfilt.dll 2008-09-27 15:44 . 2008-03-07 19:02 98,304 -----c--- I:\WINDOWS\system32\dllcache lhtml.dll 2008-09-27 15:44 . 2008-03-07 19:02 29,696 -----c--- I:\WINDOWS\system32\dllcache\mimefilt.dll . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-21 15:41 39,152 --sha-w I:\WINDOWS\system32\drivers\fidbox2.idx 2008-10-21 15:41 188,480 --sha-w I:\WINDOWS\system32\drivers\fidbox.idx 2008-10-21 15:41 13,914,912 --sha-w I:\WINDOWS\system32\drivers\fidbox.dat 2008-10-21 15:41 1,015,840 --sha-w I:\WINDOWS\system32\drivers\fidbox2.dat 2008-10-21 15:12 --------- d-----w I:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-10-21 14:44 --------- d-----w I:\Documents and Settings\PTK\Application Data\HPAppData 2008-10-21 08:00 --------- d-----w I:\Program Files\Microsoft Silverlight 2008-10-21 00:23 96,976 ----a-w I:\WINDOWS\system32\drivers\klin.dat 2008-10-20 04:24 --------- d-----w I:\Program Files\HP 2008-10-19 22:48 --------- d-----w I:\Documents and Settings\All Users\Application Data\Google Updater 2008-10-11 17:56 --------- d-----w I:\Program Files\ATI Technologies 2008-10-07 20:56 --------- d-----w I:\Program Files\iTunes 2008-10-07 20:39 --------- d-----w I:\Program Files\MSECache 2008-10-06 12:44 --------- d-----w I:\Documents and Settings\Francine\Application Data\Yahoo! 2008-10-02 04:45 --------- d-----w I:\Program Files\Windows Live 2008-10-02 04:36 --------- d-----w I:\Program Files\Picasa2 2008-10-01 15:51 --------- d-----w I:\Program Files\Windows Live Safety Center 2008-09-21 17:08 --------- d-----w I:\Program Files\Fichiers communs\Symantec Shared 2008-09-18 17:47 --------- d-----w I:\Documents and Settings\PTK\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 2008-09-18 16:53 --------- d-----w I:\Program Files\FileZilla FTP Client 2008-09-18 16:50 --------- d-----w I:\Program Files\Fichiers communs\Adobe 2008-09-16 17:22 --------- d-----w I:\Program Files\QuickTime 2008-09-16 17:21 --------- d-----w I:\Program Files\Fichiers communs\Apple 2008-09-16 17:15 --------- d-----w I:\Program Files\Bonjour 2008-09-15 20:42 --------- d-----w I:\Program Files\BitComet 2008-09-15 19:49 --------- d-----w I:\Documents and Settings\PTK\Application Data\FileZilla 2008-09-15 15:26 1,846,528 ----a-w I:\WINDOWS\system32\win32k.sys 2008-09-12 15:12 --------- d-----w I:\Program Files\Fichiers communs\AVSMedia 2008-09-12 15:12 --------- d-----w I:\Program Files\AVS4YOU 2008-09-08 22:03 51,712 ----a-w I:\WINDOWS\system32\sirenacm.dll 2008-09-08 10:41 333,824 ----a-w I:\WINDOWS\system32\drivers\srv.sys 2008-09-07 09:43 --------- d-----w I:\Program Files\DivX 2008-09-05 13:56 287,744 ----a-w I:\WINDOWS\WLXPGSS.SCR 2008-08-29 08:18 87,336 ----a-w I:\WINDOWS\system32\dns-sd.exe 2008-08-29 07:53 61,440 ----a-w I:\WINDOWS\system32\dnssd.dll 2008-08-28 07:47 74,752 ----a-w I:\WINDOWS\system32\msw3prt.dll 2008-08-28 07:47 105,472 ----a-w I:\WINDOWS\system32\win32spl.dll 2008-08-26 08:11 826,368 ----a-w I:\WINDOWS\system32\wininet.dll 2008-08-25 10:59 --------- d--h--w I:\Program Files\InstallShield Installation Information 2008-08-22 14:18 --------- d-----w I:\Program Files\Google 2008-08-21 04:52 3,299,840 ----a-w I:\WINDOWS\system32\drivers\ati2mtag.sys 2008-08-21 02:19 425,984 ----a-w I:\WINDOWS\system32\ATIDEMGX.dll 2008-08-21 02:18 314,880 ----a-w I:\WINDOWS\system32\ati2dvag.dll 2008-08-21 02:08 184,320 ----a-w I:\WINDOWS\system32\atipdlxx.dll 2008-08-21 02:08 143,360 ----a-w I:\WINDOWS\system32\Oemdspif.dll 2008-08-21 02:07 43,520 ----a-w I:\WINDOWS\system32\ati2edxx.dll 2008-08-21 02:07 26,112 ----a-w I:\WINDOWS\system32\Ati2mdxx.exe 2008-08-21 02:07 143,360 ----a-w I:\WINDOWS\system32\ati2evxx.dll 2008-08-21 02:05 573,440 ----a-w I:\WINDOWS\system32\ati2evxx.exe 2008-08-21 02:04 53,248 ----a-w I:\WINDOWS\system32\ATIDDC.DLL 2008-08-21 02:01 10,084,352 ----a-w I:\WINDOWS\system32\atioglxx.dll 2008-08-21 01:55 4,094,560 ----a-w I:\WINDOWS\system32\ati3duag.dll 2008-08-21 01:50 307,200 ----a-w I:\WINDOWS\system32\atiiiexx.dll 2008-08-21 01:38 2,377,856 ----a-w I:\WINDOWS\system32\ativvaxx.dll 2008-08-21 01:23 48,640 ----a-w I:\WINDOWS\system32\amdpcom32.dll 2008-08-21 01:19 380,928 ----a-w I:\WINDOWS\system32\atikvmag.dll 2008-08-21 01:18 37,376 ----a-w I:\WINDOWS\system32\atiadlxx.dll 2008-08-21 01:18 17,408 ----a-w I:\WINDOWS\system32\atitvo32.dll 2008-08-21 01:17 53,248 ----a-w I:\WINDOWS\system32\drivers\ati2erec.dll 2008-08-21 01:17 253,952 ----a-w I:\WINDOWS\system32\atiok3x2.dll 2008-08-21 01:11 561,152 ----a-w I:\WINDOWS\system32\ati2cqag.dll 2008-08-20 19:05 593,920 ------w I:\WINDOWS\system32\ati2sgag.exe 2008-08-14 13:23 2,147,328 ----a-w I:\WINDOWS\system32 toskrnl.exe 2008-08-14 13:23 2,025,984 ----a-w I:\WINDOWS\system32 tkrnlpa.exe 2008-08-06 05:42 327,680 ----a-w I:\WINDOWS\system32\pythoncom25.dll 2008-08-06 05:42 2,113,536 ----a-w I:\WINDOWS\system32\python25.dll 2008-08-06 05:42 102,400 ----a-w I:\WINDOWS\system32\pywintypes25.dll 2008-08-05 21:14 90,112 ----a-w I:\WINDOWS\system32\ATIBRTMON.EXE 2008-08-05 15:55 265,720 ----a-w I:\WINDOWS\system32\msdbg2.dll 2008-07-29 18:21 218,376 ----a-w I:\WINDOWS\system32\klogon.dll 2008-07-25 08:36 524,288 ----a-w I:\WINDOWS\system32\DivXsm.exe 2008-07-23 16:50 3,596,288 ----a-w I:\WINDOWS\system32\qt-dx331.dll 2008-07-23 16:48 200,704 ----a-w I:\WINDOWS\system32\ssldivx.dll 2008-07-23 16:48 1,044,480 ----a-w I:\WINDOWS\system32\libdivx.dll 2008-07-23 16:46 12,288 ----a-w I:\WINDOWS\system32\DivXWMPExtType.dll 2007-03-07 17:04 774,144 ----a-w I:\Program Files\RngInterstitial.dll 2006-06-23 12:48 32,768 ----a-r I:\WINDOWS\inf\UpdateUSB.exe 2008-05-28 21:07 32,768 --sha-w I:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008052820080529\index.dat . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}] 2008-08-21 15:15 94736 --a------ I:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{21FA44EF-376D-4D53-9B0F-8A89D3229068}"= "I:\Program Files\Windows Live\Toolbar\wltcore.dll" [2008-09-02 953360] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{21FA44EF-376D-4D53-9B0F-8A89D3229068}"= "I:\Program Files\Windows Live\Toolbar\wltcore.dll" [2008-09-02 953360] [HKEY_CLASSES_ROOT\clsid\{21fa44ef-376d-4d53-9b0f-8a89d3229068}] [HKEY_CLASSES_ROOT\TypeLib\{182E05A4-F4FF-4F73-8C84-D36B87D915AF}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="I:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360] "MsnMsgr"="I:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2008-09-09 3513344] "VPbubble"="I:\Program Files\Nosibay\VPbubble\launcher.exe" [2008-06-20 239120] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroCheck"="I:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648] "AudioDeck"="I:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe" [2006-11-02 528384] "SunJavaUpdateSched"="I:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "JMB36X IDE Setup"="I:\WINDOWS\JM\JMInsIDE.exe" [2006-10-30 36864] "JMB36X Configure"="I:\WINDOWS\system32\JMRaidTool.exe" [2006-06-02 385024] "SoundMAXPnP"="I:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 868352] "Ai Nap"="I:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe" [2007-05-24 1423872] "HP Software Update"="I:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "basicsmssmenu"="I:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe" [2007-10-09 169328] "HydraVisionDesktopManager"="I:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe" [2003-09-15 270336] "iTunesHelper"="I:\Program Files\iTunes\iTunesHelper.exe" [2008-10-01 289576] "Canal Widget"="I:\Program Files\Canal\Canal Widget\Launcher.exe" [2008-06-03 103992] "Google Desktop Search"="I:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-10-09 30192] "Synchronization Manager"="I:\WINDOWS\system32\mobsync.exe" [2008-04-14 143872] "QuickTime Task"="I:\Program Files\QuickTime\qttask.exe" [2008-09-06 413696] "AppleSyncNotifier"="I:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936] "Adobe Reader Speed Launcher"="I:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "StartCCC"="I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-01 61440] "AVP"="I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2008-07-29 206088] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="I:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360] "Picasa Media Detector"="I:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-08-21 443968] I:\Documents and Settings\Francine\Menu D‚marrer\Programmes\D‚marrage\ Outil de notification Live Search.lnk - I:\Documents and Settings\Francine\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe [2008-10-02 143360] I:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ D‚marrage rapide de HP Photosmart Premier.lnk - I:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2006-02-10 73728] HP Digital Imaging Monitor.lnk - I:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472] Windows Search.lnk - I:\Program Files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "I:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "I:\Program Files\Azureus\Azureus.exe"= "I:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"= "I:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"= "I:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"= "I:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"= "I:\Program Files\HP\Digital Imaging\bin\hposid01.exe"= "I:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"= "I:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"= "I:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"= "I:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"= "I:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"= "I:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"= "I:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"= "I:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"= "I:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"= "I:\Program Files\BitComet\BitComet.exe"= "I:\WINDOWS\Network Diagnostic\xpnetdiag.exe"= "I:\Program Files\Messenger\msmsgs.exe"= "I:\Program Files\FileZilla FTP Client\filezilla.exe"= "I:\kav\kis7.0\french\setup.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "I:\WINDOWS\system32\mmc.exe"= "I:\WINDOWS\system32\usmt\migwiz.exe"= "I:\Program Files\eMule\emule.exe"= "I:\Program Files\Bonjour\mDNSResponder.exe"= "I:\Program Files\Windows Live\Messenger\wlcsdk.exe"= "I:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "I:\Program Files\iTunes\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "6346:TCP"= 6346:TCP:shareaza "6346:UDP"= 6346:UDP:shareaza "11682:TCP"= 11682:TCP:BitComet "11682:UDP"= 11682:UDP:BitComet "11279:TCP"= 11279:TCP:BitComet 11279 TCP "11279:UDP"= 11279:UDP:BitComet 11279 UDP "27013:TCP"= 27013:TCP:BitComet 27013 TCP "27013:UDP"= 27013:UDP:BitComet 27013 UDP "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 R0 klbg;Kaspersky Lab Boot Guard Driver;I:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 32784] R2 Basics Service;Basics Service;I:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe [2007-10-09 124280] R2 CanalPlus.VOD;CanalPlus.VOD;I:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe [2008-06-03 61440] R2 fssfltr;FssFltr;I:\WINDOWS\system32\DRIVERS\fssfltr.sys [2008-09-04 56344] R3 KLFLTDEV;Kaspersky Lab KLFltDev;I:\WINDOWS\system32\DRIVERS\klfltdev.sys [2008-03-13 26640] R3 klim5;Kaspersky Anti-Virus NDIS Filter;I:\WINDOWS\system32\DRIVERS\klim5.sys [2008-04-30 24592] S2 NIOC;NIOC Service;I:\WINDOWS\system32\NIOC.SYS [ ] S2 WZCBDLService;WZCBDL Service;I:\Program Files\WZCBDL Service\WZCBDLS.exe [ ] S3 fsssvc;Windows Live Family Safety;I:\Program Files\Windows Live\Family Safety\fsssvc.exe [2008-09-04 512536] S3 getPlus(R) Helper;getPlus(R) Helper;I:\Program Files\NOS\bin\getPlus_HelperSvc.exe [2008-08-29 33752] S3 GoogleDesktopManager-092308-165331;Google Desktop Manager 5.8.809.23506;I:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-10-09 30192] S3 PRISM_USB;D-Link Air DWL-122 Wireless USB Adapter Driver;I:\WINDOWS\system32\DRIVERS\PRISMUSB.sys [2007-04-22 636416] . Contenu du dossier 'Tâches planifiées' 2008-10-14 I:\WINDOWS\Tasks\AppleSoftwareUpdate.job - I:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34] 2008-10-21 I:\WINDOWS\Tasks\User_Feed_Synchronization-{37555EE4-9CEF-4417-B039-920382C2F875}.job - I:\WINDOWS\system32\msfeedssync.exe [2007-08-13 19:36] 2008-10-21 I:\WINDOWS\Tasks\User_Feed_Synchronization-{EE03ED08-DAF7-47F7-85C1-FECB59AE8BDE}.job - I:\WINDOWS\system32\msfeedssync.exe [2007-08-13 19:36] 2008-10-21 I:\WINDOWS\Tasks\{F897AA24-BDC3-11D1-B85B-00C04FB93981}_A-AF6D5CAC220E4_Francine.job - I:\WINDOWS\system32\mobsync.exe [2008-04-14 04:34] . - - - - ORPHELINS SUPPRIMES - - - - BHO-{B7DBCD27-56B4-47D2-935C-B98A0DDA2821} - (no file) WebBrowser-{6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - (no file) WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file) WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file) Notify-efcBqpOH - (no file) . ------- Examen supplémentaire ------- . FireFox -: Profile - I:\Documents and Settings\Francine\Application Data\Mozilla\Firefox\Profiles\6tnoqvyg.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.msn.fr/ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.msn.fr/ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.msn.fr/ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.msn.fr/ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.msn.fr/ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.msn.fr/ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.msn.fr/ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.msn.fr/ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.msn.fr/ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.msn.fr/ . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-21 17:46:42 Windows 5.1.2600 Service Pack 3 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . ------------------------ Autres processus actifs ------------------------ . I:\WINDOWS\system32\ati2evxx.exe I:\WINDOWS\system32\ati2evxx.exe I:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe I:\Program Files\Bonjour\mDNSResponder.exe I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe I:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE I:\WINDOWS\system32\HPZipm12.exe I:\WINDOWS\system32\searchindexer.exe I:\Program Files\Canal\Canal Widget\Canal Widget.exe I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe I:\Documents and Settings\Francine\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe I:\Program Files\iPod\bin\iPodService.exe I:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe I:\Program Files\Nosibay\VPbubble\VPbubble.exe I:\Program Files\HP\Digital Imaging\bin\hpqste08.exe . ************************************************************************** . Heure de fin: 2008-10-21 17:54:28 - La machine a redémarré [Francine] ComboFix-quarantined-files.txt 2008-10-21 15:54:24 Avant-CF: 69,571,727,360 octets libres Après-CF: 71,459,946,496 octets libres 305 --- E O F --- 2008-10-21 08:00:15

Utilisateur anonyme · Answer

Re,

OK.

maintenant refait un hijs tout neuf STP.

merci.

franny12772 · Answer

Cher Goldorak, 

le voilou:



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:53:01, on 21/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\Ati2evxx.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\system32\Ati2evxx.exe
I:\WINDOWS\system32\spoolsv.exe
I:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
I:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe
I:\Program Files\Bonjour\mDNSResponder.exe
I:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe
I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
I:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\system32\SearchIndexer.exe
I:\WINDOWS\System32\svchost.exe
I:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe
I:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
I:\Program Files\Analog Devices\Core\smax4pnp.exe
I:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe
I:\Program Files\HP\HP Software Update\HPWuSchd2.exe
I:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe
I:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
I:\Program Files\iTunes\iTunesHelper.exe
I:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
I:\WINDOWS\system32\ctfmon.exe
I:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
I:\Program Files\Nosibay\VPbubble\launcher.exe
I:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
I:\Program Files\Windows Desktop Search\WindowsSearch.exe
I:\Documents and Settings\Francine\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
I:\Documents and Settings\Francine\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
I:\Program Files\iPod\bin\iPodService.exe
I:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
I:\Program Files\Nosibay\VPbubble\VPbubble.exe
I:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
I:\WINDOWS\explorer.exe
I:\WINDOWS\system32undll32.exe
I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
I:\Program Files\Windows Live\Contacts\wlcomm.exe
I:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\Ati2evxx.exe
I:\WINDOWS\system32\HPZipm12.exe
I:\WINDOWS\system32\SearchProtocolHost.exe
I:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.aufeminin.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.yahoo.com/?p=us
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - I:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - I:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - I:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - I:\Program Files\BitComet	ools\BitCometBHO_1.2.8.7.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - I:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - I:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - I:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - I:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - I:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - I:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - I:\Program Files\MSN\Toolbar\3.0.0311.0\msneshellx.dll
O2 - BHO: Windows Live Toolbar Beta - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - I:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - I:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - I:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - I:\Program Files\MSN\Toolbar\3.0.0311.0\msneshellx.dll
O3 - Toolbar: &Windows Live Toolbar Beta - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - I:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [NeroCheck] I:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AudioDeck] I:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [SunJavaUpdateSched] "I:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [JMB36X IDE Setup] I:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [JMB36X Configure] I:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [SoundMAXPnP] I:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Ai Nap] "I:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe"
O4 - HKLM\..\Run: [HP Software Update] I:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [basicsmssmenu] "I:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe"
O4 - HKLM\..\Run: [HydraVisionDesktopManager] "I:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe"
O4 - HKLM\..\Run: [iTunesHelper] "I:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Canal Widget] "I:\Program Files\Canal\Canal Widget\Launcher.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "I:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [QuickTime Task] "I:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] I:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "I:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [StartCCC] "I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [AVP] "I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "I:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [VPbubble] "I:\Program Files\Nosibay\VPbubble\launcher.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-583907252-287218729-682003330-1009\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\ctfmon.exe (User 'PTK')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Outil de notification Live Search.lnk = I:\Documents and Settings\Francine\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = I:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = I:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Windows Search.lnk = I:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://I:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://I:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://I:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - I:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - I:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - I:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - I:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://I:\Program Files\BitComet	ools\BitCometBHO_1.2.8.7.dll/206 (file missing)
O9 - Extra button: Sélection intelligente HP - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - I:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.canal-plus.com (HKLM)
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - I:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5036.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
O23 - Service: Apple Mobile Device - Apple Inc. - I:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - I:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - I:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security (avp) - Kaspersky Lab - I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Basics Service - Seagate Technology LLC - I:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - I:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CanalPlus.VOD - Canal+ Active - I:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - I:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Desktop Manager 5.8.809.23506 (GoogleDesktopManager-092308-165331) - Google - I:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - I:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - I:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - I:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - I:\WINDOWS\system32\HPZipm12.exe
O23 - Service: WZCBDL Service (WZCBDLService) - Unknown owner - I:\Program Files\WZCBDL Service\WZCBDLS.exe (file missing)
O24 - Desktop Component 0: (no name) - http://wallpapers.boolsite.net/...

Utilisateur anonyme · Answer

Re,

maintenant,

installe smitfraudfix

#1)  Recherche:

    * Double cliquer sur SmitfraudFix.exe
    
* Sélectionner 1 et pressez Entrée dans le menu pour créer un rapport des fichiers responsables de l'infection. Le rapport se trouve à la racine du disque système 

C:\rapport.txt



==>et colle le rapport génèrer sur le forum.



*=>ne pas faire l'option 2 sans un avis d'une personne compétente*<=

franny12772 · Answer

Re-,  


Voici le rapport.
En tous cas merci pour ton aide.



SmitFraudFix v2.361

Rapport fait à 19:09:54,45, 21/10/2008
Executé à partir de I:\Documents and Settings\Francine\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\Ati2evxx.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\system32\Ati2evxx.exe
I:\WINDOWS\system32\spoolsv.exe
I:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
I:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe
I:\Program Files\Bonjour\mDNSResponder.exe
I:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe
I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
I:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\system32\SearchIndexer.exe
I:\WINDOWS\System32\svchost.exe
I:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe
I:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
I:\Program Files\Analog Devices\Core\smax4pnp.exe
I:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe
I:\Program Files\HP\HP Software Update\HPWuSchd2.exe
I:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe
I:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
I:\Program Files\iTunes\iTunesHelper.exe
I:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
I:\WINDOWS\system32\ctfmon.exe
I:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
I:\Program Files\Nosibay\VPbubble\launcher.exe
I:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
I:\Program Files\Windows Desktop Search\WindowsSearch.exe
I:\Documents and Settings\Francine\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
I:\Documents and Settings\Francine\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
I:\Program Files\iPod\bin\iPodService.exe
I:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
I:\Program Files\Nosibay\VPbubble\VPbubble.exe
I:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
I:\WINDOWS\explorer.exe
I:\WINDOWS\system32undll32.exe
I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
I:\Program Files\Windows Live\Contacts\wlcomm.exe
I:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\Ati2evxx.exe
I:\WINDOWS\system32\HPZipm12.exe
I:\Program Files\Internet Explorer\iexplore.exe
I:\Program Files\Windows Live\Toolbar\wltuser.exe
I:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
I:\WINDOWS\system32\SearchProtocolHost.exe
I:\Documents and Settings\Francine\Bureau\SmitfraudFix\Policies.exe
I:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» I:\


»»»»»»»»»»»»»»»»»»»»»»»» I:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» I:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» I:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» I:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» I:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» I:\Documents and Settings\Francine


»»»»»»»»»»»»»»»»»»»»»»»» I:\Documents and Settings\Francine\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» I:\DOCUME~1\Francine\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» I:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="http://wallpapers.boolsite.net/..."
"SubscribedURL"="http://wallpapers.boolsite.net/..."
"FriendlyName"=""
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"appinit_dlls"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="I:\WINDOWS\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Realtek RTL8168/8111 PCI-E Gigabit Ethernet NIC - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.30.1
DNS Server Search Order: 0.0.0.0

Description: Realtek RTL8168/8111 PCI-E Gigabit Ethernet NIC - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.40.240
DNS Server Search Order: 212.27.40.241

HKLM\SYSTEM\CCS\Services\Tcpip\..\{DDD641D1-E57D-461D-A46C-09B42A6DB71B}: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CCS\Services\Tcpip\..\{EDCE24F2-9727-4BBF-AEF6-437EC64F22CD}: DhcpNameServer=192.168.30.1 0.0.0.0
HKLM\SYSTEM\CS1\Services\Tcpip\..\{DDD641D1-E57D-461D-A46C-09B42A6DB71B}: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CS1\Services\Tcpip\..\{EDCE24F2-9727-4BBF-AEF6-437EC64F22CD}: DhcpNameServer=192.168.30.1 0.0.0.0
HKLM\SYSTEM\CS3\Services\Tcpip\..\{DDD641D1-E57D-461D-A46C-09B42A6DB71B}: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CS3\Services\Tcpip\..\{EDCE24F2-9727-4BBF-AEF6-437EC64F22CD}: DhcpNameServer=192.168.30.1 0.0.0.0
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.240 212.27.40.241


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

Utilisateur anonyme · Answer

Re,

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
• Redémarre ton ordinateur
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
• Choisis ton compte.

• Puis, ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
• Appuie sur une touche pour commencer le processus de nettoyage.
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
• Appuie sur une touche pour redémarrer le PC.
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
• Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.

• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau rapport Hijackthis !

franny12772 · Answer

Goldorack, 

je ne peux tjs pas passer en mode sans échec, mon PC redémarre.

Utilisateur anonyme · Answer

Re,

essaie en mode sans echec avec prise en charge du réseau

franny12772 · Answer

Je te communique le rapport SDFix:

[b]SDFix: Version 1.236 [/b]
Run by Francine on 21/10/2008 at 20:33

Microsoft Windows XP [version 5.1.2600]
Running From: I:\Documents and Settings\Francine\Bureau\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

No Trojan Files Found






Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-21 20:49:09
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"I:\Program Files\Azureus\Azureus.exe"="I:\Program Files\Azureus\Azureus.exe:*:Enabled:Azureus"
"I:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="I:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"I:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="I:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"I:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="I:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"I:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="I:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
"I:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="I:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"I:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="I:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"I:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="I:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"I:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="I:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"I:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="I:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"I:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="I:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"I:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="I:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"I:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="I:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"
"I:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="I:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
"I:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="I:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
"I:\Program Files\BitComet\BitComet.exe"="I:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"I:\WINDOWS\Network Diagnostic\xpnetdiag.exe"="I:\WINDOWS\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"I:\Program Files\Messenger\msmsgs.exe"="I:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"I:\Program Files\FileZilla FTP Client\filezilla.exe"="I:\Program Files\FileZilla FTP Client\filezilla.exe:*:Enabled:FileZilla FTP Client"
"I:\kav\kis7.0\french\setup.exe"="I:\kav\kis7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Internet Security 7.0"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"I:\WINDOWS\system32\mmc.exe"="I:\WINDOWS\system32\mmc.exe:*:Enabled:Microsoft Management Console"
"I:\WINDOWS\system32\usmt\migwiz.exe"="I:\WINDOWS\system32\usmt\migwiz.exe:*:Enabled:Assistant Transfert de fichiers et de paramŠtres"
"I:\Program Files\eMule\emule.exe"="I:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"I:\Program Files\Bonjour\mDNSResponder.exe"="I:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"I:\Program Files\Windows Live\Messenger\wlcsdk.exe"="I:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"I:\Program Files\Windows Live\Messenger\msnmsgr.exe"="I:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"I:\Program Files\iTunes\iTunes.exe"="I:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"I:\Program Files\Windows Live\Messenger\wlcsdk.exe"="I:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"I:\Program Files\Windows Live\Messenger\msnmsgr.exe"="I:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[b]Remaining Files [/b]:



[b]Files with Hidden Attributes [/b]:

Mon 14 Apr 2008     1,695,232 ..SH. --- I:\PROGRA~1\MESSEN~1\MSMSGS.EXE
Thu  2 Oct 2008     6,108,728 A..H. --- I:\PROGRA~1\PICASA2\SETUP.EXE
Thu 24 Jul 2008         4,348 A.SH. --- I:\DOCUME~1\ALLUSE~1\DRM\DRMV1.BAK
Sun 11 Feb 2007         4,348 ..SH. --- I:\DOCUME~1\ALLUSE~1\DRMOLD\DRMV1.BAK
Wed 23 Jul 2008             0 A.SH. --- I:\DOCUME~1\ALLUSE~1\DRM\CACHE\INDIV01.TMP
Tue 13 Feb 2007             0 A.SH. --- I:\DOCUME~1\ALLUSE~1\DRMOLD\CACHE\INDIV01.TMP
Fri  5 Oct 2007             0 A..H. --- I:\WINDOWS\SOFTWA~1\DOWNLOAD\D03F71~1\BITD.TMP

[b]Finished![/b]

Merci!

Utilisateur anonyme · Answer

Re,

refait moi un hijs 

merci.

franny12772 · Answer

Tiens, à force d'attendre j'avais oublié:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:21:22, on 21/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\Ati2evxx.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\system32\Ati2evxx.exe
I:\WINDOWS\system32\spoolsv.exe
I:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
I:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe
I:\Program Files\Bonjour\mDNSResponder.exe
I:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe
I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
I:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
I:\WINDOWS\system32\HPZipm12.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\system32\SearchIndexer.exe
I:\WINDOWS\System32\svchost.exe
I:\Program Files\iPod\bin\iPodService.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\Ati2evxx.exe
I:\WINDOWS\Explorer.EXE
I:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe
I:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
I:\Program Files\Analog Devices\Core\smax4pnp.exe
I:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe
I:\Program Files\HP\HP Software Update\HPWuSchd2.exe
I:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe
I:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
I:\Program Files\iTunes\iTunesHelper.exe
I:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
I:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
I:\WINDOWS\system32\ctfmon.exe
I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
I:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
I:\Program Files\Nosibay\VPbubble\launcher.exe
I:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
I:\Program Files\Windows Desktop Search\WindowsSearch.exe
I:\Documents and Settings\Francine\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
I:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
I:\Documents and Settings\Francine\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
I:\Program Files\Nosibay\VPbubble\VPbubble.exe
I:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
I:\Program Files\Windows Live\Contacts\wlcomm.exe
I:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
I:\WINDOWS\system32undll32.exe
I:\Program Files\Internet Explorer\IEXPLORE.EXE
I:\Program Files\Windows Live\Toolbar\wltuser.exe
I:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.aufeminin.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.yahoo.com/?p=us
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - I:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - I:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - I:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - I:\Program Files\BitComet	ools\BitCometBHO_1.2.8.7.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - I:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - I:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - I:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - I:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - I:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - I:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - I:\Program Files\MSN\Toolbar\3.0.0311.0\msneshellx.dll
O2 - BHO: Windows Live Toolbar Beta - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - I:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - I:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - I:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - I:\Program Files\MSN\Toolbar\3.0.0311.0\msneshellx.dll
O3 - Toolbar: &Windows Live Toolbar Beta - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - I:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [NeroCheck] I:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AudioDeck] I:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [SunJavaUpdateSched] "I:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [JMB36X IDE Setup] I:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [JMB36X Configure] I:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [SoundMAXPnP] I:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Ai Nap] "I:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe"
O4 - HKLM\..\Run: [HP Software Update] I:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [basicsmssmenu] "I:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe"
O4 - HKLM\..\Run: [HydraVisionDesktopManager] "I:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe"
O4 - HKLM\..\Run: [iTunesHelper] "I:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Canal Widget] "I:\Program Files\Canal\Canal Widget\Launcher.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "I:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [QuickTime Task] "I:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] I:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "I:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [StartCCC] "I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [AVP] "I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "I:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [VPbubble] "I:\Program Files\Nosibay\VPbubble\launcher.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-583907252-287218729-682003330-1009\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\ctfmon.exe (User 'PTK')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Outil de notification Live Search.lnk = I:\Documents and Settings\Francine\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = I:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = I:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Windows Search.lnk = I:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://I:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://I:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://I:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - I:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - I:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - I:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - I:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://I:\Program Files\BitComet	ools\BitCometBHO_1.2.8.7.dll/206 (file missing)
O9 - Extra button: Sélection intelligente HP - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - I:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.canal-plus.com (HKLM)
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - I:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5036.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
O23 - Service: Apple Mobile Device - Apple Inc. - I:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - I:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - I:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security (avp) - Kaspersky Lab - I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Basics Service - Seagate Technology LLC - I:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - I:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CanalPlus.VOD - Canal+ Active - I:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - I:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Desktop Manager 5.8.809.23506 (GoogleDesktopManager-092308-165331) - Google - I:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - I:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - I:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - I:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - I:\WINDOWS\system32\HPZipm12.exe
O23 - Service: WZCBDL Service (WZCBDLService) - Unknown owner - I:\Program Files\WZCBDL Service\WZCBDLS.exe (file missing)
O24 - Desktop Component 0: (no name) - http://wallpapers.boolsite.net/...

Utilisateur anonyme · Answer

Re,

tu relance hijackthis est tu fixe cette ligne la:

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - I:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll 

Ensuite tu refait un scn malwarebyte.

et un nouveau hijs.

pas un ancien un tiut neuf ensuite on pourra peut êter passer a l'étape de finissions.

@+

merci.

franny12772 · Answer

ok mais qu'entends-tu par tu fixe cette ligne.
Là je suis larguée.

a tout de suite

Utilisateur anonyme · Answer

Re,

en marge de la page de hijs tu as des cases et ben tu coche la case a gauche de cette ligne.



 [/]  O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - I:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll

volià grossièrement le truc.

@+

franny12772 · Answer

Voilà le dernier Hjs si t'es tjs là!


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:49:32, on 21/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\Ati2evxx.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\system32\Ati2evxx.exe
I:\WINDOWS\system32\spoolsv.exe
I:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
I:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe
I:\Program Files\Bonjour\mDNSResponder.exe
I:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe
I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
I:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
I:\WINDOWS\system32\HPZipm12.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\system32\SearchIndexer.exe
I:\WINDOWS\System32\svchost.exe
I:\Program Files\iPod\bin\iPodService.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\Ati2evxx.exe
I:\WINDOWS\Explorer.EXE
I:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe
I:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
I:\Program Files\Analog Devices\Core\smax4pnp.exe
I:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe
I:\Program Files\HP\HP Software Update\HPWuSchd2.exe
I:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe
I:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
I:\Program Files\iTunes\iTunesHelper.exe
I:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
I:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
I:\WINDOWS\system32\ctfmon.exe
I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
I:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
I:\Program Files\Nosibay\VPbubble\launcher.exe
I:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
I:\Program Files\Windows Desktop Search\WindowsSearch.exe
I:\Documents and Settings\Francine\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
I:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
I:\Documents and Settings\Francine\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
I:\Program Files\Nosibay\VPbubble\VPbubble.exe
I:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
I:\Program Files\Windows Live\Contacts\wlcomm.exe
I:\WINDOWS\system32undll32.exe
I:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
I:\WINDOWS\system32\wscntfy.exe
I:\WINDOWS\system32\NOTEPAD.EXE
I:\Program Files\Internet Explorer\IEXPLORE.EXE
I:\Program Files\Windows Live\Toolbar\wltuser.exe
I:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
I:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.aufeminin.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.yahoo.com/?p=us
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - I:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - I:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - I:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - I:\Program Files\BitComet	ools\BitCometBHO_1.2.8.7.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - I:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - I:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - I:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - I:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - I:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - I:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - I:\Program Files\MSN\Toolbar\3.0.0311.0\msneshellx.dll
O2 - BHO: Windows Live Toolbar Beta - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - I:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - I:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - I:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - I:\Program Files\MSN\Toolbar\3.0.0311.0\msneshellx.dll
O3 - Toolbar: &Windows Live Toolbar Beta - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - I:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [NeroCheck] I:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AudioDeck] I:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [SunJavaUpdateSched] "I:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [JMB36X IDE Setup] I:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [JMB36X Configure] I:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [SoundMAXPnP] I:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Ai Nap] "I:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe"
O4 - HKLM\..\Run: [HP Software Update] I:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [basicsmssmenu] "I:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe"
O4 - HKLM\..\Run: [HydraVisionDesktopManager] "I:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe"
O4 - HKLM\..\Run: [iTunesHelper] "I:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Canal Widget] "I:\Program Files\Canal\Canal Widget\Launcher.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "I:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [QuickTime Task] "I:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] I:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "I:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [StartCCC] "I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [AVP] "I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "I:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [VPbubble] "I:\Program Files\Nosibay\VPbubble\launcher.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-583907252-287218729-682003330-1009\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\ctfmon.exe (User 'PTK')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Outil de notification Live Search.lnk = I:\Documents and Settings\Francine\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = I:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = I:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Windows Search.lnk = I:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://I:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://I:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://I:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - I:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - I:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - I:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - I:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://I:\Program Files\BitComet	ools\BitCometBHO_1.2.8.7.dll/206 (file missing)
O9 - Extra button: Sélection intelligente HP - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - I:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.canal-plus.com (HKLM)
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - I:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5036.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
O23 - Service: Apple Mobile Device - Apple Inc. - I:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - I:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - I:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security (avp) - Kaspersky Lab - I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Basics Service - Seagate Technology LLC - I:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - I:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CanalPlus.VOD - Canal+ Active - I:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - I:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Desktop Manager 5.8.809.23506 (GoogleDesktopManager-092308-165331) - Google - I:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - I:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - I:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - I:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - I:\WINDOWS\system32\HPZipm12.exe
O23 - Service: WZCBDL Service (WZCBDLService) - Unknown owner - I:\Program Files\WZCBDL Service\WZCBDLS.exe (file missing)
O24 - Desktop Component 0: (no name) - http://wallpapers.boolsite.net/...

Utilisateur anonyme · Answer

Re,

tu la fixer la ligne ou pas?

@+

franny12772 · Answer

Re-, 

ben oui, je suis tes instructions.
pourquoi?

A+

Utilisateur anonyme · Answer

Re,

bon 

si la suppression échoue il faut recommencer en mode sans échec :

# Télécharge et installe CCleaner (si ce n’est déjà fait) : https://www.commentcamarche.net/telecharger/utilitaires/5647-ccleaner/
Sur le site, clique sur > Download latest version et laisse-toi guider.
Ne coche pas "Ajouter la barre d' outils Yahoo" lors de l’installation !

# Télécharge OTMoveIt (de Old_Timer) sur ton bureau : http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe

# Hijackthis
Lance Hijackthis, choisis 'do a system scan only', coche les lignes suivantes et clique sur "Fix Checked" :

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - I:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll 

# Double-clique sur OTMoveIt.exe pour le lancer.
Assure toi que la case "Unregister Dll's and Ocx's" soit bien cochée !!!
Copie le texte ci-dessous et colle-le dans le cadre de gauche de OTMoveIt nommé Paste List of Files/Folders to be moved.
c:\program files\platrium
c:\program files\save
Clique sur MoveIt! pour lancer la suppression.
Lorsque un résultat apparaît dans le cadre Results, clique sur Exit et redémarre ton PC.
Copie-colle le rapport dans ta réponse : il est situé sur --> C:\_OTMoveIt\MovedFiles.

# Lance CCleaner :
Option --> avancé --> décoche « effacer uniquement les fichiers plus vieux que 48h »
Puis nettoyeur --> Analyse > Lancer le nettoyage,
puis sur OK dans la fenêtre qui s' affiche.
Relance le nettoyage une deuxième fois.

Enfin, registre --> corrige toutes les erreurs, et recommence jusqu'à ce qu'il ne trouve plus d'erreurs.

Utilisateur anonyme · Answer

Re,

refait un hijs tout neuf.

merci

Franny · Answer

Voilà le Hjs demandé.
Merci à toi


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:09:25, on 22/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\Ati2evxx.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\system32\Ati2evxx.exe
I:\WINDOWS\system32\spoolsv.exe
I:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
I:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe
I:\Program Files\Bonjour\mDNSResponder.exe
I:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe
I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
I:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
I:\WINDOWS\system32\HPZipm12.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\system32\SearchIndexer.exe
I:\WINDOWS\System32\svchost.exe
I:\Program Files\iPod\bin\iPodService.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\Ati2evxx.exe
I:\WINDOWS\Explorer.EXE
I:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe
I:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
I:\Program Files\Analog Devices\Core\smax4pnp.exe
I:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe
I:\Program Files\HP\HP Software Update\HPWuSchd2.exe
I:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe
I:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
I:\Program Files\iTunes\iTunesHelper.exe
I:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
I:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
I:\WINDOWS\system32\ctfmon.exe
I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
I:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
I:\Program Files\Nosibay\VPbubble\launcher.exe
I:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
I:\Program Files\Windows Desktop Search\WindowsSearch.exe
I:\Documents and Settings\Francine\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
I:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
I:\Documents and Settings\Francine\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
I:\Program Files\Nosibay\VPbubble\VPbubble.exe
I:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
I:\Program Files\Windows Live\Contacts\wlcomm.exe
I:\WINDOWS\system32undll32.exe
I:\WINDOWS\system32\wscntfy.exe
I:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
I:\Program Files\Internet Explorer\IEXPLORE.EXE
I:\Program Files\Windows Live\Toolbar\wltuser.exe
I:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
I:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.aufeminin.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.yahoo.com/?p=us
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - I:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - I:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - I:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - I:\Program Files\BitComet	ools\BitCometBHO_1.2.8.7.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - I:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - I:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - I:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - I:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - I:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - I:\Program Files\MSN\Toolbar\3.0.0311.0\msneshellx.dll
O2 - BHO: Windows Live Toolbar Beta - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - I:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - I:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - I:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - I:\Program Files\MSN\Toolbar\3.0.0311.0\msneshellx.dll
O3 - Toolbar: &Windows Live Toolbar Beta - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - I:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [NeroCheck] I:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AudioDeck] I:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [SunJavaUpdateSched] "I:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [JMB36X IDE Setup] I:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [JMB36X Configure] I:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [SoundMAXPnP] I:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Ai Nap] "I:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe"
O4 - HKLM\..\Run: [HP Software Update] I:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [basicsmssmenu] "I:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe"
O4 - HKLM\..\Run: [HydraVisionDesktopManager] "I:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe"
O4 - HKLM\..\Run: [iTunesHelper] "I:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Canal Widget] "I:\Program Files\Canal\Canal Widget\Launcher.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "I:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [QuickTime Task] "I:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] I:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "I:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [StartCCC] "I:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [AVP] "I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "I:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [VPbubble] "I:\Program Files\Nosibay\VPbubble\launcher.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-583907252-287218729-682003330-1009\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\ctfmon.exe (User 'PTK')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Outil de notification Live Search.lnk = I:\Documents and Settings\Francine\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = I:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = I:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Windows Search.lnk = I:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://I:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://I:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://I:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - I:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - I:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - I:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - I:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://I:\Program Files\BitComet	ools\BitCometBHO_1.2.8.7.dll/206 (file missing)
O9 - Extra button: Sélection intelligente HP - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - I:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.canal-plus.com (HKLM)
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - I:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5036.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
O23 - Service: Apple Mobile Device - Apple Inc. - I:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - I:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - I:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security (avp) - Kaspersky Lab - I:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Basics Service - Seagate Technology LLC - I:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - I:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CanalPlus.VOD - Canal+ Active - I:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - I:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Desktop Manager 5.8.809.23506 (GoogleDesktopManager-092308-165331) - Google - I:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - I:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - I:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - I:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - I:\WINDOWS\system32\HPZipm12.exe
O23 - Service: WZCBDL Service (WZCBDLService) - Unknown owner - I:\Program Files\WZCBDL Service\WZCBDLS.exe (file missing)
O24 - Desktop Component 0: (no name) - http://wallpapers.boolsite.net/...

Utilisateur anonyme · Answer

Re,

bon tu n'as apparemment plus rien mais reste un truc à faire.

[b]Pour supprimer toutes les traces des logiciels qui ont servi à traiter les infections spécifiques :[/b]

Télécharge toolscleaner sur ton Bureau : 

[url=http://pc-system.fr/ toolscleaner]

* Double-clique sur ToolsCleaner2.exe et laisse le travailler 
* Clique sur Recherche et laisse le scan se terminer. 
* Clique sur Suppression pour finaliser. 
* Tu peux, si tu le souhaites, te servir des Options facultatives. 
* Clique sur Quitter, pour que le rapport puisse se créer. 
* Le rapport (TCleaner.txt) se trouve à la racine de votre disque dur (C:\)...colle le dans ta réponse


[color=red][b]Désactive et réactive la Restauration du système :[/b][/color]
 
1 Dans la barre des tâches de Windows, clique sur Démarrer.
 
2 Clique avec le bouton droit de la souris sur Poste de travail puis clique sur Propriétés.
 
3 Dans l'onglet Restauration du système, coche "Désactiver la Restauration du système"

4 Clique sur Appliquer.
  
5 Ensuite décoche "Désactiver la restauration du systeme"

6 clique sur appliquer puis ok

7 vas créer un point de restauration dans accessoires----outils systeme----restauration du systeme.

poste le rapport ici est en suite bonne nuit.

Utilisateur anonyme · Answer

Re,

ok.

bonne nuit a toi.merci

et suis pas un génie loin de la.

@+

Franny · Answer

tu n'es peut être pas un génie mais moi ça fait des mois que je rame et là c'est solutionné.
Donc vraiment merci d'autant que tu a été d'une grande réactivité et d'une grande disponibilité.

Allez, excellente journée à toi Goldorack59, avec un pseudo pareil sur que tu aime venir à la rescousse.

A+

Heur.Downloader

35 réponses

Newsletters