tout va bien??? Résolu

Question

Bonjour,
je vvoudrais savoir si tout va bien...lol!!! avec le fameux programme hijackthis. Merci pour vos reponses serieuses.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:59:26, on 19/11/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\G DATA\TotalCare\Firewall\GDFirewallTray.exe
C:\Program Files\G DATA\TotalCare\AVKTray\AVKTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Belkin\Bluetooth Software\BTTray.exe
C:\Users\amawil\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Users\amawil\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\Belkin\Bluetooth Software\BtStackServer.exe
C:\Windows\system32\conime.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Crawler\CToolbar.exe
C:\Users\amawil\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\INZO42K2\HiJackThis[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60076
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://lo.st
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\ctbr.dll
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: G DATA WebFilter Class - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G DATA\TotalCare\Webfilter\AVKWebIE.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\ctbr.dll
O2 - BHO: EoBho Class - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: G DATA WebFilter - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G DATA\TotalCare\Webfilter\AVKWebIE.dll
O4 - HKLM\..\Run: [GDFirewallTray] C:\Program Files\G DATA\TotalCare\Firewall\GDFirewallTray.exe
O4 - HKLM\..\Run: [G DATA AntiVirus Trayapplication] C:\Program Files\G DATA\TotalCare\AVKTray\AVKTray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: Outil de notification Live Search.lnk = C:\Users\amawil\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Envoyer l'&image au périphérique Bluetooth... - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix: 
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-8559c07e9d9d815e.spaces.live.com/PhotoUpload/VistaMsnPUpldfr-fr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\ctbr.dll
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: G DATA AntiVirus Proxy (AVKProxy) - G DATA Software AG - C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe
O23 - Service: Planificateur G DATA (AVKService) - G DATA Software AG - C:\Program Files\G DATA\TotalCare\AVK\AVKService.exe
O23 - Service: Gardien d'AntiVirus (AVKWCtl) - G DATA Software AG - C:\Program Files\G DATA\TotalCare\AVK\AVKWCtl.exe
O23 - Service: G DATA Tuner Service - G DATA Software AG - C:\Program Files\G DATA\TotalCare\AVKTuner\AVKTunerService.exe
O23 - Service: Pare-feu personnel G DATA (GDFwSvc) - G DATA Software AG - C:\Program Files\G DATA\TotalCare\Firewall\GDFwSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: RdnaoFlSvc - Unknown owner - C:\Program Filesnamfler
aofsvc.exe
O23 - Service: Service de sauvegarde G DATA - G DATA Software AG - C:\Program Files\G DATA\TotalCare\AVKBackup\AVKBackupService.exe

archet9 · Answer

non toolbars infectees

--Télécharge Toolbar-S&D (Team IDN) sur ton Bureau. 
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2 

* Lance l'installation du programme en exécutant le fichier téléchargé. 
* Double-clique maintenant sur le raccourci de Toolbar-S&D. 
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée. 
* Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche. 
* Poste le rapport généré. (C:\TB.txt)
a+
Antonio Giacomo Stradivari, souvent appelé Stradivarius (Crémone, 1644 - Crémone, 18 décembre 1737 
Le Soil (1714), considéré par beaucoup comme le meilleur instrument du monde.
peu de temps avant sa mort il cherchait encore...

wilama1 · Answer

ok tout dabord merci!!! voila le rapport

   -----------\  ToolBar S&D 1.2.4   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6001 ) Service Pack 1
   X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 X2 Dual Core Processor 4600+ )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : amawil ( Administrator )
   BOOT : Normal boot
   C:\ (Local Disk) - NTFS - Total:111 Go (Free:70 Go)
   D:\ (Local Disk) - NTFS - Total:111 Go (Free:60 Go)
   E:\ (CD or DVD) - UDF - Total:4 Go (Free:2 Go)
   F:\ (USB)
   G:\ (USB)
   H:\ (USB)
   I:\ (USB)
   J:\ (CD or DVD)
   K:\ (USB)

   "C:\ToolBar SD" ( MAJ : 27-10-2008|09:25 )
   Option : [1] ( 19/11/2008|21:09 )

   [ UAC => 1 ]

   -----------\  Recherche de Fichiers / Dossiers ...

   C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Barre d'outils Crawler
   C:\Program Files\Crawler
   C:\Program Files\Crawler\adrkeys.dat
   C:\Program Files\Crawler\Cache
   C:\Program Files\Crawler\COMMON_FF.dat
   C:\Program Files\Crawler\confirm.dat
   C:\Program Files\Crawler\ctbcomm.dll
   C:\Program Files\Crawler\ctbr.dll
   C:\Program Files\Crawler\CTConf.dat
   C:\Program Files\Crawler\CTipsDef.dll
   C:\Program Files\Crawler\CToolbar.exe
   C:\Program Files\Crawler\CUpdate.exe
   C:\Program Files\Crawler\Download
   C:\Program Files\Crawler\firefox
   C:\Program Files\Crawler\Languages
   C:\Program Files\Crawler\lookfor.dat
   C:\Program Files\Crawler\majorse.dat
   C:\Program Files\Crawlerootmenu.dat
   C:\Program Files\Crawler\services.dat
   C:\Program Files\Crawler\STWSGLanguageAct
   C:\Program Files\Crawler\STWSG_FF.dat
   C:\Program Files\Crawler\TBR5LanguageAct
   C:\Program Files\Crawler\Update
   C:\Program Files\Crawler\WebSecurityGuard.dll
   C:\Program Files\Crawler\WSGData
   C:\Program Files\DAEMON Tools Toolbar
   C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
   C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT
   C:\Program Files\DAEMON Tools Toolbar\Resources
   C:\Program Files\DAEMON Tools Toolbar\uninst.exe
   C:\Program Files\DAEMON Tools Toolbar\_DTLite.xml

   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.google.fr/?gws_rd=ssl"
   "Search Bar"="http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60076"
   "Url"="https://www.msn.com/fr-fr/actualite/"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="http://lo.st"
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"


   --------------------\  Recherche d'autres infections

   C:\Program Files\MessengerSkinner
   C:\Program Files\MessengerSkinner\download
   C:\Program Files\MessengerSkinner\messengerskinnerdll_new.dll
   C:\Program Files\MessengerSkinneresources
   C:\Program Files\MessengerSkinner\uninst.exe
   C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\MessengerSkinner
   C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\MessengerSkinner\Conditions g‚n‚rales.url
   C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\MessengerSkinner\Confidentialit‚.url
   C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\MessengerSkinner\D‚sinstaller.lnk
   C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\MessengerSkinner\Website.url
   C:\Windows\System32
vs2.inf
 
   C:\Users\amawil\AppData\Local\aeaqgca_navfx.dat
   C:\Users\amawil\AppData\Local\quemc.dat
   C:\Users\amawil\AppData\Local\quemc_nav.dat
   C:\Users\amawil\AppData\Local\quemc_navps.dat
   C:\Users\amawil\AppData\Local\vlbqgd.bat
   C:\Users\amawil\AppData\Local\vlbqgd_navtmp.dat
   [b]==> EGDACCESS <==/b

   --------------------\  Cracks & Keygens ..

   C:\Users\amawil\AppData\Local\Microsoft\Windows Photo Gallery\Original Images\{24B7FA03-D599-4257-BC56-891D7E7888B6}-CrackFDown.jpg
   C:\Users\amawil\Documents\LimeWire\Incomplete\T-1134377-Patch ITA + Crack + Seriale - Need For Speed Carbon.rar


   [ UAC => 1 ]


   1 - "C:\ToolBar SD\TB_1.txt" - 19/11/2008|21:10 - Option : [1]

   -----------\  Fin du rapport a 21:10:16,21

wilama1 · Answer

une question??? comment las tu vu???? je ne comprend pas trop cette analyse...

wilama1 · Answer

ok voila

   -----------\  ToolBar S&D 1.2.4   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6001 ) Service Pack 1
   X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 X2 Dual Core Processor 4600+ )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : amawil ( Administrator )
   BOOT : Normal boot
   C:\ (Local Disk) - NTFS - Total:111 Go (Free:70 Go)
   D:\ (Local Disk) - NTFS - Total:111 Go (Free:60 Go)
   E:\ (CD or DVD) - UDF - Total:4 Go (Free:2 Go)
   F:\ (USB)
   G:\ (USB)
   H:\ (USB)
   I:\ (USB)
   J:\ (CD or DVD)
   K:\ (USB)

   "C:\ToolBar SD" ( MAJ : 27-10-2008|09:25 )
   Option : [2] ( 19/11/2008|21:23 )

   [ UAC => 1 ]

   -----------\ SUPPRESSION

   Supprime! - C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Barre d'outils Crawler
   Supprime! - C:\Program Files\Crawler\adrkeys.dat
   Supprime! - C:\Program Files\Crawler\COMMON_FF.dat
   Supprime! - C:\Program Files\Crawler\confirm.dat
   Supprime! - C:\Program Files\Crawler\ctbcomm.dll
   Supprime! - C:\Program Files\Crawler\ctbr.dll
   Supprime! - C:\Program Files\Crawler\CTConf.dat
   Supprime! - C:\Program Files\Crawler\CTipsDef.dll
   Supprime! - C:\Program Files\Crawler\CToolbar.exe
   Supprime! - C:\Program Files\Crawler\CUpdate.exe
   Supprime! - C:\Program Files\Crawler\Download
   Supprime! - C:\Program Files\Crawler\firefox
   Supprime! - C:\Program Files\Crawler\Languages
   Supprime! - C:\Program Files\Crawler\lookfor.dat
   Supprime! - C:\Program Files\Crawler\majorse.dat
   Supprime! - C:\Program Files\Crawlerootmenu.dat
   Supprime! - C:\Program Files\Crawler\services.dat
   Supprime! - C:\Program Files\Crawler\STWSGLanguageAct
   Supprime! - C:\Program Files\Crawler\STWSG_FF.dat
   Supprime! - C:\Program Files\Crawler\TBR5LanguageAct
   Supprime! - C:\Program Files\Crawler\Update
   Supprime! - C:\Program Files\Crawler\WebSecurityGuard.dll
   Supprime! - C:\Program Files\Crawler\WSGData
   Supprime! - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
   Supprime! - C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT
   Supprime! - C:\Program Files\DAEMON Tools Toolbar\Resources
   Supprime! - C:\Program Files\DAEMON Tools Toolbar\uninst.exe
   Supprime! - C:\Program Files\DAEMON Tools Toolbar\_DTLite.xml
   Supprime! - C:\Program Files\Crawler
   Supprime! - C:\Program Files\DAEMON Tools Toolbar

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.google.fr/?gws_rd=ssl"
   "Search Bar"="http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60076"
   "Url"="https://www.msn.com/fr-fr/actualite/"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="https://www.msn.com/fr-fr/"
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"


   --------------------\  Recherche d'autres infections

   C:\Program Files\MessengerSkinner
   C:\Program Files\MessengerSkinner\download
   C:\Program Files\MessengerSkinner\messengerskinnerdll_new.dll
   C:\Program Files\MessengerSkinneresources
   C:\Program Files\MessengerSkinner\uninst.exe
   C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\MessengerSkinner
   C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\MessengerSkinner\Conditions g‚n‚rales.url
   C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\MessengerSkinner\Confidentialit‚.url
   C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\MessengerSkinner\D‚sinstaller.lnk
   C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\MessengerSkinner\Website.url
   C:\Windows\System32
vs2.inf
 
   C:\Users\amawil\AppData\Local\aeaqgca_navfx.dat
   C:\Users\amawil\AppData\Local\quemc.dat
   C:\Users\amawil\AppData\Local\quemc_nav.dat
   C:\Users\amawil\AppData\Local\quemc_navps.dat
   C:\Users\amawil\AppData\Local\vlbqgd.bat
   C:\Users\amawil\AppData\Local\vlbqgd_navtmp.dat
   [b]==> EGDACCESS <==/b

   --------------------\  Cracks & Keygens ..

   C:\Users\amawil\AppData\Local\Microsoft\Windows Photo Gallery\Original Images\{24B7FA03-D599-4257-BC56-891D7E7888B6}-CrackFDown.jpg
   C:\Users\amawil\Documents\LimeWire\Incomplete\T-1134377-Patch ITA + Crack + Seriale - Need For Speed Carbon.rar


   [ UAC => 1 ]


   1 - "C:\ToolBar SD\TB_1.txt" - 19/11/2008|21:10 - Option : [1]
   2 - "C:\ToolBar SD\TB_2.txt" - 19/11/2008|21:24 - Option : [2]

   -----------\  Fin du rapport a 21:24:36,27

wilama1 · Answer

okok et maintenant mon rapport que dis til??? lol

wilama1 · Answer

ok merci mais dand le hijackthis je parle comment voir?? et mon rapport maintenat que faire???

   -----------\  ToolBar S&D 1.2.4   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6001 ) Service Pack 1
   X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 X2 Dual Core Processor 4600+ )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : amawil ( Administrator )
   BOOT : Normal boot
   C:\ (Local Disk) - NTFS - Total:111 Go (Free:70 Go)
   D:\ (Local Disk) - NTFS - Total:111 Go (Free:60 Go)
   E:\ (CD or DVD) - UDF - Total:4 Go (Free:2 Go)
   F:\ (USB)
   G:\ (USB)
   H:\ (USB)
   I:\ (USB)
   J:\ (CD or DVD)
   K:\ (USB)

   "C:\ToolBar SD" ( MAJ : 27-10-2008|09:25 )
   Option : [2] ( 19/11/2008|21:23 )

   [ UAC => 1 ]

   -----------\ SUPPRESSION

   Supprime! - C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Barre d'outils Crawler
   Supprime! - C:\Program Files\Crawler\adrkeys.dat
   Supprime! - C:\Program Files\Crawler\COMMON_FF.dat
   Supprime! - C:\Program Files\Crawler\confirm.dat
   Supprime! - C:\Program Files\Crawler\ctbcomm.dll
   Supprime! - C:\Program Files\Crawler\ctbr.dll
   Supprime! - C:\Program Files\Crawler\CTConf.dat
   Supprime! - C:\Program Files\Crawler\CTipsDef.dll
   Supprime! - C:\Program Files\Crawler\CToolbar.exe
   Supprime! - C:\Program Files\Crawler\CUpdate.exe
   Supprime! - C:\Program Files\Crawler\Download
   Supprime! - C:\Program Files\Crawler\firefox
   Supprime! - C:\Program Files\Crawler\Languages
   Supprime! - C:\Program Files\Crawler\lookfor.dat
   Supprime! - C:\Program Files\Crawler\majorse.dat
   Supprime! - C:\Program Files\Crawlerootmenu.dat
   Supprime! - C:\Program Files\Crawler\services.dat
   Supprime! - C:\Program Files\Crawler\STWSGLanguageAct
   Supprime! - C:\Program Files\Crawler\STWSG_FF.dat
   Supprime! - C:\Program Files\Crawler\TBR5LanguageAct
   Supprime! - C:\Program Files\Crawler\Update
   Supprime! - C:\Program Files\Crawler\WebSecurityGuard.dll
   Supprime! - C:\Program Files\Crawler\WSGData
   Supprime! - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
   Supprime! - C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT
   Supprime! - C:\Program Files\DAEMON Tools Toolbar\Resources
   Supprime! - C:\Program Files\DAEMON Tools Toolbar\uninst.exe
   Supprime! - C:\Program Files\DAEMON Tools Toolbar\_DTLite.xml
   Supprime! - C:\Program Files\Crawler
   Supprime! - C:\Program Files\DAEMON Tools Toolbar

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.google.fr/?gws_rd=ssl"
   "Search Bar"="http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60076"
   "Url"="https://www.msn.com/fr-fr/actualite/"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="https://www.msn.com/fr-fr/"
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"


   --------------------\  Recherche d'autres infections

   C:\Program Files\MessengerSkinner
   C:\Program Files\MessengerSkinner\download
   C:\Program Files\MessengerSkinner\messengerskinnerdll_new.dll
   C:\Program Files\MessengerSkinneresources
   C:\Program Files\MessengerSkinner\uninst.exe
   C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\MessengerSkinner
   C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\MessengerSkinner\Conditions g‚n‚rales.url
   C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\MessengerSkinner\Confidentialit‚.url
   C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\MessengerSkinner\D‚sinstaller.lnk
   C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\MessengerSkinner\Website.url
   C:\Windows\System32
vs2.inf
 
   C:\Users\amawil\AppData\Local\aeaqgca_navfx.dat
   C:\Users\amawil\AppData\Local\quemc.dat
   C:\Users\amawil\AppData\Local\quemc_nav.dat
   C:\Users\amawil\AppData\Local\quemc_navps.dat
   C:\Users\amawil\AppData\Local\vlbqgd.bat
   C:\Users\amawil\AppData\Local\vlbqgd_navtmp.dat
   [b]==> EGDACCESS <==/b

   --------------------\  Cracks & Keygens ..

   C:\Users\amawil\AppData\Local\Microsoft\Windows Photo Gallery\Original Images\{24B7FA03-D599-4257-BC56-891D7E7888B6}-CrackFDown.jpg
   C:\Users\amawil\Documents\LimeWire\Incomplete\T-1134377-Patch ITA + Crack + Seriale - Need For Speed Carbon.rar


   [ UAC => 1 ]


   1 - "C:\ToolBar SD\TB_1.txt" - 19/11/2008|21:10 - Option : [1]
   2 - "C:\ToolBar SD\TB_2.txt" - 19/11/2008|21:24 - Option : [2]

   -----------\  Fin du rapport a 21:24:36,27

wilama1 · Answer

ok merci voila le rapport
Search Navipromo version 3.6.9 commencé le 19/11/2008 à 22:30:25,95

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1
Session actuelle : "amawil" 

Mise à jour le 05.11.2008 à 21h00 par IL-MAFIOSO

Microsoft Windows Vista 6.0.6001 
Internet Explorer : 7.0.6001.18000 
Système de fichiers : NTFS

Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "C:\Windows" ***


*** Recherche dossiers dans "C:\Program Files" ***

...\MessengerSkinner trouvé !

*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***

...\MessengerSkinner trouvé !

*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1" ***


*** Recherche dossiers dans "C:\ProgramData" ***


*** Recherche dossiers dans "c:\users\amawil\appdataoaming\micros~1\windows\startm~1\programs" ***


*** Recherche dossiers dans "C:\Users\amawil\AppData\Local\virtualstore\Program Files" ***


*** Recherche dossiers dans "C:\Users\amawil\AppData\Roaming" ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\Windows\system32" *

* Recherche dans "C:\Users\amawil\AppData\Local\Microsoft" *

* Recherche dans "C:\Users\amawil\AppData\Local\virtualstore\windows\system32" *

* Recherche dans "C:\Users\amawil\AppData\Local" *



*** Recherche fichiers *** 


C:\Windows\system32
vs2.inf trouvé !

*** Recherche clés spécifiques dans le Registre ***

HKEY_CURRENT_USER\Software\Lanconfig trouvé ! 

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\Windows\system32" :


* Dans "C:\Users\amawil\AppData\Local\Microsoft" :


* Dans "C:\Users\amawil\AppData\Local\virtualstore\windows\system32" :


* Dans "C:\Users\amawil\AppData\Local" :

aeaqgca_navfx.dat trouvé !
quemc.dat trouvé !
quemc_nav.dat trouvé !
quemc_navps.dat trouvé !
vlbqgd_navtmp.dat trouvé !

3)Recherche Certificats :

Certificat Egroup trouvé !
Certificat Electronic-Group trouvé !
Certificat Montorgueil absent !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :



*** Analyse terminée le 19/11/2008 à 22:43:23,30 ***

wilama1 · Answer

voila le rapport
Clean Navipromo version 3.6.9 commencé le 19/11/2008 à 22:53:28,78

Outil exécuté depuis C:\Program Files
avilog1
Session actuelle : "amawil" 

Mise à jour le 05.11.2008 à 21h00 par IL-MAFIOSO

Microsoft Windows Vista 6.0.6001 
Internet Explorer : 7.0.6001.18000
Système de fichiers : NTFS

Mode suppression automatique 
avec prise en charge résultats Catchme et GNS


Nettoyage exécuté au redémarrage de l'ordinateur

 
*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)
 

*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\Windows\System32" *


* Suppression dans "C:\Users\amawil\AppData\Local\Microsoft" *


* Suppression dans "C:\Users\amawil\AppData\Local\virtualstore\windows\system32" *


* Suppression dans "C:\Users\amawil\AppData\Local" *



*** Suppression dossiers dans "C:\Windows" ***


*** Suppression dossiers dans "C:\Program Files" ***

...\MessengerSkinner ...suppression... 
...\MessengerSkinner supprimé ! 


*** Suppression dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***

...\MessengerSkinner ...suppression... 
...\MessengerSkinner supprimé ! 


*** Suppression dossiers dans "c:\progra~2\micros~1\windows\startm~1" ***


*** Suppression dossiers dans "C:\ProgramData" ***


*** Suppression dossiers dans c:\users\amawil\appdataoaming\micros~1\windows\startm~1\programs ***


*** Suppression dossiers dans "C:\Users\amawil\AppData\Local\virtualstore\Program Files" ***


*** Suppression dossiers dans "C:\Users\amawil\AppData\Roaming" ***



*** Suppression fichiers ***

C:\Windows\system32
vs2.inf supprimé !

*** Suppression fichiers temporaires ***

Nettoyage contenu C:\Windows\Temp effectué !
Nettoyage contenu C:\Users\amawil\AppData\Local\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\Windows\system32" *


* Dans "C:\Users\amawil\AppData\Local\Microsoft" *


* Dans "C:\Users\amawil\AppData\Local\virtualstore\windows\system32" *


* Dans "C:\Users\amawil\AppData\Local" *


aeaqgca_navfx.dat trouvé ! 
Copie aeaqgca_navfx.dat réalisée avec succès !
aeaqgca_navfx.dat supprimé !

quemc.dat trouvé ! 
Copie quemc.dat réalisée avec succès !
quemc.dat supprimé !

quemc_nav.dat trouvé ! 
Copie quemc_nav.dat réalisée avec succès !
quemc_nav.dat supprimé !

quemc_navps.dat trouvé ! 
Copie quemc_navps.dat réalisée avec succès !
quemc_navps.dat supprimé !

vlbqgd_navtmp.dat trouvé ! 
Copie vlbqgd_navtmp.dat réalisée avec succès !
vlbqgd_navtmp.dat supprimé !

vlbqgd.bat trouvé ! 
Copie vlbqgd.bat réalisée avec succès !
vlbqgd.bat supprimé !


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup supprimé !
Certificat Electronic-Group supprimé !
Certificat Montorgueil absent !
Certificat OOO-Favorit supprimé !
Certificat Sunny-Day-Design-Ltdt absent !


*** Nettoyage terminé le 19/11/2008 à 22:56:56,22 ***

wilama1 · Answer

bonsoir!!!
voila le rapport:
 Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1412
Windows 6.0.6001 Service Pack 1

20/11/2008 19:12:06
mbam-log-2008-11-20 (19-12-06).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 140042
Temps écoulé: 1 hour(s), 32 minute(s), 47 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\Local Page (Hijack.Search) -> Bad: (http://www.iesearch.com/) Good: (https://www.google.com/?gws_rd=ssl -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Program Files\EoRezo (Rogue.Eorezo) -> Delete on reboot.

wilama1 · Answer

ok tot dabord merci pour ta patience!!! voila le rapport
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:27:14, on 20/11/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\G DATA\TotalCare\Firewall\GDFirewallTray.exe
C:\Program Files\G DATA\TotalCare\AVKTray\AVKTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Belkin\Bluetooth Software\BTTray.exe
C:\Users\amawil\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Users\amawil\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Belkin\Bluetooth Software\BtStackServer.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\amawil\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F771CJRL\HiJackThis[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60076
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: G DATA WebFilter Class - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G DATA\TotalCare\Webfilter\AVKWebIE.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: EoBho Class - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - (no file)
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: G DATA WebFilter - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G DATA\TotalCare\Webfilter\AVKWebIE.dll
O4 - HKLM\..\Run: [GDFirewallTray] C:\Program Files\G DATA\TotalCare\Firewall\GDFirewallTray.exe
O4 - HKLM\..\Run: [G DATA AntiVirus Trayapplication] C:\Program Files\G DATA\TotalCare\AVKTray\AVKTray.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: Outil de notification Live Search.lnk = C:\Users\amawil\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Envoyer l'&image au périphérique Bluetooth... - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix: 
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-8559c07e9d9d815e.spaces.live.com/PhotoUpload/VistaMsnPUpldfr-fr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: G DATA AntiVirus Proxy (AVKProxy) - G DATA Software AG - C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe
O23 - Service: Planificateur G DATA (AVKService) - G DATA Software AG - C:\Program Files\G DATA\TotalCare\AVK\AVKService.exe
O23 - Service: Gardien d'AntiVirus (AVKWCtl) - G DATA Software AG - C:\Program Files\G DATA\TotalCare\AVK\AVKWCtl.exe
O23 - Service: G DATA Tuner Service - G DATA Software AG - C:\Program Files\G DATA\TotalCare\AVKTuner\AVKTunerService.exe
O23 - Service: Pare-feu personnel G DATA (GDFwSvc) - G DATA Software AG - C:\Program Files\G DATA\TotalCare\Firewall\GDFwSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: RdnaoFlSvc - Unknown owner - C:\Program Filesnamfler
aofsvc.exe
O23 - Service: Service de sauvegarde G DATA - G DATA Software AG - C:\Program Files\G DATA\TotalCare\AVKBackup\AVKBackupService.exe

wilama1 · Answer

ca y estn dans panneau de config mais il me disait quil nexistait plus voulez vous le suppriomer de la liste et je lai fait!!!

wilama1 · Answer

voila
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:36:15, on 20/11/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\G DATA\TotalCare\Firewall\GDFirewallTray.exe
C:\Program Files\G DATA\TotalCare\AVKTray\AVKTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Belkin\Bluetooth Software\BTTray.exe
C:\Users\amawil\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Users\amawil\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Belkin\Bluetooth Software\BtStackServer.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\amawil\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ALSU1KCS\HiJackThis[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60076
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: G DATA WebFilter Class - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G DATA\TotalCare\Webfilter\AVKWebIE.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: EoBho Class - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - (no file)
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: G DATA WebFilter - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G DATA\TotalCare\Webfilter\AVKWebIE.dll
O4 - HKLM\..\Run: [GDFirewallTray] C:\Program Files\G DATA\TotalCare\Firewall\GDFirewallTray.exe
O4 - HKLM\..\Run: [G DATA AntiVirus Trayapplication] C:\Program Files\G DATA\TotalCare\AVKTray\AVKTray.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: Outil de notification Live Search.lnk = C:\Users\amawil\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Envoyer l'&image au périphérique Bluetooth... - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix: 
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-8559c07e9d9d815e.spaces.live.com/PhotoUpload/VistaMsnPUpldfr-fr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: G DATA AntiVirus Proxy (AVKProxy) - G DATA Software AG - C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe
O23 - Service: Planificateur G DATA (AVKService) - G DATA Software AG - C:\Program Files\G DATA\TotalCare\AVK\AVKService.exe
O23 - Service: Gardien d'AntiVirus (AVKWCtl) - G DATA Software AG - C:\Program Files\G DATA\TotalCare\AVK\AVKWCtl.exe
O23 - Service: G DATA Tuner Service - G DATA Software AG - C:\Program Files\G DATA\TotalCare\AVKTuner\AVKTunerService.exe
O23 - Service: Pare-feu personnel G DATA (GDFwSvc) - G DATA Software AG - C:\Program Files\G DATA\TotalCare\Firewall\GDFwSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: RdnaoFlSvc - Unknown owner - C:\Program Filesnamfler
aofsvc.exe
O23 - Service: Service de sauvegarde G DATA - G DATA Software AG - C:\Program Files\G DATA\TotalCare\AVKBackup\AVKBackupService.exe

wilama1 · Answer

c fait!!
ComboFix 08-11-19.08 - amawil 2008-11-20 20:55:13.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1078 [GMT 1:00]
Lancé depuis: c:\users\amawil\Downloads\ComboFix.exe
* Un nouveau point de restauration a été créé
.

((((((((((((((((((((((((((((( Fichiers créés du 2008-10-20 au 2008-11-20 ))))))))))))))))))))))))))))))))))))
.

2008-11-20 13:40 . 2008-11-20 13:40 <REP> d-------- c:\users\amawil\AppData\Roaming\Malwarebytes
2008-11-20 13:40 . 2008-11-20 13:40 <REP> d-------- c:\users\All Users\Malwarebytes
2008-11-20 13:40 . 2008-11-20 13:40 <REP> d-------- c:\programdata\Malwarebytes
2008-11-20 13:40 . 2008-11-20 13:40 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-20 13:40 . 2008-10-22 16:10 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
2008-11-20 13:40 . 2008-10-22 16:10 15,504 --a------ c:\windows\System32\drivers\mbam.sys
2008-11-19 22:29 . 2008-11-19 22:56 <REP> d-------- c:\program files\Navilog1
2008-11-19 21:09 . 2008-11-19 21:24 <REP> d-------- C:\ToolBar SD
2008-11-18 19:43 . 2008-11-18 19:43 <REP> d-------- c:\program files\PC Inspector File Recovery
2008-11-18 19:43 . 2002-02-18 18:40 6,200 --a------ c:\windows\System32\INT13EXT.VXD
2008-11-16 20:08 . 2008-11-16 20:16 <REP> d-------- c:\program files\Wise Registry Cleaner
2008-11-12 17:51 . 2008-09-10 04:40 1,334,272 --a------ c:\windows\System32\msxml6.dll
2008-11-12 17:51 . 2008-09-05 06:14 1,191,936 --a------ c:\windows\System32\msxml3.dll
2008-11-12 17:51 . 2008-08-27 02:05 212,480 --a------ c:\windows\System32\drivers\mrxsmb10.sys
2008-11-11 20:43 . 2008-11-11 20:43 29,128 --a------ c:\windows\System32\drivers\GRD.sys
2008-11-11 20:04 . 2008-11-11 20:04 51,656 --a------ c:\windows\System32\drivers\PktIcpt.sys
2008-11-11 20:04 . 2008-11-11 20:04 50,888 --a------ c:\windows\System32\drivers\MiniIcpt.sys
2008-11-11 20:04 . 2008-11-11 20:04 32,200 --a------ c:\windows\System32\drivers\HookCentre.sys
2008-11-11 20:03 . 2008-11-11 20:03 <REP> d--hs---- C:\#GDATA.Trash.Store#
2008-11-11 20:03 . 2008-11-11 20:03 39,880 --a------ c:\windows\System32\drivers\gdwfpcd32.sys
2008-11-11 20:02 . 2008-11-11 20:08 <REP> d-------- c:\users\All Users\G DATA
2008-11-11 20:02 . 2008-11-11 20:08 <REP> d-------- c:\programdata\G DATA
2008-11-11 20:02 . 2008-11-11 20:02 <REP> d-------- c:\program files\G DATA
2008-11-11 20:02 . 2008-11-11 20:03 <REP> d-------- c:\program files\Common Files\G DATA
2008-11-06 18:16 . 2008-11-06 18:16 <REP> d-------- c:\users\All Users\Yahoo! Companion
2008-11-06 18:16 . 2008-11-06 18:16 <REP> d-------- c:\programdata\Yahoo! Companion
2008-11-06 16:06 . 2008-11-06 16:06 <REP> d-------- c:\program files\Panda Security
2008-11-06 16:06 . 2008-06-19 17:24 28,544 --a------ c:\windows\System32\drivers\pavboot.sys
2008-11-06 15:37 . 2008-11-06 15:37 <REP> d-------- c:\program files\Yahoo!
2008-11-06 15:36 . 2008-11-06 15:38 <REP> d-------- c:\program files\CCleaner
2008-11-05 20:03 . 2008-11-05 20:03 850 --a------ c:\windows\System32\ProductTweaks.xml
2008-11-05 20:03 . 2008-11-05 20:03 385 --a------ c:\windows\System32\user_gensett.xml
2008-11-04 13:05 . 2008-11-04 13:07 <REP> d-------- c:\users\All Users\Adobe
2008-11-04 13:05 . 2008-11-04 13:06 <REP> d-------- c:\program files\Common Files\Adobe
2008-11-03 19:28 . 2008-11-03 19:28 <REP> d-------- c:\program files\MSXML 4.0
2008-11-02 19:50 . 2008-11-04 13:34 <REP> d-------- c:\program files\Dachshund Software
2008-11-02 19:50 . 2008-11-02 19:50 74 --ah----- c:\windows\wininf.dat
2008-11-02 19:42 . 2008-11-02 19:42 <REP> d-------- c:\program files\Power IE
2008-11-02 19:42 . 2008-11-02 19:42 <REP> d-------- c:\program files\inKline Global
2008-11-02 18:38 . 2008-08-05 10:49 428,544 --a------ c:\windows\System32\EncDec.dll
2008-11-02 18:38 . 2008-08-05 10:49 293,376 --a------ c:\windows\System32\psisdecd.dll
2008-11-02 18:38 . 2008-08-05 10:48 217,088 --a------ c:\windows\System32\psisrndr.ax
2008-11-02 18:38 . 2008-08-05 10:48 177,664 --a------ c:\windows\System32\mpg2splt.ax
2008-11-02 18:38 . 2008-08-05 10:48 80,896 --a------ c:\windows\System32\MSNP.ax
2008-11-01 18:42 . 2008-11-02 13:18 <REP> d-------- c:\program files\MotoGP
2008-11-01 13:25 . 2008-11-01 13:38 2,117,632 --a------ c:\windows\System32\python25.dll
2008-11-01 13:25 . 2008-09-16 17:26 1,332,197 --a------ c:\windows\System32\pythondll.zip
2008-11-01 13:25 . 2008-11-01 13:38 339,968 --a------ c:\windows\System32\pythoncom25.dll
2008-11-01 13:25 . 2008-11-01 13:38 114,688 --a------ c:\windows\System32\pywintypes25.dll
2008-11-01 13:23 . 2008-11-02 14:09 <REP> d-------- c:\program files\AGI
2008-10-31 14:56 . 2008-10-31 15:16 <REP> d-------- c:\users\amawil\AppData\Roaming\FileZilla
2008-10-30 13:40 . 2008-10-30 13:40 <REP> d-------- c:\users\amawil\AppData\Roaming\TuneUp Software
2008-10-30 13:28 . 2008-10-30 13:28 <REP> d-------- c:\users\amawil\AppData\Roaming\PeerNetworking
2008-10-29 10:22 . 2008-08-12 04:39 443,392 --a------ c:\windows\System32\win32spl.dll
2008-10-29 10:22 . 2008-09-18 05:56 147,456 --a------ c:\windows\System32\Faultrep.dll
2008-10-29 10:22 . 2008-09-18 05:56 125,952 --a------ c:\windows\System32\wersvc.dll
2008-10-26 12:37 . 2008-10-26 13:10 <REP> d-------- c:\users\amawil\AppData\Roaming\flightgear.org

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-20 18:15 --------- d-----w c:\users\amawil\AppData\Roaming\OpenOffice.org2
2008-11-20 12:40 --------- d-----w c:\programdata\Google Updater
2008-11-18 18:43 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-17 18:01 --------- d-----w c:\programdata\WLInstaller
2008-11-16 13:33 --------- d-----w c:\programdata\Microsoft Help
2008-11-11 12:14 --------- d-----w c:\program files\Messenger Plus! Live
2008-11-11 12:13 --------- d-----w c:\program files\Windows Live
2008-11-09 13:34 --------- d-----w c:\programdata\eMule
2008-11-07 13:01 --------- d-----w c:\program files\Common Files\BitDefender
2008-11-07 12:23 81,984 ----a-w c:\windows\System32\bdod.bin
2008-11-05 18:58 --------- d-----w c:\program files\BitDefender
2008-11-05 10:24 --------- d-----w c:\users\amawil\AppData\Roaming\LimeWire
2008-10-26 11:26 --------- d-----w c:\program files\Google
2008-10-19 18:19 724 ---ha-w C:\os264931.bin
2008-10-19 18:00 --------- d-----w c:\program files\Common Files\Vbox
2008-10-16 09:40 --------- d-----w c:\program files\Windows Mail
2008-10-08 13:13 0 ---ha-w c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2008-10-02 03:49 827,392 ----a-w c:\windows\System32\wininet.dll
2008-09-30 15:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll
2008-09-28 12:11 --------- d-----w c:\program files\Microsoft Works
2008-09-28 12:10 --------- d-----w c:\program files\Microsoft.NET
2008-09-25 15:01 --------- d--h--r c:\program files\rnamfler
2008-09-24 11:45 --------- d-----w c:\program files\easyMule
2008-09-21 08:57 --------- d-----w c:\programdata\Apple Computer
2008-09-21 08:57 --------- d-----w c:\program files\QuickTime
2008-09-21 08:57 --------- d-----w c:\program files\Common Files\Apple
2008-09-21 08:56 --------- d-----w c:\programdata\Apple
2008-09-21 08:56 --------- d-----w c:\program files\Apple Software Update
2008-09-21 08:19 --------- d-----w c:\program files\LimeWire
2008-09-18 05:09 3,601,464 ----a-w c:\windows\System32\ntkrnlpa.exe
2008-09-18 05:09 3,549,240 ----a-w c:\windows\System32\ntoskrnl.exe
2008-09-18 02:16 2,032,640 ----a-w c:\windows\System32\win32k.sys
2008-09-03 03:59 468,992 ----a-w c:\windows\System32\newdev.dll
2008-09-03 03:58 74,752 ----a-w c:\windows\System32\newdev.exe
2008-07-24 17:36 174 --sha-w c:\program files\desktop.ini
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GDFirewallTray"="c:\program files\G DATA\TotalCare\Firewall\GDFirewallTray.exe" [2008-09-09 1037992]
"G DATA AntiVirus Trayapplication"="c:\program files\G DATA\TotalCare\AVKTray\AVKTray.exe" [2008-09-10 996424]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2008-10-22 1261200]

c:\users\amawil\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216]
Outil de notification Live Search.lnk - c:\users\amawil\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe [2008-11-11 143360]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\Belkin\Bluetooth Software\BTTray.exe [2007-02-27 715568]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.i420"= i420vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{9A2DBD2F-251A-4211-97EB-BAC9C9610824}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{AEFBFBA9-3F0F-4D13-975B-BD1AA2BDD031}"= UDP:c:\program files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe
"{CDD21E82-6DB9-4FCE-9AB3-4C5BF52E21E8}"= TCP:c:\program files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe
"{FB0B6646-EDD8-4560-9C27-252037955555}"= UDP:c:\program files\Microsoft LifeCam\LifeEnC2.exe:LifeEnC2.exe
"{E5856527-A4D6-47E7-ABF4-7B3E697B8D02}"= TCP:c:\program files\Microsoft LifeCam\LifeEnC2.exe:LifeEnC2.exe
"{E5F2ADEA-E96F-43D3-AFC7-103F24ADE936}"= UDP:c:\program files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe
"{99902F33-F025-487A-9FB1-6BAFACA96719}"= TCP:c:\program files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe
"{1BD0F0E6-C4AE-40AB-B4AF-AD6A1BCB042E}"= UDP:c:\program files\Microsoft LifeCam\LifeTray.exe:LifeTray.exe
"{048335CA-80D2-48CA-A69B-0A8BCB24D0BD}"= TCP:c:\program files\Microsoft LifeCam\LifeTray.exe:LifeTray.exe
"{7C3873E9-B9C9-411E-ABC1-DF6E84268B41}"= Disabled:UDP:c:\program files\IncrediMail\bin\ImApp.exe:IncrediMail
"{C5BEDEC1-AD58-44ED-8AD9-F89F8385916F}"= Disabled:TCP:c:\program files\IncrediMail\bin\ImApp.exe:IncrediMail
"{4F181C04-1E9B-465A-B164-4F59B5B59C25}"= Disabled:UDP:c:\program files\IncrediMail\bin\IncMail.exe:IncrediMail
"{D4A193AF-5604-4F12-8ED9-F95BA90E6C54}"= Disabled:TCP:c:\program files\IncrediMail\bin\IncMail.exe:IncrediMail
"{DDE15BBB-76F9-4421-A86C-6F395151BBD1}"= Disabled:UDP:c:\program files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{78159BB1-C4AB-438E-9329-6FC2784E1837}"= Disabled:TCP:c:\program files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{1A142249-9A2E-4800-AF40-6C952D7322F8}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{79D2B45A-6900-4B91-93B7-10875031CB0D}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{3F3FEB65-362F-40D9-847F-DE8A6FD5BA2C}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{6D88DF09-F9CE-489A-9F57-4A2747254132}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{F210E8DF-BC0F-4024-84B5-867D94B6771A}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{FD028356-B0A2-4C83-992C-4EB95CDC874C}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R0 AtiPcie;ATI PCI Express (3GIO) Filter;c:\windows\system32\DRIVERS\AtiPcie.sys [2006-10-30 7680]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-11-06 28544]
R1 gdwfpcd;G DATA WFP CD;c:\windows\system32\drivers\gdwfpcd32.sys [2008-11-11 39880]
R1 GRD;G DATA Rootkit Detector Driver;\??\c:\windows\system32\drivers\GRD.sys [2008-11-11 29128]
R2 AVKProxy;G DATA AntiVirus Proxy;"c:\program files\Common Files\G DATA\AVKProxy\AVKProxy.exe" [2008-09-08 651848]
R2 AVKService;Planificateur G DATA;c:\program files\G DATA\TotalCare\AVK\AVKService.exe [2008-09-08 386120]
R2 AVKWCtl;Gardien d'AntiVirus;c:\program files\G DATA\TotalCare\AVK\AVKWCtl.exe [2008-08-14 1185496]
R2 MSCamSvc;MSCamSvc;"c:\program files\Microsoft LifeCam\MSCamS32.exe" [2008-04-25 156704]
R3 atikmdag;atikmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2008-05-12 3592704]
R3 GDFwSvc;Pare-feu personnel G DATA;c:\program files\G DATA\TotalCare\Firewall\GDFwSvc.exe [2008-08-15 1395616]
R3 GDMnIcpt;GDMnIcpt;\??\c:\windows\system32\drivers\MiniIcpt.sys [2008-11-11 50888]
R3 GDPkIcpt;GDPkIcpt;\??\c:\windows\system32\drivers\PktIcpt.sys [2008-11-11 51656]
R3 HookCentre;HookCentre;\??\c:\windows\system32\drivers\HookCentre.sys [2008-11-11 32200]
S3 G DATA Tuner Service;G DATA Tuner Service;c:\program files\G DATA\TotalCare\AVKTuner\AVKTunerService.exe [2008-08-19 925768]
S3 Service de sauvegarde G DATA;Service de sauvegarde G DATA;c:\program files\G DATA\TotalCare\AVKBackup\AVKBackupService.exe [2008-08-22 882760]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{36196f0e-7036-11dd-9fce-000a3a7f19b3}]
\shell\AutoRun\command - J:\MLLaunch.exe

*Newly Created Service* - PROCEXP90
.
Contenu du dossier 'Tâches planifiées'

2008-11-20 c:\windows\Tasks\Maintenance en 1 clic.job
- D:\OneClickStarter.exe []

2008-11-20 c:\windows\Tasks\User_Feed_Synchronization-{034039F1-1D4C-48DB-AFB1-81A0AA052912}.job
- c:\windows\system32\msfeedssync.exe [2008-01-19 08:33]
.
.
------- Examen supplémentaire -------
.
FireFox -: Profile - c:\users\amawil\AppData\Roaming\Mozilla\Firefox\Profiles\4lvv1xh6.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.msn.fr/
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-20 20:58:03
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2008-11-20 20:59:47
ComboFix-quarantined-files.txt 2008-11-20 19:59:42

Avant-CF: 72 602 779 648 octets libres
Après-CF: 72,628,756,480 octets libres

201 --- E O F --- 2008-11-16 13:33:13

wilama1 · Answer

voila et il ma paru plus rapide a analyser en meme pas 2 seconde!!!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:30:04, on 20/11/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Program Files\G DATA\TotalCare\Firewall\GDFirewallTray.exe
C:\Program Files\G DATA\TotalCare\AVKTray\AVKTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Belkin\Bluetooth Software\BTTray.exe
C:\Users\amawil\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Users\amawil\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Belkin\Bluetooth Software\BtStackServer.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\Explorer.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\amawil\Downloads\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: G DATA WebFilter Class - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G DATA\TotalCare\Webfilter\AVKWebIE.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: EoBho Class - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - (no file)
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: G DATA WebFilter - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G DATA\TotalCare\Webfilter\AVKWebIE.dll
O4 - HKLM\..\Run: [GDFirewallTray] C:\Program Files\G DATA\TotalCare\Firewall\GDFirewallTray.exe
O4 - HKLM\..\Run: [G DATA AntiVirus Trayapplication] C:\Program Files\G DATA\TotalCare\AVKTray\AVKTray.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: Outil de notification Live Search.lnk = C:\Users\amawil\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Envoyer l'&image au périphérique Bluetooth... - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix: 
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-8559c07e9d9d815e.spaces.live.com/PhotoUpload/VistaMsnPUpldfr-fr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: G DATA AntiVirus Proxy (AVKProxy) - G DATA Software AG - C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe
O23 - Service: Planificateur G DATA (AVKService) - G DATA Software AG - C:\Program Files\G DATA\TotalCare\AVK\AVKService.exe
O23 - Service: Gardien d'AntiVirus (AVKWCtl) - G DATA Software AG - C:\Program Files\G DATA\TotalCare\AVK\AVKWCtl.exe
O23 - Service: G DATA Tuner Service - G DATA Software AG - C:\Program Files\G DATA\TotalCare\AVKTuner\AVKTunerService.exe
O23 - Service: Pare-feu personnel G DATA (GDFwSvc) - G DATA Software AG - C:\Program Files\G DATA\TotalCare\Firewall\GDFwSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: RdnaoFlSvc - Unknown owner - C:\Program Filesnamfler
aofsvc.exe
O23 - Service: Service de sauvegarde G DATA - G DATA Software AG - C:\Program Files\G DATA\TotalCare\AVKBackup\AVKBackupService.exe

wilama1 · Answer

oh c magique!!! avant que je fermais la fenetre de paaneau de config par exemple, ca me marquer windows explrer a cesser de fonctionnerr blabla et pis les icones disparaissait et reaparaissait mais la ca le fait plus!! merci!!! et une question: javais bitdefender internet security 2008 et comme la license set expirer jai mis le meme en 2009 mais ca me faisait ralentir et planter mon pc. Crois tu que ca marchera beaucoup mieu comme ca??? jai pas envie de le reinstaller si ca me replante tout!!! la g une version dessai cest g data mais je voudrais revenir au bitdefnder comme je lai acheter!!! en plus il y a moins dun mois!!!

archet9 · Answer

si tu as acheté bitdefender installe le il est tres bon.....

ensuite pour desinstallerles kogs utililisés pour la desinfection:

--Telecharge ToolsCleaner2--> http://pc-system.fr/ 

-Une fois téléchargé, installe-le et lance-le 

-Clique sur Recherche et laisse le scan se terminer 

-Clique sur Suppression 

-Clique sur Quitter pour que le rapport puisse se créer 

-Poste moi le rapport se trouvant ici--> C:\TCleaner.txt 

a+
Antonio Giacomo Stradivari, souvent appelé Stradivarius (Crémone, 1644 - Crémone, 18 décembre 1737 
Le Soil (1714), considéré par beaucoup comme le meilleur instrument du monde.
peu de temps avant sa mort il cherchait encore...

wilama1 · Answer

il me dit impossible de creer le rapport C:\TCleaner.txt  acces refuser

wilama1 · Answer

le logo windows??? ou ca en bas a gauche?? je vois pas... en bas de ou??

wilama1 · Answer

c marquer aucun element ne correspont a votre recherche

wilama1 · Answer

ben oui mais c marquer aucun element ne correspont a votre recherche

archet9 · Answer

j ai oublié le lien..........

--Telecharge ToolsCleaner2--> http://pc-system.fr/ 




&+
Antonio Giacomo Stradivari, souvent appelé Stradivarius (Crémone, 1644 - Crémone, 18 décembre 1737 
Le Soil (1714), considéré par beaucoup comme le meilleur instrument du monde.
peu de temps avant sa mort il cherchait encore...

wilama1 · Answer

ok c bon 
[ Rapport ToolsCleaner version 2.2.6 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

C:\Combofix.txt: trouvé !
C:\fixnavi.txt: trouvé !
C:\cleannavi.txt: trouvé !
C:\avenger.txt: trouvé !
C:\TB.txt: trouvé !
C:\Combofix: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files\Navilog1\Navilog1.bat: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\Navilog1: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Navilog1: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Navilog1\Navilog1.lnk: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programmes\Navilog1: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Navilog1: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Navilog1\Navilog1.lnk: trouvé !
C:\Users\amawil\Downloads\ComboFix.exe: trouvé !

---------------------------------
-->- Suppression: 

C:\Program Files\Navilog1\Navilog1.bat: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Navilog1\Navilog1.lnk: supprimé !
C:\Users\amawil\Downloads\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Combofix.txt: supprimé !
C:\fixnavi.txt: supprimé !
C:\cleannavi.txt: supprimé !
C:\avenger.txt: supprimé !
C:\TB.txt: supprimé !
C:\Combofix: ERREUR DE SUPPRESSION !!
C:\Program Files\Navilog1: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\Navilog1: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Navilog1: supprimé !

wilama1 · Answer

non ils sont activer

wilama1 · Answer

non et toi tu vois que tout est ok maintenant??

wilama1 · Answer

ben un grand merci pour ton je ten suis tres reconnaissant

wilama1 · Answer

bonne nuit et encore merci pour ton aide

Tout va bien???

26 réponses

Discussions similaires

Newsletters