reçu lien sur widows live messenger

Question

Bonjour,
j'ai reçu un lien sur msn : "foto http://site.myspacy.net/viewimage.php?=mon adresse mail "pensant avoir reçu une photo je l'ai ouvert puis rien. Sauf que tout mes contacts recoivent ce lien de ma part comment faire pour m'en debarraser . Je vous en remercie

Sloubi76 · Answer

Christel,

Télécharge HijackThis ici :

-> http://www.trendsecure.com/portal/en-US/_download/HiJackThis.exe

Démo : (Merci a Balltrap34 pour cette réalisation)
http://www.tutoriaux-excalibur.com/hijackthis.htm
https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html

Renomer Hijackthis, pour contrer une éventuelle infection de Vundo.

ex:Renomme le fichier HijackThis.exe en CCM.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste

Ensuite avec Explorer créer un dossier c:\hijackthis
Décompresser Hijackthis dans ce dossier.
C'est important pour les sauvegardes.
 
Lance Hitjack this
Do a system scan and save a log file

Post le rapport généré ici stp...

christel · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:07:44, on 07/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\system32\dla	fswctrl.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Documents and Settings\Christelle\Bureau\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.dell.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O1 - Hosts: 212.95.67.78www.kochonland.com
O2 - BHO: (no name) - {1FE4BFC2-60DB-461C-B734-1D40F120299A} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\opnlKEvT.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9669d50c-1b7c-4a5b-9b1d-c0691c997d10} - C:\WINDOWS\system32\verenoka.dll
O2 - BHO: (no name) - {A7F723E7-89BA-4C67-8AFB-683BD0B01ABD} - C:\WINDOWS\system32	uvWomKd.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: (no name) - {C9D5FAF1-AEEE-F806-6A10-1E2FF3FF507C} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Anti-Blaxx Manager] C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
O4 - HKLM\..\Run: [AlfaCleaner] C:\Program Files\AlfaCleaner\AlfaCleaner.exe
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
O4 - HKLM\..\Run: [SMrhclnuj0er0l] C:\Program Fileshclnuj0er0lhclnuj0er0l.exe
O4 - HKLM\..\Run: [SMshcnnuj0er0l] C:\Program Files\shcnnuj0er0l\shcnnuj0er0l.exe
O4 - HKLM\..\Run: [hoguvavisi] Rundll32.exe "C:\WINDOWS\system32\pakagede.dll",s
O4 - HKLM\..\Run: [a89dbbc6] rundll32.exe "C:\WINDOWS\system32\kugugupa.dll",b
O4 - HKLM\..\Run: [CPMabae885a] Rundll32.exe "c:\windows\system32\jojigude.dll",a
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [window bin] C:\DOCUME~1\CHRIST~1\APPLIC~1\COMPON~1\dupesoftwaregrim.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Antivirus] C:\Program Files\VAV\vav.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [hoguvavisi] Rundll32.exe "C:\WINDOWS\system32\pakagede.dll",s (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/fr/4,0,0,90/mcinsctl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O20 - AppInit_DLLs: ulqeqf.dll C:\WINDOWS\system32\vasudere.dll c:\windows\system32\jojigude.dll
O20 - Winlogon Notify: opnlKEvT - C:\WINDOWS\SYSTEM32\opnlKEvT.dll
O20 - Winlogon Notify: tuvSkHXn - tuvSkHXn.dll (file missing)
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\jojigude.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\jojigude.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\Program Files\Inventel\Gateway\wlancfg.exe

christel · Answer

Bonjour 
j'ai telechargé Smitfraudfix.exe et quand je double clic dessus il ce passe  rien du tout, je ne peux donc pas suivre votre conseil. J'ai du faire un truc que j'ai pas comprit ça commence par le telechargement de smitfraudfix que j'enregitre sur le c:/ dans le poste de travail j'écrit au c:\ smitfraudfix.exe et quand je double clic une fenetre c:/ windows\systems32\cmd.exe une fenetre bleu apparait je fait 1 et entrer comme vs l'indiqué et l' apparait smitfraudfix v2.381 puis plus rien ......

christel · Answer

re bonsoir 
je viens de faire ce que tu m'as ecrit. quand je double clic il me demande d'escuter mais il demande pas ou il va directement sur c:\sitting_docment _christel.....je peux pas changer ça 
j'ai donc eexcuter une fenetre bleu est apparu  j'ai fait 1 et entre puis c'est affiché 
smitfraudfix v2.381
recherche process...
recherche hosts.....

et c'est tout .... que dois je faire ?

christel · Answer

Bonjour,
j'ai laissé mon ordi allumé toute la nuit est la fenetre bleue n'a pas changé elle dit recherche process recherche hosts....est ce normal ? dois je le laisser encore chercher ? Mon ordi rame de plus en plus ? des pages de pubs apparaisent des que je suis sur le net . Que dois je faire ? Merci

christel · Answer

bonsoir 
j'ai tout mis a la poubelle car ça marche toujours pas la journée d'hier a etait en recherche et rien . J'ai mon anti virus qui ne peut pas suprimer "generic PUP.x" et le "Pcr viewer" coment faire pour me virer tout ça s'il vous plait merci .

christel · Answer

Bonjour, 
je suis desolée de ne pas vs avoir ecrit plus tot mais mon ordi est inaxessible, toujours meme probleme des fenetre s'ouvre tout le temps voir une bonne dixaine ce qui m'agace . J'ai fait le telechargement liveudapte mais rien de ce que j'ai fait n'a dit ce que vs m'avez ecrit il veut toujours excuter. Quand j'ai fait excuter, le message lu1860 ne s'affiche pas . Un nouveau truc viens de s'afficher auss il s'appel preload dell france installer que j'ai essayé de virer mais impossible. que doije faire maintenant ? l'ammener voir un informatitien peut etre ? merci j'attend de vos nouvelles

jorginho67 · Answer

Salut.

Juste pour essayer d'avancer.

Sauvegarde  ces instructions car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.

Clic droit sur le bureau => nouveau document => document texte et copi/colle ces instructions que tu porras consulter  pour faire la manip' correctement !

1)

• Télécharge OTMoveIt3 de OldTimer
http://oldtimer.geekstogo.com/OTMoveIt3.exe

* Enregistre-le sur ton bureau

Redémarre en mode sans échec

Pour cela, tapotes la touche F8 (Si F8 ne marche pas utilise la touche F5) dès le début de l’allumage du pc sans t’arrêter.
Une fenêtre va s’ouvrir, tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape [Entrée].
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !

comment demarrer en mode sans echec en images

* Double-clique sur OTMoveIt3.exe pour le lancer (l'extension peut ne pas apparaître)
* Copie-colle l'ensemble des lignes en gras ci dessous dans la partie "Paste Instructions for Items to be Moved" (en-dessous de la barre jaune) :

:files
C:\Program Files\VAV\vav.exe 
C:\Program Files\AlfaCleaner\AlfaCleaner.exe 
:commands
[emptytemp]
[Reboot]

* Clique sur le bouton rouge Moveit! pour lancer le nettoyage
* Copie-colle dans ta prochaine réponse tout ce qui se trouve dans la fenêtre Results (en vert à droite)

* Ferme OTMoveIt3 (en cliquant sur Exit)

Note : Si un fichier ou un dossier ne sait être supprimé directement, l'outil peut demander un redémarrage pour terminer le processus. 
Clique alors sur "Yes" pour accepter...


Redémarre normalement .

==> Un rapport sera généré dans le dossier C:\ _OTMoveIt\MovedFiles avec la date et l'heure du passage de l'outil (mmddyyyy_hhmmss.log)

Poste le ici
=======================

ENSUITE :


2)

Le pc est bourré de Vundo, d'ou les fenetres intempestives.

Continue avec  ceci, on y verra plus clair:


* Télécharge Malwarebytes' Anti-Malware (MBAM) et enregistre le sur ton Bureau.
S'il manque le fichier COMCTL32.OCX, tu pourras le télécharger ici

C'est un bon scan passif que tu peux garder avec lequel tu pourras effectuer un nettoyage hebdomadaire, sans oublier de faire une mise à jour manuelle avant d'exécuter l’analyse .

A la fin du téléchargement, ferme toutes les fenêtres et programmes, y compris celle-ci.

* Double-clique sur l'icône Download_mbam-setup.exe sur ton bureau pour démarrer le programme d'installation.

Pendant l'installation, suis les indications (en particulier le choix de la langue et l'autorisation d'accession à Internet). N'apporte aucune modification aux réglages par défaut et, en fin d'installation, vérifie que les options Update Malwarebytes' Anti-Malware et Launch Malwarebytes' Anti-Malware soient cochées.

MBAM démarrera automatiquement et enverra un message demandant à mettre à jour le programme avant de lancer une analyse. Comme MBAM se met automatiquement à jour en fin d'installation, clique sur OK pour fermer la boîte de dialogue. La fenêtre principale de MBAM s'affiche :

 * Dans l'onglet analyse, vérifie que "Exécuter un examen RAPIDE" soit coché et clique sur le bouton Rechercher pour démarrer l'analyse.

MBAM analyse ton ordinateur. L'analyse peut prendre un certain temps. Il suffit de vérifier de temps en temps son avancement.

A la fin de l'analyse, un message s'affiche indiquant la fin de l'analyse. Clique sur OK pour poursuivre.

* Si des malwares ont été détectés, leur liste s'affiche.

Coche tous les éléments détectés par Malwarebytes' Anti-Malware puis clique sur Supprimer la sélection afin d'éradiquer les malwares détectés.
 /!\ (a faire impérativement sous peine de recommencer le scan) /!\  , MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.


MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Ferme le Bloc-notes. (Le rapport peut être retrouvé sous l'onglet Rapports/logs)

Ferme MBAM en cliquant sur Quitter.

Poste le rapport dans ta réponse 

Tutoriel
Un autre  si tu as besoin d'aide.

christel · Answer

bonsoir
tans bien que mal j'ai reussi a faire la 1ere partie ci joint la reponse. Je vais essayer de faire la 2ieme partie car ça rame dur .....merci 

========== FILES ==========
File/Folder c:\Program files\VAV\vav.exe not found.
File/Folder c:\Program files\Alfacleaner\Alfacleaner.exe not found.
========== COMMANDS ==========
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS	emp\mcmsc_VVFrrbkaIEG4EW9 scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.
 
OTMoveIt3 by OldTimer - Version 1.0.7.2 log created on 12192008_205812

Files moved on Reboot...
File C:\WINDOWS	emp\mcmsc_VVFrrbkaIEG4EW9 not found!

christel · Answer

reponse du 2ieme moi ça me parle pas tout ça . malwarebytes n'a pas pu tout suprimer.


Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1456
Windows 5.1.2600 Service Pack 3

19/12/2008 23:10:10
mbam-log-2008-12-19 (23-10-10).txt

Type de recherche: Examen rapide
Eléments examinés: 81208
Temps écoulé: 42 minute(s), 46 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 8
Clé(s) du Registre infectée(s): 37
Valeur(s) du Registre infectée(s): 8
Elément(s) de données du Registre infecté(s): 7
Dossier(s) infecté(s): 3
Fichier(s) infecté(s): 48

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\funesabo.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32	uvWomKd.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\feyumaze.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\zubadira.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\mehoguhi.dll (Trojan.Vundo.H) -> Delete on reboot.
c:\WINDOWS\system32\jojigude.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\ulqeqf.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\ducrdt.dll (Trojan.Vundo.H) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2e5523af-6492-4766-86e9-187895451d38} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2e5523af-6492-4766-86e9-187895451d38} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6f08d7ce-75b4-438a-883b-e917e873414f} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{6f08d7ce-75b4-438a-883b-e917e873414f} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9669d50c-1b7c-4a5b-9b1d-c0691c997d10} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{9669d50c-1b7c-4a5b-9b1d-c0691c997d10} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9669d50c-1b7c-4a5b-9b1d-c0691c997d10} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2e5523af-6492-4766-86e9-187895451d38} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6f08d7ce-75b4-438a-883b-e917e873414f} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7545d8c8-f53c-4e2f-8fa0-d248ef4a6e61} (Rogue.Installer) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{f919fbd3-a96b-4679-af26-f551439bb5fd} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{09f1adac-76d8-4d0f-99a5-5c907dadb988} (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1fe4bfc2-60db-461c-b734-1d40f120299a} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{31a59636-0fa3-4a56-954d-db7ad02840d8} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3fa917b9-df69-477f-9e4f-b60d929de79f} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{8c875948-9c60-4381-9248-0df180542d53} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{ed8525ea-2bfc-4440-bd8a-20efb9d5e541} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1fe4bfc2-60db-461c-b734-1d40f120299a} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstallhclnuj0er0l (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\shcnnuj0er0l (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWAREhclnuj0er0l (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\shcnnuj0er0l (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\VAV (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoftdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoftdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a89dbbc6 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoguvavisi (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpmabae885a (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{1fe4bfc2-60db-461c-b734-1d40f120299a} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smrhclnuj0er0l (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smshcnnuj0er0l (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32	uvwomkd -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\feyumaze.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\feyumaze.dll  -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\feyumaze.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\jojigude.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\jojigude.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32	uvwomkd  -> Delete on reboot.

Dossier(s) infecté(s):
C:\Program Fileshclnuj0er0l (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\shcnnuj0er0l (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\778670 (Trojan.BHO) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\WINDOWS\system32\ducrdt.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32	uvWomKd.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\dKmoWvut.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dKmoWvut.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\funesabo.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\obasenuf.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\joxvrmxg.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gxmrvxoj.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lowylsan.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32
aslywol.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sbxffedx.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xdeffxbs.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wfnvajbi.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ibjavnfw.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\zubadira.dll (Trojan.Vundo.H) -> Delete on reboot.
c:\WINDOWS\system32\jojigude.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\mehoguhi.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\feyumaze.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\ulqeqf.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\gnppjrhw.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fihogepe.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fiwskvqu.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\saspkj.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\89YBCPEZ\pldr7[1].htm (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Léa\Local Settings\Temporary Internet Files\Content.IE5\NX2DR09X\css4[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Laurent\Local Settings\Temporary Internet Files\Content.IE5\2MFLPF27\index[1] (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\Laurent\Local Settings\Temporary Internet Files\Content.IE5\TWC1S0FI\upd105320[1] (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Program Fileshclnuj0er0l\database.dat (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Fileshclnuj0er0l\license.txt (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Fileshclnuj0er0l\MFC71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Fileshclnuj0er0l\MFC71ENU.DLL (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Fileshclnuj0er0l\msvcp71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Fileshclnuj0er0l\msvcr71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Fileshclnuj0er0lhclnuj0er0l.exe.local (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\shcnnuj0er0l\database.dat (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\shcnnuj0er0l\license.txt (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\shcnnuj0er0l\MFC71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\shcnnuj0er0l\MFC71ENU.DLL (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\shcnnuj0er0l\msvcp71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\shcnnuj0er0l\msvcr71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\shcnnuj0er0l\shcnnuj0er0l.exe.local (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\shcnnuj0er0l\Uninstall.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\Christelle\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\Pierre\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\Léa\Local Settings\Temp\.ttA.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Léa\Local Settings\Temp\.ttD.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

jorginho67 · Answer

Nickel ;-)) ...


Refais ensuite un rapport de scan avec Hijackthis ( HJT ) et poste le aussi.

Ø Relance Hijackthis en double cliquant sur son raccourci sur le Bureau.
Choisis l'option "Do a system scan and save a log file"
Clique sur "Save log" pour enregistrer le rapport qui s'ouvrira avec le bloc-note
Clique sur "Edition" ->> "Sélectionner tout", puis sur "Edition" ->> Copier" pour copier tout le contenu du rapport ici

christel · Answer

Bonjour ci joint le rapport du hijackthis 


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:33:58, on 20/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\system32\dla	fswctrl.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Documents and Settings\Christelle\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Documents and Settings\Christelle\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Christelle\Bureau\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.dell.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O1 - Hosts: 212.95.67.78www.kochonland.com
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: (no name) - {C9D5FAF1-AEEE-F806-6A10-1E2FF3FF507C} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Anti-Blaxx Manager] C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
O4 - HKLM\..\Run: [AlfaCleaner] C:\Program Files\AlfaCleaner\AlfaCleaner.exe
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [window bin] C:\DOCUME~1\CHRIST~1\APPLIC~1\COMPON~1\dupesoftwaregrim.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Antivirus] C:\Program Files\VAV\vav.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [hoguvavisi] Rundll32.exe "C:\WINDOWS\system32\zubadira.dll",s (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-3505198121-2334664744-207698824-1006\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM= (User 'Laurent')
O4 - HKUS\S-1-5-21-3505198121-2334664744-207698824-1006\..\Run: [Odebit Multimedia V2] C:\Program Files\Odebit Multimédia\V2\Odebit.exe (User 'Laurent')
O4 - HKUS\S-1-5-21-3505198121-2334664744-207698824-1006\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Laurent')
O4 - HKUS\S-1-5-21-3505198121-2334664744-207698824-1006\..\Run: [Antivirus] C:\Program Files\VAV\vav.exe (User 'Laurent')
O4 - HKUS\S-1-5-21-3505198121-2334664744-207698824-1006\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (User 'Laurent')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Startup: Outil de notification Live Search.lnk = C:\Documents and Settings\Christelle\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/fr/4,0,0,90/mcinsctl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O20 - AppInit_DLLs: ulqeqf.dll  ducrdt.dll , 
O20 - Winlogon Notify: opnlKEvT - opnlKEvT.dll (file missing)
O20 - Winlogon Notify: tuvSkHXn - tuvSkHXn.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\Program Files\Inventel\Gateway\wlancfg.exe

jorginho67 · Answer

Tu as redémarré le pc ?

Télécharge SmitfraudFix
Utilitaire de S!Ri: Moe et balltrap34

Installe le à la racine de C : tuto d'utilisation

Double clique sur l'exe pour le décompresser et lancer le fix.

Utilisation option 1 Recherche :

Double clique sur smitfraudfix.cmd
Sélectionne 1 pour créer un rapport des fichiers responsables de l'infection.

Ne fais rien d'autre sans notre avis

Copie/colle le RAPPORT sur ta prochaine réponse sur ce post stp.

Process.exe est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.


Tutoriel d'aide

christel · Answer

SmitFraudFix v2.387

Rapport fait à 20:20:31,79, 20/12/2008
Executé à partir de C:\Documents and Settings\Christelle\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\system32\dla	fswctrl.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Documents and Settings\Christelle\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Documents and Settings\Christelle\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\drivers\hesvc.sys PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Christelle


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Christelle\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\CHRIST~1\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="ulqeqf.dll  ducrdt.dll , "
"LoadAppInit_DLLs"=dword:00000001


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel(R) PRO/1000 PL Network Connection - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{5FFC01DA-E490-4223-A099-7D5FA1DD6258}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{9CC75CC1-F481-43F3-A878-A59B5AE64E7C}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{5FFC01DA-E490-4223-A099-7D5FA1DD6258}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{9CC75CC1-F481-43F3-A878-A59B5AE64E7C}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{5FFC01DA-E490-4223-A099-7D5FA1DD6258}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{9CC75CC1-F481-43F3-A878-A59B5AE64E7C}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

christel · Answer

je me pose la question dois je faire la suite en mode sans echec ou pas ?
car je vous ai envoyé que la 1ere partie ou il faut taper 1(recherche ) apres sur le model il dise de redemarrer l'ordi et faire f8 etc ......???? que dois je faire ? continuer comme sur le model ?????
merci en tout cas je n'ai plus de fenetre qui s'ouvre tout le temps et l'ordi rame plus . Mais j'ai toujours les fenetre de preloab dell france installer qui sont toujours impossible a virer . merci a bientot

jorginho67 · Answer

Ensuite : Option 2 Redémarre en mode sans échec Pour cela, tapotes la touche F8 (Si F8 ne marche pas utilise la touche F5) dès le début de l’allumage du pc sans t’arrêter. Une fenêtre va s’ouvrir, tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape [Entrée]. Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal ! comment demarrer en mode sans echec en images ------------------------------------------------------------------------------- Double clique sur smitfraudfix.cmd Cette fois choisit l’option 2 !! répond Oui (o) à tout Une fois le nettoyage terminé, SmitFraudfix ouvre le rapport de nettoyage sur le bloc-note. Redémarre l'ordinateur en mode normal (comme d'habitude), Sur le bureau doit se trouver le rapport enregistré (sinon il est sur le Poste de Travail / Disque C / rapport.txt) Refais un log Hitjackthis et poste les deux rapports s'il te plait !

christel · Answer

par rapport a l'autre jour tout a fonctionné ci joint le rapprot

SmitFraudFix v2.387

Rapport fait à 20:20:31,79, 20/12/2008
Executé à partir de C:\Documents and Settings\Christelle\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\system32\dla	fswctrl.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Documents and Settings\Christelle\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Documents and Settings\Christelle\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\drivers\hesvc.sys PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Christelle


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Christelle\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\CHRIST~1\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="ulqeqf.dll  ducrdt.dll , "
"LoadAppInit_DLLs"=dword:00000001


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel(R) PRO/1000 PL Network Connection - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{5FFC01DA-E490-4223-A099-7D5FA1DD6258}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{9CC75CC1-F481-43F3-A878-A59B5AE64E7C}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{5FFC01DA-E490-4223-A099-7D5FA1DD6258}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{9CC75CC1-F481-43F3-A878-A59B5AE64E7C}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{5FFC01DA-E490-4223-A099-7D5FA1DD6258}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{9CC75CC1-F481-43F3-A878-A59B5AE64E7C}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

christel · Answer

desolé je t'ai envoyé le mauvais rapport .... 
le voilà

SmitFraudFix v2.387

Rapport fait à 22:31:12,39, 20/12/2008
Executé à partir de C:\Documents and Settings\Christelle\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1       localhost
212.95.67.78www.kochonland.com

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

C:\WINDOWS\system32\drivers\hesvc.sys supprimé

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» RK


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{5FFC01DA-E490-4223-A099-7D5FA1DD6258}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{9CC75CC1-F481-43F3-A878-A59B5AE64E7C}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{5FFC01DA-E490-4223-A099-7D5FA1DD6258}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{9CC75CC1-F481-43F3-A878-A59B5AE64E7C}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{5FFC01DA-E490-4223-A099-7D5FA1DD6258}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{9CC75CC1-F481-43F3-A878-A59B5AE64E7C}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
 
Nettoyage terminé. 
 
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

jorginho67 · Answer

Ø Relance Hijackthis en double cliquant sur son raccourci sur le Bureau.
Choisis l'option "Do a system scan and save a log file"
Clique sur "Save log" pour enregistrer le rapport qui s'ouvrira avec le bloc-note
Clique sur "Edition" ->> "Sélectionner tout", puis sur "Edition" ->> Copier" pour copier tout le contenu du rapport ici

christel · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:15:29, on 20/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\system32\dla	fswctrl.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\Documents and Settings\Christelle\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Documents and Settings\Christelle\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Documents and Settings\Christelle\Bureau\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail?service=communiquer&u=http://webmail.wanadoo.fr/wanadoo/inbox.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O1 - Hosts: 212.95.67.78www.kochonland.com
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: (no name) - {C9D5FAF1-AEEE-F806-6A10-1E2FF3FF507C} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Anti-Blaxx Manager] C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [window bin] C:\DOCUME~1\CHRIST~1\APPLIC~1\COMPON~1\dupesoftwaregrim.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [hoguvavisi] Rundll32.exe "C:\WINDOWS\system32\zubadira.dll",s (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Startup: Outil de notification Live Search.lnk = C:\Documents and Settings\Christelle\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/fr/4,0,0,90/mcinsctl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O20 - AppInit_DLLs: ulqeqf.dll  ducrdt.dll , 
O20 - Winlogon Notify: opnlKEvT - opnlKEvT.dll (file missing)
O20 - Winlogon Notify: tuvSkHXn - tuvSkHXn.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\Program Files\Inventel\Gateway\wlancfg.exe

jorginho67 · Answer

Télécharge LopSD.exe sur ton Bureau
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2

* Double-clique dessus pour lancer l'installation
* Clique droit sur le raccourci Lop S&D présent sur ton Bureau puis " Exécuter en tant qu'administrateur "
* Séléctionne la langue souhaitée, puis choisis l'option 1 (Recherche)
* Patiente jusqu'à la fin du scan
* Poste le rapport généré qui se trouve ici => (C:\lopR.txt)

(Si le Bureau ne réapparait pas, presse Ctrl+Alt+Suppr, Onglet Fichier, Nouvelle tâche, tape explorer.exe et valide)

Si tu as un problème pour utiliser Lop S&D, regarde ce tutorial

christel · Answer

--------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) 4 CPU 3.20GHz )
   BIOS : Phoenix ROM BIOS PLUS Version 1.10 A02
   USER : Christelle ( Administrator )
   BOOT : Normal boot
   Antivirus : McAfee VirusScan  (Activated)
   Firewall  : McAfee Personal Firewall  (Activated)
   C:\ (Local Disk) - NTFS - Total:229 Go (Free:185 Go)
   D:\ (CD or DVD)
   E:\ (CD or DVD)
   G:\ (USB)
   H:\ (USB)
   I:\ (USB)
   J:\ (USB)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [1] ( 20/12/2008|23:36 )
 
   --------------------\  Listing des dossiers dans APPLIC~1

   [20/08/2004|11:41] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
   [08/12/2005|23:55] C:\DOCUME~1\ADMINI~1\APPLIC~1\Jasc Software Inc
   [20/08/2004|11:30] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
   [08/12/2005|23:47] C:\DOCUME~1\ADMINI~1\APPLIC~1\Sun
   [08/12/2005|23:53] C:\DOCUME~1\ADMINI~1\APPLIC~1\You've Got Pictures Screensaver

   [14/07/2008|09:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [14/02/2006|17:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
   [30/12/2006|18:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
   [13/03/2006|12:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Fastwavelongfirst
   [14/12/2005|21:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP
   [08/12/2005|23:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
   [19/12/2008|21:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
   [31/10/2008|09:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
   [27/04/2007|23:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee.com
   [05/03/2008|10:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [10/02/2006|21:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\pixelStorm
   [26/11/2006|14:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\POPWWPROFILES
   [06/01/2006|14:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Prism
   [25/02/2006|19:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
   [20/08/2004|11:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
   [11/10/2008|09:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SiteAdvisor
   [25/02/2006|19:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [23/09/2008|17:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM
   [13/12/2008|12:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
   [08/12/2005|23:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
   [25/02/2006|20:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [13/12/2008|18:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

   [13/07/2008|09:58] C:\DOCUME~1\CHRIST~1\APPLIC~1\Adobe
   [14/07/2008|09:19] C:\DOCUME~1\CHRIST~1\APPLIC~1\AdobeUM
   [30/08/2008|23:05] C:\DOCUME~1\CHRIST~1\APPLIC~1\agi
   [13/03/2006|13:26] C:\DOCUME~1\CHRIST~1\APPLIC~1\Comp online active
   [14/12/2005|20:12] C:\DOCUME~1\CHRIST~1\APPLIC~1\CyberLink
   [20/01/2006|13:32] C:\DOCUME~1\CHRIST~1\APPLIC~1\eConf
   [28/01/2006|18:47] C:\DOCUME~1\CHRIST~1\APPLIC~1\Google
   [08/03/2006|09:17] C:\DOCUME~1\CHRIST~1\APPLIC~1\HbTools
   [05/01/2006|20:07] C:\DOCUME~1\CHRIST~1\APPLIC~1\Help
   [10/05/2006|18:29] C:\DOCUME~1\CHRIST~1\APPLIC~1\HP
   [20/08/2004|11:41] C:\DOCUME~1\CHRIST~1\APPLIC~1\Identities
   [14/04/2008|15:03] C:\DOCUME~1\CHRIST~1\APPLIC~1\Image Zone Express
   [19/01/2006|19:32] C:\DOCUME~1\CHRIST~1\APPLIC~1\Jasc Software Inc
   [05/02/2006|20:21] C:\DOCUME~1\CHRIST~1\APPLIC~1\Leadertech
   [06/03/2006|21:29] C:\DOCUME~1\CHRIST~1\APPLIC~1\Macromedia
   [19/12/2008|21:56] C:\DOCUME~1\CHRIST~1\APPLIC~1\Malwarebytes
   [13/12/2008|13:46] C:\DOCUME~1\CHRIST~1\APPLIC~1\Microsoft
   [20/01/2006|14:32] C:\DOCUME~1\CHRIST~1\APPLIC~1\MSNInstaller
   [13/03/2006|12:50] C:\DOCUME~1\CHRIST~1\APPLIC~1\OneEggs
   [12/11/2008|18:08] C:\DOCUME~1\CHRIST~1\APPLIC~1\OpenOffice.org
   [22/02/2008|22:10] C:\DOCUME~1\CHRIST~1\APPLIC~1\PlayFirst
   [05/02/2006|20:21] C:\DOCUME~1\CHRIST~1\APPLIC~1\Sonic
   [08/12/2005|23:47] C:\DOCUME~1\CHRIST~1\APPLIC~1\Sun
   [14/12/2005|12:33] C:\DOCUME~1\CHRIST~1\APPLIC~1\Template
   [14/12/2008|15:51] C:\DOCUME~1\CHRIST~1\APPLIC~1\uTorrent
   [13/11/2008|11:31] C:\DOCUME~1\CHRIST~1\APPLIC~1\WinRAR
   [08/12/2005|23:53] C:\DOCUME~1\CHRIST~1\APPLIC~1\You've Got Pictures Screensaver

   [20/08/2004|11:41] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [08/12/2005|23:55] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Jasc Software Inc
   [20/08/2004|11:30] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
   [08/12/2005|23:47] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Sun
   [08/12/2005|23:53] C:\DOCUME~1\DEFAUL~1\APPLIC~1\You've Got Pictures Screensaver


   [30/08/2008|23:05] C:\DOCUME~1\LOCALS~1\APPLIC~1\agi
   [21/02/2007|09:52] C:\DOCUME~1\LOCALS~1\APPLIC~1\Macromedia
   [21/02/2007|09:52] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
   [20/12/2008|18:39] C:\DOCUME~1\LOCALS~1\APPLIC~1\SACore

   [08/04/2008|10:49] C:\DOCUME~1\LA4770~1\APPLIC~1\Adobe
   [01/04/2006|14:56] C:\DOCUME~1\LA4770~1\APPLIC~1\AdobeUM
   [30/12/2005|12:10] C:\DOCUME~1\LA4770~1\APPLIC~1\CyberLink
   [25/01/2006|11:43] C:\DOCUME~1\LA4770~1\APPLIC~1\eConf
   [10/03/2006|19:53] C:\DOCUME~1\LA4770~1\APPLIC~1\HbTools
   [11/02/2006|15:09] C:\DOCUME~1\LA4770~1\APPLIC~1\Help
   [20/08/2004|11:41] C:\DOCUME~1\LA4770~1\APPLIC~1\Identities
   [08/12/2005|23:55] C:\DOCUME~1\LA4770~1\APPLIC~1\Jasc Software Inc
   [30/12/2005|12:09] C:\DOCUME~1\LA4770~1\APPLIC~1\Leadertech
   [08/01/2006|15:52] C:\DOCUME~1\LA4770~1\APPLIC~1\Macromedia
   [13/05/2006|13:39] C:\DOCUME~1\LA4770~1\APPLIC~1\Microsoft
   [18/12/2008|19:41] C:\DOCUME~1\LA4770~1\APPLIC~1\OpenOffice.org
   [30/12/2005|12:10] C:\DOCUME~1\LA4770~1\APPLIC~1\Sonic
   [08/12/2005|23:47] C:\DOCUME~1\LA4770~1\APPLIC~1\Sun
   [13/05/2006|13:39] C:\DOCUME~1\LA4770~1\APPLIC~1\Template
   [17/12/2007|07:05] C:\DOCUME~1\LA4770~1\APPLIC~1\Viewpoint
   [08/12/2005|23:53] C:\DOCUME~1\LA4770~1\APPLIC~1\You've Got Pictures Screensaver

   [05/03/2008|12:38] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

   [11/06/2008|18:29] C:\DOCUME~1\Pierre\APPLIC~1\Adobe
   [14/07/2006|11:53] C:\DOCUME~1\Pierre\APPLIC~1\AdobeUM
   [10/03/2006|23:04] C:\DOCUME~1\Pierre\APPLIC~1\HbTools
   [20/08/2004|11:41] C:\DOCUME~1\Pierre\APPLIC~1\Identities
   [14/07/2006|21:37] C:\DOCUME~1\Pierre\APPLIC~1\Image Zone Express
   [08/12/2005|23:55] C:\DOCUME~1\Pierre\APPLIC~1\Jasc Software Inc
   [17/01/2006|18:31] C:\DOCUME~1\Pierre\APPLIC~1\Leadertech
   [17/01/2006|18:22] C:\DOCUME~1\Pierre\APPLIC~1\Macromedia
   [23/09/2006|15:54] C:\DOCUME~1\Pierre\APPLIC~1\Microsoft
   [17/01/2006|18:31] C:\DOCUME~1\Pierre\APPLIC~1\Sonic
   [08/12/2005|23:47] C:\DOCUME~1\Pierre\APPLIC~1\Sun
   [23/09/2006|15:54] C:\DOCUME~1\Pierre\APPLIC~1\Template
   [08/12/2005|23:53] C:\DOCUME~1\Pierre\APPLIC~1\You've Got Pictures Screensaver

   [17/12/2005|19:10] C:\DOCUME~1\PROPRI~1\APPLIC~1\You've Got Pictures Screensaver

   [20/09/2008|18:58] C:\DOCUME~1\Thomas\APPLIC~1\Adobe
   [14/07/2006|12:59] C:\DOCUME~1\Thomas\APPLIC~1\AdobeUM
   [10/03/2006|23:06] C:\DOCUME~1\Thomas\APPLIC~1\HbTools
   [20/08/2004|11:41] C:\DOCUME~1\Thomas\APPLIC~1\Identities
   [08/12/2005|23:55] C:\DOCUME~1\Thomas\APPLIC~1\Jasc Software Inc
   [02/04/2006|13:24] C:\DOCUME~1\Thomas\APPLIC~1\Macromedia
   [28/06/2007|12:15] C:\DOCUME~1\Thomas\APPLIC~1\Microsoft
   [08/12/2005|23:47] C:\DOCUME~1\Thomas\APPLIC~1\Sun
   [02/04/2006|13:28] C:\DOCUME~1\Thomas\APPLIC~1\Template
   [08/12/2005|23:53] C:\DOCUME~1\Thomas\APPLIC~1\You've Got Pictures Screensaver
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [20/12/2008 23:00][--a------] C:\WINDOWS	asks
bepjrra.job
   [15/12/2008 01:00][--a------] C:\WINDOWS	asks\McDefragTask.job
   [01/12/2008 09:51][--a------] C:\WINDOWS	asks\McQcTask.job
   [20/12/2008 23:00][--ah-----] C:\WINDOWS	asks\AFA47E82916BF56E.job
   [14/12/2005 23:45][--a------] C:\WINDOWS	asks\Rappel d'abonnement 1 auprŠs de l'ISP.job
   [20/12/2008 22:38][--ah-----] C:\WINDOWS	asks\SA.DAT
   [05/08/2004 13:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   ( AFA47E82916BF56E.job )=( c:\docume~1\christ~1\applic~1\compon~1\faceloudsecond.exe )

   --------------------\  Listing des dossiers dans C:\Program Files

   [25/02/2006|19:44] C:\Program Files\3ivx
   [06/02/2006|14:49] C:\Program Files\Adobe
   [25/02/2006|20:45] C:\Program Files\Anti-Blaxx
   [08/12/2005|23:51] C:\Program Files\ATI Technologies
   [19/12/2008|10:27] C:\Program Files\CCleaner
   [12/02/2006|21:02] C:\Program Files\Comp online active
   [20/08/2004|11:35] C:\Program Files\ComPlus Applications
   [08/12/2005|23:51] C:\Program Files\CyberLink
   [08/12/2005|23:55] C:\Program Files\Dell
   [08/12/2005|23:55] C:\Program Files\Dell Inc
   [25/02/2006|19:42] C:\Program Files\DivX
   [25/02/2006|20:27] C:\Program Files\D-Tools
   [29/12/2006|13:12] C:\Program Files\DVD Shrink
   [04/08/2008|12:46] C:\Program Files\eMule
   [18/12/2008|12:32] C:\Program Files\Fichiers communs
   [28/01/2006|19:10] C:\Program Files\Google
   [14/07/2006|21:05] C:\Program Files\HP
   [10/02/2006|21:18] C:\Program Files\IncrediMail
   [09/03/2008|17:53] C:\Program Files\InstallShield Installation Information
   [08/12/2005|23:50] C:\Program Files\Intel
   [19/10/2008|12:18] C:\Program Files\Internet Explorer
   [06/04/2006|10:24] C:\Program Files\Inventel
   [08/12/2005|23:55] C:\Program Files\Jasc Software Inc
   [03/12/2008|08:31] C:\Program Files\Java
   [12/11/2008|18:04] C:\Program Files\JRE
   [30/08/2008|23:05] C:\Program Files\Kiwee Toolbar2
   [08/12/2005|23:53] C:\Program Files\Learn2.com
   [27/01/2006|13:24] C:\Program Files\Livecom
   [23/09/2008|17:47] C:\Program Files\Macrogaming
   [19/12/2008|22:23] C:\Program Files\Malwarebytes' Anti-Malware
   [18/12/2008|11:28] C:\Program Files\McAfee
   [27/04/2007|23:39] C:\Program Files\McAfee.com
   [17/08/2008|12:25] C:\Program Files\Messenger
   [07/10/2007|22:00] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [20/08/2004|11:37] C:\Program Files\microsoft frontpage
   [10/10/2006|14:46] C:\Program Files\Microsoft Office
   [05/03/2008|12:26] C:\Program Files\Microsoft SQL Server Compact Edition
   [08/12/2005|23:52] C:\Program Files\Microsoft Works
   [17/01/2006|18:26] C:\Program Files\Mindscape
   [27/07/2008|12:01] C:\Program Files\Movie Maker
   [27/04/2007|23:37] C:\Program Files\Mozilla Firefox
   [05/03/2008|12:32] C:\Program Files\MSN
   [19/02/2006|20:46] C:\Program Files\MSN Games
   [20/08/2004|11:34] C:\Program Files\MSN Gaming Zone
   [05/03/2008|12:33] C:\Program Files\MSN Messenger
   [18/11/2006|23:01] C:\Program Files\MSXML 4.0
   [25/02/2006|19:42] C:\Program Files\MUSK Codec Pack v5
   [22/01/2006|11:32] C:\Program Files\Nathan
   [07/12/2008|12:44] C:\Program Files\Navilog1
   [27/07/2008|11:58] C:\Program Files\NetMeeting
   [23/02/2007|11:16] C:\Program Files\NewSoft
   [23/11/2006|18:12] C:\Program Files\Odebit Multim‚dia
   [25/02/2006|19:58] C:\Program Files\On2 Technologies
   [20/08/2004|11:34] C:\Program Files\Online Services
   [12/11/2008|18:04] C:\Program Files\OpenOffice.org 3
   [27/07/2008|11:58] C:\Program Files\Outlook Express
   [25/02/2006|19:44] C:\Program Files\QuickTime
   [13/11/2008|11:03] C:\Program Files\QuickZip4
   [08/12/2005|23:52] C:\Program Files\Real
   [25/02/2006|20:32] C:\Program Files\Sierra On-Line
   [08/12/2005|23:48] C:\Program Files\Sigmatel
   [08/12/2005|23:55] C:\Program Files\Sonic
   [25/02/2006|19:36] C:\Program Files\Spybot - Search & Destroy
   [23/11/2006|17:04] C:\Program Files\Ubisoft
   [20/08/2004|11:41] C:\Program Files\Uninstall Information
   [30/09/2008|15:32] C:\Program Files\uTorrent
   [08/12/2005|23:53] C:\Program Files\Viewpoint
   [25/02/2006|22:52] C:\Program Files\vtplus
   [20/12/2008|23:33] C:\Program Files\Wanadoo
   [08/12/2005|23:56] C:\Program Files\Wanadoo Europe
   [10/03/2006|20:03] C:\Program Files\Webtarot
   [13/12/2008|18:25] C:\Program Files\Windows Live
   [12/09/2008|17:24] C:\Program Files\Windows Live Safety Center
   [07/12/2008|14:01] C:\Program Files\Windows Media Connect 2
   [27/07/2008|11:58] C:\Program Files\Windows Media Player
   [27/07/2008|11:58] C:\Program Files\Windows NT
   [20/08/2004|11:35] C:\Program Files\WindowsUpdate
   [13/11/2008|11:30] C:\Program Files\WinRAR
   [25/02/2006|22:53] C:\Program Files\WinTV
   [23/11/2006|16:55] C:\Program Files\XBox 360 Controller for Windows Software
   [20/08/2004|11:37] C:\Program Files\xerox
   [25/02/2006|19:44] C:\Program Files\XviD
   [10/03/2006|20:04] C:\Program Files\Yahoo!

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [14/07/2008|09:22] C:\Program Files\Fichiers communs\Adobe
   [14/02/2006|17:34] C:\Program Files\Fichiers communs\AOL
   [25/02/2006|20:47] C:\Program Files\Fichiers communs\DirectX
   [31/03/2006|20:20] C:\Program Files\Fichiers communs\ErrorSafe
   [14/12/2005|21:24] C:\Program Files\Fichiers communs\Hewlett-Packard
   [14/07/2006|21:05] C:\Program Files\Fichiers communs\HP
   [25/01/2006|16:26] C:\Program Files\Fichiers communs\InstallShield
   [08/12/2005|23:55] C:\Program Files\Fichiers communs\Jasc Software Inc
   [08/12/2005|23:47] C:\Program Files\Fichiers communs\Java
   [18/02/2006|18:25] C:\Program Files\Fichiers communs\Logitech
   [06/02/2008|11:07] C:\Program Files\Fichiers communs\McAfee
   [13/12/2008|18:31] C:\Program Files\Fichiers communs\Microsoft Shared
   [20/08/2004|11:35] C:\Program Files\Fichiers communs\MSSoap
   [23/02/2007|11:16] C:\Program Files\Fichiers communs\NewSoft
   [08/12/2005|23:53] C:\Program Files\Fichiers communs\Nullsoft
   [20/08/2004|11:30] C:\Program Files\Fichiers communs\ODBC
   [08/12/2005|23:52] C:\Program Files\Fichiers communs\Real
   [20/08/2004|11:35] C:\Program Files\Fichiers communs\Services
   [08/12/2005|23:56] C:\Program Files\Fichiers communs\Sonic Shared
   [20/08/2004|11:30] C:\Program Files\Fichiers communs\SpeechEngines
   [27/07/2008|11:58] C:\Program Files\Fichiers communs\System
   [08/12/2005|23:54] C:\Program Files\Fichiers communs\TiVo Shared
   [05/03/2008|10:58] C:\Program Files\Fichiers communs\WindowsLiveInstaller

   --------------------\  Process

   ( 63 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\DOCUME~1\CHRIST~1\APPLIC~1\compon~1
   C:\Program Files\compon~1
   C:\DOCUME~1\CHRIST~1\Cookies\christelle@advertising[2].txt
   C:\WINDOWS\Tasks\AFA47E82916BF56E.job
 
   --------------------\  Verification du Registre

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
   "window bin"="C:\DOCUME~1\CHRIST~1\APPLIC~1\COMPON~1\dupesoftwaregrim.exe"

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-12-20 23:38:18
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 176
 
   --------------------\  Recherche d'autres infections

   C:\WINDOWS\system32\HNXIRBeg.ini2
   C:\WINDOWS\system32\iOYFOqss.ini
   C:\WINDOWS\system32\iOYFOqss.ini2
   C:\WINDOWS\system32
qrCeMoq.ini
   C:\WINDOWS\system32
qrCeMoq.ini2
   C:\WINDOWS\system32\pWGNnXyb.ini
   C:\WINDOWS\system32\pWGNnXyb.ini2
   [b]==> VUNDO <==/b
 
   --------------------\  ROGUES ..

   C:\PROGRA~1\FICHIE~1\ErrorSafe



   [F:6][D:2]-> C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp
   [F:73][D:0]-> C:\DOCUME~1\CHRIST~1\Cookies
   [F:1052][D:8]-> C:\DOCUME~1\CHRIST~1\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 20/12/2008|23:39 - Option : [1]

   --------------------\  Fin du rapport a 23:39:36

jorginho67 · Answer

Ouvre le Dossier Lop S&D et double clique sur Scan.bat ( le .bat peut ne pas apparaitre )
 
Au menu , tape 2 ( Suppression ) et valide  
Ne ferme pas la fenêtre lors de la suppression
 
Poste le rapport généré  
( il se trouve aussi dans le dossier Lop S&D et se nomme Rapport-Lop.txt )
 
( Si le Bureau ne réapparît pas presse Ctrl + Alt + Suppr , Onglet Fichier , Nouvelle tâche , tape explorer et valide )
  

Reposte moi un rapport HJT stp...

christel · Answer

Bonjour,
je voulai vous dire que je n'ai plus les fenetres grise de preload dell intaller tout a l'aire de bien fonctionner. Mon ordi et rapide comme avant. J'aimerai savoir ce qu'il a et avait ? C'est aussi prendre des risques que de vous  confiance et ce n'est pas dans mes habitudes . Mais  mille mercis, j'y connais rien du tout et c'est pas facile toutes ces manipes  tout cas je vous joins encore un rapport qui me parles pas du tout ! lol ! 


--------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) 4 CPU 3.20GHz )
   BIOS : Phoenix ROM BIOS PLUS Version 1.10 A02
   USER : Christelle ( Administrator )
   BOOT : Normal boot
   Antivirus : McAfee VirusScan  (Activated)
   Firewall  : McAfee Personal Firewall  (Activated)
   C:\ (Local Disk) - NTFS - Total:229 Go (Free:185 Go)
   D:\ (CD or DVD)
   E:\ (CD or DVD)
   G:\ (USB)
   H:\ (USB)
   I:\ (USB)
   J:\ (USB)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [2] ( 21/12/2008|20:18 )


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\WINDOWS\Tasks\AFA47E82916BF56E.job 
   Supprime! - C:\DOCUME~1\CHRIST~1\APPLIC~1\compon~1
   Supprime! - C:\Program Files\compon~1
 
   \\\\\\\\\\\\\\\ 

   Supprime! - C:\Program Files\Viewpoint
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
 
   \\\\\\\\\\\\\\\

 
   --------------------\  Listing des dossiers dans APPLIC~1

   [20/08/2004|11:41] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
   [08/12/2005|23:55] C:\DOCUME~1\ADMINI~1\APPLIC~1\Jasc Software Inc
   [20/08/2004|11:30] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
   [08/12/2005|23:47] C:\DOCUME~1\ADMINI~1\APPLIC~1\Sun
   [08/12/2005|23:53] C:\DOCUME~1\ADMINI~1\APPLIC~1\You've Got Pictures Screensaver

   [14/07/2008|09:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [14/02/2006|17:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
   [30/12/2006|18:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
   [13/03/2006|12:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Fastwavelongfirst
   [14/12/2005|21:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP
   [08/12/2005|23:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
   [19/12/2008|21:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
   [31/10/2008|09:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
   [27/04/2007|23:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee.com
   [05/03/2008|10:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [10/02/2006|21:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\pixelStorm
   [26/11/2006|14:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\POPWWPROFILES
   [06/01/2006|14:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Prism
   [25/02/2006|19:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
   [20/08/2004|11:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
   [11/10/2008|09:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SiteAdvisor
   [25/02/2006|19:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [23/09/2008|17:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM
   [13/12/2008|12:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
   [25/02/2006|20:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [13/12/2008|18:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

   [13/07/2008|09:58] C:\DOCUME~1\CHRIST~1\APPLIC~1\Adobe
   [14/07/2008|09:19] C:\DOCUME~1\CHRIST~1\APPLIC~1\AdobeUM
   [30/08/2008|23:05] C:\DOCUME~1\CHRIST~1\APPLIC~1\agi
   [14/12/2005|20:12] C:\DOCUME~1\CHRIST~1\APPLIC~1\CyberLink
   [20/01/2006|13:32] C:\DOCUME~1\CHRIST~1\APPLIC~1\eConf
   [28/01/2006|18:47] C:\DOCUME~1\CHRIST~1\APPLIC~1\Google
   [08/03/2006|09:17] C:\DOCUME~1\CHRIST~1\APPLIC~1\HbTools
   [05/01/2006|20:07] C:\DOCUME~1\CHRIST~1\APPLIC~1\Help
   [10/05/2006|18:29] C:\DOCUME~1\CHRIST~1\APPLIC~1\HP
   [20/08/2004|11:41] C:\DOCUME~1\CHRIST~1\APPLIC~1\Identities
   [14/04/2008|15:03] C:\DOCUME~1\CHRIST~1\APPLIC~1\Image Zone Express
   [19/01/2006|19:32] C:\DOCUME~1\CHRIST~1\APPLIC~1\Jasc Software Inc
   [05/02/2006|20:21] C:\DOCUME~1\CHRIST~1\APPLIC~1\Leadertech
   [06/03/2006|21:29] C:\DOCUME~1\CHRIST~1\APPLIC~1\Macromedia
   [19/12/2008|21:56] C:\DOCUME~1\CHRIST~1\APPLIC~1\Malwarebytes
   [13/12/2008|13:46] C:\DOCUME~1\CHRIST~1\APPLIC~1\Microsoft
   [20/01/2006|14:32] C:\DOCUME~1\CHRIST~1\APPLIC~1\MSNInstaller
   [13/03/2006|12:50] C:\DOCUME~1\CHRIST~1\APPLIC~1\OneEggs
   [12/11/2008|18:08] C:\DOCUME~1\CHRIST~1\APPLIC~1\OpenOffice.org
   [22/02/2008|22:10] C:\DOCUME~1\CHRIST~1\APPLIC~1\PlayFirst
   [05/02/2006|20:21] C:\DOCUME~1\CHRIST~1\APPLIC~1\Sonic
   [08/12/2005|23:47] C:\DOCUME~1\CHRIST~1\APPLIC~1\Sun
   [14/12/2005|12:33] C:\DOCUME~1\CHRIST~1\APPLIC~1\Template
   [14/12/2008|15:51] C:\DOCUME~1\CHRIST~1\APPLIC~1\uTorrent
   [13/11/2008|11:31] C:\DOCUME~1\CHRIST~1\APPLIC~1\WinRAR
   [08/12/2005|23:53] C:\DOCUME~1\CHRIST~1\APPLIC~1\You've Got Pictures Screensaver

   [20/08/2004|11:41] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [08/12/2005|23:55] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Jasc Software Inc
   [20/08/2004|11:30] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
   [08/12/2005|23:47] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Sun
   [08/12/2005|23:53] C:\DOCUME~1\DEFAUL~1\APPLIC~1\You've Got Pictures Screensaver


   [30/08/2008|23:05] C:\DOCUME~1\LOCALS~1\APPLIC~1\agi
   [21/02/2007|09:52] C:\DOCUME~1\LOCALS~1\APPLIC~1\Macromedia
   [21/02/2007|09:52] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
   [20/12/2008|18:39] C:\DOCUME~1\LOCALS~1\APPLIC~1\SACore

   [08/04/2008|10:49] C:\DOCUME~1\LA4770~1\APPLIC~1\Adobe
   [01/04/2006|14:56] C:\DOCUME~1\LA4770~1\APPLIC~1\AdobeUM
   [30/12/2005|12:10] C:\DOCUME~1\LA4770~1\APPLIC~1\CyberLink
   [25/01/2006|11:43] C:\DOCUME~1\LA4770~1\APPLIC~1\eConf
   [10/03/2006|19:53] C:\DOCUME~1\LA4770~1\APPLIC~1\HbTools
   [11/02/2006|15:09] C:\DOCUME~1\LA4770~1\APPLIC~1\Help
   [20/08/2004|11:41] C:\DOCUME~1\LA4770~1\APPLIC~1\Identities
   [08/12/2005|23:55] C:\DOCUME~1\LA4770~1\APPLIC~1\Jasc Software Inc
   [30/12/2005|12:09] C:\DOCUME~1\LA4770~1\APPLIC~1\Leadertech
   [08/01/2006|15:52] C:\DOCUME~1\LA4770~1\APPLIC~1\Macromedia
   [13/05/2006|13:39] C:\DOCUME~1\LA4770~1\APPLIC~1\Microsoft
   [18/12/2008|19:41] C:\DOCUME~1\LA4770~1\APPLIC~1\OpenOffice.org
   [30/12/2005|12:10] C:\DOCUME~1\LA4770~1\APPLIC~1\Sonic
   [08/12/2005|23:47] C:\DOCUME~1\LA4770~1\APPLIC~1\Sun
   [13/05/2006|13:39] C:\DOCUME~1\LA4770~1\APPLIC~1\Template
   [17/12/2007|07:05] C:\DOCUME~1\LA4770~1\APPLIC~1\Viewpoint
   [08/12/2005|23:53] C:\DOCUME~1\LA4770~1\APPLIC~1\You've Got Pictures Screensaver

   [05/03/2008|12:38] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

   [11/06/2008|18:29] C:\DOCUME~1\Pierre\APPLIC~1\Adobe
   [14/07/2006|11:53] C:\DOCUME~1\Pierre\APPLIC~1\AdobeUM
   [10/03/2006|23:04] C:\DOCUME~1\Pierre\APPLIC~1\HbTools
   [20/08/2004|11:41] C:\DOCUME~1\Pierre\APPLIC~1\Identities
   [14/07/2006|21:37] C:\DOCUME~1\Pierre\APPLIC~1\Image Zone Express
   [08/12/2005|23:55] C:\DOCUME~1\Pierre\APPLIC~1\Jasc Software Inc
   [17/01/2006|18:31] C:\DOCUME~1\Pierre\APPLIC~1\Leadertech
   [17/01/2006|18:22] C:\DOCUME~1\Pierre\APPLIC~1\Macromedia
   [23/09/2006|15:54] C:\DOCUME~1\Pierre\APPLIC~1\Microsoft
   [17/01/2006|18:31] C:\DOCUME~1\Pierre\APPLIC~1\Sonic
   [08/12/2005|23:47] C:\DOCUME~1\Pierre\APPLIC~1\Sun
   [23/09/2006|15:54] C:\DOCUME~1\Pierre\APPLIC~1\Template
   [08/12/2005|23:53] C:\DOCUME~1\Pierre\APPLIC~1\You've Got Pictures Screensaver

   [17/12/2005|19:10] C:\DOCUME~1\PROPRI~1\APPLIC~1\You've Got Pictures Screensaver

   [20/09/2008|18:58] C:\DOCUME~1\Thomas\APPLIC~1\Adobe
   [14/07/2006|12:59] C:\DOCUME~1\Thomas\APPLIC~1\AdobeUM
   [10/03/2006|23:06] C:\DOCUME~1\Thomas\APPLIC~1\HbTools
   [20/08/2004|11:41] C:\DOCUME~1\Thomas\APPLIC~1\Identities
   [08/12/2005|23:55] C:\DOCUME~1\Thomas\APPLIC~1\Jasc Software Inc
   [02/04/2006|13:24] C:\DOCUME~1\Thomas\APPLIC~1\Macromedia
   [28/06/2007|12:15] C:\DOCUME~1\Thomas\APPLIC~1\Microsoft
   [08/12/2005|23:47] C:\DOCUME~1\Thomas\APPLIC~1\Sun
   [02/04/2006|13:28] C:\DOCUME~1\Thomas\APPLIC~1\Template
   [08/12/2005|23:53] C:\DOCUME~1\Thomas\APPLIC~1\You've Got Pictures Screensaver
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [20/12/2008 23:00][--a------] C:\WINDOWS	asks
bepjrra.job
   [15/12/2008 01:00][--a------] C:\WINDOWS	asks\McDefragTask.job
   [01/12/2008 09:51][--a------] C:\WINDOWS	asks\McQcTask.job
   [14/12/2005 23:45][--a------] C:\WINDOWS	asks\Rappel d'abonnement 1 auprŠs de l'ISP.job
   [20/12/2008 22:38][--ah-----] C:\WINDOWS	asks\SA.DAT
   [05/08/2004 13:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [25/02/2006|19:44] C:\Program Files\3ivx
   [06/02/2006|14:49] C:\Program Files\Adobe
   [25/02/2006|20:45] C:\Program Files\Anti-Blaxx
   [08/12/2005|23:51] C:\Program Files\ATI Technologies
   [19/12/2008|10:27] C:\Program Files\CCleaner
   [20/08/2004|11:35] C:\Program Files\ComPlus Applications
   [08/12/2005|23:51] C:\Program Files\CyberLink
   [08/12/2005|23:55] C:\Program Files\Dell
   [08/12/2005|23:55] C:\Program Files\Dell Inc
   [25/02/2006|19:42] C:\Program Files\DivX
   [25/02/2006|20:27] C:\Program Files\D-Tools
   [29/12/2006|13:12] C:\Program Files\DVD Shrink
   [04/08/2008|12:46] C:\Program Files\eMule
   [18/12/2008|12:32] C:\Program Files\Fichiers communs
   [28/01/2006|19:10] C:\Program Files\Google
   [14/07/2006|21:05] C:\Program Files\HP
   [10/02/2006|21:18] C:\Program Files\IncrediMail
   [09/03/2008|17:53] C:\Program Files\InstallShield Installation Information
   [08/12/2005|23:50] C:\Program Files\Intel
   [19/10/2008|12:18] C:\Program Files\Internet Explorer
   [06/04/2006|10:24] C:\Program Files\Inventel
   [08/12/2005|23:55] C:\Program Files\Jasc Software Inc
   [03/12/2008|08:31] C:\Program Files\Java
   [12/11/2008|18:04] C:\Program Files\JRE
   [30/08/2008|23:05] C:\Program Files\Kiwee Toolbar2
   [08/12/2005|23:53] C:\Program Files\Learn2.com
   [27/01/2006|13:24] C:\Program Files\Livecom
   [23/09/2008|17:47] C:\Program Files\Macrogaming
   [19/12/2008|22:23] C:\Program Files\Malwarebytes' Anti-Malware
   [18/12/2008|11:28] C:\Program Files\McAfee
   [27/04/2007|23:39] C:\Program Files\McAfee.com
   [17/08/2008|12:25] C:\Program Files\Messenger
   [07/10/2007|22:00] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [20/08/2004|11:37] C:\Program Files\microsoft frontpage
   [10/10/2006|14:46] C:\Program Files\Microsoft Office
   [05/03/2008|12:26] C:\Program Files\Microsoft SQL Server Compact Edition
   [08/12/2005|23:52] C:\Program Files\Microsoft Works
   [17/01/2006|18:26] C:\Program Files\Mindscape
   [27/07/2008|12:01] C:\Program Files\Movie Maker
   [27/04/2007|23:37] C:\Program Files\Mozilla Firefox
   [05/03/2008|12:32] C:\Program Files\MSN
   [19/02/2006|20:46] C:\Program Files\MSN Games
   [20/08/2004|11:34] C:\Program Files\MSN Gaming Zone
   [05/03/2008|12:33] C:\Program Files\MSN Messenger
   [18/11/2006|23:01] C:\Program Files\MSXML 4.0
   [25/02/2006|19:42] C:\Program Files\MUSK Codec Pack v5
   [22/01/2006|11:32] C:\Program Files\Nathan
   [07/12/2008|12:44] C:\Program Files\Navilog1
   [27/07/2008|11:58] C:\Program Files\NetMeeting
   [23/02/2007|11:16] C:\Program Files\NewSoft
   [23/11/2006|18:12] C:\Program Files\Odebit Multim‚dia
   [25/02/2006|19:58] C:\Program Files\On2 Technologies
   [20/08/2004|11:34] C:\Program Files\Online Services
   [12/11/2008|18:04] C:\Program Files\OpenOffice.org 3
   [27/07/2008|11:58] C:\Program Files\Outlook Express
   [25/02/2006|19:44] C:\Program Files\QuickTime
   [13/11/2008|11:03] C:\Program Files\QuickZip4
   [08/12/2005|23:52] C:\Program Files\Real
   [25/02/2006|20:32] C:\Program Files\Sierra On-Line
   [08/12/2005|23:48] C:\Program Files\Sigmatel
   [08/12/2005|23:55] C:\Program Files\Sonic
   [25/02/2006|19:36] C:\Program Files\Spybot - Search & Destroy
   [23/11/2006|17:04] C:\Program Files\Ubisoft
   [20/08/2004|11:41] C:\Program Files\Uninstall Information
   [30/09/2008|15:32] C:\Program Files\uTorrent
   [25/02/2006|22:52] C:\Program Files\vtplus
   [21/12/2008|10:49] C:\Program Files\Wanadoo
   [08/12/2005|23:56] C:\Program Files\Wanadoo Europe
   [10/03/2006|20:03] C:\Program Files\Webtarot
   [13/12/2008|18:25] C:\Program Files\Windows Live
   [12/09/2008|17:24] C:\Program Files\Windows Live Safety Center
   [07/12/2008|14:01] C:\Program Files\Windows Media Connect 2
   [27/07/2008|11:58] C:\Program Files\Windows Media Player
   [27/07/2008|11:58] C:\Program Files\Windows NT
   [20/08/2004|11:35] C:\Program Files\WindowsUpdate
   [13/11/2008|11:30] C:\Program Files\WinRAR
   [25/02/2006|22:53] C:\Program Files\WinTV
   [23/11/2006|16:55] C:\Program Files\XBox 360 Controller for Windows Software
   [20/08/2004|11:37] C:\Program Files\xerox
   [25/02/2006|19:44] C:\Program Files\XviD
   [10/03/2006|20:04] C:\Program Files\Yahoo!

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [14/07/2008|09:22] C:\Program Files\Fichiers communs\Adobe
   [14/02/2006|17:34] C:\Program Files\Fichiers communs\AOL
   [25/02/2006|20:47] C:\Program Files\Fichiers communs\DirectX
   [31/03/2006|20:20] C:\Program Files\Fichiers communs\ErrorSafe
   [14/12/2005|21:24] C:\Program Files\Fichiers communs\Hewlett-Packard
   [14/07/2006|21:05] C:\Program Files\Fichiers communs\HP
   [25/01/2006|16:26] C:\Program Files\Fichiers communs\InstallShield
   [08/12/2005|23:55] C:\Program Files\Fichiers communs\Jasc Software Inc
   [08/12/2005|23:47] C:\Program Files\Fichiers communs\Java
   [18/02/2006|18:25] C:\Program Files\Fichiers communs\Logitech
   [06/02/2008|11:07] C:\Program Files\Fichiers communs\McAfee
   [13/12/2008|18:31] C:\Program Files\Fichiers communs\Microsoft Shared
   [20/08/2004|11:35] C:\Program Files\Fichiers communs\MSSoap
   [23/02/2007|11:16] C:\Program Files\Fichiers communs\NewSoft
   [08/12/2005|23:53] C:\Program Files\Fichiers communs\Nullsoft
   [20/08/2004|11:30] C:\Program Files\Fichiers communs\ODBC
   [08/12/2005|23:52] C:\Program Files\Fichiers communs\Real
   [20/08/2004|11:35] C:\Program Files\Fichiers communs\Services
   [08/12/2005|23:56] C:\Program Files\Fichiers communs\Sonic Shared
   [20/08/2004|11:30] C:\Program Files\Fichiers communs\SpeechEngines
   [27/07/2008|11:58] C:\Program Files\Fichiers communs\System
   [08/12/2005|23:54] C:\Program Files\Fichiers communs\TiVo Shared
   [05/03/2008|10:58] C:\Program Files\Fichiers communs\WindowsLiveInstaller

   --------------------\  Process

   ( 82 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\DOCUME~1\CHRIST~1\Cookies\christelle@advertising[1].txt
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-12-21 20:20:18
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 176
 
   --------------------\  Recherche d'autres infections

   C:\WINDOWS\system32\HNXIRBeg.ini2
   C:\WINDOWS\system32\iOYFOqss.ini
   C:\WINDOWS\system32\iOYFOqss.ini2
   C:\WINDOWS\system32
qrCeMoq.ini
   C:\WINDOWS\system32
qrCeMoq.ini2
   C:\WINDOWS\system32\pWGNnXyb.ini
   C:\WINDOWS\system32\pWGNnXyb.ini2
   [b]==> VUNDO <==/b
 
   --------------------\  ROGUES ..

   C:\PROGRA~1\FICHIE~1\ErrorSafe



   [F:21][D:5]-> C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp
   [F:104][D:0]-> C:\DOCUME~1\CHRIST~1\Cookies
   [F:2511][D:8]-> C:\DOCUME~1\CHRIST~1\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 20/12/2008|23:39 - Option : [1]
   2 - "C:\Lop SD\LopR_2.txt" - 21/12/2008|20:21 - Option : [2]

   --------------------\  Fin du rapport a 20:21:37

jorginho67 · Answer

Relance MBAM

 * Dans l'onglet analyse, vérifie que "Exécuter un examen RAPIDE" soit coché et clique sur le bouton Rechercher pour démarrer l'analyse.

MBAM analyse ton ordinateur. L'analyse peut prendre un certain temps. Il suffit de vérifier de temps en temps son avancement.

A la fin de l'analyse, un message s'affiche indiquant la fin de l'analyse. Clique sur OK pour poursuivre.

* Si des malwares ont été détectés, leur liste s'affiche.

Coche tous les éléments détectés par Malwarebytes' Anti-Malware puis clique sur Supprimer la sélection afin d'éradiquer les malwares détectés.
 /!\ (a faire impérativement sous peine de recommencer le scan) /!\  , MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.


MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Ferme le Bloc-notes. (Le rapport peut être retrouvé sous l'onglet Rapports/logs)

Ferme MBAM en cliquant sur Quitter.

Poste le rapport dans ta réponse 

Tutoriel
Un autre  si tu as besoin d'aide.

christel · Answer

j'avais rien a cocher 

Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1456
Windows 5.1.2600 Service Pack 3

21/12/2008 22:07:23
mbam-log-2008-12-21 (22-07-23).txt

Type de recherche: Examen rapide
Eléments examinés: 90452
Temps écoulé: 28 minute(s), 52 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

jorginho67 · Answer

1) Désactive ta "Restauration du système" puis réactive la.

(a) Désactivation
Clique droit sur le "Poste de travail" > Propriétés > onglet "Restauration du système" > coche la case " Désactiver la Restauration du système sur tous les lecteurs"
Appliquer . patiente jusqu a que cela soit marqué "désactivée" puis Ok.

(b) Activation
Suivre le même chemin ; décoche la case "Désactiver la Restauration du système sur tous les lecteurs"
Appliquer. attends que cela soit a nouveau sur "surveillance" puis Ok. Redémarre l'ordinateur !

Tu as ici un tutoriel en cas de doute.


2) Relance LOP SD puis choisis l'option 1 (Recherche)
* Patiente jusqu'à la fin du scan
* Poste le rapport généré qui se trouve ici => (C:\lopR.txt)

(Si le Bureau ne réapparait pas, presse Ctrl+Alt+Suppr, Onglet Fichier, Nouvelle tâche, tape explorer.exe et valide)

christel · Answer

--------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) 4 CPU 3.20GHz )
   BIOS : Phoenix ROM BIOS PLUS Version 1.10 A02
   USER : Christelle ( Administrator )
   BOOT : Normal boot
   Antivirus : McAfee VirusScan  (Activated)
   Firewall  : McAfee Personal Firewall  (Activated)
   C:\ (Local Disk) - NTFS - Total:229 Go (Free:186 Go)
   D:\ (CD or DVD)
   E:\ (CD or DVD)
   G:\ (USB)
   H:\ (USB)
   I:\ (USB)
   J:\ (USB)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [1] ( 21/12/2008|22:52 )
 
   --------------------\  Listing des dossiers dans APPLIC~1

   [20/08/2004|11:41] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
   [08/12/2005|23:55] C:\DOCUME~1\ADMINI~1\APPLIC~1\Jasc Software Inc
   [20/08/2004|11:30] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
   [08/12/2005|23:47] C:\DOCUME~1\ADMINI~1\APPLIC~1\Sun
   [08/12/2005|23:53] C:\DOCUME~1\ADMINI~1\APPLIC~1\You've Got Pictures Screensaver

   [14/07/2008|09:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [14/02/2006|17:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
   [30/12/2006|18:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
   [13/03/2006|12:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Fastwavelongfirst
   [14/12/2005|21:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP
   [08/12/2005|23:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
   [19/12/2008|21:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
   [31/10/2008|09:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
   [27/04/2007|23:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee.com
   [05/03/2008|10:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [10/02/2006|21:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\pixelStorm
   [26/11/2006|14:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\POPWWPROFILES
   [06/01/2006|14:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Prism
   [25/02/2006|19:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
   [20/08/2004|11:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
   [11/10/2008|09:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SiteAdvisor
   [25/02/2006|19:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [23/09/2008|17:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM
   [13/12/2008|12:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
   [25/02/2006|20:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [13/12/2008|18:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

   [13/07/2008|09:58] C:\DOCUME~1\CHRIST~1\APPLIC~1\Adobe
   [14/07/2008|09:19] C:\DOCUME~1\CHRIST~1\APPLIC~1\AdobeUM
   [30/08/2008|23:05] C:\DOCUME~1\CHRIST~1\APPLIC~1\agi
   [14/12/2005|20:12] C:\DOCUME~1\CHRIST~1\APPLIC~1\CyberLink
   [20/01/2006|13:32] C:\DOCUME~1\CHRIST~1\APPLIC~1\eConf
   [28/01/2006|18:47] C:\DOCUME~1\CHRIST~1\APPLIC~1\Google
   [08/03/2006|09:17] C:\DOCUME~1\CHRIST~1\APPLIC~1\HbTools
   [05/01/2006|20:07] C:\DOCUME~1\CHRIST~1\APPLIC~1\Help
   [10/05/2006|18:29] C:\DOCUME~1\CHRIST~1\APPLIC~1\HP
   [20/08/2004|11:41] C:\DOCUME~1\CHRIST~1\APPLIC~1\Identities
   [14/04/2008|15:03] C:\DOCUME~1\CHRIST~1\APPLIC~1\Image Zone Express
   [19/01/2006|19:32] C:\DOCUME~1\CHRIST~1\APPLIC~1\Jasc Software Inc
   [05/02/2006|20:21] C:\DOCUME~1\CHRIST~1\APPLIC~1\Leadertech
   [06/03/2006|21:29] C:\DOCUME~1\CHRIST~1\APPLIC~1\Macromedia
   [19/12/2008|21:56] C:\DOCUME~1\CHRIST~1\APPLIC~1\Malwarebytes
   [13/12/2008|13:46] C:\DOCUME~1\CHRIST~1\APPLIC~1\Microsoft
   [20/01/2006|14:32] C:\DOCUME~1\CHRIST~1\APPLIC~1\MSNInstaller
   [13/03/2006|12:50] C:\DOCUME~1\CHRIST~1\APPLIC~1\OneEggs
   [12/11/2008|18:08] C:\DOCUME~1\CHRIST~1\APPLIC~1\OpenOffice.org
   [22/02/2008|22:10] C:\DOCUME~1\CHRIST~1\APPLIC~1\PlayFirst
   [05/02/2006|20:21] C:\DOCUME~1\CHRIST~1\APPLIC~1\Sonic
   [08/12/2005|23:47] C:\DOCUME~1\CHRIST~1\APPLIC~1\Sun
   [14/12/2005|12:33] C:\DOCUME~1\CHRIST~1\APPLIC~1\Template
   [14/12/2008|15:51] C:\DOCUME~1\CHRIST~1\APPLIC~1\uTorrent
   [13/11/2008|11:31] C:\DOCUME~1\CHRIST~1\APPLIC~1\WinRAR
   [08/12/2005|23:53] C:\DOCUME~1\CHRIST~1\APPLIC~1\You've Got Pictures Screensaver

   [20/08/2004|11:41] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [08/12/2005|23:55] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Jasc Software Inc
   [20/08/2004|11:30] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
   [08/12/2005|23:47] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Sun
   [08/12/2005|23:53] C:\DOCUME~1\DEFAUL~1\APPLIC~1\You've Got Pictures Screensaver


   [30/08/2008|23:05] C:\DOCUME~1\LOCALS~1\APPLIC~1\agi
   [21/02/2007|09:52] C:\DOCUME~1\LOCALS~1\APPLIC~1\Macromedia
   [21/02/2007|09:52] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
   [20/12/2008|18:39] C:\DOCUME~1\LOCALS~1\APPLIC~1\SACore

   [08/04/2008|10:49] C:\DOCUME~1\LA4770~1\APPLIC~1\Adobe
   [01/04/2006|14:56] C:\DOCUME~1\LA4770~1\APPLIC~1\AdobeUM
   [30/12/2005|12:10] C:\DOCUME~1\LA4770~1\APPLIC~1\CyberLink
   [25/01/2006|11:43] C:\DOCUME~1\LA4770~1\APPLIC~1\eConf
   [10/03/2006|19:53] C:\DOCUME~1\LA4770~1\APPLIC~1\HbTools
   [11/02/2006|15:09] C:\DOCUME~1\LA4770~1\APPLIC~1\Help
   [20/08/2004|11:41] C:\DOCUME~1\LA4770~1\APPLIC~1\Identities
   [08/12/2005|23:55] C:\DOCUME~1\LA4770~1\APPLIC~1\Jasc Software Inc
   [30/12/2005|12:09] C:\DOCUME~1\LA4770~1\APPLIC~1\Leadertech
   [08/01/2006|15:52] C:\DOCUME~1\LA4770~1\APPLIC~1\Macromedia
   [13/05/2006|13:39] C:\DOCUME~1\LA4770~1\APPLIC~1\Microsoft
   [18/12/2008|19:41] C:\DOCUME~1\LA4770~1\APPLIC~1\OpenOffice.org
   [30/12/2005|12:10] C:\DOCUME~1\LA4770~1\APPLIC~1\Sonic
   [08/12/2005|23:47] C:\DOCUME~1\LA4770~1\APPLIC~1\Sun
   [13/05/2006|13:39] C:\DOCUME~1\LA4770~1\APPLIC~1\Template
   [17/12/2007|07:05] C:\DOCUME~1\LA4770~1\APPLIC~1\Viewpoint
   [08/12/2005|23:53] C:\DOCUME~1\LA4770~1\APPLIC~1\You've Got Pictures Screensaver

   [05/03/2008|12:38] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

   [11/06/2008|18:29] C:\DOCUME~1\Pierre\APPLIC~1\Adobe
   [14/07/2006|11:53] C:\DOCUME~1\Pierre\APPLIC~1\AdobeUM
   [10/03/2006|23:04] C:\DOCUME~1\Pierre\APPLIC~1\HbTools
   [20/08/2004|11:41] C:\DOCUME~1\Pierre\APPLIC~1\Identities
   [14/07/2006|21:37] C:\DOCUME~1\Pierre\APPLIC~1\Image Zone Express
   [08/12/2005|23:55] C:\DOCUME~1\Pierre\APPLIC~1\Jasc Software Inc
   [17/01/2006|18:31] C:\DOCUME~1\Pierre\APPLIC~1\Leadertech
   [17/01/2006|18:22] C:\DOCUME~1\Pierre\APPLIC~1\Macromedia
   [23/09/2006|15:54] C:\DOCUME~1\Pierre\APPLIC~1\Microsoft
   [17/01/2006|18:31] C:\DOCUME~1\Pierre\APPLIC~1\Sonic
   [08/12/2005|23:47] C:\DOCUME~1\Pierre\APPLIC~1\Sun
   [23/09/2006|15:54] C:\DOCUME~1\Pierre\APPLIC~1\Template
   [08/12/2005|23:53] C:\DOCUME~1\Pierre\APPLIC~1\You've Got Pictures Screensaver

   [17/12/2005|19:10] C:\DOCUME~1\PROPRI~1\APPLIC~1\You've Got Pictures Screensaver

   [20/09/2008|18:58] C:\DOCUME~1\Thomas\APPLIC~1\Adobe
   [14/07/2006|12:59] C:\DOCUME~1\Thomas\APPLIC~1\AdobeUM
   [10/03/2006|23:06] C:\DOCUME~1\Thomas\APPLIC~1\HbTools
   [20/08/2004|11:41] C:\DOCUME~1\Thomas\APPLIC~1\Identities
   [08/12/2005|23:55] C:\DOCUME~1\Thomas\APPLIC~1\Jasc Software Inc
   [02/04/2006|13:24] C:\DOCUME~1\Thomas\APPLIC~1\Macromedia
   [28/06/2007|12:15] C:\DOCUME~1\Thomas\APPLIC~1\Microsoft
   [08/12/2005|23:47] C:\DOCUME~1\Thomas\APPLIC~1\Sun
   [02/04/2006|13:28] C:\DOCUME~1\Thomas\APPLIC~1\Template
   [08/12/2005|23:53] C:\DOCUME~1\Thomas\APPLIC~1\You've Got Pictures Screensaver
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [20/12/2008 23:00][--a------] C:\WINDOWS	asks
bepjrra.job
   [15/12/2008 01:00][--a------] C:\WINDOWS	asks\McDefragTask.job
   [01/12/2008 09:51][--a------] C:\WINDOWS	asks\McQcTask.job
   [14/12/2005 23:45][--a------] C:\WINDOWS	asks\Rappel d'abonnement 1 auprŠs de l'ISP.job
   [20/12/2008 22:38][--ah-----] C:\WINDOWS	asks\SA.DAT
   [05/08/2004 13:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [25/02/2006|19:44] C:\Program Files\3ivx
   [06/02/2006|14:49] C:\Program Files\Adobe
   [25/02/2006|20:45] C:\Program Files\Anti-Blaxx
   [08/12/2005|23:51] C:\Program Files\ATI Technologies
   [19/12/2008|10:27] C:\Program Files\CCleaner
   [20/08/2004|11:35] C:\Program Files\ComPlus Applications
   [08/12/2005|23:51] C:\Program Files\CyberLink
   [08/12/2005|23:55] C:\Program Files\Dell
   [08/12/2005|23:55] C:\Program Files\Dell Inc
   [25/02/2006|19:42] C:\Program Files\DivX
   [25/02/2006|20:27] C:\Program Files\D-Tools
   [29/12/2006|13:12] C:\Program Files\DVD Shrink
   [04/08/2008|12:46] C:\Program Files\eMule
   [18/12/2008|12:32] C:\Program Files\Fichiers communs
   [28/01/2006|19:10] C:\Program Files\Google
   [14/07/2006|21:05] C:\Program Files\HP
   [10/02/2006|21:18] C:\Program Files\IncrediMail
   [09/03/2008|17:53] C:\Program Files\InstallShield Installation Information
   [08/12/2005|23:50] C:\Program Files\Intel
   [19/10/2008|12:18] C:\Program Files\Internet Explorer
   [06/04/2006|10:24] C:\Program Files\Inventel
   [08/12/2005|23:55] C:\Program Files\Jasc Software Inc
   [03/12/2008|08:31] C:\Program Files\Java
   [12/11/2008|18:04] C:\Program Files\JRE
   [30/08/2008|23:05] C:\Program Files\Kiwee Toolbar2
   [08/12/2005|23:53] C:\Program Files\Learn2.com
   [27/01/2006|13:24] C:\Program Files\Livecom
   [23/09/2008|17:47] C:\Program Files\Macrogaming
   [19/12/2008|22:23] C:\Program Files\Malwarebytes' Anti-Malware
   [18/12/2008|11:28] C:\Program Files\McAfee
   [27/04/2007|23:39] C:\Program Files\McAfee.com
   [17/08/2008|12:25] C:\Program Files\Messenger
   [07/10/2007|22:00] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [20/08/2004|11:37] C:\Program Files\microsoft frontpage
   [10/10/2006|14:46] C:\Program Files\Microsoft Office
   [05/03/2008|12:26] C:\Program Files\Microsoft SQL Server Compact Edition
   [08/12/2005|23:52] C:\Program Files\Microsoft Works
   [17/01/2006|18:26] C:\Program Files\Mindscape
   [27/07/2008|12:01] C:\Program Files\Movie Maker
   [27/04/2007|23:37] C:\Program Files\Mozilla Firefox
   [05/03/2008|12:32] C:\Program Files\MSN
   [19/02/2006|20:46] C:\Program Files\MSN Games
   [20/08/2004|11:34] C:\Program Files\MSN Gaming Zone
   [05/03/2008|12:33] C:\Program Files\MSN Messenger
   [18/11/2006|23:01] C:\Program Files\MSXML 4.0
   [25/02/2006|19:42] C:\Program Files\MUSK Codec Pack v5
   [22/01/2006|11:32] C:\Program Files\Nathan
   [07/12/2008|12:44] C:\Program Files\Navilog1
   [27/07/2008|11:58] C:\Program Files\NetMeeting
   [23/02/2007|11:16] C:\Program Files\NewSoft
   [23/11/2006|18:12] C:\Program Files\Odebit Multim‚dia
   [25/02/2006|19:58] C:\Program Files\On2 Technologies
   [20/08/2004|11:34] C:\Program Files\Online Services
   [12/11/2008|18:04] C:\Program Files\OpenOffice.org 3
   [27/07/2008|11:58] C:\Program Files\Outlook Express
   [25/02/2006|19:44] C:\Program Files\QuickTime
   [13/11/2008|11:03] C:\Program Files\QuickZip4
   [08/12/2005|23:52] C:\Program Files\Real
   [25/02/2006|20:32] C:\Program Files\Sierra On-Line
   [08/12/2005|23:48] C:\Program Files\Sigmatel
   [08/12/2005|23:55] C:\Program Files\Sonic
   [25/02/2006|19:36] C:\Program Files\Spybot - Search & Destroy
   [23/11/2006|17:04] C:\Program Files\Ubisoft
   [20/08/2004|11:41] C:\Program Files\Uninstall Information
   [30/09/2008|15:32] C:\Program Files\uTorrent
   [25/02/2006|22:52] C:\Program Files\vtplus
   [21/12/2008|21:37] C:\Program Files\Wanadoo
   [08/12/2005|23:56] C:\Program Files\Wanadoo Europe
   [10/03/2006|20:03] C:\Program Files\Webtarot
   [13/12/2008|18:25] C:\Program Files\Windows Live
   [12/09/2008|17:24] C:\Program Files\Windows Live Safety Center
   [07/12/2008|14:01] C:\Program Files\Windows Media Connect 2
   [27/07/2008|11:58] C:\Program Files\Windows Media Player
   [27/07/2008|11:58] C:\Program Files\Windows NT
   [20/08/2004|11:35] C:\Program Files\WindowsUpdate
   [13/11/2008|11:30] C:\Program Files\WinRAR
   [25/02/2006|22:53] C:\Program Files\WinTV
   [23/11/2006|16:55] C:\Program Files\XBox 360 Controller for Windows Software
   [20/08/2004|11:37] C:\Program Files\xerox
   [25/02/2006|19:44] C:\Program Files\XviD
   [10/03/2006|20:04] C:\Program Files\Yahoo!

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [14/07/2008|09:22] C:\Program Files\Fichiers communs\Adobe
   [14/02/2006|17:34] C:\Program Files\Fichiers communs\AOL
   [25/02/2006|20:47] C:\Program Files\Fichiers communs\DirectX
   [31/03/2006|20:20] C:\Program Files\Fichiers communs\ErrorSafe
   [14/12/2005|21:24] C:\Program Files\Fichiers communs\Hewlett-Packard
   [14/07/2006|21:05] C:\Program Files\Fichiers communs\HP
   [25/01/2006|16:26] C:\Program Files\Fichiers communs\InstallShield
   [08/12/2005|23:55] C:\Program Files\Fichiers communs\Jasc Software Inc
   [08/12/2005|23:47] C:\Program Files\Fichiers communs\Java
   [18/02/2006|18:25] C:\Program Files\Fichiers communs\Logitech
   [06/02/2008|11:07] C:\Program Files\Fichiers communs\McAfee
   [13/12/2008|18:31] C:\Program Files\Fichiers communs\Microsoft Shared
   [20/08/2004|11:35] C:\Program Files\Fichiers communs\MSSoap
   [23/02/2007|11:16] C:\Program Files\Fichiers communs\NewSoft
   [08/12/2005|23:53] C:\Program Files\Fichiers communs\Nullsoft
   [20/08/2004|11:30] C:\Program Files\Fichiers communs\ODBC
   [08/12/2005|23:52] C:\Program Files\Fichiers communs\Real
   [20/08/2004|11:35] C:\Program Files\Fichiers communs\Services
   [08/12/2005|23:56] C:\Program Files\Fichiers communs\Sonic Shared
   [20/08/2004|11:30] C:\Program Files\Fichiers communs\SpeechEngines
   [27/07/2008|11:58] C:\Program Files\Fichiers communs\System
   [08/12/2005|23:54] C:\Program Files\Fichiers communs\TiVo Shared
   [05/03/2008|10:58] C:\Program Files\Fichiers communs\WindowsLiveInstaller

   --------------------\  Process

   ( 83 Processes )

   iexplore.exe ~ [PID:5120]

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\DOCUME~1\CHRIST~1\Cookies\christelle@advertising[1].txt
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-12-21 22:55:04
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 176
 
   --------------------\  Recherche d'autres infections

   C:\WINDOWS\system32\HNXIRBeg.ini2
   C:\WINDOWS\system32\iOYFOqss.ini
   C:\WINDOWS\system32\iOYFOqss.ini2
   C:\WINDOWS\system32
qrCeMoq.ini
   C:\WINDOWS\system32
qrCeMoq.ini2
   C:\WINDOWS\system32\pWGNnXyb.ini
   C:\WINDOWS\system32\pWGNnXyb.ini2
   [b]==> VUNDO <==/b
 
   --------------------\  ROGUES ..

   C:\PROGRA~1\FICHIE~1\ErrorSafe



   [F:27][D:5]-> C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp
   [F:112][D:0]-> C:\DOCUME~1\CHRIST~1\Cookies
   [F:4034][D:8]-> C:\DOCUME~1\CHRIST~1\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 20/12/2008|23:39 - Option : [1]
   2 - "C:\Lop SD\LopR_2.txt" - 21/12/2008|20:21 - Option : [2]
   3 - "C:\Lop SD\LopR_3.txt" - 21/12/2008|22:56 - Option : [1]

   --------------------\  Fin du rapport a 22:56:20

jorginho67 · Answer

Arghhhhhhhhhh

Ca ne devrait plus être là...

C:\WINDOWS\system32\HNXIRBeg.ini2
C:\WINDOWS\system32\iOYFOqss.ini
C:\WINDOWS\system32\iOYFOqss.ini2
C:\WINDOWS\system32
qrCeMoq.ini
C:\WINDOWS\system32
qrCeMoq.ini2
C:\WINDOWS\system32\pWGNnXyb.ini
C:\WINDOWS\system32\pWGNnXyb.ini2 

Lop SD les detecte peut etre dans la 40aine de MBAM...

Clique sur le raccourci de Malwarebytes' Anti-Malware , puis sur Quarantaine, sélectionne les divers éléments en cliquant sur Tout puis clique sur Supprimer

repasse un coup de LOP SD voir s'il les détecte encore...

2) Relance LOP SD puis choisis l'option 1 (Recherche)
* Patiente jusqu'à la fin du scan
* Poste le rapport généré qui se trouve ici => (C:\lopR.txt)

christel · Answer

dsl mais je crois que ça y est encore j'ai pourtant suprimé tout. C'est grave ?

--------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) 4 CPU 3.20GHz )
   BIOS : Phoenix ROM BIOS PLUS Version 1.10 A02
   USER : Christelle ( Administrator )
   BOOT : Normal boot
   Antivirus : McAfee VirusScan  (Activated)
   Firewall  : McAfee Personal Firewall  (Activated)
   C:\ (Local Disk) - NTFS - Total:229 Go (Free:186 Go)
   D:\ (CD or DVD)
   E:\ (CD or DVD)
   G:\ (USB)
   H:\ (USB)
   I:\ (USB)
   J:\ (USB)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [1] ( 21/12/2008|23:15 )
 
   --------------------\  Listing des dossiers dans APPLIC~1

   [20/08/2004|11:41] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
   [08/12/2005|23:55] C:\DOCUME~1\ADMINI~1\APPLIC~1\Jasc Software Inc
   [20/08/2004|11:30] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
   [08/12/2005|23:47] C:\DOCUME~1\ADMINI~1\APPLIC~1\Sun
   [08/12/2005|23:53] C:\DOCUME~1\ADMINI~1\APPLIC~1\You've Got Pictures Screensaver

   [14/07/2008|09:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [14/02/2006|17:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
   [30/12/2006|18:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
   [13/03/2006|12:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Fastwavelongfirst
   [14/12/2005|21:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP
   [08/12/2005|23:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
   [19/12/2008|21:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
   [31/10/2008|09:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
   [27/04/2007|23:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee.com
   [05/03/2008|10:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [10/02/2006|21:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\pixelStorm
   [26/11/2006|14:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\POPWWPROFILES
   [06/01/2006|14:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Prism
   [25/02/2006|19:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
   [20/08/2004|11:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
   [11/10/2008|09:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SiteAdvisor
   [25/02/2006|19:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [23/09/2008|17:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM
   [13/12/2008|12:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
   [25/02/2006|20:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [13/12/2008|18:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

   [13/07/2008|09:58] C:\DOCUME~1\CHRIST~1\APPLIC~1\Adobe
   [14/07/2008|09:19] C:\DOCUME~1\CHRIST~1\APPLIC~1\AdobeUM
   [30/08/2008|23:05] C:\DOCUME~1\CHRIST~1\APPLIC~1\agi
   [14/12/2005|20:12] C:\DOCUME~1\CHRIST~1\APPLIC~1\CyberLink
   [20/01/2006|13:32] C:\DOCUME~1\CHRIST~1\APPLIC~1\eConf
   [28/01/2006|18:47] C:\DOCUME~1\CHRIST~1\APPLIC~1\Google
   [08/03/2006|09:17] C:\DOCUME~1\CHRIST~1\APPLIC~1\HbTools
   [05/01/2006|20:07] C:\DOCUME~1\CHRIST~1\APPLIC~1\Help
   [10/05/2006|18:29] C:\DOCUME~1\CHRIST~1\APPLIC~1\HP
   [20/08/2004|11:41] C:\DOCUME~1\CHRIST~1\APPLIC~1\Identities
   [14/04/2008|15:03] C:\DOCUME~1\CHRIST~1\APPLIC~1\Image Zone Express
   [19/01/2006|19:32] C:\DOCUME~1\CHRIST~1\APPLIC~1\Jasc Software Inc
   [05/02/2006|20:21] C:\DOCUME~1\CHRIST~1\APPLIC~1\Leadertech
   [06/03/2006|21:29] C:\DOCUME~1\CHRIST~1\APPLIC~1\Macromedia
   [19/12/2008|21:56] C:\DOCUME~1\CHRIST~1\APPLIC~1\Malwarebytes
   [13/12/2008|13:46] C:\DOCUME~1\CHRIST~1\APPLIC~1\Microsoft
   [20/01/2006|14:32] C:\DOCUME~1\CHRIST~1\APPLIC~1\MSNInstaller
   [13/03/2006|12:50] C:\DOCUME~1\CHRIST~1\APPLIC~1\OneEggs
   [12/11/2008|18:08] C:\DOCUME~1\CHRIST~1\APPLIC~1\OpenOffice.org
   [22/02/2008|22:10] C:\DOCUME~1\CHRIST~1\APPLIC~1\PlayFirst
   [05/02/2006|20:21] C:\DOCUME~1\CHRIST~1\APPLIC~1\Sonic
   [08/12/2005|23:47] C:\DOCUME~1\CHRIST~1\APPLIC~1\Sun
   [14/12/2005|12:33] C:\DOCUME~1\CHRIST~1\APPLIC~1\Template
   [14/12/2008|15:51] C:\DOCUME~1\CHRIST~1\APPLIC~1\uTorrent
   [13/11/2008|11:31] C:\DOCUME~1\CHRIST~1\APPLIC~1\WinRAR
   [08/12/2005|23:53] C:\DOCUME~1\CHRIST~1\APPLIC~1\You've Got Pictures Screensaver

   [20/08/2004|11:41] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [08/12/2005|23:55] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Jasc Software Inc
   [20/08/2004|11:30] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
   [08/12/2005|23:47] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Sun
   [08/12/2005|23:53] C:\DOCUME~1\DEFAUL~1\APPLIC~1\You've Got Pictures Screensaver


   [30/08/2008|23:05] C:\DOCUME~1\LOCALS~1\APPLIC~1\agi
   [21/02/2007|09:52] C:\DOCUME~1\LOCALS~1\APPLIC~1\Macromedia
   [21/02/2007|09:52] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
   [20/12/2008|18:39] C:\DOCUME~1\LOCALS~1\APPLIC~1\SACore

   [08/04/2008|10:49] C:\DOCUME~1\LA4770~1\APPLIC~1\Adobe
   [01/04/2006|14:56] C:\DOCUME~1\LA4770~1\APPLIC~1\AdobeUM
   [30/12/2005|12:10] C:\DOCUME~1\LA4770~1\APPLIC~1\CyberLink
   [25/01/2006|11:43] C:\DOCUME~1\LA4770~1\APPLIC~1\eConf
   [10/03/2006|19:53] C:\DOCUME~1\LA4770~1\APPLIC~1\HbTools
   [11/02/2006|15:09] C:\DOCUME~1\LA4770~1\APPLIC~1\Help
   [20/08/2004|11:41] C:\DOCUME~1\LA4770~1\APPLIC~1\Identities
   [08/12/2005|23:55] C:\DOCUME~1\LA4770~1\APPLIC~1\Jasc Software Inc
   [30/12/2005|12:09] C:\DOCUME~1\LA4770~1\APPLIC~1\Leadertech
   [08/01/2006|15:52] C:\DOCUME~1\LA4770~1\APPLIC~1\Macromedia
   [13/05/2006|13:39] C:\DOCUME~1\LA4770~1\APPLIC~1\Microsoft
   [18/12/2008|19:41] C:\DOCUME~1\LA4770~1\APPLIC~1\OpenOffice.org
   [30/12/2005|12:10] C:\DOCUME~1\LA4770~1\APPLIC~1\Sonic
   [08/12/2005|23:47] C:\DOCUME~1\LA4770~1\APPLIC~1\Sun
   [13/05/2006|13:39] C:\DOCUME~1\LA4770~1\APPLIC~1\Template
   [17/12/2007|07:05] C:\DOCUME~1\LA4770~1\APPLIC~1\Viewpoint
   [08/12/2005|23:53] C:\DOCUME~1\LA4770~1\APPLIC~1\You've Got Pictures Screensaver

   [05/03/2008|12:38] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

   [11/06/2008|18:29] C:\DOCUME~1\Pierre\APPLIC~1\Adobe
   [14/07/2006|11:53] C:\DOCUME~1\Pierre\APPLIC~1\AdobeUM
   [10/03/2006|23:04] C:\DOCUME~1\Pierre\APPLIC~1\HbTools
   [20/08/2004|11:41] C:\DOCUME~1\Pierre\APPLIC~1\Identities
   [14/07/2006|21:37] C:\DOCUME~1\Pierre\APPLIC~1\Image Zone Express
   [08/12/2005|23:55] C:\DOCUME~1\Pierre\APPLIC~1\Jasc Software Inc
   [17/01/2006|18:31] C:\DOCUME~1\Pierre\APPLIC~1\Leadertech
   [17/01/2006|18:22] C:\DOCUME~1\Pierre\APPLIC~1\Macromedia
   [23/09/2006|15:54] C:\DOCUME~1\Pierre\APPLIC~1\Microsoft
   [17/01/2006|18:31] C:\DOCUME~1\Pierre\APPLIC~1\Sonic
   [08/12/2005|23:47] C:\DOCUME~1\Pierre\APPLIC~1\Sun
   [23/09/2006|15:54] C:\DOCUME~1\Pierre\APPLIC~1\Template
   [08/12/2005|23:53] C:\DOCUME~1\Pierre\APPLIC~1\You've Got Pictures Screensaver

   [17/12/2005|19:10] C:\DOCUME~1\PROPRI~1\APPLIC~1\You've Got Pictures Screensaver

   [20/09/2008|18:58] C:\DOCUME~1\Thomas\APPLIC~1\Adobe
   [14/07/2006|12:59] C:\DOCUME~1\Thomas\APPLIC~1\AdobeUM
   [10/03/2006|23:06] C:\DOCUME~1\Thomas\APPLIC~1\HbTools
   [20/08/2004|11:41] C:\DOCUME~1\Thomas\APPLIC~1\Identities
   [08/12/2005|23:55] C:\DOCUME~1\Thomas\APPLIC~1\Jasc Software Inc
   [02/04/2006|13:24] C:\DOCUME~1\Thomas\APPLIC~1\Macromedia
   [28/06/2007|12:15] C:\DOCUME~1\Thomas\APPLIC~1\Microsoft
   [08/12/2005|23:47] C:\DOCUME~1\Thomas\APPLIC~1\Sun
   [02/04/2006|13:28] C:\DOCUME~1\Thomas\APPLIC~1\Template
   [08/12/2005|23:53] C:\DOCUME~1\Thomas\APPLIC~1\You've Got Pictures Screensaver
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [20/12/2008 23:00][--a------] C:\WINDOWS	asks
bepjrra.job
   [15/12/2008 01:00][--a------] C:\WINDOWS	asks\McDefragTask.job
   [01/12/2008 09:51][--a------] C:\WINDOWS	asks\McQcTask.job
   [14/12/2005 23:45][--a------] C:\WINDOWS	asks\Rappel d'abonnement 1 auprŠs de l'ISP.job
   [20/12/2008 22:38][--ah-----] C:\WINDOWS	asks\SA.DAT
   [05/08/2004 13:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [25/02/2006|19:44] C:\Program Files\3ivx
   [06/02/2006|14:49] C:\Program Files\Adobe
   [25/02/2006|20:45] C:\Program Files\Anti-Blaxx
   [08/12/2005|23:51] C:\Program Files\ATI Technologies
   [19/12/2008|10:27] C:\Program Files\CCleaner
   [20/08/2004|11:35] C:\Program Files\ComPlus Applications
   [08/12/2005|23:51] C:\Program Files\CyberLink
   [08/12/2005|23:55] C:\Program Files\Dell
   [08/12/2005|23:55] C:\Program Files\Dell Inc
   [25/02/2006|19:42] C:\Program Files\DivX
   [25/02/2006|20:27] C:\Program Files\D-Tools
   [29/12/2006|13:12] C:\Program Files\DVD Shrink
   [04/08/2008|12:46] C:\Program Files\eMule
   [18/12/2008|12:32] C:\Program Files\Fichiers communs
   [28/01/2006|19:10] C:\Program Files\Google
   [14/07/2006|21:05] C:\Program Files\HP
   [10/02/2006|21:18] C:\Program Files\IncrediMail
   [09/03/2008|17:53] C:\Program Files\InstallShield Installation Information
   [08/12/2005|23:50] C:\Program Files\Intel
   [19/10/2008|12:18] C:\Program Files\Internet Explorer
   [06/04/2006|10:24] C:\Program Files\Inventel
   [08/12/2005|23:55] C:\Program Files\Jasc Software Inc
   [03/12/2008|08:31] C:\Program Files\Java
   [12/11/2008|18:04] C:\Program Files\JRE
   [30/08/2008|23:05] C:\Program Files\Kiwee Toolbar2
   [08/12/2005|23:53] C:\Program Files\Learn2.com
   [27/01/2006|13:24] C:\Program Files\Livecom
   [23/09/2008|17:47] C:\Program Files\Macrogaming
   [19/12/2008|22:23] C:\Program Files\Malwarebytes' Anti-Malware
   [18/12/2008|11:28] C:\Program Files\McAfee
   [27/04/2007|23:39] C:\Program Files\McAfee.com
   [17/08/2008|12:25] C:\Program Files\Messenger
   [07/10/2007|22:00] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [20/08/2004|11:37] C:\Program Files\microsoft frontpage
   [10/10/2006|14:46] C:\Program Files\Microsoft Office
   [05/03/2008|12:26] C:\Program Files\Microsoft SQL Server Compact Edition
   [08/12/2005|23:52] C:\Program Files\Microsoft Works
   [17/01/2006|18:26] C:\Program Files\Mindscape
   [27/07/2008|12:01] C:\Program Files\Movie Maker
   [27/04/2007|23:37] C:\Program Files\Mozilla Firefox
   [05/03/2008|12:32] C:\Program Files\MSN
   [19/02/2006|20:46] C:\Program Files\MSN Games
   [20/08/2004|11:34] C:\Program Files\MSN Gaming Zone
   [05/03/2008|12:33] C:\Program Files\MSN Messenger
   [18/11/2006|23:01] C:\Program Files\MSXML 4.0
   [25/02/2006|19:42] C:\Program Files\MUSK Codec Pack v5
   [22/01/2006|11:32] C:\Program Files\Nathan
   [07/12/2008|12:44] C:\Program Files\Navilog1
   [27/07/2008|11:58] C:\Program Files\NetMeeting
   [23/02/2007|11:16] C:\Program Files\NewSoft
   [23/11/2006|18:12] C:\Program Files\Odebit Multim‚dia
   [25/02/2006|19:58] C:\Program Files\On2 Technologies
   [20/08/2004|11:34] C:\Program Files\Online Services
   [12/11/2008|18:04] C:\Program Files\OpenOffice.org 3
   [27/07/2008|11:58] C:\Program Files\Outlook Express
   [25/02/2006|19:44] C:\Program Files\QuickTime
   [13/11/2008|11:03] C:\Program Files\QuickZip4
   [08/12/2005|23:52] C:\Program Files\Real
   [25/02/2006|20:32] C:\Program Files\Sierra On-Line
   [08/12/2005|23:48] C:\Program Files\Sigmatel
   [08/12/2005|23:55] C:\Program Files\Sonic
   [25/02/2006|19:36] C:\Program Files\Spybot - Search & Destroy
   [23/11/2006|17:04] C:\Program Files\Ubisoft
   [20/08/2004|11:41] C:\Program Files\Uninstall Information
   [30/09/2008|15:32] C:\Program Files\uTorrent
   [25/02/2006|22:52] C:\Program Files\vtplus
   [21/12/2008|23:14] C:\Program Files\Wanadoo
   [08/12/2005|23:56] C:\Program Files\Wanadoo Europe
   [10/03/2006|20:03] C:\Program Files\Webtarot
   [13/12/2008|18:25] C:\Program Files\Windows Live
   [12/09/2008|17:24] C:\Program Files\Windows Live Safety Center
   [07/12/2008|14:01] C:\Program Files\Windows Media Connect 2
   [27/07/2008|11:58] C:\Program Files\Windows Media Player
   [27/07/2008|11:58] C:\Program Files\Windows NT
   [20/08/2004|11:35] C:\Program Files\WindowsUpdate
   [13/11/2008|11:30] C:\Program Files\WinRAR
   [25/02/2006|22:53] C:\Program Files\WinTV
   [23/11/2006|16:55] C:\Program Files\XBox 360 Controller for Windows Software
   [20/08/2004|11:37] C:\Program Files\xerox
   [25/02/2006|19:44] C:\Program Files\XviD
   [10/03/2006|20:04] C:\Program Files\Yahoo!

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [14/07/2008|09:22] C:\Program Files\Fichiers communs\Adobe
   [14/02/2006|17:34] C:\Program Files\Fichiers communs\AOL
   [25/02/2006|20:47] C:\Program Files\Fichiers communs\DirectX
   [31/03/2006|20:20] C:\Program Files\Fichiers communs\ErrorSafe
   [14/12/2005|21:24] C:\Program Files\Fichiers communs\Hewlett-Packard
   [14/07/2006|21:05] C:\Program Files\Fichiers communs\HP
   [25/01/2006|16:26] C:\Program Files\Fichiers communs\InstallShield
   [08/12/2005|23:55] C:\Program Files\Fichiers communs\Jasc Software Inc
   [08/12/2005|23:47] C:\Program Files\Fichiers communs\Java
   [18/02/2006|18:25] C:\Program Files\Fichiers communs\Logitech
   [06/02/2008|11:07] C:\Program Files\Fichiers communs\McAfee
   [13/12/2008|18:31] C:\Program Files\Fichiers communs\Microsoft Shared
   [20/08/2004|11:35] C:\Program Files\Fichiers communs\MSSoap
   [23/02/2007|11:16] C:\Program Files\Fichiers communs\NewSoft
   [08/12/2005|23:53] C:\Program Files\Fichiers communs\Nullsoft
   [20/08/2004|11:30] C:\Program Files\Fichiers communs\ODBC
   [08/12/2005|23:52] C:\Program Files\Fichiers communs\Real
   [20/08/2004|11:35] C:\Program Files\Fichiers communs\Services
   [08/12/2005|23:56] C:\Program Files\Fichiers communs\Sonic Shared
   [20/08/2004|11:30] C:\Program Files\Fichiers communs\SpeechEngines
   [27/07/2008|11:58] C:\Program Files\Fichiers communs\System
   [08/12/2005|23:54] C:\Program Files\Fichiers communs\TiVo Shared
   [05/03/2008|10:58] C:\Program Files\Fichiers communs\WindowsLiveInstaller

   --------------------\  Process

   ( 83 Processes )

   iexplore.exe ~ [PID:2280]

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\DOCUME~1\CHRIST~1\Cookies\christelle@advertising[1].txt
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-12-21 23:19:14
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 176
 
   --------------------\  Recherche d'autres infections

   C:\WINDOWS\system32\HNXIRBeg.ini2
   C:\WINDOWS\system32\iOYFOqss.ini
   C:\WINDOWS\system32\iOYFOqss.ini2
   C:\WINDOWS\system32
qrCeMoq.ini
   C:\WINDOWS\system32
qrCeMoq.ini2
   C:\WINDOWS\system32\pWGNnXyb.ini
   C:\WINDOWS\system32\pWGNnXyb.ini2
   [b]==> VUNDO <==/b
 
   --------------------\  ROGUES ..

   C:\PROGRA~1\FICHIE~1\ErrorSafe



   [F:32][D:5]-> C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp
   [F:112][D:0]-> C:\DOCUME~1\CHRIST~1\Cookies
   [F:4298][D:8]-> C:\DOCUME~1\CHRIST~1\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 20/12/2008|23:39 - Option : [1]
   2 - "C:\Lop SD\LopR_2.txt" - 21/12/2008|20:21 - Option : [2]
   3 - "C:\Lop SD\LopR_3.txt" - 21/12/2008|22:56 - Option : [1]
   4 - "C:\Lop SD\LopR_4.txt" - 21/12/2008|23:20 - Option : [1]

   --------------------\  Fin du rapport a 23:20:49

jorginho67 · Answer

Bon, on sort l'artillerie...

Télécharge combofix.exe (par sUBs) et sauvegarde le sur ton bureau.
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

* Déconnecte toi d'internet et ferme toutes tes applications.

* Désactive tes protections (antivirus, parefeu,antispyware) provisoirement et seulement le temps de l'utilisation de ComboFix,

* Double-clic sur combofix.exe, il est possible que ton parefeu te demande si tu acceptes ou non l'accès de nircmd.cfexe à la zone sûre: accepte.

* /!\ Ne touche à rien tant que le scan n'est pas terminé.Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne /!\

* Attends que Combofix ait terminé, un rapport sera créé.

* réactive ton parefeu, ton antivirus, la garde de ton antispyware

* copie/colle le rapport, le rapport se trouve dans : C:Combofix.txt

* Réactive tes protections en temps réel, Antivirus, Antispywares, avant de te reconnecter à internet.

christel · Answer

Bonjour
je n'ai pas de rapport a vs donner car je n'ai pas reussi. J'ai enregistrée combofix.exe sur le bureau, puis double clic le preload...c'est ouvert j'ai essayé de fermé un tout petit rectangle combofix c'est ouvert, j'ai laissé faire une bonne heure 1/2 et j'ai comprit que mon ordi etait bloqué. J'ai debranché car le bouton arret marché pas et j'ai recommencé combofix et toujours petit retangle vert combofix, j'ai laissé nom oodi 4h en revenant ecran noir et tout bloqué . j'ai debranché regardé 'il y avait un ropport comme vs l'aviez ecrit mais non rien . j'espere que j'ai ete claire ! merci a bientot.

christel · Answer

Bonjour, 

Tout d'abors je voudrais vous souhaiter une bonne et heureuse année 2009.
je n'ai pas eut de vos nouvelles apres avoir fait  combofix.exe, qui n'a pas fonctionné 
Je suis a bout de mon abondemment avec l'anti virus McAfee et je voudrais savoir si je pouvai faire confiance a Avast ? ou peut etre me conseillé vous un autre anti virus ?  Mon ordi marche bien de temps a autre la fenetre preolad installer viens m'enbeter mais j'arrive en percistant a l'enlever ! merci a bientot

jorginho67 · Answer

Hello et Tous mes Voeux pour 2009 ;-)

Je te conseillerais plutot AVIRA ANTIVIR ( GRATUIT EGALEMENT et maintenant en FRANCAIS ) à la place de Avast !
Pourquoi ?
Un autre avis ?
Toujours pas convaincu ? ici, l'avis des Masters en désinfection !


Donc télécharge AVIRA Antivir si tu veux l'esssayer sur le lien suivant.
http://dlce.antivir.com/down/windows/antivir_workstation_winu_fr_h.exe

Ensuite hors connexion supprime McAfee

Pour désinstaller McAfee correctement

Pour désinstaller McAfee correctement

L'outil de désinstallation n'est pas fourni avec le logiciel, il faut le télécharger.

Désinstalle Mcafee à l'aide de l'outil de désinstallation VSCleanupTool.exe  comme l'explique le support technique de Mcafee

Conseil du centre de support technique Mcafee.

1: Executez le fichier VSCleanupTool.zip joint à cet email.

2. Redemarrez l'ordinateur.

desinstallez le programme McAfee Security centre depuis ajout/suppression de programmes du panneau de configuration si possible:
Cliquez sur le bouton « Démarrer ».
Cliquez sur Panneau de configuration. Le Panneau de configuration s'affiche.
Cliquez deux fois sur l'icône Ajout/Suppression de programmes. La boîte de dialogue « Propriétés de Ajout/Suppression de programmes » s'affiche.
Recherchez McAfee Security centre dans la liste des programmes installés et cliquez dessus une fois pour les sélectionner
Cliquez sur le bouton « Ajouter/Supprimer ».

REMARQUE : si vous êtes invité à supprimer des fichiers partagés, répondez Oui pour tous.

3. Redemarrez l'ordinateur.


Installe ANTIVIR...

Paramètre le comme expliqué sur ce Tutoriel en images

Reconnecte toi, fais les mises à jours Antivir... tu seras mieux protégé !

Après l'installation, mets le à jour - si ton firewall fait une alerte.. accepte la connexion.
Assure toi qu'Antivir est bien à jour, ( clic droit sur le parapluie => Start Update ) et laisse faire la MàJ.

Pour vérifier que ton PC soit propre

Redémarre en mode sans échec !
Pour cela, redémarre l'ordinateur, avant le logo Windows, tapote sur la touche F8, un menu va apparaître, choisis Mode sans échec et appuye sur la touche entrée du clavier.

- Ouvre Antivir par le menu Démarrer / Programmes
- Cliquez sur l'onglet Scanner.
- Sélectionne Manual Selection
- Sélectionne le disque C
- Lance le scan - Mets en quarantaine tous les éléments détectés.
- Une fois le scan terminé Enregistre le rapport.

Redémarre en mode normal.

Poste le rapport ici.

christel · Answer

Bonjour 
apres avoir fait VSCleanupTool.exe, pour desinstaller mcafee une fenetre noire c'est ouverte une tonne de dossier c'est affiché puis un rapport que je vs envoie . En faisant 'demarrer' p'panneau confi' 'ajouter/suprimer' l'icone mcafee et toujour là . Puis je n'arrive pas a aller sur ma messagerie pas identication possible . J'ai quand meme telecharché avari qui est en train d'annaliser l'ordi . Que dois je faire e svp merci 

rapport apres le VSCleanupTool.exe



MCAFEE PRODUCT CLEANUP TOOL
January 06, 2009 12:54:57
INFO   Task Scheduler service started.
PASS   Command line command successful
INFO   Cleanup should start at 12:56.

MCAFEE PRODUCT CLEANUP TOOL
January 06, 2009 12:55:29
INFO   Task Scheduler service started.
PASS   Command line command successful
INFO   Cleanup should start at 12:56.

MCAFEE PRODUCT CLEANUP TOOL
January 06, 2009 12:56:00
INFO   Cleanup is being run as scheduled task.
ERROR  Internal Error
FAIL   Running pre-uninstallation operations failed.
FAIL   Running pre-uninstallation operations failed.
ERROR  Internal Error
FAIL   Uninstallation could not be run.
FAIL   Incomplete uninstallation.
ERROR  Internal Error
FAIL   Running post-uninstallation operations failed.
FAIL   Running post-uninstallation operations failed.

MCAFEE PRODUCT CLEANUP TOOL
January 06, 2009 12:56:00
INFO   Cleanup is being run as scheduled task.
ERROR  Internal Error
FAIL   Running pre-uninstallation operations failed.
FAIL   Running pre-uninstallation operations failed.
ERROR  Internal Error
FAIL   Uninstallation could not be run.
FAIL   Incomplete uninstallation.
ERROR  Internal Error
FAIL   Running post-uninstallation operations failed.
FAIL   Running post-uninstallation operations failed.

MCAFEE PRODUCT CLEANUP TOOL
January 06, 2009 13:03:59
INFO   Product mcvs to be removed from system.
INFO   Task Scheduler service started.
PASS   Command line command successful
INFO   Cleanup should start at 13:05.

MCAFEE PRODUCT CLEANUP TOOL
January 06, 2009 13:04:03
INFO   Task Scheduler service started.
PASS   Command line command successful
INFO   Cleanup should start at 13:05.

MCAFEE PRODUCT CLEANUP TOOL
MCAFEE PRODUCT CLEANUP TOOL
January 06, 2009 13:05:00
January 06, 2009 13:05:00
INFO   Cleanup is being run as scheduled task.
INFO   Cleanup is being run as scheduled task.
INFO   Product mcvs to be removed from system.
INFO   Removing product mcvs...
PASS   The products have been successfully removed.
INFO   Removing files...
PASS   C:\Program Files\McAfee.com\VSO\ediskimg.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\804mbd1.chk does not exist
PASS   C:\Program Files\McAfee.com\VSO\804mbd1.IMG does not exist
PASS   C:\Program Files\McAfee.com\VSO\ediskimg.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\804mbd1.chk does not exist
PASS   C:\Program Files\McAfee.com\VSO\804mbd1.IMG does not exist
PASS   C:\Program Files\McAfee.com\Shared\mccomctl.dll does not exist
PASS   C:\Program Files\McAfee.com\Shared\mccomctl.inf does not exist
PASS   C:\Program Files\McAfee.com\Shared\mccomctl.dll does not exist
PASS   C:\Program Files\McAfee.com\Shared\mccomctl.inf does not exist
PASS   C:\Documents and Settings\NetworkService\Bureau\McAfee.com Scan For Viruses.lnk does not exist
PASS   C:\Documents and Settings\NetworkService\Bureau\McAfee ±½´y¯f¬r.lnk does not exist
PASS   C:\Documents and Settings\NetworkService\Bureau\McAfee Auf Viren überprüfen.lnk does not exist
PASS   C:\Documents and Settings\NetworkService\Bureau\McAfee Scan.lnk does not exist
PASS   C:\Documents and Settings\NetworkService\Bureau\McAfee Scan For Viruses.lnk does not exist
PASS   C:\Documents and Settings\NetworkService\Bureau\McAfee Detectar virus does not exist
PASS   C:\Documents and Settings\NetworkService\Bureau\McAfee Analyse antivirus does not exist
PASS   C:\Documents and Settings\NetworkService\Bureau\McAfee Ricerca virus does not exist
PASS   C:\Documents and Settings\NetworkService\Bureau\McAfee ƒEƒCƒ‹ƒX‚ÌƒXƒLƒƒƒ“.lnk does not exist
PASS   C:\Documents and Settings\NetworkService\Bureau\McAfee ƒEƒCƒ‹ƒX ƒXƒLƒƒƒ“.lnk does not exist
PASS   C:\Documents and Settings\NetworkService\Bureau\McAfee Scannen op virussen does not exist
PASS   C:\Documents and Settings\NetworkService\Bureau\McAfee Verificar a Existência de Vírus does not exist
PASS   C:\Documents and Settings\All Users\Bureau\McAfee.com Scan For Viruses.lnk does not exist
PASS   C:\Documents and Settings\All Users\Bureau\McAfee ±½´y¯f¬r.lnk does not exist
PASS   C:\Documents and Settings\All Users\Bureau\McAfee Auf Viren überprüfen.lnk does not exist
PASS   C:\Documents and Settings\All Users\Bureau\McAfee Scan.lnk does not exist
PASS   C:\Documents and Settings\All Users\Bureau\McAfee Scan For Viruses.lnk does not exist
PASS   C:\Documents and Settings\All Users\Bureau\McAfee Detectar virus does not exist
PASS   C:\Documents and Settings\All Users\Bureau\McAfee Analyse antivirus does not exist
PASS   C:\Documents and Settings\All Users\Bureau\McAfee Ricerca virus does not exist
PASS   C:\Documents and Settings\All Users\Bureau\McAfee ƒEƒCƒ‹ƒX‚ÌƒXƒLƒƒƒ“.lnk does not exist
PASS   C:\Documents and Settings\All Users\Bureau\McAfee ƒEƒCƒ‹ƒX ƒXƒLƒƒƒ“.lnk does not exist
PASS   C:\Documents and Settings\All Users\Bureau\McAfee Scannen op virussen does not exist
PASS   C:\Documents and Settings\All Users\Bureau\McAfee Verificar a Existência de Vírus does not exist
PASS   C:\Documents and Settings\NetworkService\Bureau\McAfee\McAfee VirusScan does not exist
PASS   C:\Documents and Settings\All Users\Menu Démarrer\Programmes\McAfee\McAfee VirusScan does not exist
PASS   C:\Program Files\McAfee.com\VSO\unicows.dll does not exist
PASS   C:\Program Files\McAfee.com\VSOedist.txt does not exist
PASS   C:\Program Files\McAfee.com\VSO\license.txt does not exist
PASS   C:\Program Files\McAfee.com\VSO\oasres.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\emscnres.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\emlscres.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\McVSEscn.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\McVSSkt.Dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\emlscbin.inf%PROGRAMFILES%\McAfee.com\VSO\emlscbin.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\emlscres.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\emscnres.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\license.txt does not exist
PASS   C:\Program Files\McAfee.com\VSO\McVSEscn.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\McVSSkt.Dll does not exist
PASS   C:\Program Files\McAfee.com\VSO
aiavf5x.inf does not exist
PASS   C:\Program Files\McAfee.com\VSOedist.txt does not exist
PASS   C:\Program Files\McAfee.com\VSO\unicows.dll%PROGRAMFILES%\McAfee.com\VSO\emscnres.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\emlscres.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\McVSEscn.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\McVSSkt.Dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\emlscbin.inf%PROGRAMFILES%\McAfee.com\VSO\emlscbin.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\emlscres.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\emscnres.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\McVSEscn.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\McVSSkt.Dll%WINDIR%\system32\drivers
aiavf5x.sys%WINDIR%\system32\drivers\NaiFiltr.sys;[DefaultUninstall] does not exist
PASS   C:\Program Files\Mcafee.com\VSO\mcscan32.dll does not exist
PASS   C:\Program Files\Mcafee.com\VSO\vsoeng.inf does not exist
PASS   C:\Program Files\Mcafee.com\VSO\signlic.txt does not exist
PASS   C:\WINDOWS\system\MCSCAN32.VXD does not exist
PASS   C:\Program Files\Mcafee.com\VSO\RWABS16.DLL does not exist
PASS   C:\Program Files\Mcafee.com\VSO\RWABS32.DLL does not exist
PASS   C:\Program Files\Mcafee.com\VSO\mcscan32.dll does not exist
PASS   C:\Program Files\Mcafee.com\VSO\vsoeng.inf does not exist
PASS   C:\Program Files\Mcafee.com\VSO\signlic.txt does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcscan32.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsoeng.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\signlic.txt does not exist
PASS   C:\WINDOWS\system\MCSCAN32.VXD does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcscan32.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsoeng.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\signlic.txt does not exist
PASS   C:\Program Files\McAfee.com\VSO\mytilus.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\oasbin.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsengver.dll does not exist
PASS   C:\WINDOWS\system\vshinit.vxd does not exist
PASS   C:\WINDOWS\system\vshield.vxd does not exist
PASS   C:\WINDOWS\system\mcutil.vxd does not exist
PASS   C:\WINDOWS\system\mckrnl.vxd does not exist
PASS   C:\Program Files\McAfee.com\VSO\mytilus.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\oasbin.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsengver.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO
aiavfin.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO
aiavf5a.sys does not exist
PASS   C:\Program Files\McAfee.com\VSO
aiavf5i.sys does not exist
PASS   C:\Program Files\McAfee.com\VSO
aiavf5x.sys does not exist
PASS   C:\Program Files\McAfee.com\VSO
aiavf5x.cat does not exist
PASS   C:\Program Files\McAfee.com\VSO\McShield.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\ftl.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\oasbin.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsengver.dll does not exist
PASS   C:\WINDOWS\system\vshinit.vxd does not exist
PASS   C:\WINDOWS\system\vshield.vxd does not exist
PASS   C:\WINDOWS\system\mcutil.vxd does not exist
PASS   C:\WINDOWS\system\mckrnl.vxd does not exist
PASS   C:\Program Files\McAfee.com\VSO\client9x.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\oasbin.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsengver.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\McShield.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO
aiann.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO
tclient.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\ScanServ.dll does not exist
PASS   C:\WINDOWS\system32\drivers\NaiFsRec.sys does not exist
PASS   C:\WINDOWS\system32\drivers\NaiFiltr.sys does not exist
PASS   C:\Program Files\McAfee.com\VSO\NaiFiltr.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\Naifiltr.cat does not exist
PASS   C:\Program Files\McAfee.com\VSO\McShield.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO
aiann.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO
tclient.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\ScanServ.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\oasres.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\Res00\McShield.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\NAIEvent.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\oasres.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\NaiEvent.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\Res00\McShield.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\Res09\McShield.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\Res11\McShield.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO
aiann.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO
aiannps.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsps.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\oasclnt.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsshld.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsctl.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\edisk.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsoupd.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcmnhdlr.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsmap.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcavtsub.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsdiag.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vso.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcshld9x.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO
aiann.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO
aiannps.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsps.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\oasclnt.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsshld.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsctl.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\edisk.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsoupd.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcmnhdlr.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsmap.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcavtsub.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsdiag.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vso.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsrte.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsshld.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsctl.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\edisk.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsoupd.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcmnhdlr.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsmap.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcurial.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\PATCHW32.DLL does not exist
PASS   C:\Program Files\McAfee.com\VSO\vso.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcavtsub.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\scan.dat does not exist
PASS   C:\Program Files\McAfee.com\VSO\extra.dat does not exist
PASS   C:\Program Files\McAfee.com\VSO\Names.dat does not exist
PASS   C:\Program Files\McAfee.com\VSO\clean.dat does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsodat.inf does not exist
PASS   C:\Program Files\McAfee.com\Agent\uninst\vsoremui.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsocfg.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\ashldres.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsoui.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\mvsuicfg.dat does not exist
PASS   C:\Program Files\McAfee.com\VSO\config.ini does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsezres.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsez.adf does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvso.ui does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsoagnt.ui does not exist
PASS   C:\Program Files\McAfee.com\Agent\uninst\vsorem.ui does not exist
PASS   C:\Program Files\McAfee.com\VSO\config.ini does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsezres.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsez.adf does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvso.ui does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsoagnt.ui does not exist
PASS   C:\Program Files\McAfee.com\Agent\uninst\vsorem.ui does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsocfg.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\ashldres.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsoui.dll does not exist
PASS   C:\Program Files\McAfee.com\Agent\uninst\vsoremui.dll does not exist
PASS   C:\Program Files\McAfee.com\Agent\app\vso.adf does not exist
PASS   C:\Program Files\McAfee.com\VSO\vscfgui.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsowow.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vso.chm does not exist
PASS   C:\Program Files\McAfee.com\VSOeadme.txt does not exist
PASS   C:\Program Files\McAfee.com\VSO\vscfgui.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\vscfgw32.dll does not exist
PASS   C:\Program Files\McAfee.com\Agent\uninst\vscfgui.dll does not exist
PASS   C:\Program Files\McAfee.com\Agent\app\vso.adf does not exist
PASS   C:\Program Files\McAfee.com\VSO\vscfgui.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsowow.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vso.chm does not exist
PASS   C:\Program Files\McAfee.com\VSOeadme.txt does not exist
PASS   C:\Program Files\McAfee.com\VSO\vscfgui.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\vscfgw32.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsagntui.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsagntui.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsagntui.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsagntui.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcinsupd.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcinsupd.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcurial.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\PATCHW32.DLL does not exist
PASS   C:\Program Files\McAfee.com\VSO\outscan.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsolplg.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsolui.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\oscnbin.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\outscan.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\oscnbin.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\outscres.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\oscnres.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\outscres.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\oscnres.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsftsn.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\imscnbin.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsftsn.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\imscnbin.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\ftscnres.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\appinit.ini does not exist
PASS   C:\Program Files\McAfee.com\VSO\imscnres.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\ftscnres.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\appinit.ini does not exist
PASS   C:\Program Files\McAfee.com\VSO\imscnres.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsscrp.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\scrpsbin.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsscrp.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\scrpsbin.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\scrpres.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\scrstres.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\scrpres.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\scrstres.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\wormres.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\wrmstres.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\wormres.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\wrmstres.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsworm.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\wrmstbin.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsworm.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\wrmstbin.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\shlres.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\shextres.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\shlres.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\shextres.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsshl.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\shextbin.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsshl.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\shextbin.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\emscnres.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\emlscres.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\emscnres.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\emlscres.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\McVSEscn.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\McVSSkt.Dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\emlscbin.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\McVSEscn.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\McVSSkt.Dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\emlscbin.inf does not exist
INFO   Removing registry keys...
PASS   HKCR\Mccomctl.McDrives.1 does not exist
PASS   HKCR\Mccomctl.McDrives does not exist
PASS   HKCR\CLSID\{28E74E8D-7B99-4486-AE32-11B67F93B54B} removed successfully
PASS   HKCR\McComCtlLib.ListView.1 does not exist
PASS   HKCR\McComCtlLib.ListView does not exist
PASS   HKCR\CLSID\{B02F4EEB-78D3-414D-8814-7E88F4828C28} removed successfully
PASS   HKCR\McComCtlLib.ListItem.1 does not exist
PASS   HKCR\McComCtlLib.ListItem does not exist
PASS   HKCR\CLSID\{21DB24D5-9DD7-4F6F-993A-5FB0980EC5DB} removed successfully
PASS   HKCR\McComCtlLib.ListItems.1 does not exist
PASS   HKCR\McComCtlLib.ListItems does not exist
PASS   HKCR\CLSID\{3ED232B4-0346-4A74-A883-B85B69ADA6A4} removed successfully
PASS   HKCR\McComCtlLib.ColumnHeader.1 does not exist
PASS   HKCR\McComCtlLib.ColumnHeader does not exist
PASS   HKCR\CLSID\{C657669A-754D-4E13-BB96-B7269F2078F0} removed successfully
PASS   HKCR\McComCtlLib.ColumnHeaders.1 does not exist
PASS   HKCR\McComCtlLib.ColumnHeaders does not exist
PASS   HKCR\CLSID\{BF4C25B5-CD0A-4770-B2F5-750A4407957F} removed successfully
PASS   HKCR\McComCtlLib.ListItemsEnum.1 does not exist
PASS   HKCR\McComCtlLib.ListItemsEnum does not exist
PASS   HKCR\CLSID\{78D0C657-22F0-4E19-A34A-757B14A30344} removed successfully
PASS   HKCR\McComCtlLib.CheckedItems.1 does not exist
PASS   HKCR\McComCtlLib.CheckedItems does not exist
PASS   HKCR\CLSID\{0025F2F6-5458-478E-997C-76BBB056B3D6} removed successfully
PASS   HKCR\TypeLib\{6883B133-1B30-45E1-842F-B8670389559D} removed successfully
PASS   HKCR\Interface\{E4FB5840-B8F7-4F93-9760-FAD9327FF7BD} removed successfully
PASS   HKCR\Interface\{C5CDA713-B707-4F57-B9FA-CA0260B3CD26} removed successfully
PASS   HKCR\Interface\{2F9F27BF-E312-4FB4-A40D-BB132AFC9B19} removed successfully
PASS   HKCR\Interface\{7AD4839A-8823-4609-9112-CC8BA32E784B} removed successfully
PASS   HKCR\Interface\{DACD5044-3A96-49B2-8CB6-67FE1BE4FE01} removed successfully
PASS   HKCR\Interface\{15BA3DBA-E8F3-4C46-B362-871CF2E519D0} removed successfully
PASS   HKCR\Interface\{AA50CEBD-A503-4A3A-AAA9-DF6692792030} removed successfully
PASS   HKCR\Interface\{B3CF9F69-D365-4502-BA10-7123BB677F1A} removed successfully
PASS   HKCR\Interface\{9749CEC5-FD85-470F-9500-4B2FC431C816} removed successfully
PASS   HKCR\Interface\{66338027-0A5A-4BA2-B481-195A8CFB66F0} removed successfully
PASS   HKCR\Mccomctl.McDrives.1 does not exist
PASS   HKCR\Mccomctl.McDrives does not exist
PASS   HKCR\CLSID\{28E74E8D-7B99-4486-AE32-11B67F93B54B} does not exist
PASS   HKCR\McComCtlLib.ListView.1 does not exist
PASS   HKCR\McComCtlLib.ListView does not exist
PASS   HKCR\CLSID\{B02F4EEB-78D3-414D-8814-7E88F4828C28} does not exist
PASS   HKCR\McComCtlLib.ListItem.1 does not exist
PASS   HKCR\McComCtlLib.ListItem does not exist
PASS   HKCR\CLSID\{21DB24D5-9DD7-4F6F-993A-5FB0980EC5DB} does not exist
PASS   HKCR\McComCtlLib.ListItems.1 does not exist
PASS   HKCR\McComCtlLib.ListItems does not exist
PASS   HKCR\CLSID\{3ED232B4-0346-4A74-A883-B85B69ADA6A4} does not exist
PASS   HKCR\McComCtlLib.ColumnHeader.1 does not exist
PASS   HKCR\McComCtlLib.ColumnHeader does not exist
PASS   HKCR\CLSID\{C657669A-754D-4E13-BB96-B7269F2078F0} does not exist
PASS   HKCR\McComCtlLib.ColumnHeaders.1 does not exist
PASS   HKCR\McComCtlLib.ColumnHeaders does not exist
PASS   HKCR\CLSID\{BF4C25B5-CD0A-4770-B2F5-750A4407957F} does not exist
PASS   HKCR\McComCtlLib.ListItemsEnum.1 does not exist
PASS   HKCR\McComCtlLib.ListItemsEnum does not exist
PASS   HKCR\CLSID\{78D0C657-22F0-4E19-A34A-757B14A30344} does not exist
PASS   HKCR\McComCtlLib.CheckedItems.1 does not exist
PASS   HKCR\McComCtlLib.CheckedItems does not exist
PASS   HKCR\CLSID\{0025F2F6-5458-478E-997C-76BBB056B3D6} does not exist
PASS   HKCR\TypeLib\{6883B133-1B30-45E1-842F-B8670389559D} does not exist
PASS   HKCR\Interface\{E4FB5840-B8F7-4F93-9760-FAD9327FF7BD} does not exist
PASS   HKCR\Interface\{C5CDA713-B707-4F57-B9FA-CA0260B3CD26} does not exist
PASS   HKCR\Interface\{2F9F27BF-E312-4FB4-A40D-BB132AFC9B19} does not exist
PASS   HKCR\Interface\{7AD4839A-8823-4609-9112-CC8BA32E784B} does not exist
PASS   HKCR\Interface\{DACD5044-3A96-49B2-8CB6-67FE1BE4FE01} does not exist
PASS   HKCR\Interface\{15BA3DBA-E8F3-4C46-B362-871CF2E519D0} does not exist
PASS   HKCR\Interface\{AA50CEBD-A503-4A3A-AAA9-DF6692792030} does not exist
PASS   HKCR\Interface\{B3CF9F69-D365-4502-BA10-7123BB677F1A} does not exist
PASS   HKCR\Interface\{9749CEC5-FD85-470F-9500-4B2FC431C816} does not exist
PASS   HKCR\Interface\{66338027-0A5A-4BA2-B481-195A8CFB66F0} does not exist
PASS   HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\VirusScan Online does not exist
PASS   HKLM\SOFTWARE\McAfee\McAfee Internet Security\CurrentVersion\Setup\Features\VSO does not exist
PASS   HKLM\Software\Microsoft\Windows\CurrentVersion\Run\VirusScan OnlineHKLM\SOFTWARE\Network Associates\TVD does not exist
PASS   HKLM\SOFTWARE\McAfee.com\VirusScan Online does not exist
PASS   HKLM\Software\McAfee.com\Agent\Apps\VSO does not exist
PASS   HKLM\Software\Microsoft\Windows\CurrentVersion\Run\VSOCheckTask does not exist
PASS   HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\McVsRte;mcvsshld.exe does not exist
PASS   HKCR\CLSID\{692E988D-1057-4c57-8078-26CF7AE54263} does not exist
PASS   HKCR\AppID\{E35C5833-F723-4e16-84B0-2A036F264495} does not exist
PASS   HKCR\AppID\mcvsshld.exe does not exist
PASS   HKCR\TypeLib\{767880B0-68B8-4BF2-B360-3B8FF576C9C0} does not exist
PASS   HKCR\Interface\{782234D2-8554-469F-8325-DE801192DE8B} does not exist
PASS   HKCR\Interface\{C0F40D16-DC87-49E1-98AF-5A325B753AB1} does not exist
PASS   HKCR\CLSID\{b3326110-966a-4609-b3ca-c98a2a8016d9} does not exist
PASS   HKCR\AppID\{046a85cb-74fd-4569-b65c-42f698d27951} does not exist
PASS   HKCR\AppID\MCVSESCN.EXE does not exist
PASS   HKCR\TypeLib\{6CDE43F1-0F87-48A5-AE6D-092AEF09D254} does not exist
PASS   HKCR\Interface\{97238F26-7083-47CB-A493-26D9BB5C39A6} does not exist
PASS   HKCR\Interface\{52EF1B22-46F2-4B32-8B21-1A8FCB934A08} does not exist
PASS   HKCR\CLSID\{0fe38286-7e18-44c5-902e-df07775bb705} does not exist
PASS   HKCR\AppID\{{F96E8AC6-24BF-4cff-9311-D66BD50677C7}} does not exist
PASS   HKCR\AppID\MCVSIMSN.EXE does not exist
PASS   HKCR\CLSID\{000209FF-0000-0000-C000-000000000046} does not exist
PASS   HKCR\CLSID\{0006F033-0000-0000-C000-000000000046} does not exist
PASS   HKCR\CLSID\{0006F03A-0000-0000-C000-000000000046} does not exist
PASS   HKLM\Software\Microsoft\Internet Explorer\Toolbar does not exist
PASS   HKCR\McVsShl.VSCContextMenu.1 does not exist
PASS   HKCR\McVsShl.VSCContextMenu does not exist
PASS   HKCR\CLSID\{CFC7205E-2792-4378-9591-3879CC6C9022} does not exist
PASS   HKCR\*\shellex\ContextMenuHandlers\{CFC7205E-2792-4378-9591-3879CC6C9022} does not exist
PASS   HKCR\Drive\shellex\ContextMenuHandlers\{CFC7205E-2792-4378-9591-3879CC6C9022} does not exist
PASS   HKCR\file\Shellex does not exist
PASS   HKCR\Folder\shellex\ContextMenuHandlers\{CFC7205E-2792-4378-9591-3879CC6C9022} does not exist
PASS   HKCR\McVsShl.VSCDeskBand.1 does not exist
PASS   HKCR\McVsShl.VSCDeskBand does not exist
PASS   HKCR\CLSID\{BA52B914-B692-46c4-B683-905236F6F655} does not exist
PASS   HKCR\TypeLib\{FD5D5AC2-8415-4936-B4AC-114101229161} does not exist
PASS   HKCR\Interface\{4E79FFAF-E07C-4F62-936D-04B02BA0250C} does not exist
PASS   HKLM\SOFTWARE\Microsoft\Exchange\Client\Extensions\McAfee VirusScan Outlook Email Scanner does not exist
PASS   HKCR\CLSID\{B5CD01E6-C55C-4070-B823-C4A4FBACF0BE}HKLM\Software\Microsoft\Exchange\Client\Extensions\McAfee VirusScan Outlook Email Scanner does not exist
PASS   HKLM\SYSTEM\CurrentControlSet\Services\NaiAvFilter1 does not exist
PASS   HKLM\SYSTEM\CurrentControlSet\Services\NaiFiltr does not exist
PASS   HKLM\System\CurrentControlSet\Services\EventLog\System\NaiFiltr does not exist
PASS   HKLM\SOFTWARE\Network Associates\TVD\Shared Components\VirusScan Engine\4.0.xx does not exist
PASS   HKLM\SOFTWARE\Network Associates\TVD\Shared Components\VirusScan Engine\4.0.xx does not exist
PASS   HKLM\SYSTEM\CurrentControlSet\Services\VxD\VshInit does not exist
PASS   HKLM\Software\McAfee\VSCore does not exist
PASS   HKLM\Software\Network Associates\TVD does not exist
PASS   HKLM\SYSTEM\CurrentControlSet\Services\VxD\VshInit does not exist
PASS   HKLM\Software\McAfee\VSCore does not exist
PASS   HKLM\Software\Network Associates\TVD does not exist
PASS   HKLM\SYSTEM\CurrentControlSet\Services\NaiFsRec does not exist
PASS   HKLM\SYSTEM\CurrentControlSet\Services\VxD\VshInit does not exist
PASS   HKLM\SYSTEM\CurrentControlSet\Services\NaiFsRec does not exist
PASS   HKLM\SYSTEM\CurrentControlSet\Services\VxD\VshInit does not exist
PASS   HKLM\SYSTEM\CurrentControlSet\Services\McShield\Performance does not exist
PASS   HKLM\SOFTWARE\Network Associates\TVD\Shared Components\On Access Scanner\McShield\Configuration does not exist
PASS   HKLM\System\CurrentControlSet\Services\EventLog\Application\McLogEvent does not exist
PASS   HKLM\Software\Microsoft\Windows\CurrentVersion\Run\VSOCheckTask does not exist
PASS   HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\VirusScan Online does not exist
PASS   HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\McShld9x does not exist
PASS   HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\OASClnt does not exist
PASS   HKLM\SOFTWARE\McAfee.com\VirusScan Online does not exist
PASS   HKLM\Software\McAfee.com\Agent\Apps\VSO does not exist
PASS   HKCR\AppID\{DECBF619-9830-47CD-870E-975F7FBC28BC} does not exist
PASS   HKCR\AppID\McShield.exe does not exist
PASS   HKCR\CLSID\{1363FF65-F4D7-4A35-8DFD-BA9AFAAE6855} does not exist
PASS   HKCR\Interface\{1363FF65-F4D7-4A35-8DFD-BA9AFAAE6855} does not exist
PASS   HKCR\Interface\{DEC2F66D-C505-40D2-B574-AA04FB57F312} does not exist
PASS   HKCR\TypeLib\{A591F293-0DB9-4241-B82A-FD754A9370C4} does not exist
PASS   HKCR\Interface\{678EB2A8-C6EB-44E4-A069-029008E82E33} does not exist
PASS   HKCR\Interface\{69434B5E-9D4B-4F40-8CBF-5400AA81D43A} does not exist
PASS   HKCR\Interface\{38183A1A-D279-4DB5-8C80-2535070CED16} does not exist
PASS   HKCR\Interface\{90FD3C81-2B44-43DD-B93C-80CC798F10EB} does not exist
PASS   HKCR\CLSID\{A448CD02-4566-442F-BDA8-70FCF9FEAF66} does not exist
PASS   HKCR\Interface\{A448CD02-4566-442F-BDA8-70FCF9FEAF66} does not exist
PASS   HKCR\Interface\{B9932C12-8820-4079-8810-8A3472FD8B77} does not exist
PASS   HKCR\Interface\{03984113-B497-4649-AEA1-9686D77639F0} does not exist
PASS   HKCR\Interface\{38183A1A-D279-4DB5-8C80-2535070CED16} does not exist
PASS   HKCR\Interface\{E2094A26-2FE1-41D3-A250-075ED30C94B9} does not exist
PASS   HKCR\Interface\{F281EC2B-3A72-48C9-B1F0-EDB9F757F066} does not exist
PASS   HKCR\Interface\{14ADF94F-AF37-42A2-A385-77408F0D56CB} does not exist
PASS   HKCR\Interface\{EDB2A953-DD1A-4CB9-8083-C025746803BE} does not exist
PASS   HKCR\Interface\{69434B5E-9D4B-4F40-8CBF-5400AA81D43A} does not exist
PASS   HKCR\Interface\{B1B03581-70F8-4017-9731-D25A84DDD501} does not exist
PASS   HKCR\Interface\{90FD3C81-2B44-43DD-B93C-80CC798F10EB} does not exist
PASS   HKCR\Interface\{7B39DC96-AF1A-4DDA-B6B3-2F93E993FD1F} does not exist
PASS   HKCR\Interface\{678EB2A8-C6EB-44E4-A069-029008E82E33} does not exist
PASS   HKCR\CLSID\{692E988D-1057-4c57-8078-26CF7AE54263} does not exist
PASS   HKCR\AppID\{E35C5833-F723-4e16-84B0-2A036F264495} does not exist
PASS   HKCR\AppID\mcvsshld.exe does not exist
PASS   HKCR\TypeLib\{DFF46858-8BA5-495C-90F4-D84307D53B73} does not exist
PASS   HKCR\Interface\{BCB840C7-0A91-4EBB-B068-77DCC6DC0484} does not exist
PASS   HKCR\Interface\{2AF95700-C640-4EAF-97D1-EF8F9C89947D} does not exist
PASS   HKCR\Interface\{A4020C1D-5C61-40DE-B7F7-E81C5F07EDF5} does not exist
PASS   HKCR\Interface\{A047BA7D-4CE7-4106-941F-8867DC3D1AEE} does not exist
PASS   HKCR\Interface\{64B40203-AB55-48A4-852A-522A6C756B8E} does not exist
PASS   HKCR\Interface\{84288364-C325-40D3-B421-54EE8F9437DB} does not exist
PASS   HKCR\Interface\{65CC00CD-7083-4E72-88FD-3EACB4C1BE36} does not exist
PASS   HKCR\Interface\{64970E7D-9860-45F2-892C-830956ADC7E1} does not exist
PASS   HKCR\McAfee.com.MCVSScan.1 does not exist
PASS   HKCR\McAfee.MCVSScan does not exist
PASS   HKCR\CLSID\{B793DE5F-29C9-440c-A9E2-4644145DDD3D} does not exist
PASS   HKCR\McAfee.com.MCVSQTColl.1 does not exist
PASS   HKCR\McAfee.MCVSScan does not exist
PASS   HKCR\CLSID\{7DC23152-6B5E-4A65-B42E-AE5AC4199577} does not exist
PASS   HKLM\SOFTWARE\McAfee.com\VirusScan Online does not exist
PASS   HKCR\Vsoupd.MCVSProperties.1 does not exist
PASS   HKCR\Vsoupd.MCVSProperties does not exist
PASS   HKCR\CLSID\{510C5313-D85C-4307-95FB-AC87A2D3743F} does not exist
PASS   HKCR\Vsoupd.MCVSPropNotify does not exist
PASS   HKCR\CLSID\{55F94612-19DD-4C2E-9E1F-E26624933DAD} does not exist
PASS   HKCR\Vsoupd.MCVSUpdate.1 does not exist
PASS   HKCR\Vsoupd.MCVSUpdate does not exist
PASS   HKCR\CLSID\{6950611A-E2CF-421f-88C3-61C27A3832C5} does not exist
PASS   HKCR\Vsoupd.VSOInfoObject.1 does not exist
PASS   HKCR\Vsoupd.VSOInfoObject does not exist
PASS   HKCR\CLSID\{1BCD38AE-A539-40D6-B448-04F20D47433F} does not exist
PASS   HKCR\TypeLib\{16D183F4-86B7-40A0-944C-A70D5E94B2C4} does not exist
PASS   HKCR\Interface\{7580CD96-1075-4ECC-A67C-5D339D94B089} does not exist
PASS   HKCR\Interface\{88CC8C77-D7DB-411D-83BC-9DD12DBBB77B} does not exist
PASS   HKLM\SOFTWARE\McAfee.com\VirusScan Online does not exist
PASS   HKCR\Vsoupd.MCVSProperties.1 does not exist
PASS   HKCR\Vsoupd.MCVSProperties does not exist
PASS   HKCR\CLSID\{510C5313-D85C-4307-95FB-AC87A2D3743F} does not exist
PASS   HKCR\Vsoupd.MCVSPropNotify.1 does not exist
PASS   HKCR\Vsoupd.MCVSPropNotify does not exist
PASS   HKCR\CLSID\{55F94612-19DD-4C2E-9E1F-E26624933DAD} does not exist
PASS   HKCR\Vsoupd.MCVSUpdate.1 does not exist
PASS   HKCR\Vsoupd.MCVSUpdate does not exist
PASS   HKCR\CLSID\{6950611A-E2CF-421f-88C3-61C27A3832C5} does not exist
PASS   HKCR\Vsoupd.VSOInfoObject.1 does not exist
PASS   HKCR\Vsoupd.VSOInfoObject does not exist
PASS   HKCR\CLSID\{1BCD38AE-A539-40D6-B448-04F20D47433F} does not exist
PASS   HKCR\TypeLib\{16D183F4-86B7-40A0-944C-A70D5E94B2C4} does not exist
PASS   HKCR\Interface\{7580CD96-1075-4ECC-A67C-5D339D94B089} does not exist
PASS   HKCR\Interface\{88CC8C77-D7DB-411D-83BC-9DD12DBBB77B} does not exist
PASS   HKCR\CLSID\{B83E7402-2227-403a-BEBC-773F5E0D1F1B} does not exist
PASS   HKCR\AppID\{CCB622E5-5327-4a2b-A020-D90DCF82676A} does not exist
PASS   HKCR\TypeLib\{2A1AFECE-5CDC-4636-A582-8BD2D060C322} does not exist
PASS   HKCR\Interface\{7C4BCFA8-7668-4592-BDBE-28776C0881B9} does not exist
PASS   HKCR\Interface\{5C0ED3BD-00BC-4BCF-B2A2-95D4F5A3DA81} does not exist
PASS   HKCR\CLSID\{4B00087D-8CDC-4b77-A9D5-4C50150FEDF4} does not exist
PASS   HKCR\AppID\{716B6046-3784-4bc0-94AB-EA18030F1116} does not exist
PASS   HKCR\AppID\MCVSMAP.EXE does not exist
PASS   HKLM\Software\Microsoft\Windows\CurrentVersion\Run\VSOCheckTask does not exist
PASS   HKLM\Software\Microsoft\Windows\CurrentVersion\Run\VirusScan Online does not exist
PASS   HKLM\Software\Microsoft\Windows\CurrentVersion\Run\OASClnt does not exist
PASS   HKLM\SOFTWARE\McAfee.com\VirusScan Online does not exist
PASS   HKLM\SOFTWARE\McAfee\VirusScan Online does not exist
PASS   HKLM\Software\McAfee.com\Agent\Apps\VSO does not exist
PASS   HKCR\AppID\{DECBF619-9830-47CD-870E-975F7FBC28BC} does not exist
PASS   HKCR\AppID\McShield.exe does not exist
PASS   HKCR\CLSID\{1363FF65-F4D7-4A35-8DFD-BA9AFAAE6855} does not exist
PASS   HKCR\Interface\{1363FF65-F4D7-4A35-8DFD-BA9AFAAE6855} does not exist
PASS   HKCR\Interface\{DEC2F66D-C505-40D2-B574-AA04FB57F312} does not exist
PASS   HKCR\TypeLib\{A591F293-0DB9-4241-B82A-FD754A9370C4} does not exist
PASS   HKCR\Interface\{678EB2A8-C6EB-44E4-A069-029008E82E33} does not exist
PASS   HKCR\Interface\{69434B5E-9D4B-4F40-8CBF-5400AA81D43A} does not exist
PASS   HKCR\Interface\{38183A1A-D279-4DB5-8C80-2535070CED16} does not exist
PASS   HKCR\Interface\{90FD3C81-2B44-43DD-B93C-80CC798F10EB} does not exist
PASS   HKCR\CLSID\{A448CD02-4566-442F-BDA8-70FCF9FEAF66} does not exist
PASS   HKCR\Interface\{A448CD02-4566-442F-BDA8-70FCF9FEAF66} does not exist
PASS   HKCR\Interface\{B9932C12-8820-4079-8810-8A3472FD8B77} does not exist
PASS   HKCR\Interface\{03984113-B497-4649-AEA1-9686D77639F0} does not exist
PASS   HKCR\Interface\{38183A1A-D279-4DB5-8C80-2535070CED16} does not exist
PASS   HKCR\Interface\{E2094A26-2FE1-41D3-A250-075ED30C94B9} does not exist
PASS   HKCR\Interface\{F281EC2B-3A72-48C9-B1F0-EDB9F757F066} does not exist
PASS   HKCR\Interface\{14ADF94F-AF37-42A2-A385-77408F0D56CB} does not exist
PASS   HKCR\Interface\{EDB2A953-DD1A-4CB9-8083-C025746803BE} does not exist
PASS   HKCR\Interface\{69434B5E-9D4B-4F40-8CBF-5400AA81D43A} does not exist
PASS   HKCR\Interface\{B1B03581-70F8-4017-9731-D25A84DDD501} does not exist
PASS   HKCR\Interface\{90FD3C81-2B44-43DD-B93C-80CC798F10EB} does not exist
PASS   HKCR\Interface\{7B39DC96-AF1A-4DDA-B6B3-2F93E993FD1F} does not exist
PASS   HKCR\Interface\{678EB2A8-C6EB-44E4-A069-029008E82E33} does not exist
PASS   HKCR\CLSID\{692E988D-1057-4c57-8078-26CF7AE54263} does not exist
PASS   HKCR\AppID\{E35C5833-F723-4e16-84B0-2A036F264495} does not exist
PASS   HKCR\AppID\mcvsshld.exe does not exist
PASS   HKCR\TypeLib\{DFF46858-8BA5-495C-90F4-D84307D53B73} does not exist
PASS   HKCR\Interface\{BCB840C7-0A91-4EBB-B068-77DCC6DC0484} does not exist
PASS   HKCR\Interface\{2AF95700-C640-4EAF-97D1-EF8F9C89947D} does not exist
PASS   HKCR\Interface\{A4020C1D-5C61-40DE-B7F7-E81C5F07EDF5} does not exist
PASS   HKCR\Interface\{A047BA7D-4CE7-4106-941F-8867DC3D1AEE} does not exist
PASS   HKCR\Interface\{64B40203-AB55-48A4-852A-522A6C756B8E} does not exist
PASS   HKCR\Interface\{84288364-C325-40D3-B421-54EE8F9437DB} does not exist
PASS   HKCR\Interface\{65CC00CD-7083-4E72-88FD-3EACB4C1BE36} does not exist
PASS   HKCR\Interface\{64970E7D-9860-45F2-892C-830956ADC7E1} does not exist
PASS   HKCR\McAfee.com.MCVSScan.1 does not exist
PASS   HKCR\McAfee.MCVSScan does not exist
PASS   HKCR\CLSID\{B793DE5F-29C9-440c-A9E2-4644145DDD3D} does not exist
PASS   HKCR\McAfee.com.MCVSQTColl.1 does not exist
PASS   HKCR\McAfee.MCVSScan does not exist
PASS   HKCR\CLSID\{7DC23152-6B5E-4A65-B42E-AE5AC4199577} does not exist
PASS   HKLM\SOFTWARE\McAfee.com\VirusScan Online does not exist
PASS   HKCR\Vsoupd.MCVSProperties.1 does not exist
PASS   HKCR\Vsoupd.MCVSProperties does not exist
PASS   HKCR\CLSID\{510C5313-D85C-4307-95FB-AC87A2D3743F} does not exist
PASS   HKCR\Vsoupd.MCVSPropNotify does not exist
PASS   HKCR\CLSID\{55F94612-19DD-4C2E-9E1F-E26624933DAD} does not exist
PASS   HKCR\Vsoupd.MCVSUpdate.1 does not exist
PASS   HKCR\Vsoupd.MCVSUpdate does not exist
PASS   HKCR\CLSID\{6950611A-E2CF-421f-88C3-61C27A3832C5} does not exist
PASS   HKCR\Vsoupd.VSOInfoObject.1 does not exist
PASS   HKCR\Vsoupd.VSOInfoObject does not exist
PASS   HKCR\CLSID\{1BCD38AE-A539-40D6-B448-04F20D47433F} does not exist
PASS   HKCR\TypeLib\{16D183F4-86B7-40A0-944C-A70D5E94B2C4} does not exist
PASS   HKCR\Interface\{7580CD96-1075-4ECC-A67C-5D339D94B089} does not exist
PASS   HKCR\Interface\{88CC8C77-D7DB-411D-83BC-9DD12DBBB77B} does not exist
PASS   HKLM\SOFTWARE\McAfee.com\VirusScan Online does not exist
PASS   HKCR\Vsoupd.MCVSProperties.1 does not exist
PASS   HKCR\Vsoupd.MCVSProperties does not exist
PASS   HKCR\CLSID\{510C5313-D85C-4307-95FB-AC87A2D3743F} does not exist
PASS   HKCR\Vsoupd.MCVSPropNotify.1 does not exist
PASS   HKCR\Vsoupd.MCVSPropNotify does not exist
PASS   HKCR\CLSID\{55F94612-19DD-4C2E-9E1F-E26624933DAD} does not exist
PASS   HKCR\Vsoupd.MCVSUpdate.1 does not exist
PASS   HKCR\Vsoupd.MCVSUpdate does not exist
PASS   HKCR\CLSID\{6950611A-E2CF-421f-88C3-61C27A3832C5} does not exist
PASS   HKCR\Vsoupd.VSOInfoObject.1 does not exist
PASS   HKCR\Vsoupd.VSOInfoObject does not exist
PASS   HKCR\CLSID\{1BCD38AE-A539-40D6-B448-04F20D47433F} does not exist
PASS   HKCR\TypeLib\{16D183F4-86B7-40A0-944C-A70D5E94B2C4} does not exist
PASS   HKCR\Interface\{7580CD96-1075-4ECC-A67C-5D339D94B089} does not exist
PASS   HKCR\Interface\{88CC8C77-D7DB-411D-83BC-9DD12DBBB77B} does not exist
PASS   HKCR\CLSID\{B83E7402-2227-403a-BEBC-773F5E0D1F1B} does not exist
PASS   HKCR\AppID\{CCB622E5-5327-4a2b-A020-D90DCF82676A} does not exist
PASS   HKCR\TypeLib\{2A1AFECE-5CDC-4636-A582-8BD2D060C322} does not exist
PASS   HKCR\Interface\{7C4BCFA8-7668-4592-BDBE-28776C0881B9} does not exist
PASS   HKCR\Interface\{5C0ED3BD-00BC-4BCF-B2A2-95D4F5A3DA81} does not exist
PASS   HKCR\CLSID\{4B00087D-8CDC-4b77-A9D5-4C50150FEDF4} does not exist
PASS   HKCR\AppID\{716B6046-3784-4bc0-94AB-EA18030F1116} does not exist
PASS   HKCR\AppID\MCVSMAP.EXE does not exist
PASS   HKCR\TypeLib\{D65DE395-1306-4892-BF78-627C7E15B678} does not exist
PASS   HKCR\Interface\{33401868-5E15-4E85-B4CF-F5F38760859E} does not exist
PASS   HKCR\Interface\{CF5BF0B6-AC09-4013-AB73-C2CB19E3C052} does not exist
PASS   HKCR\Interface\{4B1CEC4A-70A9-4DDE-A458-AD6087D9E994} does not exist
PASS   HKCR\Interface\{E713D51C-48DA-4FF0-BD42-80867A053464} does not exist
PASS   HKCR\CLSID\{305F5F49-F5B1-4501-BDDF-712C5E67154A} does not exist
PASS   HKCR\AppID\{B39A807E-9ED1-48b9-BF0D-2FADE4302288} does not exist
PASS   HKCR\AppID\MCVSRTE.EXE does not exist
PASS   HKLM\SYSTEM\ControlSet001\Enum\ROOT\LEGACY_NAIFILTR does not exist
PASS   HKLM\SYSTEM\ControlSet001\Enum\ROOT\LEGACY_NAIFSREC does not exist
PASS   HKLM\SYSTEM\ControlSet001\Enum\ROOT\LEGACY_MCSHIELD does not exist
PASS   HKCR\TypeLib\{DFF46858-8BA5-495C-90F4-D84307D53B73} does not exist
PASS   HKCR\Interface\{BCB840C7-0A91-4EBB-B068-77DCC6DC0484} does not exist
PASS   HKCR\Interface\{2AF95700-C640-4EAF-97D1-EF8F9C89947D} does not exist
PASS   HKCR\Interface\{A4020C1D-5C61-40DE-B7F7-E81C5F07EDF5} does not exist
PASS   HKCR\Interface\{A047BA7D-4CE7-4106-941F-8867DC3D1AEE} does not exist
PASS   HKCR\Interface\{64B40203-AB55-48A4-852A-522A6C756B8E} does not exist
PASS   HKCR\Interface\{84288364-C325-40D3-B421-54EE8F9437DB} does not exist
PASS   HKCR\Interface\{65CC00CD-7083-4E72-88FD-3EACB4C1BE36} does not exist
PASS   HKCR\Interface\{64970E7D-9860-45F2-892C-830956ADC7E1} does not exist
PASS   HKCR\McAfee.com.MCVSScan.1 does not exist
PASS   HKCR\McAfee.MCVSScan does not exist
PASS   HKCR\CLSID\{B793DE5F-29C9-440c-A9E2-4644145DDD3D} does not exist
PASS   HKCR\McAfee.com.MCVSQTColl.1 does not exist
PASS   HKCR\CLSID\{7DC23152-6B5E-4A65-B42E-AE5AC4199577} does not exist
PASS   HKCR\EDisk2.MgEdisk.1 does not exist
PASS   HKCR\EDisk2.MgEdisk does not exist
PASS   HKCR\CLSID\{340A0150-9DC7-11D3-9A01-005004677EF4} does not exist
PASS   HKCR\TypeLib\{340A0143-9DC7-11D3-9A01-005004677EF4} does not exist
PASS   HKCR\Interface\{340A0151-9DC7-11D3-9A01-005004677EF4} does not exist
PASS   HKCR\Interface\{340A014F-9DC7-11D3-9A01-005004677EF4} does not exist
PASS   HKLM\SOFTWARE\McAfee.com\VirusScan Online does not exist
PASS   HKCR\Vsoupd.MCVSProperties.1 does not exist
PASS   HKCR\Vsoupd.MCVSProperties does not exist
PASS   HKCR\CLSID\{510C5313-D85C-4307-95FB-AC87A2D3743F} does not exist
PASS   HKCR\Vsoupd.MCVSPropNotify.1 does not exist
PASS   HKCR\Vsoupd.MCVSPropNotify does not exist
PASS   HKCR\CLSID\{55F94612-19DD-4C2E-9E1F-E26624933DAD} does not exist
PASS   HKCR\Vsoupd.MCVSUpdate.1 does not exist
PASS   HKCR\Vsoupd.MCVSUpdate does not exist
PASS   HKCR\CLSID\{6950611A-E2CF-421f-88C3-61C27A3832C5} does not exist
PASS   HKCR\Vsoupd.VSOInfoObject.1 does not exist
PASS   HKCR\Vsoupd.VSOInfoObject does not exist
PASS   HKCR\CLSID\{1BCD38AE-A539-40D6-B448-04F20D47433F} does not exist
PASS   HKCR\TypeLib\{16D183F4-86B7-40A0-944C-A70D5E94B2C4} does not exist
PASS   HKCR\Interface\{7580CD96-1075-4ECC-A67C-5D339D94B089} does not exist
PASS   HKCR\Interface\{88CC8C77-D7DB-411D-83BC-9DD12DBBB77B} does not exist
PASS   HKCR\CLSID\{B83E7402-2227-403a-BEBC-773F5E0D1F1B} does not exist
PASS   HKCR\AppID\{CCB622E5-5327-4a2b-A020-D90DCF82676A} does not exist
PASS   HKCR\TypeLib\{2A1AFECE-5CDC-4636-A582-8BD2D060C322} does not exist
PASS   HKCR\Interface\{7C4BCFA8-7668-4592-BDBE-28776C0881B9} does not exist
PASS   HKCR\Interface\{5C0ED3BD-00BC-4BCF-B2A2-95D4F5A3DA81} does not exist
PASS   HKCR\CLSID\{4B00087D-8CDC-4b77-A9D5-4C50150FEDF4} does not exist
PASS   HKCR\AppID\{716B6046-3784-4bc0-94AB-EA18030F1116} does not exist
PASS   HKCR\AppID\MCVSMAP.EXE does not exist
PASS   HKLM\Software\McAfee\VSCore\Email Scanner\Outlook does not exist
INFO   Removing directory...
PASS   C:\Documents and Settings\All Users\Menu Démarrer\Programmes\McAfee\McAfee VirusScan does not exist
INFO   Removing directory...
PASS   C:\Program Files\McAfee.com\VSO does not exist
INFO   Removing directory...
PASS   C:\Documents and Settings\All Users\Application Data\McAfee.com\VSO does not exist
INFO   Removing files...
PASS   C:\Program Files\McAfee.com\VSO\ediskimg.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\804mbd1.chk does not exist
PASS   C:\Program Files\McAfee.com\VSO\804mbd1.IMG does not exist
PASS   C:\Program Files\McAfee.com\VSO\ediskimg.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\804mbd1.chk does not exist
PASS   C:\Program Files\McAfee.com\VSO\804mbd1.IMG does not exist
PASS   C:\Program Files\McAfee.com\Shared\mccomctl.dll does not exist
PASS   C:\Program Files\McAfee.com\Shared\mccomctl.inf does not exist
PASS   C:\Program Files\McAfee.com\Shared\mccomctl.dll does not exist
PASS   C:\Program Files\McAfee.com\Shared\mccomctl.inf does not exist
PASS   C:\Documents and Settings\NetworkService\Bureau\McAfee.com Scan For Viruses.lnk does not exist
PASS   C:\Documents and Settings\NetworkService\Bureau\McAfee ±½´y¯f¬r.lnk does not exist
PASS   C:\Documents and Settings\NetworkService\Bureau\McAfee Auf Viren überprüfen.lnk does not exist
PASS   C:\Documents and Settings\NetworkService\Bureau\McAfee Scan.lnk does not exist
PASS   C:\Documents and Settings\NetworkService\Bureau\McAfee Scan For Viruses.lnk does not exist
PASS   C:\Documents and Settings\NetworkService\Bureau\McAfee Detectar virus does not exist
PASS   C:\Documents and Settings\NetworkService\Bureau\McAfee Analyse antivirus does not exist
PASS   C:\Documents and Settings\NetworkService\Bureau\McAfee Ricerca virus does not exist
PASS   C:\Documents and Settings\NetworkService\Bureau\McAfee ƒEƒCƒ‹ƒX‚ÌƒXƒLƒƒƒ“.lnk does not exist
PASS   C:\Documents and Settings\NetworkService\Bureau\McAfee ƒEƒCƒ‹ƒX ƒXƒLƒƒƒ“.lnk does not exist
PASS   C:\Documents and Settings\NetworkService\Bureau\McAfee Scannen op virussen does not exist
PASS   C:\Documents and Settings\NetworkService\Bureau\McAfee Verificar a Existência de Vírus does not exist
PASS   C:\Documents and Settings\All Users\Bureau\McAfee.com Scan For Viruses.lnk does not exist
PASS   C:\Documents and Settings\All Users\Bureau\McAfee ±½´y¯f¬r.lnk does not exist
PASS   C:\Documents and Settings\All Users\Bureau\McAfee Auf Viren überprüfen.lnk does not exist
PASS   C:\Documents and Settings\All Users\Bureau\McAfee Scan.lnk does not exist
PASS   C:\Documents and Settings\All Users\Bureau\McAfee Scan For Viruses.lnk does not exist
PASS   C:\Documents and Settings\All Users\Bureau\McAfee Detectar virus does not exist
PASS   C:\Documents and Settings\All Users\Bureau\McAfee Analyse antivirus does not exist
PASS   C:\Documents and Settings\All Users\Bureau\McAfee Ricerca virus does not exist
PASS   C:\Documents and Settings\All Users\Bureau\McAfee ƒEƒCƒ‹ƒX‚ÌƒXƒLƒƒƒ“.lnk does not exist
PASS   C:\Documents and Settings\All Users\Bureau\McAfee ƒEƒCƒ‹ƒX ƒXƒLƒƒƒ“.lnk does not exist
PASS   C:\Documents and Settings\All Users\Bureau\McAfee Scannen op virussen does not exist
PASS   C:\Documents and Settings\All Users\Bureau\McAfee Verificar a Existência de Vírus does not exist
PASS   C:\Documents and Settings\NetworkService\Bureau\McAfee\McAfee VirusScan does not exist
PASS   C:\Documents and Settings\All Users\Menu Démarrer\Programmes\McAfee\McAfee VirusScan does not exist
PASS   C:\Program Files\McAfee.com\VSO\unicows.dll does not exist
PASS   C:\Program Files\McAfee.com\VSOedist.txt does not exist
PASS   C:\Program Files\McAfee.com\VSO\license.txt does not exist
PASS   C:\Program Files\McAfee.com\VSO\oasres.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\emscnres.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\emlscres.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\McVSEscn.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\McVSSkt.Dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\emlscbin.inf%PROGRAMFILES%\McAfee.com\VSO\emlscbin.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\emlscres.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\emscnres.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\license.txt does not exist
PASS   C:\Program Files\McAfee.com\VSO\McVSEscn.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\McVSSkt.Dll does not exist
PASS   C:\Program Files\McAfee.com\VSO
aiavf5x.inf does not exist
PASS   C:\Program Files\McAfee.com\VSOedist.txt does not exist
PASS   C:\Program Files\McAfee.com\VSO\unicows.dll%PROGRAMFILES%\McAfee.com\VSO\emscnres.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\emlscres.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\McVSEscn.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\McVSSkt.Dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\emlscbin.inf%PROGRAMFILES%\McAfee.com\VSO\emlscbin.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\emlscres.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\emscnres.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\McVSEscn.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\McVSSkt.Dll%WINDIR%\system32\drivers
aiavf5x.sys%WINDIR%\system32\drivers\NaiFiltr.sys;[DefaultUninstall] does not exist
PASS   C:\Program Files\Mcafee.com\VSO\mcscan32.dll does not exist
PASS   C:\Program Files\Mcafee.com\VSO\vsoeng.inf does not exist
PASS   C:\Program Files\Mcafee.com\VSO\signlic.txt does not exist
PASS   C:\WINDOWS\system\MCSCAN32.VXD does not exist
PASS   C:\Program Files\Mcafee.com\VSO\RWABS16.DLL does not exist
PASS   C:\Program Files\Mcafee.com\VSO\RWABS32.DLL does not exist
PASS   C:\Program Files\Mcafee.com\VSO\mcscan32.dll does not exist
PASS   C:\Program Files\Mcafee.com\VSO\vsoeng.inf does not exist
PASS   C:\Program Files\Mcafee.com\VSO\signlic.txt does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcscan32.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsoeng.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\signlic.txt does not exist
PASS   C:\WINDOWS\system\MCSCAN32.VXD does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcscan32.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsoeng.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\signlic.txt does not exist
PASS   C:\Program Files\McAfee.com\VSO\mytilus.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\oasbin.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsengver.dll does not exist
PASS   C:\WINDOWS\system\vshinit.vxd does not exist
PASS   C:\WINDOWS\system\vshield.vxd does not exist
PASS   C:\WINDOWS\system\mcutil.vxd does not exist
PASS   C:\WINDOWS\system\mckrnl.vxd does not exist
PASS   C:\Program Files\McAfee.com\VSO\mytilus.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\oasbin.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsengver.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO
aiavfin.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO
aiavf5a.sys does not exist
PASS   C:\Program Files\McAfee.com\VSO
aiavf5i.sys does not exist
PASS   C:\Program Files\McAfee.com\VSO
aiavf5x.sys does not exist
PASS   C:\Program Files\McAfee.com\VSO
aiavf5x.cat does not exist
PASS   C:\Program Files\McAfee.com\VSO\McShield.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\ftl.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\oasbin.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsengver.dll does not exist
PASS   C:\WINDOWS\system\vshinit.vxd does not exist
PASS   C:\WINDOWS\system\vshield.vxd does not exist
PASS   C:\WINDOWS\system\mcutil.vxd does not exist
PASS   C:\WINDOWS\system\mckrnl.vxd does not exist
PASS   C:\Program Files\McAfee.com\VSO\client9x.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\oasbin.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsengver.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\McShield.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO
aiann.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO
tclient.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\ScanServ.dll does not exist
PASS   C:\WINDOWS\system32\drivers\NaiFsRec.sys does not exist
PASS   C:\WINDOWS\system32\drivers\NaiFiltr.sys does not exist
PASS   C:\Program Files\McAfee.com\VSO\NaiFiltr.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\Naifiltr.cat does not exist
PASS   C:\Program Files\McAfee.com\VSO\McShield.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO
aiann.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO
tclient.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\ScanServ.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\oasres.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\Res00\McShield.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\NAIEvent.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\oasres.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\NaiEvent.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\Res00\McShield.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\Res09\McShield.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\Res11\McShield.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO
aiann.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO
aiannps.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsps.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\oasclnt.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsshld.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsctl.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\edisk.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsoupd.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcmnhdlr.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsmap.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcavtsub.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsdiag.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vso.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcshld9x.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO
aiann.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO
aiannps.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsps.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\oasclnt.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsshld.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsctl.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\edisk.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsoupd.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcmnhdlr.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsmap.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcavtsub.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsdiag.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vso.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsrte.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsshld.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsctl.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\edisk.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsoupd.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcmnhdlr.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvsmap.exe does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcurial.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\PATCHW32.DLL does not exist
PASS   C:\Program Files\McAfee.com\VSO\vso.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcavtsub.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\scan.dat does not exist
PASS   C:\Program Files\McAfee.com\VSO\extra.dat does not exist
PASS   C:\Program Files\McAfee.com\VSO\Names.dat does not exist
PASS   C:\Program Files\McAfee.com\VSO\clean.dat does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsodat.inf does not exist
PASS   C:\Program Files\McAfee.com\Agent\uninst\vsoremui.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsocfg.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\ashldres.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsoui.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\mvsuicfg.dat does not exist
PASS   C:\Program Files\McAfee.com\VSO\config.ini does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsezres.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsez.adf does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvso.ui does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsoagnt.ui does not exist
PASS   C:\Program Files\McAfee.com\Agent\uninst\vsorem.ui does not exist
PASS   C:\Program Files\McAfee.com\VSO\config.ini does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsezres.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsez.adf does not exist
PASS   C:\Program Files\McAfee.com\VSO\mcvso.ui does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsoagnt.ui does not exist
PASS   C:\Program Files\McAfee.com\Agent\uninst\vsorem.ui does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsocfg.inf does not exist
PASS   C:\Program Files\McAfee.com\VSO\ashldres.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsoui.dll does not exist
PASS   C:\Program Files\McAfee.com\Agent\uninst\vsoremui.dll does not exist
PASS   C:\Program Files\McAfee.com\Agent\app\vso.adf does not exist
PASS   C:\Program Files\McAfee.com\VSO\vscfgui.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vsowow.dll does not exist
PASS   C:\Program Files\McAfee.com\VSO\vso.chm does not exist
PASS   C:\Program Files\McAfee.com\VSOeadme.txt does not exist
PASS   C:\Program

christel · Answer

ci joint le rapport apres le scan avari
je peux pas ouvrir internet que ma page d'acceuil orange et  impossible de m'identifier




Avira AntiVir Personal
Date de création du fichier de rapport : mardi 6 janvier 2009  14:21

La recherche porte sur 1150939 souches de virus.

Détenteur de la licence :Avira AntiVir PersonalEdition Classic
Numéro de série : 0000149996-ADJIE-0001
Plateforme :      Windows XP
Version de Windows :(Service Pack 3)  [5.1.2600]
Mode Boot :       Démarré normalement
Identifiant :     SYSTEM
Nom de l'ordinateur :PIROLLON

Informations de version :
BUILD.DAT     : 8.2.0.52       16931 Bytes  02/12/2008 14:55:00
AVSCAN.EXE    : 8.1.4.10      315649 Bytes  18/11/2008 08:21:00
AVSCAN.DLL    : 8.1.4.1        49921 Bytes  21/07/2008 13:44:27
LUKE.DLL      : 8.1.4.5       164097 Bytes  12/06/2008 12:44:16
LUKERES.DLL   : 8.1.4.0        13057 Bytes  04/07/2008 07:30:27
ANTIVIR0.VDF  : 7.1.0.0     15603712 Bytes  27/10/2008 11:30:36
ANTIVIR1.VDF  : 7.1.1.33     1705984 Bytes  24/12/2008 12:27:45
ANTIVIR2.VDF  : 7.1.1.60      318976 Bytes  02/01/2009 12:27:47
ANTIVIR3.VDF  : 7.1.1.73      125952 Bytes  05/01/2009 12:27:48
Version du moteur: 8.2.0.45  
AEVDF.DLL     : 8.1.0.6       102772 Bytes  14/10/2008 10:05:56
AESCRIPT.DLL  : 8.1.1.19      336252 Bytes  06/01/2009 12:27:54
AESCN.DLL     : 8.1.1.5       123251 Bytes  07/11/2008 15:06:41
AERDL.DLL     : 8.1.1.3       438645 Bytes  04/11/2008 13:58:38
AEPACK.DLL    : 8.1.3.4       393591 Bytes  11/11/2008 09:41:39
AEOFFICE.DLL  : 8.1.0.33      196987 Bytes  06/01/2009 12:27:53
AEHEUR.DLL    : 8.1.0.75     1524087 Bytes  06/01/2009 12:27:52
AEHELP.DLL    : 8.1.2.0       119159 Bytes  06/01/2009 12:27:50
AEGEN.DLL     : 8.1.1.8       323956 Bytes  06/01/2009 12:27:50
AEEMU.DLL     : 8.1.0.9       393588 Bytes  14/10/2008 10:05:56
AECORE.DLL    : 8.1.5.2       172405 Bytes  06/01/2009 12:27:49
AEBB.DLL      : 8.1.0.3        53618 Bytes  14/10/2008 10:05:56
AVWINLL.DLL   : 1.0.0.12       15105 Bytes  09/07/2008 08:40:02
AVPREF.DLL    : 8.0.2.0        38657 Bytes  16/05/2008 09:27:58
AVREP.DLL     : 8.0.0.2        98344 Bytes  31/07/2008 12:02:15
AVREG.DLL     : 8.0.0.1        33537 Bytes  09/05/2008 11:26:37
AVARKT.DLL    : 1.0.0.23      307457 Bytes  12/02/2008 08:29:19
AVEVTLOG.DLL  : 8.0.0.16      119041 Bytes  12/06/2008 12:27:46
SQLITE3.DLL   : 3.3.17.1      339968 Bytes  22/01/2008 17:28:02
SMTPLIB.DLL   : 1.2.0.23       28929 Bytes  12/06/2008 12:49:36
NETNT.DLL     : 8.0.0.1         7937 Bytes  25/01/2008 12:05:07
RCIMAGE.DLL   : 8.0.0.51     2371841 Bytes  04/07/2008 07:23:16
RCTEXT.DLL    : 8.0.52.1       86273 Bytes  17/07/2008 10:08:43

Configuration pour la recherche actuelle :
Nom de la tâche..................: Contrôle intégral du système
Fichier de configuration.........: c:\program files\avira\antivir personaledition classic\sysscan.avp
Documentation....................: bas
Action principale................: interactif
Action secondaire................: ignorer
Recherche sur les secteurs d'amorçage maître: marche
Recherche sur les secteurs d'amorçage: marche
Secteurs d'amorçage..............: C:, 
Recherche dans les programmes actifs: marche
Recherche en cours sur l'enregistrement: marche
Recherche de Rootkits............: arrêt
Fichier mode de recherche........: Sélection de fichiers intelligente
Recherche sur les archives.......: marche
Limiter la profondeur de récursivité: 20
Archive Smart Extensions.........: marche
Heuristique de macrovirus........: marche
Heuristique fichier..............: moyen

Début de la recherche : mardi 6 janvier 2009  14:21

La recherche sur les processus démarrés commence :
Processus de recherche 'avscan.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avcenter.exe' - '1' module(s) sont contrôlés
Processus de recherche 'wuauclt.exe' - '1' module(s) sont contrôlés
Processus de recherche 'wmiprvse.exe' - '1' module(s) sont contrôlés
Processus de recherche 'msiexec.exe' - '1' module(s) sont contrôlés
Processus de recherche 'alg.exe' - '1' module(s) sont contrôlés
Processus de recherche 'wmpnetwk.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'HPZipm12.exe' - '1' module(s) sont contrôlés
Processus de recherche 'MpfSrv.exe' - '1' module(s) sont contrôlés
Processus de recherche 'McProxy.exe' - '1' module(s) sont contrôlés
Processus de recherche 'McNASvc.exe' - '1' module(s) sont contrôlés
Processus de recherche 'mcmscsvc.exe' - '1' module(s) sont contrôlés
Processus de recherche 'McSACore.exe' - '1' module(s) sont contrôlés
Processus de recherche 'jqs.exe' - '1' module(s) sont contrôlés
Processus de recherche 'IAANTMon.exe' - '1' module(s) sont contrôlés
Processus de recherche 'Mise-a-jour-LiveSearch.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'FTRTSVC.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avguard.exe' - '1' module(s) sont contrôlés
Processus de recherche 'Notification-LiveSearch.exe' - '1' module(s) sont contrôlés
Processus de recherche 'soffice.bin' - '1' module(s) sont contrôlés
Processus de recherche 'soffice.exe' - '1' module(s) sont contrôlés
Processus de recherche 'wmpnscfg.exe' - '1' module(s) sont contrôlés
Processus de recherche 'ctfmon.exe' - '1' module(s) sont contrôlés
Processus de recherche 'msmsgs.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avgnt.exe' - '1' module(s) sont contrôlés
Processus de recherche 'hpztsb12.exe' - '1' module(s) sont contrôlés
Processus de recherche 'mcagent.exe' - '1' module(s) sont contrôlés
Processus de recherche 'Anti-Blaxx.exe' - '1' module(s) sont contrôlés
Processus de recherche 'daemon.exe' - '1' module(s) sont contrôlés
Processus de recherche 'tfswctrl.exe' - '1' module(s) sont contrôlés
Processus de recherche 'DMXLauncher.exe' - '1' module(s) sont contrôlés
Processus de recherche 'DVDLauncher.exe' - '1' module(s) sont contrôlés
Processus de recherche 'IAAnotif.exe' - '1' module(s) sont contrôlés
Processus de recherche 'issch.exe' - '1' module(s) sont contrôlés
Processus de recherche 'LVCOMSX.EXE' - '1' module(s) sont contrôlés
Processus de recherche 'TaskBarIcon.exe' - '1' module(s) sont contrôlés
Processus de recherche 'realplay.exe' - '1' module(s) sont contrôlés
Processus de recherche 'stsystra.exe' - '1' module(s) sont contrôlés
Processus de recherche 'jusched.exe' - '1' module(s) sont contrôlés
Processus de recherche 'explorer.exe' - '1' module(s) sont contrôlés
Processus de recherche 'sched.exe' - '1' module(s) sont contrôlés
Processus de recherche 'spoolsv.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'ati2evxx.exe' - '1' module(s) sont contrôlés
Processus de recherche 'lsass.exe' - '1' module(s) sont contrôlés
Processus de recherche 'services.exe' - '1' module(s) sont contrôlés
Processus de recherche 'winlogon.exe' - '1' module(s) sont contrôlés
Processus de recherche 'csrss.exe' - '1' module(s) sont contrôlés
Processus de recherche 'smss.exe' - '1' module(s) sont contrôlés
'55' processus ont été contrôlés avec '55' modules

La recherche sur les secteurs d'amorçage maître commence :
Secteur d'amorçage maître HD0
    [INFO]      Aucun virus trouvé !
Secteur d'amorçage maître HD1
    [INFO]      Aucun virus trouvé !
    [AVERTISSEMENT] Erreur système [21]: Le périphérique n'est pas prêt.
Secteur d'amorçage maître HD2
    [INFO]      Aucun virus trouvé !
    [AVERTISSEMENT] Erreur système [21]: Le périphérique n'est pas prêt.
Secteur d'amorçage maître HD3
    [INFO]      Aucun virus trouvé !
    [AVERTISSEMENT] Erreur système [21]: Le périphérique n'est pas prêt.
Secteur d'amorçage maître HD4
    [INFO]      Aucun virus trouvé !
    [AVERTISSEMENT] Erreur système [21]: Le périphérique n'est pas prêt.

La recherche sur les secteurs d'amorçage commence :
Secteur d'amorçage 'C:\'
    [INFO]      Aucun virus trouvé !

La recherche sur les renvois aux fichiers exécutables (registre) commence.
Le registre a été contrôlé ( '63' fichiers).


La recherche sur les fichiers sélectionnés commence :

Recherche débutant dans 'C:\'
C:\hiberfil.sys
    [AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\pagefile.sys
    [AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Documents and Settings\Léa\Local Settings\Temporary Internet Files\Content.IE5\89Q3GHWR\x3l5p5_blow-coxx-jsuis-pa-timide-remix_music[1].htm
    [RESULTAT]  Contient le code suspect : HEUR/HTML.Malware
    [REMARQUE]  Le résultat positif a été classé comme suspect.
    [REMARQUE]  Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '49cf5ef8.qua' !
C:\Program Files\MUSK Codec Pack v5\5.1\5.1.exe
    [RESULTAT]  Contient le modèle de détection du dropper DR/Gator.3202
    [REMARQUE]  Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '499462fb.qua' !
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP191\A0040244.exe
    [0] Type d'archive: RAR SFX (self extracting)
    --> SmitfraudFix\Agent.OMZ.Fix.exe
      [RESULTAT]  Le fichier contient un programme exécutable. Cependant, celui-ci se dissimule sous une extension de fichier inoffensive (HIDDENEXT/Crypted)
    [REMARQUE]  Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '499363ff.qua' !
C:\System Volume Information\_restore{EA39A09C-50BA-4996-869B-915C83FE3B53}\RP192\A0040319.exe
    [RESULTAT]  Contient le modèle de détection du dropper DR/Gator.3202
    [REMARQUE]  Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '49936409.qua' !
C:\WINDOWS\system32\Agent.OMZ.Fix.exe
    [RESULTAT]  Le fichier contient un programme exécutable. Cependant, celui-ci se dissimule sous une extension de fichier inoffensive (HIDDENEXT/Crypted)
    [REMARQUE]  Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '49c86627.qua' !
C:\WINDOWS\system32\fuwakesi.dll.tmp
    [RESULTAT]  Contient le cheval de Troie TR/Vundo.Gen
    [REMARQUE]  Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '49da6648.qua' !
C:\WINDOWS\system32
asowuva.dll.tmp
    [RESULTAT]  Contient le cheval de Troie TR/Vundo.Gen
    [REMARQUE]  Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '49d66652.qua' !
C:\WINDOWS\system32\sukakuya.dll
    [RESULTAT]  Contient le cheval de Troie TR/PSW.OnlineGames.ubyl
    [REMARQUE]  Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '49ce6680.qua' !
C:\WINDOWS\system32	edeluwi.dll.tmp
    [RESULTAT]  Contient le cheval de Troie TR/Vundo.Gen
    [REMARQUE]  Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '49c76676.qua' !


Fin de la recherche : mardi 6 janvier 2009  15:10
Temps nécessaire: 48:18 Minute(s)

La recherche a été effectuée intégralement

   8724 Les répertoires ont été contrôlés
 403049 Des fichiers ont été contrôlés
      8 Des virus ou programmes indésirables ont été trouvés
      1 Des fichiers ont été classés comme suspects
      0 Des fichiers ont été supprimés
      0 Des virus ou programmes indésirables ont été réparés
      9 Les fichiers ont été déplacés dans la quarantaine
      0 Les fichiers ont été renommés
      2 Impossible de contrôler des fichiers
 403038 Fichiers non infectés
  11127 Les archives ont été contrôlées
      6 Avertissements
      9 Consignes

christel · Answer

Bonjour,

j'ai un probleme avec internet, je suis connectée mais je n'arrive pas a aller mes site ou j'ai des mot de passe ? je les fait mes les fenetre pour rentréé ne fonctionne pas je vois rien du tout . Exemple tout simple sur je suis le portail orange, tout et bien je vois la 1ere page je peux tout lire sur cette page. Par contre je ne suis pas sur mon compte si je marque mes coordonées rien ne ce passe il s'ouvrent pas . Que dois je faire ? merci de me repondre a bientot .

christel · Answer

BONJOUR,

Je viens de faire le nettoyage en passant pas msn car je n'ai pas acces a toutes les pages du net. Je viens de voir une mise a jour de java udapte et j'ai fait comme d'habitude mais là l(ordi ne l'a pas trouvé . Tout mes problemes de connexions ne viendraient ils pas de ça des fois ????? merci de m'aider . que dois je faire ????

jorginho67 · Answer

Hello 

Tu peux vider la 40aine d'Avira.

Clique droit sur le parasol rouge, => start Avira => "Administration" puis "Quarantaine".
Tu obtiens sous forme de liste, les fichiers mis en quarantaine.

Sélectionnes les un a un et clique sur l'icone en forme de poubelle.
=================
Désactive ta "Restauration du système" puis réactive la.

(1) Désactivation
Clique droit sur le "Poste de travail" > Propriétés > onglet "Restauration du système" > coche la case " Désactiver la Restauration du système sur tous les lecteurs"
Appliquer . patiente jusqu a que cela soit marqué "désactivée" puis Ok.

(2) Activation
Suivre le même chemin ; décoche la case "Désactiver la Restauration du système sur tous les lecteurs"
Appliquer. attends que cela soit a nouveau sur "surveillance" puis Ok. Redémarre l'ordinateur !

Tu as ici un tutoriel en cas de doute.

Ø Relance Hijackthis en double cliquant sur son raccourci sur le Bureau.
Choisis l'option "Do a system scan and save a log file"
Clique sur "Save log" pour enregistrer le rapport qui s'ouvrira avec le bloc-note
Clique sur "Edition" ->> "Sélectionner tout", puis sur "Edition" ->> Copier" pour copier tout le contenu du rapport ici

christel · Answer

voilà le rapport et merci pour votre aide. heureusement que j'ai un 2ieme ordi 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:17:09, on 12/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\system32\dla	fswctrl.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Documents and Settings\Christelle\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Documents and Settings\Christelle\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32undll32.exe
c:\program files\fichiers communs\installshield\updateservice\isuspm.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\agent.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Documents and Settings\Christelle\Bureau\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O1 - Hosts: 212.95.67.78www.kochonland.com
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: (no name) - {C9D5FAF1-AEEE-F806-6A10-1E2FF3FF507C} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Anti-Blaxx Manager] C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [hoguvavisi] Rundll32.exe "C:\WINDOWS\system32\zubadira.dll",s (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-3505198121-2334664744-207698824-1006\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM= (User 'Laurent')
O4 - HKUS\S-1-5-21-3505198121-2334664744-207698824-1006\..\Run: [Odebit Multimedia V2] C:\Program Files\Odebit Multimédia\V2\Odebit.exe (User 'Laurent')
O4 - HKUS\S-1-5-21-3505198121-2334664744-207698824-1006\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Laurent')
O4 - HKUS\S-1-5-21-3505198121-2334664744-207698824-1006\..\Run: [Antivirus] C:\Program Files\VAV\vav.exe (User 'Laurent')
O4 - HKUS\S-1-5-21-3505198121-2334664744-207698824-1006\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (User 'Laurent')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Startup: Outil de notification Live Search.lnk = C:\Documents and Settings\Christelle\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/fr/4,0,0,90/mcinsctl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O20 - AppInit_DLLs: ulqeqf.dll  ducrdt.dll , 
O20 - Winlogon Notify: opnlKEvT - opnlKEvT.dll (file missing)
O20 - Winlogon Notify: tuvSkHXn - tuvSkHXn.dll (file missing)
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

jorginho67 · Answer

Décidément, il ne veux pas partir ce C:\Program Files\VAV\vav.exe


Relance MBAM, clique sur l'onglet " MISE A JOUR " laisse le faire...

Ensuite :

* Dans l'onglet analyse, vérifie que "Exécuter un examen RAPIDE" soit coché et clique sur le bouton Rechercher pour démarrer l'analyse.

MBAM analyse ton ordinateur. L'analyse peut prendre un certain temps. Il suffit de vérifier de temps en temps son avancement.

A la fin de l'analyse, un message s'affiche indiquant la fin de l'analyse. Clique sur OK pour poursuivre.

* Si des malwares ont été détectés, leur liste s'affiche.

Coche tous les éléments détectés par Malwarebytes' Anti-Malware puis clique sur Supprimer la sélection afin d'éradiquer les malwares détectés.
 /!\ (a faire impérativement sous peine de recommencer le scan) /!\  , MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.


MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Ferme le Bloc-notes. (Le rapport peut être retrouvé sous l'onglet Rapports/logs)

Ferme MBAM en cliquant sur Quitter.

Poste le rapport dans ta réponse 

Tutoriel

christel · Answer

Bonsoir

J'ai fait comme vous avez dit, j'avais rien a suprimer .... 

Malwarebytes' Anti-Malware 1.32
Version de la base de données: 1647
Windows 5.1.2600 Service Pack 3

13/01/2009 00:55:57
mbam-log-2009-01-13 (00-55-57).txt

Type de recherche: Examen rapide
Eléments examinés: 95135
Temps écoulé: 19 minute(s), 40 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

jorginho67 · Answer

Bon, MBAM ne trouve rien, pourtant, tu es encore infecté.

On tente avec ce fix, et on avisera ensuite.

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau.

Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
comment demarrer en mode sans echec en images
Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
Choisis ton compte.

Déroule la liste des instructions ci-dessous :

* Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
* Appuie sur Y pour commencer le processus de nettoyage.
Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
* Appuie sur une touche pour redémarrer le PC.
Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
* Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum

Tuto d'instalation et de mise en oeuvre
________________________________________________

Si SDfix ne se lance pas (ça arrive!)

* Démarrer => Exécuter => Dans la petite fenêtre copie/colle ceci:

%systemroot%\system32\cmd.exe /K %systemdrive%\SDFix\apps\FixPath.exe

* Clique sur ok, et valide.
* Redémarre et essaye de nouveau de lancer SDfix.

christel · Answer

bonjour,

j'ai eut quelque probleme pour executer le sdfix.exe mais j'y suis arrivée voici le rapport


[b]SDFix: Version 1.240 [/b]
Run by Christelle on 13/01/2009 at 09:51

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

No Trojan Files Found




Folder C:\microsoft - Removed


Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-13 10:15:52
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40]
"khjeh"=hex:20,02,00,00,9f,87,50,a5,64,4d,1c,41,03,60,11,3b,7f,62,46,35,ef,..
"hj34z0"=hex:e3,58,b7,cc,ac,3d,07,4f,9a,2e,51,41,7b,ef,9b,c4,49,5a,7f,d4,50,..
"hj34z1"=hex:1d,58,b7,cc,d4,3d,07,4f,9b,2e,50,41,7a,ef,9b,c4,49,5a,7f,d4,90,..
"hj34z2"=hex:1d,58,b7,cc,d4,3d,07,4f,9b,2e,50,41,7a,ef,9b,c4,49,5a,7f,d4,90,..
"hj34z3"=hex:1d,58,b7,cc,d4,3d,07,4f,9b,2e,50,41,7a,ef,9b,c4,49,5a,7f,d4,90,..
"hj34z4"=hex:1d,58,b7,cc,d4,3d,07,4f,9b,2e,50,41,7a,ef,9b,c4,49,5a,7f,d4,90,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[b]Remaining Files [/b]:



[b]Files with Hidden Attributes [/b]:

Wed 19 Apr 2006         4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Thu 13 Nov 2008        20,487 A.SHR --- "C:\Program Files\McAfee\MQC\MRU.bak"
Thu 13 Nov 2008           265 A.SHR --- "C:\Program Files\McAfee\MQC\qcconf.bak"
Sat 27 Oct 2007             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Wed 19 Apr 2006         4,348 ...H. --- "C:\Documents and Settings\Christelle\Mes documents\Ma musique\Sauvegarde de la licence\drmv1key.bak"
Fri 23 Feb 2007            20 A..H. --- "C:\Documents and Settings\Christelle\Mes documents\Ma musique\Sauvegarde de la licence\drmv1lic.bak"
Thu  5 Jan 2006           312 A.SH. --- "C:\Documents and Settings\Christelle\Mes documents\Ma musique\Sauvegarde de la licence\drmv2key.bak"

[b]Finished![/b]

jorginho67 · Answer

Bon, il faut afficher les dossiers cachés

Panneau de configuration > Options des dossiers > onglet Affichage.

Coche Afficher les fichiers et dossiers cachés,
Décoche Masquer les extensions de fichiers connus
Décoche Masquer les fichiers protégés du Système.
Un message de mise en garde va apparaitre. Clique sur OK pour confirmer ton choix.
Les fichiers et dossiers cachés du système apparaitront alors dans l'explorateur Windows en transparence.
Tutoriel

Lorsque tu aura fini d'intervenir dans les répertoires système, fait la manip inverse pour recacher les fichiers système.


ouvre le gestionnaire des taches
arrête  ces processus:

VistaAntivirus2008.exe
vav.exe
VAV2008Setup[1].exe

vérifie dans ajout suppression de programme
si=> Vista Antivirus 2008 y est présent
si c'est le cas supprime le

fais une recherche de ses fichiers:

vav.cpl
vav.exe
VAV2008Setup[1].exe
Vista Antivirus 2008.lnk

supprime les tous

ouvre le registre
trouve ces clés:

HKEY_CURRENT_USER \ Software \ Antivirus
HKEY_LOCAL_MACHINE\SOFTWARE\Antivirus HKEY_LOCAL_MACHINE \ SOFTWARE \ Antivirus
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Run

supprime tous ce qui fait  référence à Antivirus 2008 \ Antvrs.exe

Reposte moi un rapport de scan HJT ensuite.

christel · Answer

Qu'est que vous voulez dire en ecrivant  " ouvre le gestionnaire de tache " Je sais pas ou c'est !! merci

christel · Answer

j'ai pas vistaantivirus2008 et je sais pas ou le trouver

jorginho67 · Answer

Crtl  + Alt + Suppr puis sous l'onglet processus, tu as la liste

christel · Answer

J'ai rien de tout ce que vous avez ecrit sur le gestionnaire des taches  VistaAntivirus2008.exe 

 et je sais pas ou chercher HKEY_CURRENT_USER \ Software \ Antivirus 
HKEY_LOCAL_MACHINE\SOFTWARE\Antivirus HKEY_LOCAL_MACHINE \ SOFTWARE \ Antivirus 
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 
HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Run

merci encore

christel · Answer

je n'ai pas trouvé vistantivirus2008.exe dans le gestionnaire de tache,  mais je viens de faire le hijack this


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:18:27, on 13/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\winlogon.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\stsystra.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\system32\dla	fswctrl.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Documents and Settings\Christelle\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Documents and Settings\Christelle\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Documents and Settings\Christelle\Bureau\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: (no name) - {C9D5FAF1-AEEE-F806-6A10-1E2FF3FF507C} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Anti-Blaxx Manager] C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [hoguvavisi] Rundll32.exe "C:\WINDOWS\system32\zubadira.dll",s (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-3505198121-2334664744-207698824-1006\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM= (User 'Laurent')
O4 - HKUS\S-1-5-21-3505198121-2334664744-207698824-1006\..\Run: [Odebit Multimedia V2] C:\Program Files\Odebit Multimédia\V2\Odebit.exe (User 'Laurent')
O4 - HKUS\S-1-5-21-3505198121-2334664744-207698824-1006\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Laurent')
O4 - HKUS\S-1-5-21-3505198121-2334664744-207698824-1006\..\Run: [Antivirus] C:\Program Files\VAV\vav.exe (User 'Laurent')
O4 - HKUS\S-1-5-21-3505198121-2334664744-207698824-1006\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (User 'Laurent')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Startup: Outil de notification Live Search.lnk = C:\Documents and Settings\Christelle\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/fr/4,0,0,90/mcinsctl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O20 - AppInit_DLLs: ulqeqf.dll  ducrdt.dll , 
O20 - Winlogon Notify: opnlKEvT - opnlKEvT.dll (file missing)
O20 - Winlogon Notify: tuvSkHXn - tuvSkHXn.dll (file missing)
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

jorginho67 · Answer

Il y est pourtant bien :

O4 - HKUS\S-1-5-21-3505198121-2334664744-207698824-1006\..\Run: [Antivirus] C:\Program Files\VAV\vav.exe (User 'Laurent') 

Démarre en mode sans echec, suis le chemin  C:\ => Program Files\ => VAV <= supprime moi ceci

christel · Answer

je suis allée sur c:\program files\vav et ça dit impossible de trouver files vav.....

jorginho67 · Answer

Fais un scan en ligne avec Kaspersky WebScanner : https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

- Pour effectuer le scan, désactive ton antivirus, logiciels de protections et logiciels pouvant bloquer les popups (barres Google, Yahoo, etc.)

/!\ A faire  obligatoirement Internet Explorer!

    * Clique sur -> "J'accepte"
    * Une information apparaît en haut, près de la barre d'état
    * Tu dois accepter et installer l' "ActiveX" proposé. La mise à jour de l'antivirus se lance.
    * Réalise un scan complet du système (sélectionne "Poste de travail" )
    * Enregistre le rapport à l'issue du scan -> en format texte (.txt) -> sur le Bureau
    * Copie /colle le rapport Kaspersky dans ton prochain message.

/!\ Si tu reçois le message "La licence de Kaspersky On-line Scanner est périmée", va dans Ajout / suppression de programmes et
-- désinstalle "On-Line Scanner", reconnecte-toi sur le site de Kaspersky pour tenter le scan à nouveau.

Tutoriel pour Kaspersky ONLINE-SCANNER (Merci Nico_dodo)

christel · Answer

Comme je vous l'ai deja dit, depuis que j'ai desintallé mcafee je n'ai pas axces a internet du moin tout internet de peux accede qu'a la 1ere page et si je clic sur "j'accepte" rien ne se passe car il y a une 2ieme page qui devrait s'ouvrir mais ça bloque. avez vous lien qui va direct sur le site kaspersky comme tout les autres site !???

jorginho67 · Answer

Tu a essayé sous Internet Explorer ?

Activé JAVA Script ?

christel · Answer

je fais comment pour java scrip ? car je n'ai rien depuis quelque jour on dirait quand desintalant mcafee je n'ai pas acces a ma messagerie orange, les enfants ouvrent pas les jeux sur jeux.fr ect ....  là je vs envoie les rapoort en les copiant sur usb et les transfert sur mon 2ieme ordi . Pour les lien que vous envoyez je les passe par msn car j'ai 2 adreesse. Comment faire kapersky ? merci pour votre patience ! lol

jorginho67 · Answer

Désolé, je sèche un peu là...

Normalement, MBAM aurait du nettoyer .

Ce n'est pas le cas.

J'ai demandé un coup de main a mon entourage, je reviens rapidement dès que j'ai des nouvelles ;-)

Pour Mc Afee, il est encore présent...

Via ajout/suppression de programmes, vire le.

Regarde a C:\ => program files\ => fichiers communs => \mcafee <= supprime le.

christel · Answer

desolée mais je n'arrive pas a tout virer de mcafee. sur ajouter/suprimer mcaffe ouvre une page blanche qui part pas . sur program files/mcafee les fichiers ne peuvent pas etre suprimé. une fenetre "error lors de la supression du fichier ou du dossier" apparait acces refusé . J'attends de tes nouvelles a bientot .

jorginho67 · Answer

Ok, j'ai des infos ;-)

Tu vas faire tout ça dans l'ordre stp :

1 => Suppression de Mac Afee

Regarde et suis les instructions de ce tutoriel <==


2 => Hijackthis.

Sauvegarde  ces instructions car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.

Clic droit sur le bureau => nouveau  => document texte => double clique dessus et copi/colle ces instructions que tu pourras consulter  pour faire la manip' correctement !

Ferme toutes les autres fenêtres, tous les autres programmes. Pas de connections Internet.


• Relance HijackThis, choisis "do a scan only"
coche la case devant les lignes ci-dessous et clic en bas sur "fix checked", puis clique sur OK.

O4 - HKUS\S-1-5-19\..\Run: [hoguvavisi] Rundll32.exe "C:\WINDOWS\system32\zubadira.dll",s (User 'SERVICE LOCAL') 
O4 - HKUS\S-1-5-21-3505198121-2334664744-207698824-1006\..\Run: [Antivirus] C:\Program Files\VAV\vav.exe (User 'Laurent') 
O20 - Winlogon Notify: opnlKEvT - opnlKEvT.dll (file missing)
O20 - Winlogon Notify: tuvSkHXn - tuvSkHXn.dll (file missing) 

Comment fixer les lignes et Générer un rapport 
(merci balltrap34)

Ferme HijackThis.

Fais redémarrer ton PC et poste un nouveau rapport HijackThis .

christel · Answer

decidement ....!! je comprend pas trop le 1er paragraphe sur la supression de mcafee . j'ai telechargé regseeker mit en langage francais fait rechercher il y a des cases dejas de coché dessus si je decoche j'ai rien quand je recherche et quand tout et coché ou certain j'ai au moins une 50taine de hkey classées root ! je doit faitre qoi ? que coché avant de faire recherhe et qe dois je faire exactement c'est pas tres clair

jorginho67 · Answer

6. Utilisation de MVRegClean en mode manuel.
A La fin du scan il faut tout décocher et passer en revue tout ce que le programme aura trouvé et choisir uniquement ce qui a un rapport avec McAfee.

7. Utilisation de RegSeeker en mode "Recherche" en introduisant "McAfee". Il faudra faire preuve de patience.

christel · Answer

je n'arrive pas a tout suprimer mcafee

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:51:42, on 13/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\stsystra.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\system32\dla	fswctrl.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Documents and Settings\Christelle\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Documents and Settings\Christelle\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\Christelle\Bureau\HiJackThis.exe
C:\WINDOWS\system32\wscntfy.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (file missing)
O2 - BHO: (no name) - {C9D5FAF1-AEEE-F806-6A10-1E2FF3FF507C} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Anti-Blaxx Manager] C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Startup: Outil de notification Live Search.lnk = C:\Documents and Settings\Christelle\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/fr/4,0,0,90/mcinsctl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (file missing)
O20 - AppInit_DLLs: ulqeqf.dll  ducrdt.dll , 
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (file missing)
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe (file missing)
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe (file missing)
O23 - Service: McAfee SystemGuards (McSysmon) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe (file missing)
O23 - Service: McAfee Personal Firewall Service (MpfService) - Unknown owner - C:\Program Files\McAfee\MPF\MPFSrv.exe (file missing)
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

afideg · Answer

Hello vous deux,

Pour désinstaller "mcafee", regarde là également:
http://assiste.forum.free.fr/viewtopic.php?t=14926

Je trouve cependant que Mac Peter avait pondu un tuto assez clair.    ;)

Bonne chance
Al.

jorginho67 · Answer

Hello Al' ;-)

Ravi de te voir ;-)

Oui, le tuto donné plus haut est correct, mais christel a l'air d'avoir du mal...

Merci d'etre passé

@mitiés

Reçu lien sur widows live messenger

64 réponses

Discussions similaires

Newsletters