Iexplore.exe, et plein de problemes divers

Résolu

bruceleee -

Bonjour,
1- J'ai Iexplore.exe dans mes processus quand internet ouvert
2- Avast, spybot, ccleaner, ad-aware ne marche pas
3- Je ne peux quasiment rien telecharger
4- Le son a totalement disparu

CAUSE : Emule...un rar que j'ai telechargé. un truc .exe que j'ai appliqué bêtement en allant trop vite. Je n'ai pas le nom du fichier, il a été effacé
J'ai su que ça pouvait être un bagle
OUTILS DE DEPART : avast, ad-aware, ccleaner (spybot n'était pas actif)

2- >> En détail :
- spybot et avast :
D:\...\spybot-search...exe n'est pas une application Win32 valide
Quand je clique droit sur un fichier, j'essai de faire l'analyse avast ou spybot. Pour avast rien ne se produit. Pour Spybot, l'analyse paraît démarrer mais ne fait que délirer en fait.
- Ad-aware :
Au debut, jcrois que ça faisait comme avast. J'ai trifouillé le proprietes (ne me demandez pas cque jai fais...svp!), et depuis >> System error: 1810 has occurred. Description: Service is not online. Application terminates
- ccleaner :
il s'ouvre et se referme de suite, voire ne s'ouvre pas

3- J'ai essayé de télécharger des logiciels conseillés pour certains de mes problemes (je n'ai trouvé que des solutions pour qu'1 probleme à la fois), mais ça veut pas telecharger. J'exécute, mais on me propose pas la suite
Seul RegistrySmart a pu être installé
Résultat : 397 items; Mais ils ne disent rien à propos de trojan ou autre
J'ai voulu payer pour les enlever, mais ça marche pas temporairement (j'ai la poisse quand jsuis sur ordi...)

4- Mes problemes sont là depuis samedi matin
le son était revenu l'après-midi (peut-être en ayant trifouillé des trucs). Mais est reparti!
Quand j'allume le PC, le son du démarrage est parfois là.
Quand le bureau s'affiche, le pt icône son est dans la barre rapide est là. Mais disparait aussi sec

VLC, internet, firefox,... marchent correctement

L'UC n'était qu'en pic samedi jusqu'à 100. Depuis il s'est calmé, sauf parfois que là de suite où il est encore en pic...(je n'ai que cette page et le gestionnaire d'ouvert)
Util. de fichier correct

Quelqu'un connait-il un moyen de résoudre le problème sans tout formater?
Sinon, j'ai un disque dur interne, je peux mettre tous mes fichiers dedans, le débrancher, formater mon disque dur mère, et essayer de soigner ensuite l'autre, c'est faisable?
Mais formatge qu'en dernier recours, car je n'ai pas la clé qui me permet de remettre mon windows...svp

Configuration: Windows XP
Firefox 2.0.0.6

Afficher la suite

82 réponses

Résumé de la discussion

Une infection par un cheval de Troie baptisé Bagle provoque un comportement problématique du PC: processus IE actifs, impossibilité de télécharger, son disparu et défaillances des antivirus comme Avast, Spybot et Ad-Aware. Pour remédier, supprimer Spybot, CCleaner et Ad-Aware proprement car perturbés par le bagle, puis utiliser CCleaner pour nettoyer les fichiers temporaires et réparer le registre et préparer HijackThis. Ensuite, des outils comme HijackThis, RSIT ou SmitfraudFix permettent d’analyser les redirections et les entrées malveillantes, puis de partager le rapport pour déterminer les éléments à éliminer. En cas de persistance, des outils comme FindyKill ou SmitfraudFix peuvent aider à détecter et neutraliser les composants malveillants, tout en évitant les téléchargements douteux et les cracks.

Réponse 1 / 82 - Meilleure réponse
La meilleure réponse est la réponse qui a été validée par nos équipes.
sKe69 Contributeur sécurité
très bien ...

on continue :

1- Supprime proprement et complètement spybot, ccleaner, ad-aware car shooter par le bagle .... pour Avast , on verra après ...

puis fais ceci :

2- Retélécharge : - CCleaner
https://www.pcastuces.com/logitheque/ccleaner.htm
Ce logiciel va permettre de supprimer tous les fichiers temporaires et de corriger ton registre .
Lors de l'installation:
-choisis bien "francais" en langue .
-avant de cliquer sur le bouton "installer", décoche toutes les "options supplémentaires" sauf les 2 premières.

Un tuto ( aide ):
http://perso.orange.fr/jesses/Docs/Logiciels/CCleaner.htm

---> Utilisation:
! déconnecte toi et ferme toutes applications en cours !
* va dans "nettoyeur" : fais -analyse- puis -nettoyage-
* va dans "registre" : fais -chercher les erreurs- et -réparer toutes les erreurs-
( plusieurs fois jusqu'à ce qu'il n'y est plus d'erreur ) .

( CCleaner : soft à garder sur son PC , super utile pour de bons nettoyages ... )

3- Télécharge et installe le logiciel HijackThis :

ici HijackThis
ou ici http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe
ou ici https://www.clubic.com/telecharger-fiche17891-hijackthis.html

a- Clique sur le setup pour lancer l'installe : laisse toi guider et ne modifie pas les paramètres d'installation .
A la fin de l'installe , le prg ce lance automatiquement : ferme le en cliquant sur la croix rouge .
Au final, tu dois avoir un raccourci sur ton bureau et aussi un cheminement comme :
"C:\ program files\Trend Micro\HijackThis\HijackThis.exe " .

tuto pour utilisation :
Regarde ici, c'est parfaitement expliqué en images (merci balltrap34),
http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm
( Ne fixe encore AUCUNE ligne, cela pourrait empêcher ton PC de fonctionner correctement )

b- !! Déconnecte toi et ferme toutes tes applications en cours !!

Clique sur le raccourci du bureau pour lancer le prg :
fais un scan HijackThis en cliquant sur : "Do a system scan and save a logfile"

---> Poste le rapport généré pour analyse ...
2
Réponse 2 / 82
sKe69 Contributeur sécurité
Salut,

fais exactement ce que je vais t'indiquer et rien d'autre ! .... merci .... ;)

Infection par un Bagle :

1-IMPORTANT :
je rappelle que bagle est amené par un crack et qu'il se relance dès que tu te sers de celui ci; même si tu ne sers pas, il peut se relancer de lui même au démarrage de ton PC . En claire :
Essaye surtout de te rappeler si récemment tu n'as pas cliquer sur un "patch" ou un "keygen" pour installer un logiciel, un jeu cracké ou avoir une version complète d'un soft , et qu'il ne se soit rien passé de particulier ... C'est la que les bagles s'infiltrent ! Si tu retrouves ce crack en particulier ,scratch tout ( le crack, le soft ou encore les zip concernés). Si tu ne te rappelles plus trop , je te conseille fortement de supprimer tous les cracks qui sont sur ton PC ... ;)

2-Télécharge FindyKill de Chiquitine29 :

http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe

->Enregistre le sur ton bureau et pas ailleurs !

!! Déconnecte toi et ferme toutes applications en cours !!

( Si ton anti-virus s'affolle au moment de l'enregistrement ou de l'utilisation de l'outil , ignore l'alerte ...)

-> Clique sur "FindyKill.exe" pour lancer l'installe de l'outil . Ne touche surtout pas aux paramètres d'installation.

Notes importantes :
* si tu as le prg Elibagla sur ton PC , supprime le ( risque de conflit entre les deux outils ) .

--> Double clique sur le raccourci " FindyKill " qui est sur ton bureau .
( sur la 1er fenêtre , tapes f puis [entrèe] pour la version en français ).

-->choisis l'option 1 ( recherche ) . Puis laisse travailler l'outil sans rien toucher ...

Une fois terminé, poste le rapport FindyKill.txt qui est généré ...

( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt )

PS : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

Tuto : https://www.malekal.com/tutorial-findykill/
1
Réponse 3 / 82
jlpjlp Contributeur sécurité
slt vire tes cracks

puis

Telecharge FindyKill sur ton bureau :

--> http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe

--> Lance l installation avec les parametres par default

--> Double clic sur le raccourci FindyKill sur ton bureau

--> Au menu principal,choisi l option 1 (Recherche)

--> Post le rapport FindyKill.txt

Note : le rapport FindyKill.txt est sauvegardé a la racine du disque
0
Réponse 4 / 82
bruceleee Auteur
ok
Je retourne de ce pas sur mon PC!
merci
j'essai et reviens te dire si tout va bien
0
Vous n’avez pas trouvé la réponse que vous recherchez ?

La communauté CCM répond en moyenne en moins de 2h.

Posez votre question
Réponse 5 / 82
bruceleee Auteur
(J'm'absente 30min au moins, j'ai 1 course à faire)
(Pour elibagla, j'avais pas réussi à le télécharger hier donc pas de souci avec!)

Voilà le rapport :

----------------- FindyKill V4.707 ------------------

* User : Lydie1 - LYDIE
* Emplacement : D:\Program Files\FindyKill
* Outils Mis a jours le 06/12/08 par Chiquitine29
* Recherche effectuée à 15:21:42 le 08/12/2008
* Windows XP - Internet Explorer 7.0.5730.13

((((((((((((((((( *** Recherche *** ))))))))))))))))))

--------------- [ Processus actifs ] ----------------

D:\WINNT\System32\smss.exe
D:\WINNT\system32\csrss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\System32\svchost.exe
D:\WINNT\System32\svchost.exe
D:\WINNT\system32\spoolsv.exe
D:\WINNT\Explorer.EXE
D:\WINNT\system32\VTTimer.exe
D:\WINNT\system32\VTtrayp.exe
D:\Outils\RegistrySmart\RegistrySmart.exe
D:\WINNT\system32\ctfmon.exe
D:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
D:\WINNT\System32\svchost.exe
D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\WINNT\System32\svchost.exe

--------------- [ Fichiers/Dossiers infectieux ] ----------------

»»»» Presence des fichiers dans D:

»»»» Presence des fichiers dans D:\WINNT

»»»» Presence des fichiers dans D:\WINNT\Prefetch

Found ! - D:\WINNT\prefetch\113046.EXE-3497B089.pf
Found ! - D:\WINNT\prefetch\120640.EXE-2145EBFF.pf
Found ! - D:\WINNT\prefetch\128062.EXE-2C6544CD.pf
Found ! - D:\WINNT\prefetch\129203.EXE-03BF5260.pf
Found ! - D:\WINNT\prefetch\132375.EXE-01BF4C2F.pf
Found ! - D:\WINNT\prefetch\133234.EXE-0D90C64A.pf
Found ! - D:\WINNT\prefetch\137703.EXE-06861676.pf
Found ! - D:\WINNT\prefetch\140578.EXE-3337D2CA.pf
Found ! - D:\WINNT\prefetch\141234.EXE-067F908A.pf
Found ! - D:\WINNT\prefetch\148671.EXE-2F8BBA0D.pf
Found ! - D:\WINNT\prefetch\167906.EXE-3B583542.pf
Found ! - D:\WINNT\prefetch\168640.EXE-04E15264.pf
Found ! - D:\WINNT\prefetch\172203.EXE-3255BE38.pf
Found ! - D:\WINNT\prefetch\64203.EXE-0606E2F8.pf
Found ! - D:\WINNT\prefetch\79765.EXE-38F6E0F4.pf
Found ! - D:\WINNT\prefetch\80015.EXE-242BFB62.pf
Found ! - D:\WINNT\prefetch\84125.EXE-31775B0E.pf
Found ! - D:\WINNT\prefetch\86000.EXE-118C692F.pf
Found ! - D:\WINNT\prefetch\FLEC006.EXE-28686AE2.pf
Found ! - D:\WINNT\prefetch\MDELK.EXE-01C3630F.pf
Found ! - D:\WINNT\prefetch\WINTEMS.EXE-2A914939.pf

»»»» Presence des fichiers dans D:\WINNT\system32

Found ! [08/12/2008 13:03] - D:\WINNT\system32\mdelk.exe
Found ! [08/12/2008 13:03] - D:\WINNT\system32\wintems.exe
Found ! [08/12/2008 15:04] - D:\WINNT\system32\ban_list.txt

»»»» Presence des fichiers dans D:\WINNT\system32\drivers

Found ! [08/12/2008 15:03] - D:\WINNT\system32\drivers\srosa.sys
Found ! [08/12/2008 15:03] - D:\WINNT\system32\drivers\srosa2.sys
Found ! [24/01/2006 10:07] - D:\WINNT\system32\drivers\winfilse.exe
Found ! [08/12/2008 15:07] - "D:\WINNT\system32\drivers\downld"
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\104281.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\111578.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\111718.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\112281.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\113046.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\115453.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\118203.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\121781.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\122421.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\123734.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\124078.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\124531.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\127875.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\128062.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\129203.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\132375.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\132531.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\132578.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\133234.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\133671.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\133781.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\136656.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\139640.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\140281.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\142265.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\143234.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\143531.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\144296.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\148671.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\150921.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\157390.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\164468.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\165312.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\166906.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\167812.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\167906.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\168578.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\168640.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\171031.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\171234.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\172203.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\174015.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\174750.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\176703.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\180109.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\182234.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\186421.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\186453.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\199140.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\201250.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\203156.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\206406.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\207578.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\207765.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\208484.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\210312.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\210671.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\218265.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\227046.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\235015.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\239937.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\241937.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\246437.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\246781.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\263906.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\355875.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\358875.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\361203.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\373484.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\374187.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\393812.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\396453.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\400078.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\411906.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\456015.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\457734.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\462906.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\494765.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\502328.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\53703.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\53859.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\54453.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\54765.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\55109.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\55140.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\56484.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\57109.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\57703.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\58140.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\58343.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\58718.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\60046.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\64203.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\65609.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\66062.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\66453.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\67343.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\67687.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\68062.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\69375.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\70937.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\72093.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\73765.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\76531.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\76765.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\77968.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\79125.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\79765.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\79921.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\80015.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\82859.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\83390.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\84125.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\84406.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\87125.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\87687.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\88234.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\88937.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\90437.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\91312.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\92312.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\92765.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\97390.exe
Found ! [08/12/2008 15:07] - D:\WINNT\system32\drivers\downld\99609.exe

»»»» Presence des fichiers dans D:\Documents and Settings\Lydie1\Application Data

Found ! [08/12/2008 15:04] - "D:\Documents and Settings\Lydie1\Application Data\m\flec006.exe"
Found ! [08/12/2008 15:05] - "D:\Documents and Settings\Lydie1\Application Data\m\list.oct"
Found ! [08/12/2008 15:05] - "D:\Documents and Settings\Lydie1\Application Data\m\data.oct"
Found ! [08/12/2008 15:05] - "D:\Documents and Settings\Lydie1\Application Data\m\srvlist.oct"
Found ! [08/12/2008 15:07] - "D:\Documents and Settings\Lydie1\Application Data\m\shared"
Found ! [06/12/2008 15:42] - "D:\Documents and Settings\Lydie1\Application Data\m"

»»»» Presence des fichiers dans D:\DOCUME~1\Lydie1\LOCALS~1\Temp

»»»» Presence des fichiers dans D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5

Found ! [05/12/2008 14:35] - D:\Documents and Settings\All Users\Application Data\Skype\Plugins\Local Cache\D3987B641C134048B815DB578D607F42_more.jpg
Found ! [08/12/2008 13:02] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\F2B18G4G\b64_1[1].jpg
Found ! [07/12/2008 20:58] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\FE4G9QCS\b64[1].jpg
Found ! [07/12/2008 21:39] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\FE4G9QCS\b64[2].jpg
Found ! [07/12/2008 22:28] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\FE4G9QCS\b64[3].jpg
Found ! [07/12/2008 22:38] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\FE4G9QCS\b64[4].jpg
Found ! [06/12/2008 11:32] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\FE4G9QCS\b64_1[1].jpg
Found ! [06/12/2008 11:25] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\FE4G9QCS\b64_3[1].jpg
Found ! [07/12/2008 09:32] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\FE4G9QCS\b64_3[2].jpg
Found ! [07/12/2008 22:27] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\FE4G9QCS\b64_3[3].jpg
Found ! [08/12/2008 13:04] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\IKQMQBBS\b64[1].jpg
Found ! [08/12/2008 13:03] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\IKQMQBBS\b64_3[1].jpg
Found ! [08/12/2008 15:05] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\IKQMQBBS\mxd[1].jpg
Found ! [07/12/2008 22:39] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\MTF2NSBI\b64[1].jpg
Found ! [06/12/2008 12:03] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\MTF2NSBI\b64_1[1].jpg
Found ! [07/12/2008 09:32] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\MTF2NSBI\b64_2[1].jpg
Found ! [07/12/2008 09:32] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\MTF2NSBI\b64_2[2].jpg
Found ! [07/12/2008 20:58] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\MTF2NSBI\b64_2[3].jpg
Found ! [07/12/2008 21:38] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\MTF2NSBI\b64_2[4].jpg
Found ! [07/12/2008 21:39] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\MTF2NSBI\b64_2[5].jpg
Found ! [06/12/2008 12:03] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\MTF2NSBI\b64_3[1].jpg
Found ! [08/12/2008 15:03] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\U1E0771G\b64_1[1].jpg
Found ! [06/12/2008 12:04] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\WIJOWNR9\b64[1].jpg
Found ! [06/12/2008 11:24] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\WIJOWNR9\b64_1[1].jpg
Found ! [07/12/2008 22:38] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\WIJOWNR9\b64_1[2].jpg
Found ! [06/12/2008 11:39] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\WIJOWNR9\b64_2[1].jpg
Found ! [07/12/2008 22:28] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\WIJOWNR9\b64_2[2].jpg
Found ! [07/12/2008 22:38] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\WIJOWNR9\b64_2[3].jpg
Found ! [06/12/2008 11:32] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\WIJOWNR9\b64_3[1].jpg
Found ! [06/12/2008 11:26] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\ZS4Z3N8G\b64[1].jpg
Found ! [07/12/2008 09:33] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\ZS4Z3N8G\b64[2].jpg
Found ! [07/12/2008 22:27] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\ZS4Z3N8G\b64[3].jpg
Found ! [07/12/2008 09:32] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\ZS4Z3N8G\b64_1[1].jpg
Found ! [07/12/2008 20:57] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\ZS4Z3N8G\b64_1[2].jpg
Found ! [06/12/2008 11:25] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\ZS4Z3N8G\b64_2[1].jpg
Found ! [06/12/2008 11:33] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\ZS4Z3N8G\b64_2[2].jpg
Found ! [06/12/2008 12:04] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\ZS4Z3N8G\b64_2[3].jpg
Found ! [06/12/2008 12:04] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\ZS4Z3N8G\b64_3[1].jpg
Found ! [07/12/2008 09:33] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\ZS4Z3N8G\mxd[1].jpg
Found ! [08/12/2008 15:04] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\ZX98VY0M\b64[1].jpg
Found ! [08/12/2008 02:21] - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\ZX98VY0M\b64_2[1].jpg

--------------- [ Registre / Startup ] ----------------

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
CTFMON.EXE=D:\WINNT\system32\ctfmon.exe
swg=D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
VeohPlugin="D:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe"
SpybotSD TeaTimer=D:\Outils\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
Synchronization Manager=mobsync.exe /logon
VTTimer=VTTimer.exe
VTTrayp=VTtrayp.exe
StandardInstall=
SunJavaUpdateSched="D:\Program Files\Java\jre6\bin\jusched.exe"
EPSON Stylus CX6600 Series=D:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATI9EE.EXE /P26 "EPSON Stylus CX6600 Series" /O5 "LPT1:" /M "Stylus CX6600"
avast!=D:\Outils\ALWILS~1\Avast4\ashDisp.exe
TkBellExe="D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
AppleSyncNotifier=D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
QuickTime Task="D:\Outils\QuickTime\QTTask.exe" -atboottime
RegistrySmart=D:\Outils\RegistrySmart\RegistrySmart.exe

[HKEY_CURRENT_USER\software\local appwizard-generated applications\GoogleToolbarNotifier]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\key_generator]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\winfilse]

--------------- [ Registre / Clés infectieuses ] ----------------

Found ! - HKEY_USERS\S-1-5-21-1935655697-2077806209-839522115-1000\Software\Local AppWizard-Generated Applications\winfilse
Found ! - HKEY_USERS\S-1-5-21-1935655697-2077806209-839522115-1000\Software\bisoft
Found ! - HKEY_USERS\S-1-5-21-1935655697-2077806209-839522115-1000\Software\DateTime4
Found ! - HKEY_USERS\S-1-5-21-1935655697-2077806209-839522115-1000\Software\FFC
Found ! - HKEY_USERS\S-1-5-21-1935655697-2077806209-839522115-1000\Software\FirtR
Found ! - HKEY_USERS\S-1-5-21-1935655697-2077806209-839522115-1000\Software\MuleAppData
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winfilse
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Found ! - HKEY_CURRENT_USER\Software\bisoft
Found ! - HKEY_CURRENT_USER\Software\DateTime4
Found ! - HKEY_CURRENT_USER\Software\FirtR
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sK9Ou0s

--------------- [ Etat / Services ] ----------------

Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot

- sans echec non fonctionnel !!

Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal

- sans echec non fonctionnel !!

Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network

- sans echec non fonctionnel !!

+- Services : [ Auto=2 / Demande=3 / Désactivé=4 ]

/!\ Ndisuio - Type de démarrage = 4

EapHost - Type de démarrage = 3

/!\ Ip6Fw - Type de démarrage = 4

/!\ SharedAccess - Type de démarrage = 4

/!\ wuauserv - Type de démarrage = 4

/!\ wscsvc - Type de démarrage = 4

--------------- [ Recherche dans supports amovibles] ----------------

+- Informations :

C: - Lecteur fixe

D: - Lecteur fixe

+- presence des fichiers :

--------------- [ Registre / Mountpoint2 ] ----------------

-> Not found !

------------------- ! Fin du rapport ! --------------------
0
Réponse 6 / 82
sKe69 Contributeur sécurité
Bien ... la suite :

1- Important :
Branche toutes tes unités externes au PC ( DD externes , clé USB , lecteur mp3, ect...) mais sans les ouvrir !
Tu les retireras après la manipe ...

2- ! Ferme toutes applications en cours !

Relance FindyKill :

-> choisis cette fois-ci l'option 2 .

/!\ ton PC va redémarrer de lui même , c'est normal !... Laisse travailler l'outil jusqu' à l'apparition du message :
"nettoyage terminé" .

Note : lors du message d'avertissement , clique sur " Ok " .

--> ensuite poste le nouveau rapport FindyKill.txt qui est généré et attends la suite ...

( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt )

PS : Si le Bureau ne réapparait pas, presse Ctrl + Alt + Suppr , Onglet "Fichier"-> "Nouvelle tâche":
tape explorer.exe et valide .

( PS2 : si Spybot S&D te demande des modifs de registres une fois de retour sur le bureau , tu les acceptes toutes ... )
1
Réponse 7 / 82
bruceleee Auteur
Voilà :

----------------- FindyKill V4.707 ------------------

* User : Lydie1 - LYDIE
* executed from : D:\Program Files\FindyKill
* Update on 06/12/08 par Chiquitine29
* Start at 17:38:40 the 08/12/2008
* Windows XP - Internet Explorer 7.0.5730.13

((((((((((((((( *** deleting *** ))))))))))))))))))

--------------- [ Active Processes ] ----------------

D:\WINNT\System32\smss.exe
D:\WINNT\system32\csrss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\System32\svchost.exe
D:\WINNT\System32\svchost.exe
D:\WINNT\system32\logonui.exe
D:\WINNT\system32\spoolsv.exe
D:\WINNT\system32\userinit.exe
D:\WINNT\system32\WgaTray.exe

--------------- [ Infected files / folders ] ----------------

»»»» Supression files in D:

»»»» Supression files in D:\WINNT

»»»» Supression files in D:\WINNT\Prefetch

Deleted ! - D:\WINNT\prefetch\111734.EXE-36BCB596.pf
Deleted ! - D:\WINNT\prefetch\113046.EXE-3497B089.pf
Deleted ! - D:\WINNT\prefetch\120640.EXE-2145EBFF.pf
Deleted ! - D:\WINNT\prefetch\128062.EXE-2C6544CD.pf
Deleted ! - D:\WINNT\prefetch\129203.EXE-03BF5260.pf
Deleted ! - D:\WINNT\prefetch\130421.EXE-3000AC5D.pf
Deleted ! - D:\WINNT\prefetch\132375.EXE-01BF4C2F.pf
Deleted ! - D:\WINNT\prefetch\133234.EXE-0D90C64A.pf
Deleted ! - D:\WINNT\prefetch\137703.EXE-06861676.pf
Deleted ! - D:\WINNT\prefetch\140578.EXE-3337D2CA.pf
Deleted ! - D:\WINNT\prefetch\141234.EXE-067F908A.pf
Deleted ! - D:\WINNT\prefetch\148671.EXE-2F8BBA0D.pf
Deleted ! - D:\WINNT\prefetch\167906.EXE-3B583542.pf
Deleted ! - D:\WINNT\prefetch\168640.EXE-04E15264.pf
Deleted ! - D:\WINNT\prefetch\170953.EXE-1E7F20F3.pf
Deleted ! - D:\WINNT\prefetch\172203.EXE-3255BE38.pf
Deleted ! - D:\WINNT\prefetch\64203.EXE-0606E2F8.pf
Deleted ! - D:\WINNT\prefetch\79765.EXE-38F6E0F4.pf
Deleted ! - D:\WINNT\prefetch\80015.EXE-242BFB62.pf
Deleted ! - D:\WINNT\prefetch\84125.EXE-31775B0E.pf
Deleted ! - D:\WINNT\prefetch\86000.EXE-118C692F.pf
Deleted ! - D:\WINNT\prefetch\FLEC006.EXE-28686AE2.pf
Deleted ! - D:\WINNT\prefetch\MDELK.EXE-01C3630F.pf
Deleted ! - D:\WINNT\prefetch\WINTEMS.EXE-2A914939.pf

»»»» Supression files in D:\WINNT\system32

Deleted ! - D:\WINNT\system32\mdelk.exe
Deleted ! - D:\WINNT\system32\wintems.exe
Deleted ! - D:\WINNT\system32\ban_list.txt

»»»» Supression files in D:\WINNT\system32\drivers

Deleted ! - D:\WINNT\system32\drivers\srosa.sys
Deleted ! - D:\WINNT\system32\drivers\srosa2.sys
Deleted ! - D:\WINNT\system32\drivers\winfilse.exe
Deleted ! - D:\WINNT\system32\drivers\downld\104281.exe
Deleted ! - D:\WINNT\system32\drivers\downld\111578.exe
Deleted ! - D:\WINNT\system32\drivers\downld\111718.exe
Deleted ! - D:\WINNT\system32\drivers\downld\111734.exe
Deleted ! - D:\WINNT\system32\drivers\downld\112281.exe
Deleted ! - D:\WINNT\system32\drivers\downld\113046.exe
Deleted ! - D:\WINNT\system32\drivers\downld\115453.exe
Deleted ! - D:\WINNT\system32\drivers\downld\118203.exe
Deleted ! - D:\WINNT\system32\drivers\downld\121781.exe
Deleted ! - D:\WINNT\system32\drivers\downld\122421.exe
Deleted ! - D:\WINNT\system32\drivers\downld\123734.exe
Deleted ! - D:\WINNT\system32\drivers\downld\124078.exe
Deleted ! - D:\WINNT\system32\drivers\downld\124531.exe
Deleted ! - D:\WINNT\system32\drivers\downld\127875.exe
Deleted ! - D:\WINNT\system32\drivers\downld\128062.exe
Deleted ! - D:\WINNT\system32\drivers\downld\129203.exe
Deleted ! - D:\WINNT\system32\drivers\downld\132375.exe
Deleted ! - D:\WINNT\system32\drivers\downld\132531.exe
Deleted ! - D:\WINNT\system32\drivers\downld\132578.exe
Deleted ! - D:\WINNT\system32\drivers\downld\133234.exe
Deleted ! - D:\WINNT\system32\drivers\downld\133671.exe
Deleted ! - D:\WINNT\system32\drivers\downld\133781.exe
Deleted ! - D:\WINNT\system32\drivers\downld\136656.exe
Deleted ! - D:\WINNT\system32\drivers\downld\137546.exe
Deleted ! - D:\WINNT\system32\drivers\downld\139640.exe
Deleted ! - D:\WINNT\system32\drivers\downld\140281.exe
Deleted ! - D:\WINNT\system32\drivers\downld\142265.exe
Deleted ! - D:\WINNT\system32\drivers\downld\143234.exe
Deleted ! - D:\WINNT\system32\drivers\downld\143531.exe
Deleted ! - D:\WINNT\system32\drivers\downld\144296.exe
Deleted ! - D:\WINNT\system32\drivers\downld\148671.exe
Deleted ! - D:\WINNT\system32\drivers\downld\150921.exe
Deleted ! - D:\WINNT\system32\drivers\downld\157390.exe
Deleted ! - D:\WINNT\system32\drivers\downld\164468.exe
Deleted ! - D:\WINNT\system32\drivers\downld\165312.exe
Deleted ! - D:\WINNT\system32\drivers\downld\166906.exe
Deleted ! - D:\WINNT\system32\drivers\downld\167812.exe
Deleted ! - D:\WINNT\system32\drivers\downld\167906.exe
Deleted ! - D:\WINNT\system32\drivers\downld\168578.exe
Deleted ! - D:\WINNT\system32\drivers\downld\168640.exe
Deleted ! - D:\WINNT\system32\drivers\downld\170953.exe
Deleted ! - D:\WINNT\system32\drivers\downld\171031.exe
Deleted ! - D:\WINNT\system32\drivers\downld\171234.exe
Deleted ! - D:\WINNT\system32\drivers\downld\172203.exe
Deleted ! - D:\WINNT\system32\drivers\downld\174015.exe
Deleted ! - D:\WINNT\system32\drivers\downld\174750.exe
Deleted ! - D:\WINNT\system32\drivers\downld\176703.exe
Deleted ! - D:\WINNT\system32\drivers\downld\180109.exe
Deleted ! - D:\WINNT\system32\drivers\downld\182234.exe
Deleted ! - D:\WINNT\system32\drivers\downld\186421.exe
Deleted ! - D:\WINNT\system32\drivers\downld\186453.exe
Deleted ! - D:\WINNT\system32\drivers\downld\199140.exe
Deleted ! - D:\WINNT\system32\drivers\downld\201250.exe
Deleted ! - D:\WINNT\system32\drivers\downld\203156.exe
Deleted ! - D:\WINNT\system32\drivers\downld\206406.exe
Deleted ! - D:\WINNT\system32\drivers\downld\207578.exe
Deleted ! - D:\WINNT\system32\drivers\downld\207765.exe
Deleted ! - D:\WINNT\system32\drivers\downld\208484.exe
Deleted ! - D:\WINNT\system32\drivers\downld\210312.exe
Deleted ! - D:\WINNT\system32\drivers\downld\210671.exe
Deleted ! - D:\WINNT\system32\drivers\downld\218265.exe
Deleted ! - D:\WINNT\system32\drivers\downld\219000.exe
Deleted ! - D:\WINNT\system32\drivers\downld\227046.exe
Deleted ! - D:\WINNT\system32\drivers\downld\235015.exe
Deleted ! - D:\WINNT\system32\drivers\downld\239937.exe
Deleted ! - D:\WINNT\system32\drivers\downld\241937.exe
Deleted ! - D:\WINNT\system32\drivers\downld\246437.exe
Deleted ! - D:\WINNT\system32\drivers\downld\246781.exe
Deleted ! - D:\WINNT\system32\drivers\downld\254687.exe
Deleted ! - D:\WINNT\system32\drivers\downld\262156.exe
Deleted ! - D:\WINNT\system32\drivers\downld\263906.exe
Deleted ! - D:\WINNT\system32\drivers\downld\355875.exe
Deleted ! - D:\WINNT\system32\drivers\downld\358875.exe
Deleted ! - D:\WINNT\system32\drivers\downld\361203.exe
Deleted ! - D:\WINNT\system32\drivers\downld\373484.exe
Deleted ! - D:\WINNT\system32\drivers\downld\374187.exe
Deleted ! - D:\WINNT\system32\drivers\downld\393812.exe
Deleted ! - D:\WINNT\system32\drivers\downld\396453.exe
Deleted ! - D:\WINNT\system32\drivers\downld\400078.exe
Deleted ! - D:\WINNT\system32\drivers\downld\411906.exe
Deleted ! - D:\WINNT\system32\drivers\downld\456015.exe
Deleted ! - D:\WINNT\system32\drivers\downld\457734.exe
Deleted ! - D:\WINNT\system32\drivers\downld\462906.exe
Deleted ! - D:\WINNT\system32\drivers\downld\49171.exe
Deleted ! - D:\WINNT\system32\drivers\downld\494765.exe
Deleted ! - D:\WINNT\system32\drivers\downld\502328.exe
Deleted ! - D:\WINNT\system32\drivers\downld\53703.exe
Deleted ! - D:\WINNT\system32\drivers\downld\53859.exe
Deleted ! - D:\WINNT\system32\drivers\downld\54453.exe
Deleted ! - D:\WINNT\system32\drivers\downld\54765.exe
Deleted ! - D:\WINNT\system32\drivers\downld\55109.exe
Deleted ! - D:\WINNT\system32\drivers\downld\55140.exe
Deleted ! - D:\WINNT\system32\drivers\downld\56484.exe
Deleted ! - D:\WINNT\system32\drivers\downld\57109.exe
Deleted ! - D:\WINNT\system32\drivers\downld\57703.exe
Deleted ! - D:\WINNT\system32\drivers\downld\58140.exe
Deleted ! - D:\WINNT\system32\drivers\downld\58343.exe
Deleted ! - D:\WINNT\system32\drivers\downld\58718.exe
Deleted ! - D:\WINNT\system32\drivers\downld\60046.exe
Deleted ! - D:\WINNT\system32\drivers\downld\64203.exe
Deleted ! - D:\WINNT\system32\drivers\downld\65609.exe
Deleted ! - D:\WINNT\system32\drivers\downld\66062.exe
Deleted ! - D:\WINNT\system32\drivers\downld\66453.exe
Deleted ! - D:\WINNT\system32\drivers\downld\67343.exe
Deleted ! - D:\WINNT\system32\drivers\downld\67687.exe
Deleted ! - D:\WINNT\system32\drivers\downld\68062.exe
Deleted ! - D:\WINNT\system32\drivers\downld\69375.exe
Deleted ! - D:\WINNT\system32\drivers\downld\70937.exe
Deleted ! - D:\WINNT\system32\drivers\downld\71062.exe
Deleted ! - D:\WINNT\system32\drivers\downld\72015.exe
Deleted ! - D:\WINNT\system32\drivers\downld\72093.exe
Deleted ! - D:\WINNT\system32\drivers\downld\73765.exe
Deleted ! - D:\WINNT\system32\drivers\downld\76531.exe
Deleted ! - D:\WINNT\system32\drivers\downld\76765.exe
Deleted ! - D:\WINNT\system32\drivers\downld\77968.exe
Deleted ! - D:\WINNT\system32\drivers\downld\79125.exe
Deleted ! - D:\WINNT\system32\drivers\downld\79765.exe
Deleted ! - D:\WINNT\system32\drivers\downld\79921.exe
Deleted ! - D:\WINNT\system32\drivers\downld\80015.exe
Deleted ! - D:\WINNT\system32\drivers\downld\82859.exe
Deleted ! - D:\WINNT\system32\drivers\downld\83390.exe
Deleted ! - D:\WINNT\system32\drivers\downld\84125.exe
Deleted ! - D:\WINNT\system32\drivers\downld\84406.exe
Deleted ! - D:\WINNT\system32\drivers\downld\87125.exe
Deleted ! - D:\WINNT\system32\drivers\downld\87687.exe
Deleted ! - D:\WINNT\system32\drivers\downld\88234.exe
Deleted ! - D:\WINNT\system32\drivers\downld\88937.exe
Deleted ! - D:\WINNT\system32\drivers\downld\90437.exe
Deleted ! - D:\WINNT\system32\drivers\downld\91312.exe
Deleted ! - D:\WINNT\system32\drivers\downld\92312.exe
Deleted ! - D:\WINNT\system32\drivers\downld\92765.exe
Deleted ! - D:\WINNT\system32\drivers\downld\97390.exe
Deleted ! - D:\WINNT\system32\drivers\downld\99609.exe
Deleted ! - "D:\WINNT\system32\drivers\downld"

»»»» Supression files in D:\Documents and Settings\Lydie1\Application Data

Deleted ! - "D:\Documents and Settings\Lydie1\Application Data\m\flec006.exe"
Deleted ! - "D:\Documents and Settings\Lydie1\Application Data\m\list.oct"
Deleted ! - "D:\Documents and Settings\Lydie1\Application Data\m\data.oct"
Deleted ! - "D:\Documents and Settings\Lydie1\Application Data\m\srvlist.oct"
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\!3D Development Studio for Microsoft Visual C# .Net 6.07.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\3D Photo Album Screensaver 1.3 (Crack).zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\642-091 Practice Exam Testing Engine Software (KeyGen).zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Actions Monitor 1.02 (Cracked).zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\AdSense Watch 1.0.1.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Advanced_Encryption_Package_2007_4.6.7.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\ADX Toys 2 OL 2.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Amigo_Restaurant_POS_4.10.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Argente - Process Manager 1.3.0.1.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Arusoft_Password_Generator_2.11.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\ASP.NET_Maker_3.2.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Auto Debug System 4.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\AVS DV to DVD 1.2.1.97.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\AVS_Video_to_iPod_2.1.1.102.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\A_Personal_Diet_Fitness_Manager_1.7.3_With_Crack.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\BackToBasics 9.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\BangaBangarasoft Family 1.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\BBC_Radio_4_Player_1.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\BNNClock 1.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Chilkat XMP .NET Component 1.1.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Cleantouch InventGST Reloaded 1.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Clickrisk_Scanner_Pro_1.038.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Comparator Fast 1.0.0.27.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Coolumns_Pack_3.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\CreateInstall 4.13.7.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\CrossHair_1.01.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Cymphonix Speed-O-Meter 4.1.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\DVD_to_AVI_Converter_4.0.25_(Serial).zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\DVD_to_iPhone_Suite_3.0.72.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Effects_2.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Elephant Screensaver.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Explorer Background Changer 1.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\File Cabinets 2.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\FileZ_5.3.2.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Find Them 1.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\FolderFix_XP_2.2.1.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Free Compound Interest Calculator 1.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Free Parental Control 2.05.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\FTP_Uploader_Creator_5.1.1.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\GlyphThis_4.0.4.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Gmail_Opener_1.4.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\GvpGet 1.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Half-Life_2_DM_Crossfire_Source_map.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\HandyFileSearch_1.1.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Helpmatic_Pro_HTML_6.4.3.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\HIPAA_Employee_Training_Program_1.1.1.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\HSLAB_Shutdown_Folder_Lite_1.8.30.162.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\HTML Translator 2.5.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\IconForge Icon Editing Tool Kit 7.23.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\ImageConvertor 1.9.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\ImageReducer 2004.7.1 build 157.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\ImgSource 4.0.7.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\IM_Speak!_3.8_Patch.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\K-Lite_MPEG_Pack_1.1.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Lacey WallPaper 1.1.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\LanguageStudio_Italian_2.1s_build_69_(Patch).zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\LingvoSoft Talking Picture Dictionary 2007 German - Polish 1.1.18.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\LingvoSoft_Picture_Dictionary_2007_Russian_-_Polish_1.1.18_(Cracked).zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\LiveJournal Friends Reader 1.5.3.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\LUNA_Free_1.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\MagicTable_For_BricsCAD_1.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Magic_Recovery_Professional_3.2.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Mcafee.Antivirus.9.0.Full.Cracked.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\MessagePopup II 3.5.7.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\MoreAmp_0.1.19.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\MvTools_1.4.1.3.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\N2C TreeView for ASP.NET 2.2.5.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Nebula3HS_1.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\NewName_2.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Notezilla Portable 7.0 Build 80 (Patch).zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\NSEXEM32 1.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\OECombo_2.0.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Openchart2_1.2.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Paint_Blox_1.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\PasswordCreator 1.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Password_Generator_2004_1.1.5.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\PayPunchWeb_Enterprise_3.2.21_KeyGen.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\PDF_Info_1.00_Crack.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Peep Show Lite 1.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Personal Progress File Standard Edition 1.4.02.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\PhotoVision 1.2a.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\PlasmaplugsScrollBar_1.0_Key.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Polar_Draw_Component_3.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Process_Eliminator_1.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Production_Mix_Model_Excel_20.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\ProQuant 1.3.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Protexis_Test2_2.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\QuickScore_Elite_MIDI_Edition_12.0.7.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\RankQuest SEO Gadget 1.1.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\RemoteScan 4.3.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Replica_1.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Requirements_Whiteboard_Reviewer_Edition_1.1.2.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Rip'n'TagIt_1.5.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Scare With Skulls Screensaver 1.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\SC_Audio_Extractor_6.3.0.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Sliber_1.01.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\SlovoEd_English-Italian-English_Gold_Dictionary_3.04.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Smart Pet Health Professional 1.1.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\SmE GB Host 1.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Snacks_Animated_Cursors_1.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\SNMP_Test_for_Routers_1.04_Build_26.1.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Stardust Screen Saver Control 2003 3.0.0.65.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\StarFisher 0.7.3 Alpha.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Sticker Book 1.05.78.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\System_ScreenSaver_2.1.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Thank You Letter Writer 1.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\The Recipe Processor 2000 6.1.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\The_Oud_Tutor_1.4.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\TossCalc_1.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Traductor_EDG_1.2.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Trellian ImageMapper 1.0.3.55.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\TRW_2000_1.23_[Serial].zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Tutorial_Bridge_4.4.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\UKPad 1.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Unreal Tournament 2004 Exion mod zip 2.00.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Unreal_Tournament_2003_-_Black_Jack_Repoman_skin.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\User Control 2006 4.412.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\USGS Earthquake RSS Feed Reader 1.0.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\UTM_for_Windows_5.1.10-016_[With_Crack].zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\VistaAeroSwitch 1.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Web Views 1.0 [KeyGen].zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Web_Link_Validator_4.7.477.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\White Backup 1.0.18.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Worm.Zotob_Removal_Tool_1.0.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\X-Win32 8.0.2204s.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\X360_Tiff_Image_&_Fax_Viewer_ActiveX_Control_4.0_Key+Serial.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Xilisoft_Ripper_Pack_Platinum_4.0.85.0809.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\YNAB_Pro_1.1.zip
Deleted ! - D:\Documents and Settings\Lydie1\Application Data\m\shared\Zoner Panorama Maker 1.0 [With Crack].zip
Deleted ! - "D:\Documents and Settings\Lydie1\Application Data\m\shared"
Deleted ! - "D:\Documents and Settings\Lydie1\Application Data\m"

»»»» Supression files in D:\DOCUME~1\Lydie1\LOCALS~1\Temp

»»»» Supression files in D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5

Deleted ! - D:\Documents and Settings\All Users\Application Data\Skype\Plugins\Local Cache\D3987B641C134048B815DB578D607F42_more.jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\F2B18G4G\b64_1[1].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\F2B18G4G\b64_2[1].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\F2B18G4G\mxd[1].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\F2B18G4G\mxd[2].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\FE4G9QCS\b64[1].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\FE4G9QCS\b64[2].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\FE4G9QCS\b64[3].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\FE4G9QCS\b64[4].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\FE4G9QCS\b64_1[1].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\FE4G9QCS\b64_3[1].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\FE4G9QCS\b64_3[2].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\FE4G9QCS\b64_3[3].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\IKQMQBBS\b64[1].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\IKQMQBBS\b64[2].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\IKQMQBBS\b64_3[1].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\IKQMQBBS\mxd[1].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\MTF2NSBI\b64[1].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\MTF2NSBI\b64_1[1].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\MTF2NSBI\b64_2[1].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\MTF2NSBI\b64_2[2].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\MTF2NSBI\b64_2[3].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\MTF2NSBI\b64_2[4].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\MTF2NSBI\b64_2[5].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\MTF2NSBI\b64_3[1].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\U1E0771G\b64_1[1].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\WIJOWNR9\b64[1].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\WIJOWNR9\b64_1[1].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\WIJOWNR9\b64_1[2].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\WIJOWNR9\b64_2[1].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\WIJOWNR9\b64_2[2].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\WIJOWNR9\b64_2[3].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\WIJOWNR9\b64_3[1].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\ZS4Z3N8G\b64[1].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\ZS4Z3N8G\b64[2].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\ZS4Z3N8G\b64[3].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\ZS4Z3N8G\b64_1[1].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\ZS4Z3N8G\b64_1[2].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\ZS4Z3N8G\b64_2[1].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\ZS4Z3N8G\b64_2[2].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\ZS4Z3N8G\b64_2[3].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\ZS4Z3N8G\b64_3[1].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\ZS4Z3N8G\mxd[1].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\ZX98VY0M\b64[1].jpg
Deleted ! - D:\Documents and Settings\Lydie1\Local Settings\Temporary Internet Files\Content.IE5\ZX98VY0M\b64_2[1].jpg

--------------- [ Registry / Infected keys ] ----------------

Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_USERS\S-1-5-21-1935655697-2077806209-839522115-1000\Software\Local AppWizard-Generated Applications\winfilse

--------------- [ States / Restarting of services ] ----------------

+- Safe boot mode restored !

+- Services : [ Auto=2 / Request=3 / Disable=4 ]

Ndisuio - Type of startup = 3

EapHost - Type of startup = 2

Ip6Fw - Type of startup = 2

SharedAccess - Type of startup = 2

wuauserv - Type of startup = 2

wscsvc - Type of startup = 2

--------------- [ Cleaning removable drives ] ----------------

+- Informations :

C: - Lecteur fixe

D: - Lecteur fixe

F: - Lecteur amovible

+- deleting files :

--------------- [ Registry / Mountpoint2 ] ----------------

-> Not found !

--------------- [ Searching Cracks / Keygen ] ----------------

D:\Documents and Settings\Lydie1\Application Data\cYo\ComicRack
D:\Documents and Settings\Lydie1\Application Data\cYo\ComicRack\ComicDb.xml
D:\Documents and Settings\Lydie1\Application Data\cYo\ComicRack\ComicDb.xml.bak
D:\Documents and Settings\Lydie1\Application Data\cYo\ComicRack\Config.xml
D:\Documents and Settings\Lydie1\Application Data\cYo\ComicRack\DonateImage
D:\Documents and Settings\Lydie1\Application Data\cYo\ComicRack\NewsFeeds.xml
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Thumbnails
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\16
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\18
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\21
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\63
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\cache.idx
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\16\169521630417805677_0_0.cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\16\169521630417805677_1_0.cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\16\169521630417805677_2_0.cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\16\169521630417805677_3_0.cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\16\169521630417805677_4_0.cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\16\169521630417805677_5_0.cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\16\169521630417805677_6_0.cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\16\169521630417805677_7_0.cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\16\169521630417805677_8_0.cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\18\-17212594321830801_0_0.cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\18\-17212594321830801_2_0.cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\18\-17212594321830801_3_0.cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\18\-17212594321830801_4_0.cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\18\-17212594321830801_5_0.cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\18\-17212594321830801_6_0.cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\18\-17212594321830801_7_0.cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\18\-17212594321830801_8_0.cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\18\-17212594321830801_9_0.cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\21\211037840816387223_0_0.cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\21\211037840816387223_1_0.cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\21\211037840816387223_2_0.cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\21\211037840816387223_3_0.cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\21\211037840816387223_4_0.cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\21\211037840816387223_5_0.cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\63\62790866316649842_0_0.cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\63\62790866316649842_1_0.cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\63\62790866316649842_2_0.cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\63\62790866316649842_3_0.cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Images\63\62790866316649842_4_0.cache
D:\Documents and Settings\Lydie1\Local Settings\Application Data\cYo\ComicRack\Cache\Thumbnails\cache.idx
D:\Documents and Settings\All Users\Bureau\ComicRack.lnk
D:\Documents and Settings\All Users\Menu D‚marrer\Programmes\ComicRack
D:\Documents and Settings\All Users\Menu D‚marrer\Programmes\ComicRack\ComicRack.lnk
D:\Documents and Settings\All Users\Menu D‚marrer\Programmes\ComicRack\Release Notes.lnk
D:\Documents and Settings\All Users\Menu D‚marrer\Programmes\ComicRack\Version History.lnk
D:\Documents and Settings\All Users\Menu D‚marrer\Programmes\ComicRack\Website.lnk

---------------- ! End of report ! ------------------

Le son est revenu!
0
Réponse 8 / 82
bruceleee Auteur
Voilà :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:45:42, on 08/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\System32\svchost.exe
D:\WINNT\system32\spoolsv.exe
D:\WINNT\Explorer.EXE
D:\WINNT\system32\VTTimer.exe
D:\WINNT\system32\VTtrayp.exe
D:\Program Files\Java\jre6\bin\jusched.exe
D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
D:\WINNT\system32\ctfmon.exe
D:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\WINNT\System32\svchost.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\WINNT\System32\svchost.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.update.microsoft.com/windowsupdate/v6/default.aspx
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - D:\Outils\Real player\rpbrowserrecordplugin.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar2.dll
O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - D:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [EPSON Stylus CX6600 Series] D:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATI9EE.EXE /P26 "EPSON Stylus CX6600 Series" /O5 "LPT1:" /M "Stylus CX6600"
O4 - HKLM\..\Run: [avast!] D:\Outils\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AppleSyncNotifier] D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Outils\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [VeohPlugin] "D:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe"
O4 - HKUS\S-1-5-19\..\Run: [internat.exe] internat.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [^SetupICWDesktop] D:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [internat.exe] internat.exe (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [^SetupICWDesktop] D:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [internat.exe] internat.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] D:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] D:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - D:\WINNT\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - D:\WINNT\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINNT\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINNT\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - https://driveragent.com/files/driveragent.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Apple Mobile Device - Apple Inc. - D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
0
Réponse 9 / 82
sKe69 Contributeur sécurité
Bien ... Avast est bel et bien naze ... on va voir cela après ... ( surtout que j'ai mieux comme AV à te proposer ; ) )

fais ceci pour approfondir hijackthis :

Télécharge Random's System Information Tool (RSIT) de random/random et enregistre l'exécutable sur ton Bureau.

-> http://images.malwareremoval.com/random/RSIT.exe

! Ferme bien toutes tes applications en cours !

Double-clique sur " RSIT.exe " pour le lancer .

-> Une première fenêtre s'ouvre avec en titre : " Disclaimer of warranty " .

* Devant l'option "List files/folders created ..." , tu choisis : 2 months

* clique ensuite sur " Continue " pour lancer l'analyse ...

( Note : Si la dernière version de HijackThis n'est pas détectée sur ton PC, RSIT le téléchargera et te demandera d'accepter la licence.)

-> laisse faire le scan et ne touche pas au PC ...

Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront (probablement avec le bloc-note).

Poste le contenu de " log.txt " (c'est celui qui apparait à l'écran), ainsi que de " info.txt " (que tu verras dans la barre des tâches), pour analyse et attends la suite ...

Important : poste un rapport, puis l'autre dans la réponse suivante ... si tu essaies de poster les deux en même temps,
cela risque d'être trop long pour le forum ...
Et si "log.txt" seul, ne passe pas non plus , fais le en 2 fois ... merci ...

( Note : les rapports seront en outre sauvegardés dans ce dossier -> C:\rsit )
1
Réponse 10 / 82
bruceleee Auteur
Voilà, log bloc note :

Logfile of random's system information tool 1.04 (written by random/random)
Run by Lydie1 at 2008-12-08 18:57:25
Microsoft Windows XP Professionnel Service Pack 3
System drive D: has 22 GB (28%) free of 79 GB
Total RAM: 446 MB (52% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:57:29, on 08/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\System32\svchost.exe
D:\WINNT\system32\spoolsv.exe
D:\WINNT\Explorer.EXE
D:\WINNT\system32\VTTimer.exe
D:\WINNT\system32\VTtrayp.exe
D:\Program Files\Java\jre6\bin\jusched.exe
D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
D:\WINNT\system32\ctfmon.exe
D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\WINNT\System32\svchost.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\WINNT\System32\svchost.exe
D:\Documents and Settings\Lydie1\Bureau\RSIT.exe
D:\Program Files\Trend Micro\HijackThis\Lydie1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.update.microsoft.com/windowsupdate/v6/default.aspx
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - D:\Outils\Real player\rpbrowserrecordplugin.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar2.dll
O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - D:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [EPSON Stylus CX6600 Series] D:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATI9EE.EXE /P26 "EPSON Stylus CX6600 Series" /O5 "LPT1:" /M "Stylus CX6600"
O4 - HKLM\..\Run: [avast!] D:\Outils\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AppleSyncNotifier] D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Outils\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [VeohPlugin] "D:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe"
O4 - HKUS\S-1-5-19\..\Run: [internat.exe] internat.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [^SetupICWDesktop] D:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [internat.exe] internat.exe (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [^SetupICWDesktop] D:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [internat.exe] internat.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] D:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] D:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - D:\WINNT\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - D:\WINNT\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINNT\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINNT\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - https://driveragent.com/files/driveragent.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Apple Mobile Device - Apple Inc. - D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
0
Réponse 11 / 82
bruceleee Auteur
Et voilà info bloc note :

info.txt logfile of random's system information tool 1.04 2008-12-08 18:57:31

======Uninstall list======

-->D:\Outils\DivX\DivXConverterUninstall.exe /CONVERTER
-->D:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 D:\WINNT\INF\PCHealth.inf
Adobe Flash Player 10 ActiveX-->D:\WINNT\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->D:\WINNT\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 7.1.0 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A71000000002}
adsl TV-->D:\Outils\adslTV\Uninstal.exe
Apple Mobile Device Support-->MsiExec.exe /I{EC4455AB-F155-4CC1-A4C5-88F3777F9886}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Assistant de connexion Windows Live-->MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
avast! Antivirus-->D:\Outils\Alwil Software\Avast4\aswRunDll.exe "D:\Outils\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
Bonjour-->MsiExec.exe /I{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}
BroadJump Client Foundation-->D:\WINNT\IsUninst.exe -f"D:\Program Files\BroadJump\Client Foundation\Uninst.isu" -c"D:\Program Files\BroadJump\Client Foundation\RmvBJCFD.dll" -b"CFD" -h"CFD" -a
CCleaner (remove only)-->"D:\Program Files\CCleaner\uninst.exe"
Cluedo-->D:\Outils\Jeux\Cluedo\Uninstal.exe
ComicRack v0.9.80-->D:\Outils\ComicRack\uninst.exe
Correctif pour Lecteur Windows Media 11 (KB939683)-->"D:\WINNT\$NtUninstallKB939683$\spuninst\spuninst.exe"
Correctif pour Windows Internet Explorer 7 (KB947864)-->"D:\WINNT\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Correctif pour Windows XP (KB952287)-->"D:\WINNT\$NtUninstallKB952287$\spuninst\spuninst.exe"
DivX Codec-->D:\Outils\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->D:\Outils\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->D:\Outils\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player-->D:\Outils\DivX\DivXWebPlayerUninstall.exe /PLUGIN
eMule-->"D:\Outils\eMule\Uninstall.exe"
EPSON Logiciel imprimante-->D:\WINNT\System32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /R
FindyKill-->D:\Program Files\FindyKill\Uninstal.exe
Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
Google Toolbar for Firefox-->MsiExec.exe /X{2CCBABCB-6427-4A55-B091-49864623C43F}
Google Toolbar for Internet Explorer-->MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Toolbar for Internet Explorer-->regsvr32 /u /s "d:\program files\google\googletoolbar2.dll"
HijackThis 2.0.2-->"D:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399)-->"D:\WINNT\$NtUninstallKB929399$\spuninst\spuninst.exe"
Java(TM) 6 Update 10-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216010FF}
Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java(TM) 6 Update 4-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160040}
Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Lanceur Club Internet v6-->"D:\Program Files\Club-Internet\Lanceur\uninstall.exe"
Lecteur Windows Media 11-->"D:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Ma-Config.com plugin-->MsiExec.exe /I{D2D7529F-6B55-4C1C-BC9C-D6F1BCC066B6}
MediaInfo 0.7.7.4-->D:\Outils\MediaInfo\uninst.exe
Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft Compression Client Pack 1.0 for Windows XP-->"D:\WINNT\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"D:\WINNT\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"D:\WINNT\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"D:\WINNT\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"D:\WINNT\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"D:\WINNT\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)-->"D:\WINNT\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB942615)-->"D:\WINNT\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB944533)-->"D:\WINNT\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB950759)-->"D:\WINNT\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB953838)-->"D:\WINNT\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)-->"D:\WINNT\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923789)-->D:\WINNT\system32\MacroMed\Flash\genuinst.exe D:\WINNT\system32\MacroMed\Flash\KB923789.inf
Mise à jour de sécurité pour Windows XP (KB938464)-->"D:\WINNT\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"D:\WINNT\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"D:\WINNT\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950760)-->"D:\WINNT\$NtUninstallKB950760$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"D:\WINNT\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"D:\WINNT\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"D:\WINNT\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376)-->"D:\WINNT\$NtUninstallKB951376$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"D:\WINNT\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"D:\WINNT\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"D:\WINNT\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"D:\WINNT\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953839)-->"D:\WINNT\$NtUninstallKB953839$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"D:\WINNT\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"D:\WINNT\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"D:\WINNT\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956391)-->"D:\WINNT\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"D:\WINNT\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"D:\WINNT\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957095)-->"D:\WINNT\$NtUninstallKB957095$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"D:\WINNT\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"D:\WINNT\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951072-v2)-->"D:\WINNT\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951978)-->"D:\WINNT\$NtUninstallKB951978$\spuninst\spuninst.exe"
MobileMe Control Panel-->MsiExec.exe /I{2604C0F9-BFD3-4BA0-9EB5-22537C648F03}
Mozilla Firefox (2.0.0.18)-->D:\Program Files\Mozilla Firefox\uninstall\helper.exe
OpenOffice.org 2.4-->MsiExec.exe /I{A122962F-331A-4C2E-93DB-AD92D8A4FB14}
Outils Club Internet-->"D:\Program Files\Club-Internet\Assistance\OutilsCI\uninstall.exe"
QuickTime-->MsiExec.exe /I{F958CA02-BB40-4007-894B-258729456EE4}
RealPlayer-->D:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Realtek AC'97 Audio-->RunDll32 D:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "D:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" -l0x40c -removeonly
Safari-->MsiExec.exe /I{582D2A53-F426-4C5E-A2E6-43C1AB36B907}
TeamSpeak 2 RC2-->D:\Outils\Teamspeak2_RC2\unins000.exe
TV sur PC-->D:\Program Files\Neuf\TV_PC\uninstall.exe
Veoh Web Player Beta-->"D:\Program Files\Veoh Networks\VeohWebPlayer\uninst.exe"
VIA Gestionnaire de périphériques de plate-forme-->D:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{20D4A895-748C-4D88-871C-FDB1695B0169}
VIA Rhine-Family Fast-Ethernet Adapter-->Rundll32.exe vuins32.dll,vuins32Ex $Rhine $VIA
VIA/S3G Display Driver 6.14.10.0297-->D:\PROGRA~1\S3\UChromeP\s3minset.exe /u UChromeP.uns
VideoLAN VLC media player 0.8.6h-->D:\Outils\VLC\uninstall.exe
Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
Windows Live OneCare safety scanner-->RunDll32.exe "D:\Program Files\Windows Live Safety Center\wlscCore.dll",UninstallFunction WLSC_SCANNER_PRODUCT
Windows Media Format 11 runtime-->"D:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"D:\WINNT\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"D:\WINNT\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"D:\WINNT\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinRAR archiver-->D:\Program Files\WinRAR\uninstall.exe

======Security center information======

AV: avast! antivirus 4.8.1290 [VPS 081205-0]

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\WBEM;D:\Outils\QuickTime\QTSystem\
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 95 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=5f02
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"FP_NO_HOST_CHECK"=NO
"CLASSPATH"=.;D:\Program Files\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=D:\Program Files\Java\jre6\lib\ext\QTJava.zip

-----------------EOF-----------------
0
Réponse 12 / 82
sKe69 Contributeur sécurité
bien ... encore des saltés qui trainent ...

Télécharge SmitfraudFix (de S!Ri, balltrap34 et moe31 ) :
http://siri.urz.free.fr/Fix/SmitfraudFix.exe

Installe le soft sur ton bureau ( et pas ailleurs! ) .

!! Déconnecte toi, ferme toutes tes applications et désactives tes défenses ( anti-virus ,anti-spyware,...) le temps de la manipe !!

Tuto ( aide ) : http://siri.urz.free.fr/Fix/SmitfraudFix.php
Autre tuto animé ( merci balltrapp34 ;) ) : http://pagesperso-orange.fr/rginformatique/section%20virus/smitfraudfix.htm

Utilisation ---> option 1 / Recherche :
Double-clique sur l'icône "Smitfraudfix.exe" et sélectionne 1 (et pas sur autre chose sans notre accord !) pour créer un rapport des fichiers responsables de l'infection.

Poste le rapport ( "rapport.txt" qui se trouve sous C\: ) et attends la suite ...

(Attention : "process.exe", un composant de l'outil, est détecté par certains antivirus comme étant un "RiskTool". Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité.)
1
Réponse 13 / 82
bruceleee Auteur
Voilà :

SmitFraudFix v2.381

Rapport fait à 19:11:13,48, 08/12/2008
Executé à partir de D:\Documents and Settings\Lydie1\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\System32\svchost.exe
D:\WINNT\system32\spoolsv.exe
D:\WINNT\Explorer.EXE
D:\WINNT\system32\VTTimer.exe
D:\WINNT\system32\VTtrayp.exe
D:\Program Files\Java\jre6\bin\jusched.exe
D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
D:\WINNT\system32\ctfmon.exe
D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\WINNT\System32\svchost.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\WINNT\System32\svchost.exe
D:\WINNT\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» D:\

»»»»»»»»»»»»»»»»»»»»»»»» D:\WINNT

»»»»»»»»»»»»»»»»»»»»»»»» D:\WINNT\system

»»»»»»»»»»»»»»»»»»»»»»»» D:\WINNT\Web

»»»»»»»»»»»»»»»»»»»»»»»» D:\WINNT\system32

»»»»»»»»»»»»»»»»»»»»»»»» D:\WINNT\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» D:\Documents and Settings\Lydie1

»»»»»»»»»»»»»»»»»»»»»»»» D:\DOCUME~1\Lydie1\LOCALS~1\Temp

»»»»»»»»»»»»»»»»»»»»»»»» D:\Documents and Settings\Lydie1\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» D:\DOCUME~1\Lydie1\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» D:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="D:\\WINNT\\system32\\userinit.exe,"
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» RK

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: VIA Rhine II Fast Ethernet Adapter
DNS Server Search Order: 192.168.1.1
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{810A22DE-E583-4C6C-8FA1-72397A59EB57}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{810A22DE-E583-4C6C-8FA1-72397A59EB57}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{810A22DE-E583-4C6C-8FA1-72397A59EB57}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{810A22DE-E583-4C6C-8FA1-72397A59EB57}: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin
0
Réponse 14 / 82
sKe69 Contributeur sécurité
Smithfraud n'a pas détecté l'infection ... bizard ...

fais ceci :

Télécharge MalwareByte's :
ici http://www.commentcamarche.net/telecharger/telecharger 34055379 malwarebytes anti malware
ou ici : http://www.malwarebytes.org/mbam.php

* Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .

(NB : S'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharge le ici : https://www.malekal.com/tutorial-aboutbuster/ )

* Potasse le tuto pour te familiariser avec le prg :
https://forum.pcastuces.com/sujet.asp?f=31&s=3
( cela dis, il est très simple d'utilisation ).

! Déconnecte toi et ferme toutes applications en cours !

* Lance Malwarebyte's .

Fais un examen dit "Rapide" .

--> Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
--> à la fin tu cliques sur "résultat" .
--> Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .

Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !

Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date),
accompagné d'un nouveau rapport RSIT( "log.txt" ) pour analyse ...
1
Réponse 15 / 82
bruceleee Auteur
Voilà :

Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1475
Windows 5.1.2600 Service Pack 3

08/12/2008 19:36:19
mbam-log-2008-12-08 (19-36-19).txt

Type de recherche: Examen rapide
Eléments examinés: 47014
Temps écoulé: 3 minute(s), 12 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 4
Fichier(s) infecté(s): 8

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\RegistrySmart (Rogue.RegistrySmart) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
D:\WINNT\system32\drivers\downld (Trojan.Agent) -> Quarantined and deleted successfully.
D:\Documents and Settings\Lydie1\Application Data\RegistrySmart (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
D:\Documents and Settings\Lydie1\Application Data\RegistrySmart\Log (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
D:\Documents and Settings\Lydie1\Application Data\RegistrySmart\Registry Backups (Rogue.RegistrySmart) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
D:\Documents and Settings\Lydie1\Local Settings\Application Data\tvbleezvtq_navps.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
D:\Documents and Settings\Lydie1\Local Settings\Application Data\tvbleezvtq_nav.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
D:\Documents and Settings\Lydie1\Local Settings\Application Data\tvbleezvtq.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
D:\Documents and Settings\Lydie1\Application Data\RegistrySmart\Log\2008 Dec 08 - 01_02_42 PM_484.log (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
D:\Documents and Settings\Lydie1\Application Data\RegistrySmart\Log\2008 Dec 08 - 03_03_10 PM_562.log (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
D:\Documents and Settings\Lydie1\Application Data\RegistrySmart\Log\2008 Dec 08 - 05_22_03 PM_171.log (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
D:\Documents and Settings\Lydie1\Application Data\RegistrySmart\Log\2008 Dec 08 - 12_04_38 PM_390.log (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
D:\Documents and Settings\Lydie1\Application Data\RegistrySmart\Registry Backups\2008-12-08_02-24-39.reg (Rogue.RegistrySmart) -> Quarantined and deleted successfully.
0
Réponse 16 / 82
sKe69 Contributeur sécurité
bien ...

un nouveau scan RSIT et poste le rapport obtenu maintenant .... MBAM à dégoter une autre infection en plus ...
1
Réponse 17 / 82
bruceleee Auteur
Voilà le log bloc note, par contre j'ai pas eu de info bloc note cette fois :

Logfile of random's system information tool 1.04 (written by random/random)
Run by Lydie1 at 2008-12-08 19:46:26
Microsoft Windows XP Professionnel Service Pack 3
System drive D: has 22 GB (28%) free of 79 GB
Total RAM: 446 MB (49% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:46:32, on 08/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\System32\svchost.exe
D:\WINNT\system32\spoolsv.exe
D:\WINNT\Explorer.EXE
D:\WINNT\system32\VTTimer.exe
D:\WINNT\system32\VTtrayp.exe
D:\Program Files\Java\jre6\bin\jusched.exe
D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
D:\WINNT\system32\ctfmon.exe
D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\WINNT\System32\svchost.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\WINNT\System32\svchost.exe
D:\Documents and Settings\Lydie1\Bureau\RSIT.exe
D:\Program Files\Trend Micro\HijackThis\Lydie1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.update.microsoft.com/windowsupdate/v6/default.aspx
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - D:\Outils\Real player\rpbrowserrecordplugin.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar2.dll
O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - D:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [EPSON Stylus CX6600 Series] D:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATI9EE.EXE /P26 "EPSON Stylus CX6600 Series" /O5 "LPT1:" /M "Stylus CX6600"
O4 - HKLM\..\Run: [avast!] D:\Outils\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AppleSyncNotifier] D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Outils\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] D:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [VeohPlugin] "D:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe"
O4 - HKUS\S-1-5-19\..\Run: [internat.exe] internat.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [^SetupICWDesktop] D:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [internat.exe] internat.exe (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [^SetupICWDesktop] D:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [internat.exe] internat.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] D:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] D:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - D:\WINNT\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - D:\WINNT\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINNT\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINNT\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - https://driveragent.com/files/driveragent.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Apple Mobile Device - Apple Inc. - D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
0
Réponse 18 / 82
sKe69 Contributeur sécurité
Bien ... on poursuit dans l'ordre :

1- Télécharge OTMoveIt3 (de Old_Timer) sur ton Bureau.

http://oldtimer.geekstogo.com/OTMoveIt3.exe

! Déconnecte toi et ferme toutes tes applications en cours !

Double clique sur "OTMoveIt3.exe" pour ouvrir le prg .
Puis copie ce qui se trouve en citation ci-dessous,
```
:Processes
explorer.exe

:Services

:Reg

:Files
D:\WINNT\tasks\RegistrySmart Scheduled Scan.job

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]
```
et colle le dans le cadre de gauche de OTMoveIt3 :
Paste Instructions for items to be moved.
(ne touche à rien d'autre !)

-> clique sur MoveIt! pour lancer la suppression.
-> laisse travailler l'outil ...

( Note : ton bureau va disparaitre puis réapparaitre, c'est normal .)

-> une fois finis , un petite fenêtre s'ouvre : clique sur " Yes " .

Ton PC va redémarrer de lui même ...

-->Poste le contenu du rapport qui se trouve dans le dossier "C:\_OTMoveIt\MovedFiles"
( " xxxx2008_xxxxxx.log " où les "x" correspondent au jour et à l'heure de l'utilisation ).

2- refais un coup de CCleaner ( registre compris ).

3- Télécharge Navilog1 sur ton bureau :

http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe

!! Déconnecte toi,désactive tes défenses( anti-virus,anti-spyware ) et ferme bien toutes tes applications le temps de la manipe !!

Ensuite double clique sur navilog1.exe pour lancer l'installation.
Une fois l'installation terminée, le fix s'exécutera automatiquement.
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau).

Laisse-toi guider. Au menu principal, choisis 1 et valide .
(ne fais pas le choix 2,3 ou 4 sans notre avis/accord)

Patiente jusqu'au message :
*** Analyse Termine le ..... ***

Appuie sur une touche comme demandé, le bloc-note va s'ouvrir.
Copie-colle l'intégralité de son contenu dans ta prochaine réponse et attends la suite .

(Le rapport est en outre sauvegardé à la racine du disque "C\:fixnavi.txt" )

TUTO (aide) : http://www.malekal.com/Adware.Magic_Control.php#mozTocId595901
0
Réponse 19 / 82
bruceleee Auteur
Voilà pour OTmoveIt3 :

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
D:\WINNT\tasks\RegistrySmart Scheduled Scan.job moved successfully.
========== COMMANDS ==========
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. D:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. D:\WINNT\temp\Perflib_Perfdata_7cc.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.2 log created on 12082008_201941

Files moved on Reboot...
D:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat moved successfully.
File D:\WINNT\temp\Perflib_Perfdata_7cc.dat not found!
0
Réponse 20 / 82
bruceleee Auteur
Et voilà pour navilog1 :

Search Navipromo version 3.6.9 commencé le 08/12/2008 à 20:41:04,62

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis D:\Program Files\navilog1
Session actuelle : "Lydie1"

Mise à jour le 05.11.2008 à 21h00 par IL-MAFIOSO

Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.13
Système de fichiers : NTFS

Recherche executé en mode normal

*** Recherche Programmes installés ***

*** Recherche dossiers dans "D:\WINNT" ***

*** Recherche dossiers dans "D:\Program Files" ***

*** Recherche dossiers dans "D:\Documents and Settings\All Users\menudm~1\progra~1" ***

*** Recherche dossiers dans "D:\Documents and Settings\All Users\menudm~1" ***

*** Recherche dossiers dans "d:\docume~1\alluse~1\applic~1" ***

*** Recherche dossiers dans "D:\Documents and Settings\Lydie1\applic~1" ***

*** Recherche dossiers dans "D:\Documents and Settings\Lydie1\locals~1\applic~1" ***

*** Recherche dossiers dans "D:\Documents and Settings\Lydie1\menudm~1\progra~1" ***

*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "D:\WINNT\system32" *

* Recherche dans "D:\Documents and Settings\Lydie1\locals~1\applic~1" *

*** Recherche fichiers ***

*** Recherche clés spécifiques dans le Registre ***

HKEY_CURRENT_USER\Software\Lanconfig trouvé !

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :

2)Recherche Heuristique :

* Dans "D:\WINNT\system32" :

* Dans "D:\Documents and Settings\Lydie1\locals~1\applic~1" :

3)Recherche Certificats :

Certificat Egroup trouvé !
Certificat Electronic-Group trouvé !
Certificat Montorgueil absent !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :

*** Analyse terminée le 08/12/2008 à 20:43:50,81 ***
0
- 1
- 2
- 3
- 4
- 5
Suivant

Iexplore.exe, et plein de problemes divers

82 réponses

Discussions similaires

Newsletters