Probleme virus systeme volume information [Résolu/Fermé]

krazy 11 Messages postés vendredi 20 février 2009Date d'inscription 21 février 2009 Dernière intervention - 20 févr. 2009 à 15:20 - Dernière réponse : krazy1 111 Messages postés mercredi 19 décembre 2007Date d'inscription 23 mars 2013 Dernière intervention
- 23 févr. 2009 à 21:32
Bonjour,

Je viens d'avoir un message indiquant une infection et le teste suivant:
C:\systeme volume information\_restore{FBDDE16BD-C162-4CC9-AE82-290E08D1A9D0}RP154\A0030051.exe

Je suis sous windows XP SP3
PC pentium 3 2.8ghz 1.5G ram
antivirus avira a jour

Pouvez vous m'aider a resoudre ce probleme...???
Je poste un rapport hickjackthis

Logfile of HijackThis v1.99.1
Scan saved at 15:19:28, on 20/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\atwtusb.exe
C:\Program Files\KMaestro\KMaestro.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\TBLMOUSE.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\HomePlayer\HomePlayer.exe
C:\Program Files\yz dock 0.8.3 French English Japan German Spanish + 37 Docklets\YzDock.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Windows\System32\wsaupdater.exe,
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb127\Dealio.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O3 - Toolbar: The Weather Channel Toolbar - {2E5E800E-6AC0-411E-940A-369530A35E43} - C:\WINDOWS\system32\TwcToolbarIe7.dll
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb127\Dealio.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [BtcMaestro] C:\Program Files\KMaestro\KMaestro.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: HomePlayer.lnk = C:\Program Files\HomePlayer\HomePlayer.exe
O4 - Startup: Raccourci vers YzDock.lnk = C:\Program Files\yz dock 0.8.3 French English Japan German Spanish + 37 Docklets\YzDock.exe
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Documents and Settings\krazy\Application Data\Dealio\kb127\res\DealioSearch.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O9 - Extra 'Tools' menuitem: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Correcteur - {F7C8E5F6-B6D1-45db-8D91-2BCFA5DF11A9} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote K - IE 7.htm (HKCU)
O9 - Extra button: Dictionnaires - {F9B969E8-58D0-4dd9-AC8A-EE2336FF8F65} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote D - IE 7.htm (HKCU)
O9 - Extra button: Guides - {FA089E36-3F1B-4c51-9A1A-C4E7012483AF} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote G - IE 7.htm (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Update Service (gupdate1c98c5c3233d0ca) (gupdate1c98c5c3233d0ca) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe" /svc (file missing)
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\RpcSandraSrv.exe
O23 - Service: Steganos Live Encryption Engine (Version 503) [Service] (SLEE_503_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE503.exe (file missing)
O23 - Service: Steganos Live Encryption Engine 8.1 [Service] (SLEE_81_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE81.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

merci d'avance
krazy
Afficher la suite 
11Messages postés vendredi 20 février 2009Date d'inscription 21 février 2009 Dernière intervention

58 réponses

geoffrey5 13751 Messages postés dimanche 20 mai 2007Date d'inscriptionContributeur sécuritéStatut 21 mai 2010 Dernière intervention - 20 févr. 2009 à 15:24
0
Utile
1
Bonjour,

le virus étant dans la restauration, on s'en occupera en fin de désinfection...

Commence par faire ceci stp :

▶ Télécharge Toolbar-S&D (de Team IDN) sur ton Bureau

▶ Lance l'installation du programme en exécutant le fichier téléchargé.

▶ Double-clique maintenant sur le raccourci de Toolbar-S&D.

▶ Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.

▶ Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.

▶ Poste le rapport généré. (C:\TB.txt)
krazy 11 Messages postés vendredi 20 février 2009Date d'inscription 21 février 2009 Dernière intervention - 20 févr. 2009 à 17:40
Bonjour et merci pour le coup de main..
J'ai telechargé toolbar SD comme tu me l'as indiqué et j'ai obtenu un rapport que je colle ici:


-----------\\ ToolBar S&D 1.2.8 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 2.80GHz )
BIOS : BIOS Date: 08/28/03 18:50:07 Ver: 08.00.09
USER : krazy ( Administrator )
BOOT : Normal boot
Antivirus : Avira AntiVir PersonalEdition 8.0.1.30 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:38 Go (Free:12 Go)
D:\ (Local Disk) - NTFS - Total:115 Go (Free:90 Go)
E:\ (CD or DVD)
F:\ (CD or DVD)
G:\ (CD or DVD)
H:\ (CD or DVD)
I:\ (Local Disk) - NTFS - Total:186 Go (Free:77 Go)
J:\ (USB)

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [1] ( 20/02/2009|17:30 )

-----------\\ Recherche de Fichiers / Dossiers ...

C:\DOCUME~1\krazy\APPLIC~1\Dealio
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\temp
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\alerts.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\alerts_over.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\alerts_rec.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\alerts_rec_over.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\chevron-small.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\DealioSearch.html
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\deals-leftcap.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\deal_report.jpg
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\ebay_login.jpg
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\err_mainwindow.html
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\err_toolbar.html
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\global_scripts.js
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\headerbgthin.jpg
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\highlight-bg.png
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\logo.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\logo_over.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\man_toolbar.css
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\man_toolbar.html
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\man_toolbar.js
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\man_toolbarl.js
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\post-this-deal.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\post-this-deal_over.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\scripts.js
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\scroller.js
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\search-chevron.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\search-chevron_over.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\search_bg_blink.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\separator.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\settings.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\settings_over.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\yahoo-search.png
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\index.76.35
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.10.76
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.109.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.110.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.12.52
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.13.58
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.130.58
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.135.50
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.153.44
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.155.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.156.49
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.16.60
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.161.52
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.178.66
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.184.55
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.188.52
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.189.45
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.196.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.198.56
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.199.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.200.53
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.201.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.202.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.203.71
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.205.62
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.213.71
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.214.49
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.215.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.216.67
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.217.67
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.218.52
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.219.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.220.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.221.57
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.222.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.223.68
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.226.68
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.227.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.228.62
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.229.76
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.23.63
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.239.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.24.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.240.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.241.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.242.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.243.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.244.63
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.245.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.247.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.248.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.249.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.250.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.251.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.252.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.253.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.254.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.255.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.256.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.257.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.279.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.28.58
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.282.75
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.283.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.284.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.289.67
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.290.62
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.291.61
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.296.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.297.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.304.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.307.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.308.75
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.31.47
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.310.46
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.311.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.315.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.316.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.317.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.318.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.319.49
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.32.48
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.334.44
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.335.60
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.336.44
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.337.44
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.338.75
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.339.47
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.34.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.340.47
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.341.47
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.349.50
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.35.48
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.350.50
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.351.51
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.352.54
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.353.51
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.354.51
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.357.62
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.358.52
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.359.52
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.360.53
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.361.54
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.362.68
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.363.58
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.364.54
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.365.53
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.367.56
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.368.58
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.369.55
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.370.56
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.371.56
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.372.57
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.373.55
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.375.56
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.376.57
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.377.55
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.378.65
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.384.58
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.386.71
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.387.59
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.388.59
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.389.59
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.390.60
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.391.60
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.392.60
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.393.60
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.394.60
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.396.61
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.397.61
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.398.60
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.399.60
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.403.61
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.404.63
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.405.61
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.406.61
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.407.76
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.408.63
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.409.61
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.412.62
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.413.62
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.414.62
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.415.62
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.416.62
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.417.62
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.418.62
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.419.62
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.420.62
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.421.62
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.423.63
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.424.63
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.425.63
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.426.63
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.427.63
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.428.65
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.429.63
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.430.63
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.432.65
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.433.64
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.434.65
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.435.64
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.436.76
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.437.64
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.438.71
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.439.71
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.440.75
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.442.73
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.443.73
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.444.73
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.445.68
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.446.69
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.450.67
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.451.67
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.452.68
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.453.68
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.454.69
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.456.69
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.457.75
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.458.70
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.459.70
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.460.69
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.462.74
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.463.69
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.464.70
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.465.68
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.468.70
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.469.70
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.470.70
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.471.73
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.472.70
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.478.74
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.479.73
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.480.68
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.481.71
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.482.74
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.49.67
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.50.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.500.71
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.501.74
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.502.71
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.51.69
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.52.72
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.520.76
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.521.76
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.522.76
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.53.51
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.531.76
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.532.75
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.534.75
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.54.47
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.55.45
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.56.69
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.57.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.58.47
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.593.76
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.595.76
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.63.57
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.66.47
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.70.75
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.71.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\temp\dealio-14291.log
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\temp\dealio-14293.log
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\temp\dealio-14294.log
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\temp\dod_cache.xml
C:\Program Files\Dealio
C:\Program Files\Dealio\DealioAU.exe
C:\Program Files\Dealio\kb124
C:\Program Files\Dealio\kb127
C:\Program Files\Dealio\SearchSettingsKit.exe
C:\Program Files\Dealio\kb127\Dealio Deskbar.exe
C:\Program Files\Dealio\kb127\Dealio.dll
C:\Program Files\Dealio\kb127\DealioRes409.dll
C:\Program Files\Dealio\kb127\res
C:\Program Files\Dealio\kb127\resDN
C:\Program Files\Dealio\kb127\rules
C:\Program Files\Dealio\kb127\temp
C:\Program Files\Dealio\kb127\res\alerts.gif
C:\Program Files\Dealio\kb127\res\alerts_over.gif
C:\Program Files\Dealio\kb127\res\alerts_rec.gif
C:\Program Files\Dealio\kb127\res\alerts_rec_over.gif
C:\Program Files\Dealio\kb127\res\chevron-small.gif
C:\Program Files\Dealio\kb127\res\DealioSearch.html
C:\Program Files\Dealio\kb127\res\deals-leftcap.gif
C:\Program Files\Dealio\kb127\res\deal_report.jpg
C:\Program Files\Dealio\kb127\res\ebay_login.jpg
C:\Program Files\Dealio\kb127\res\err_mainwindow.html
C:\Program Files\Dealio\kb127\res\err_toolbar.html
C:\Program Files\Dealio\kb127\res\global_scripts.js
C:\Program Files\Dealio\kb127\res\headerbgthin.jpg
C:\Program Files\Dealio\kb127\res\highlight-bg.png
C:\Program Files\Dealio\kb127\res\logo.gif
C:\Program Files\Dealio\kb127\res\logo_over.gif
C:\Program Files\Dealio\kb127\res\man_toolbar.css
C:\Program Files\Dealio\kb127\res\man_toolbar.html
C:\Program Files\Dealio\kb127\res\man_toolbar.js
C:\Program Files\Dealio\kb127\res\man_toolbarl.js
C:\Program Files\Dealio\kb127\res\post-this-deal.gif
C:\Program Files\Dealio\kb127\res\post-this-deal_over.gif
C:\Program Files\Dealio\kb127\res\scripts.js
C:\Program Files\Dealio\kb127\res\scroller.js
C:\Program Files\Dealio\kb127\res\search-chevron.gif
C:\Program Files\Dealio\kb127\res\search-chevron_over.gif
C:\Program Files\Dealio\kb127\res\search_bg_blink.gif
C:\Program Files\Dealio\kb127\res\separator.gif
C:\Program Files\Dealio\kb127\res\settings.gif
C:\Program Files\Dealio\kb127\res\settings_over.gif
C:\Program Files\Dealio\kb127\res\yahoo-search.png
C:\Program Files\Dealio\kb127\resDN\bottom.gif
C:\Program Files\Dealio\kb127\resDN\chevron_down.gif
C:\Program Files\Dealio\kb127\resDN\chevron_up.gif
C:\Program Files\Dealio\kb127\resDN\close.gif
C:\Program Files\Dealio\kb127\resDN\deskbar.css
C:\Program Files\Dealio\kb127\resDN\deskbar.js
C:\Program Files\Dealio\kb127\resDN\dispatch_helper.js
C:\Program Files\Dealio\kb127\resDN\ebay_compatible.jpg
C:\Program Files\Dealio\kb127\resDN\logo.gif
C:\Program Files\Dealio\kb127\resDN\logo_chevron_bkg.gif
C:\Program Files\Dealio\kb127\resDN\losing.gif
C:\Program Files\Dealio\kb127\resDN\lost.gif
C:\Program Files\Dealio\kb127\resDN\man_deskbar.html
C:\Program Files\Dealio\kb127\resDN\menu_arrow.gif
C:\Program Files\Dealio\kb127\resDN\menu_check.gif
C:\Program Files\Dealio\kb127\resDN\no_image.gif
C:\Program Files\Dealio\kb127\resDN\prod_img.gif
C:\Program Files\Dealio\kb127\resDN\search_chevron.gif
C:\Program Files\Dealio\kb127\resDN\spacer.gif
C:\Program Files\Dealio\kb127\resDN\textfield_bkg.gif
C:\Program Files\Dealio\kb127\resDN\top.gif
C:\Program Files\Dealio\kb127\resDN\unknown.gif
C:\Program Files\Dealio\kb127\resDN\winning.gif
C:\Program Files\Dealio\kb127\resDN\won.gif
C:\Program Files\Dealio\kb127\rules\index.76.35
C:\Program Files\Dealio\kb127\rules\rules.1.10.76
C:\Program Files\Dealio\kb127\rules\rules.1.109.43
C:\Program Files\Dealio\kb127\rules\rules.1.110.43
C:\Program Files\Dealio\kb127\rules\rules.1.12.52
C:\Program Files\Dealio\kb127\rules\rules.1.13.58
C:\Program Files\Dealio\kb127\rules\rules.1.130.58
C:\Program Files\Dealio\kb127\rules\rules.1.135.50
C:\Program Files\Dealio\kb127\rules\rules.1.153.44
C:\Program Files\Dealio\kb127\rules\rules.1.155.43
C:\Program Files\Dealio\kb127\rules\rules.1.156.49
C:\Program Files\Dealio\kb127\rules\rules.1.16.60
C:\Program Files\Dealio\kb127\rules\rules.1.161.52
C:\Program Files\Dealio\kb127\rules\rules.1.178.66
C:\Program Files\Dealio\kb127\rules\rules.1.184.55
C:\Program Files\Dealio\kb127\rules\rules.1.188.52
C:\Program Files\Dealio\kb127\rules\rules.1.189.45
C:\Program Files\Dealio\kb127\rules\rules.1.196.43
C:\Program Files\Dealio\kb127\rules\rules.1.198.56
C:\Program Files\Dealio\kb127\rules\rules.1.199.43
C:\Program Files\Dealio\kb127\rules\rules.1.200.53
C:\Program Files\Dealio\kb127\rules\rules.1.201.43
C:\Program Files\Dealio\kb127\rules\rules.1.202.43
C:\Program Files\Dealio\kb127\rules\rules.1.203.71
C:\Program Files\Dealio\kb127\rules\rules.1.205.62
C:\Program Files\Dealio\kb127\rules\rules.1.213.71
C:\Program Files\Dealio\kb127\rules\rules.1.214.49
C:\Program Files\Dealio\kb127\rules\rules.1.215.43
C:\Program Files\Dealio\kb127\rules\rules.1.216.67
C:\Program Files\Dealio\kb127\rules\rules.1.217.67
C:\Program Files\Dealio\kb127\rules\rules.1.218.52
C:\Program Files\Dealio\kb127\rules\rules.1.219.43
C:\Program Files\Dealio\kb127\rules\rules.1.220.43
C:\Program Files\Dealio\kb127\rules\rules.1.221.57
C:\Program Files\Dealio\kb127\rules\rules.1.222.43
C:\Program Files\Dealio\kb127\rules\rules.1.223.68
C:\Program Files\Dealio\kb127\rules\rules.1.226.68
C:\Program Files\Dealio\kb127\rules\rules.1.227.43
C:\Program Files\Dealio\kb127\rules\rules.1.228.62
C:\Program Files\Dealio\kb127\rules\rules.1.229.76
C:\Program Files\Dealio\kb127\rules\rules.1.23.63
C:\Program Files\Dealio\kb127\rules\rules.1.239.43
C:\Program Files\Dealio\kb127\rules\rules.1.24.43
C:\Program Files\Dealio\kb127\rules\rules.1.240.43
C:\Program Files\Dealio\kb127\rules\rules.1.241.43
C:\Program Files\Dealio\kb127\rules\rules.1.242.43
C:\Program Files\Dealio\kb127\rules\rules.1.243.43
C:\Program Files\Dealio\kb127\rules\rules.1.244.63
C:\Program Files\Dealio\kb127\rules\rules.1.245.43
C:\Program Files\Dealio\kb127\rules\rules.1.247.43
C:\Program Files\Dealio\kb127\rules\rules.1.248.43
C:\Program Files\Dealio\kb127\rules\rules.1.249.43
C:\Program Files\Dealio\kb127\rules\rules.1.250.43
C:\Program Files\Dealio\kb127\rules\rules.1.251.43
C:\Program Files\Dealio\kb127\rules\rules.1.252.43
C:\Program Files\Dealio\kb127\rules\rules.1.253.43
C:\Program Files\Dealio\kb127\rules\rules.1.254.43
C:\Program Files\Dealio\kb127\rules\rules.1.255.43
C:\Program Files\Dealio\kb127\rules\rules.1.256.43
C:\Program Files\Dealio\kb127\rules\rules.1.257.43
C:\Program Files\Dealio\kb127\rules\rules.1.279.43
C:\Program Files\Dealio\kb127\rules\rules.1.28.58
C:\Program Files\Dealio\kb127\rules\rules.1.282.75
C:\Program Files\Dealio\kb127\rules\rules.1.283.43
C:\Program Files\Dealio\kb127\rules\rules.1.284.43
C:\Program Files\Dealio\kb127\rules\rules.1.289.67
C:\Program Files\Dealio\kb127\rules\rules.1.290.62
C:\Program Files\Dealio\kb127\rules\rules.1.291.61
C:\Program Files\Dealio\kb127\rules\rules.1.296.43
C:\Program Files\Dealio\kb127\rules\rules.1.297.43
C:\Program Files\Dealio\kb127\rules\rules.1.304.43
C:\Program Files\Dealio\kb127\rules\rules.1.307.43
C:\Program Files\Dealio\kb127\rules\rules.1.308.75
C:\Program Files\Dealio\kb127\rules\rules.1.31.47
C:\Program Files\Dealio\kb127\rules\rules.1.310.46
C:\Program Files\Dealio\kb127\rules\rules.1.311.43
C:\Program Files\Dealio\kb127\rules\rules.1.315.43
C:\Program Files\Dealio\kb127\rules\rules.1.316.43
C:\Program Files\Dealio\kb127\rules\rules.1.317.43
C:\Program Files\Dealio\kb127\rules\rules.1.318.43
C:\Program Files\Dealio\kb127\rules\rules.1.319.49
C:\Program Files\Dealio\kb127\rules\rules.1.32.48
C:\Program Files\Dealio\kb127\rules\rules.1.334.44
C:\Program Files\Dealio\kb127\rules\rules.1.335.60
C:\Program Files\Dealio\kb127\rules\rules.1.336.44
C:\Program Files\Dealio\kb127\rules\rules.1.337.44
C:\Program Files\Dealio\kb127\rules\rules.1.338.75
C:\Program Files\Dealio\kb127\rules\rules.1.339.47
C:\Program Files\Dealio\kb127\rules\rules.1.34.43
C:\Program Files\Dealio\kb127\rules\rules.1.340.47
C:\Program Files\Dealio\kb127\rules\rules.1.341.47
C:\Program Files\Dealio\kb127\rules\rules.1.349.50
C:\Program Files\Dealio\kb127\rules\rules.1.35.48
C:\Program Files\Dealio\kb127\rules\rules.1.350.50
C:\Program Files\Dealio\kb127\rules\rules.1.351.51
C:\Program Files\Dealio\kb127\rules\rules.1.352.54
C:\Program Files\Dealio\kb127\rules\rules.1.353.51
C:\Program Files\Dealio\kb127\rules\rules.1.354.51
C:\Program Files\Dealio\kb127\rules\rules.1.357.62
C:\Program Files\Dealio\kb127\rules\rules.1.358.52
C:\Program Files\Dealio\kb127\rules\rules.1.359.52
C:\Program Files\Dealio\kb127\rules\rules.1.360.53
C:\Program Files\Dealio\kb127\rules\rules.1.361.54
C:\Program Files\Dealio\kb127\rules\rules.1.362.68
C:\Program Files\Dealio\kb127\rules\rules.1.363.58
C:\Program Files\Dealio\kb127\rules\rules.1.364.54
C:\Program Files\Dealio\kb127\rules\rules.1.365.53
C:\Program Files\Dealio\kb127\rules\rules.1.367.56
C:\Program Files\Dealio\kb127\rules\rules.1.368.58
C:\Program Files\Dealio\kb127\rules\rules.1.369.55
C:\Program Files\Dealio\kb127\rules\rules.1.370.56
C:\Program Files\Dealio\kb127\rules\rules.1.371.56
C:\Program Files\Dealio\kb127\rules\rules.1.372.57
C:\Program Files\Dealio\kb127\rules\rules.1.373.55
C:\Program Files\Dealio\kb127\rules\rules.1.375.56
C:\Program Files\Dealio\kb127\rules\rules.1.376.57
C:\Program Files\Dealio\kb127\rules\rules.1.377.55
C:\Program Files\Dealio\kb127\rules\rules.1.378.65
C:\Program Files\Dealio\kb127\rules\rules.1.384.58
C:\Program Files\Dealio\kb127\rules\rules.1.386.71
C:\Program Files\Dealio\kb127\rules\rules.1.387.59
C:\Program Files\Dealio\kb127\rules\rules.1.388.59
C:\Program Files\Dealio\kb127\rules\rules.1.389.59
C:\Program Files\Dealio\kb127\rules\rules.1.390.60
C:\Program Files\Dealio\kb127\rules\rules.1.391.60
C:\Program Files\Dealio\kb127\rules\rules.1.392.60
C:\Program Files\Dealio\kb127\rules\rules.1.393.60
C:\Program Files\Dealio\kb127\rules\rules.1.394.60
C:\Program Files\Dealio\kb127\rules\rules.1.396.61
C:\Program Files\Dealio\kb127\rules\rules.1.397.61
C:\Program Files\Dealio\kb127\rules\rules.1.398.60
C:\Program Files\Dealio\kb127\rules\rules.1.399.60
C:\Program Files\Dealio\kb127\rules\rules.1.403.61
C:\Program Files\Dealio\kb127\rules\rules.1.404.63
C:\Program Files\Dealio\kb127\rules\rules.1.405.61
C:\Program Files\Dealio\kb127\rules\rules.1.406.61
C:\Program Files\Dealio\kb127\rules\rules.1.407.76
C:\Program Files\Dealio\kb127\rules\rules.1.408.63
C:\Program Files\Dealio\kb127\rules\rules.1.409.61
C:\Program Files\Dealio\kb127\rules\rules.1.412.62
C:\Program Files\Dealio\kb127\rules\rules.1.413.62
C:\Program Files\Dealio\kb127\rules\rules.1.414.62
C:\Program Files\Dealio\kb127\rules\rules.1.415.62
C:\Program Files\Dealio\kb127\rules\rules.1.416.62
C:\Program Files\Dealio\kb127\rules\rules.1.417.62
C:\Program Files\Dealio\kb127\rules\rules.1.418.62
C:\Program Files\Dealio\kb127\rules\rules.1.419.62
C:\Program Files\Dealio\kb127\rules\rules.1.420.62
C:\Program Files\Dealio\kb127\rules\rules.1.421.62
C:\Program Files\Dealio\kb127\rules\rules.1.423.63
C:\Program Files\Dealio\kb127\rules\rules.1.424.63
C:\Program Files\Dealio\kb127\rules\rules.1.425.63
C:\Program Files\Dealio\kb127\rules\rules.1.426.63
C:\Program Files\Dealio\kb127\rules\rules.1.427.63
C:\Program Files\Dealio\kb127\rules\rules.1.428.65
C:\Program Files\Dealio\kb127\rules\rules.1.429.63
C:\Program Files\Dealio\kb127\rules\rules.1.430.63
C:\Program Files\Dealio\kb127\rules\rules.1.432.65
C:\Program Files\Dealio\kb127\rules\rules.1.433.64
C:\Program Files\Dealio\kb127\rules\rules.1.434.65
C:\Program Files\Dealio\kb127\rules\rules.1.435.64
C:\Program Files\Dealio\kb127\rules\rules.1.436.76
C:\Program Files\Dealio\kb127\rules\rules.1.437.64
C:\Program Files\Dealio\kb127\rules\rules.1.438.71
C:\Program Files\Dealio\kb127\rules\rules.1.439.71
C:\Program Files\Dealio\kb127\rules\rules.1.440.75
C:\Program Files\Dealio\kb127\rules\rules.1.442.73
C:\Program Files\Dealio\kb127\rules\rules.1.443.73
C:\Program Files\Dealio\kb127\rules\rules.1.444.73
C:\Program Files\Dealio\kb127\rules\rules.1.445.68
C:\Program Files\Dealio\kb127\rules\rules.1.446.69
C:\Program Files\Dealio\kb127\rules\rules.1.450.67
C:\Program Files\Dealio\kb127\rules\rules.1.451.67
C:\Program Files\Dealio\kb127\rules\rules.1.452.68
C:\Program Files\Dealio\kb127\rules\rules.1.453.68
C:\Program Files\Dealio\kb127\rules\rules.1.454.69
C:\Program Files\Dealio\kb127\rules\rules.1.456.69
C:\Program Files\Dealio\kb127\rules\rules.1.457.75
C:\Program Files\Dealio\kb127\rules\rules.1.458.70
C:\Program Files\Dealio\kb127\rules\rules.1.459.70
C:\Program Files\Dealio\kb127\rules\rules.1.460.69
C:\Program Files\Dealio\kb127\rules\rules.1.462.74
C:\Program Files\Dealio\kb127\rules\rules.1.463.69
C:\Program Files\Dealio\kb127\rules\rules.1.464.70
C:\Program Files\Dealio\kb127\rules\rules.1.465.68
C:\Program Files\Dealio\kb127\rules\rules.1.468.70
C:\Program Files\Dealio\kb127\rules\rules.1.469.70
C:\Program Files\Dealio\kb127\rules\rules.1.470.70
C:\Program Files\Dealio\kb127\rules\rules.1.471.73
C:\Program Files\Dealio\kb127\rules\rules.1.472.70
C:\Program Files\Dealio\kb127\rules\rules.1.478.74
C:\Program Files\Dealio\kb127\rules\rules.1.479.73
C:\Program Files\Dealio\kb127\rules\rules.1.480.68
C:\Program Files\Dealio\kb127\rules\rules.1.481.71
C:\Program Files\Dealio\kb127\rules\rules.1.482.74
C:\Program Files\Dealio\kb127\rules\rules.1.49.67
C:\Program Files\Dealio\kb127\rules\rules.1.50.43
C:\Program Files\Dealio\kb127\rules\rules.1.500.71
C:\Program Files\Dealio\kb127\rules\rules.1.501.74
C:\Program Files\Dealio\kb127\rules\rules.1.502.71
C:\Program Files\Dealio\kb127\rules\rules.1.51.69
C:\Program Files\Dealio\kb127\rules\rules.1.52.72
C:\Program Files\Dealio\kb127\rules\rules.1.520.76
C:\Program Files\Dealio\kb127\rules\rules.1.521.76
C:\Program Files\Dealio\kb127\rules\rules.1.522.76
C:\Program Files\Dealio\kb127\rules\rules.1.53.51
C:\Program Files\Dealio\kb127\rules\rules.1.531.76
C:\Program Files\Dealio\kb127\rules\rules.1.532.75
C:\Program Files\Dealio\kb127\rules\rules.1.534.75
C:\Program Files\Dealio\kb127\rules\rules.1.54.47
C:\Program Files\Dealio\kb127\rules\rules.1.55.45
C:\Program Files\Dealio\kb127\rules\rules.1.56.69
C:\Program Files\Dealio\kb127\rules\rules.1.57.43
C:\Program Files\Dealio\kb127\rules\rules.1.58.47
C:\Program Files\Dealio\kb127\rules\rules.1.593.76
C:\Program Files\Dealio\kb127\rules\rules.1.595.76
C:\Program Files\Dealio\kb127\rules\rules.1.63.57
C:\Program Files\Dealio\kb127\rules\rules.1.66.47
C:\Program Files\Dealio\kb127\rules\rules.1.70.75
C:\Program Files\Dealio\kb127\rules\rules.1.71.43
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\Dealio
C:\DOCUME~1\krazy\APPLIC~1\Search Settings
C:\DOCUME~1\krazy\APPLIC~1\Search Settings\kb127
C:\DOCUME~1\krazy\APPLIC~1\Search Settings\kb127\res
C:\DOCUME~1\krazy\APPLIC~1\Search Settings\kb127\temp
C:\DOCUME~1\krazy\APPLIC~1\Search Settings\kb127\temp\ws-14293.log
C:\Program Files\Search Settings
C:\Program Files\Search Settings\kb127
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\Search Settings\kb127\res
C:\Program Files\Search Settings\kb127\SearchSettings.dll
C:\Program Files\Search Settings\kb127\SearchSettingsRes409.dll
C:\Program Files\Search Settings\kb127\temp
C:\DOCUME~1\krazy\Favoris\France Torrent Search 2007 - ici Tous les liens torrent fr 2007 sur un seul site !.url

-----------\\ Extensions

(krazy) - {b9db16a4-6edc-47ec-a1f4-b86292ed211d} => dwhelper


-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.fr/"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="http://home.microsoft.com/search/lobby/search.asp"
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Search Bar"="http://home.microsoft.com/search/lobby/search.asp"


--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\krazy\Local Settings\Application Data\ApplicationHistory\KeygenAntidotePrismeV6.exe.43f2c32d.ini
C:\DOCUME~1\krazy\Local Settings\Application Data\ApplicationHistory\KeygenAntidotePrismeV6.exe.aca77363.ini



1 - "C:\ToolBar SD\TB_1.txt" - 20/02/2009|17:31 - Option : [1]

-----------\\ Fin du rapport a 17:31:46,59

J'au aussi passé CCLEANER mais je ne pense pas que ce soit suffisant...!
^^Marie^^ 115971 Messages postés mardi 6 septembre 2005Date d'inscription 10 janvier 2017 Dernière intervention - 20 févr. 2009 à 15:24
0
Utile
Bonjour

Ton infection se situe dans la resto systeme
Donc il te faut désinfecter ton PC avant de purger ta resto

Ta version HT est obsolète

Donc supprime la et fais ce qui suit

C - Ccleaner :
(nettoyeur de registre, cookies+temps+tempos+prefetch+historique+etc.)
* Télécharge CCleaner.
(attention à l'installation penser à DECOCHER l'installation de Yahoo toolbar discrètement proposé en plus de CCleaner).

http://www.pcastuces.com/logitheque/ccleaner.htm
http://www.commentcamarche.net/telecharger/telecharger 168 ccleaner
Installe le dans un répertoire dédié.
Décoche pendant l'installation
--- les deux cases "Ajouter l'option ... "
--- Contrôler les mises à jour
* Lance Ccleaner pour un nettoyage complet.
Tutorial ici:
http://kerio.probb.fr/...
http://www.malekal.com/tutorial_CCleaner.html
ET
http://perso.orange.fr/jesses/Docs/Logiciels/CCleaner.htm



F - Hijackthis - Outil de diagnostic et réparation
télécharge HijackThis ici:
http://telechargement.zebulon.fr/138-hijackthis-1991.html
http://kerio.probb.fr/...
Dézippe le dans un dossier prévu à cet effet.
Par exemple C:\hijackthis < Enregistre le bien dans c : !
Démo : (Merci a Balltrap34 pour cette réalisation)
http://pageperso.aol.fr/balltrap34/Hijenr.gif
Lance le puis:
clique sur "do a system scan and save logfile" (cf démo)
faire un copier coller du log entier sur le forum
Démo : (Merci a Balltrap34 pour cette réalisation)
http://pagesperso-orange.fr/rginformatique/section%20virus/demohijack.htm
http://www.tutoriaux-excalibur.com/hijackthis.htm
http://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html

Bon courage

A+
geoffrey5 13751 Messages postés dimanche 20 mai 2007Date d'inscriptionContributeur sécuritéStatut 21 mai 2010 Dernière intervention - 20 févr. 2009 à 19:04
0
Utile
1
▶ Relance Toolbar-S&D en double-cliquant sur le raccourci.

▶ Tape sur "2" puis valide en appuyant sur "Entrée".

/!\ Ne ferme pas la fenêtre lors de la suppression /!\

▶ Un rapport sera généré, poste son contenu ici.

NOTE : Si ton Bureau ne réapparait pas, appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches.
Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter..."
Tape explorer puis valide.

Ce qu'il faut savoir sur les toolbars (barres d'outils)
krazy 11 Messages postés vendredi 20 février 2009Date d'inscription 21 février 2009 Dernière intervention - 20 févr. 2009 à 20:02
voici le rapport...


-----------\\ ToolBar S&D 1.2.8 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 2.80GHz )
BIOS : BIOS Date: 08/28/03 18:50:07 Ver: 08.00.09
USER : krazy ( Administrator )
BOOT : Normal boot
Antivirus : Avira AntiVir PersonalEdition 8.0.1.30 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:38 Go (Free:15 Go)
D:\ (Local Disk) - NTFS - Total:115 Go (Free:92 Go)
E:\ (CD or DVD)
F:\ (CD or DVD)
G:\ (CD or DVD)
H:\ (CD or DVD)
I:\ (Local Disk) - NTFS - Total:186 Go (Free:79 Go)
J:\ (USB)

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [2] ( 20/02/2009|20:00 )

-----------\\ SUPPRESSION

Supprime! - C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127
Supprime! - C:\Program Files\Dealio\DealioAU.exe
Supprime! - C:\Program Files\Dealio\kb124
Supprime! - C:\Program Files\Dealio\kb127
Supprime! - C:\Program Files\Dealio\SearchSettingsKit.exe
Supprime! - C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\Dealio
Supprime! - C:\DOCUME~1\krazy\APPLIC~1\Search Settings\kb127
Supprime! - C:\Program Files\Search Settings\kb127
Supprime! - C:\Program Files\Search Settings\SearchSettings.exe
Supprime! - C:\DOCUME~1\krazy\Favoris\France Torrent Search 2007 - ici Tous les liens torrent fr 2007 sur un seul site !.url
Supprime! - C:\DOCUME~1\krazy\APPLIC~1\Dealio
Supprime! - C:\Program Files\Dealio
Supprime! - C:\DOCUME~1\krazy\APPLIC~1\Search Settings
Supprime! - C:\Program Files\Search Settings

-----------\\ Recherche de Fichiers / Dossiers ...


-----------\\ Extensions

(krazy) - {b9db16a4-6edc-47ec-a1f4-b86292ed211d} => dwhelper


-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.fr/"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="http://home.microsoft.com/search/lobby/search.asp"
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="http://www.msn.com/"
"Search Bar"="http://home.microsoft.com/search/lobby/search.asp"


--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\krazy\Local Settings\Application Data\ApplicationHistory\KeygenAntidotePrismeV6.exe.43f2c32d.ini
C:\DOCUME~1\krazy\Local Settings\Application Data\ApplicationHistory\KeygenAntidotePrismeV6.exe.aca77363.ini



1 - "C:\ToolBar SD\TB_1.txt" - 20/02/2009|17:31 - Option : [1]
2 - "C:\ToolBar SD\TB_2.txt" - 20/02/2009|20:02 - Option : [2]

-----------\\ Fin du rapport a 20:02:18,89
geoffrey5 13751 Messages postés dimanche 20 mai 2007Date d'inscriptionContributeur sécuritéStatut 21 mai 2010 Dernière intervention - 20 févr. 2009 à 20:04
0
Utile
1
Ok maintenant fais ce que t'as demandé Marie au deuxième message stp :

http://www.commentcamarche.net/forum/affich 11155764 probleme virus systeme volume information?#2
krazy 11 Messages postés vendredi 20 février 2009Date d'inscription 21 février 2009 Dernière intervention - 20 févr. 2009 à 20:08
Marie a dit : Ta version HT est obsolète
ca veut dire quoi exactement ...?
geoffrey5 13751 Messages postés dimanche 20 mai 2007Date d'inscriptionContributeur sécuritéStatut 21 mai 2010 Dernière intervention - 20 févr. 2009 à 20:11
0
Utile
1
ça veut dire que tu as une vieille version de hijackthis... Tu dois le désinstaller et ensuite le retélécharger à partir des liens qu'elle t'as donnée...

Ensuite tu refais un rapport hijackthis et tu le postes dans ta prochaine réponse ;-)
krazy 11 Messages postés vendredi 20 février 2009Date d'inscription 21 février 2009 Dernière intervention - 20 févr. 2009 à 20:21
voila..c'est fait j'ai passé CCLEANER et je mets le log HICKJACKTHIS:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:18:58, on 20/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\atwtusb.exe
C:\Program Files\KMaestro\KMaestro.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\TBLMOUSE.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\HomePlayer\HomePlayer.exe
C:\Program Files\yz dock 0.8.3 French English Japan German Spanish + 37 Docklets\YzDock.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Windows\System32\wsaupdater.exe,
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O3 - Toolbar: The Weather Channel Toolbar - {2E5E800E-6AC0-411E-940A-369530A35E43} - C:\WINDOWS\system32\TwcToolbarIe7.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [BtcMaestro] C:\Program Files\KMaestro\KMaestro.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MSN Update] dllcon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Microsoft Features] ms32cfg.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: HomePlayer.lnk = C:\Program Files\HomePlayer\HomePlayer.exe
O4 - Startup: Raccourci vers YzDock.lnk = C:\Program Files\yz dock 0.8.3 French English Japan German Spanish + 37 Docklets\YzDock.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O9 - Extra 'Tools' menuitem: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Correcteur - {F7C8E5F6-B6D1-45db-8D91-2BCFA5DF11A9} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote K - IE 7.htm (HKCU)
O9 - Extra button: Dictionnaires - {F9B969E8-58D0-4dd9-AC8A-EE2336FF8F65} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote D - IE 7.htm (HKCU)
O9 - Extra button: Guides - {FA089E36-3F1B-4c51-9A1A-C4E7012483AF} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote G - IE 7.htm (HKCU)
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Update Service (gupdate1c98c5c3233d0ca) (gupdate1c98c5c3233d0ca) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\RpcSandraSrv.exe
O23 - Service: Steganos Live Encryption Engine (Version 503) [Service] (SLEE_503_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE503.exe (file missing)
O23 - Service: Steganos Live Encryption Engine 8.1 [Service] (SLEE_81_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE81.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
geoffrey5 13751 Messages postés dimanche 20 mai 2007Date d'inscriptionContributeur sécuritéStatut 21 mai 2010 Dernière intervention - 20 févr. 2009 à 20:31
0
Utile
1
Ok... Je vois que tu as 2 antivirus : Steganos Security Suite et Antivir... Lequel utilises-tu ??

▶ Télécharge malwarebyte's anti-malware

▶ Un tutoriel sera à ta disposition pour l'installer et l'utiliser correctement.

▶ Fais la mise à jour du logiciel (elle se fait normalement à l'installation)

▶ Lance une analyse complète en cliquant sur "Exécuter un examen complet"

▶ Sélectionnes les disques que tu veux analyser et cliques sur "Lancer l'examen"

▶ L'analyse peut durer un bon moment.....

▶ Une fois l'analyse terminée, cliques sur "OK" puis sur "Afficher les résultats"

▶ Vérifies que tout est bien coché et cliques sur "Supprimer la sélection" => et ensuite sur "OK"

▶ Un rapport va s'ouvrir dans le bloc note... Fais un copié/collé du rapport dans ta prochaine réponse sur le forum


* Il se pourrait que certains fichiers devront être supprimés au redémarrage du PC... Faites le en cliquant sur "oui" à la question posée
krazy 11 Messages postés vendredi 20 février 2009Date d'inscription 21 février 2009 Dernière intervention - 21 févr. 2009 à 08:35
Bonjour,
voici le rapport...
Malwarebytes' Anti-Malware 1.34
Version de la base de données: 1782
Windows 5.1.2600 Service Pack 3

21/02/2009 08:33:16
mbam-log-2009-02-21 (08-33-16).txt

Type de recherche: Examen complet (C:\|D:\|I:\|)
Eléments examinés: 218570
Temps écoulé: 11 hour(s), 26 minute(s), 22 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 3
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\Windows\System32\wsaupdater.exe,) Good: (userinit.exe) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

En ce qui concerne steganos c'est un programme que j'avais installé il y a un certain temps mais que j'ai desinstallé depuis...j'ai fais une recherche et je n'ai rien trouvé sur mon disque C par contre il reste des traces dans le registre...que dois en faire...???
geoffrey5 13751 Messages postés dimanche 20 mai 2007Date d'inscriptionContributeur sécuritéStatut 21 mai 2010 Dernière intervention - 21 févr. 2009 à 10:51
0
Utile
3
Bonjour,

On s'occupera de Steganos plus tard...

Vas vider la quarantaine de Malwarebytes et ensuite fais ceci stp :

▶ Télécharge et enregistre le fichier d installation sur ton bureau :

http://sd-1.archive-host.com/membres/up/16506160323759868/AD-R.exe

▶ Double clique sur le programme d'installation , et installe le dans son emplacement par défaut. ( le bureau )

▶ Ouvre le dossier Ad-remover présent sur ton bureau, et double clique sur Ad-remover.bat.

▶ Au menu principal choisi l'option "A"

▶ Poste le rapport qui apparait à la fin.

( le rapport est sauvegardé aussi sous C:\Ad-report.log )

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Note :

Process.exe est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.
krazy 11 Messages postés vendredi 20 février 2009Date d'inscription 21 février 2009 Dernière intervention - 21 févr. 2009 à 11:01
voici le rapport...


------- LOGFILE OF AD-REMOVER 1.1.1.3 | ONLY XP/VISTA -------

Updated by C_XX on 15/02/2009 at 10:20

Start at: 10:59:43 | 21/02/2009 | Boot mode: Normal Boot
Option: SCAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
Operating System: Microsoft® Windows XP™ Service Pack 3 (version 5.1.2600)
Computer Name: KRAZY-PCSSD3UIO
Current User: krazy - Administrator
Drive(s):
- C:\ (File System: NTFS)
- D:\ (File System: NTFS)
- I:\ (File System: NTFS)
System Drive: C:\
Windows Directory: C:\WINDOWS\
System Directory: C:\WINDOWS\System32\

--- Running Processes: 43

+-----------------| Boonty/Boonty Games Elements Found:

.
.

+-----------------| Eorezo Elements Found:

.

+-----------------| Infected Poker Softwares Elements Found:

.

+-----------------| FunWebProducts/MyWay/MyWebSearch/MyGlobalSearch Elements Found:

.
.

+-----------------| It's TV Elements Found:

.

+-----------------| Sweetim Elements Found:

.

+-----------------| Added Scan:

---- Mozilla FireFox Version 3.0.6 ----

ProfilePath: vsgi8iiw.default
.
Prefs.js: Browser.Search.DefaultEngineName: "Search the web"
Prefs.js: Browser.Search.SelectedEngine: "Babylon"
Prefs.js: Browser.Search.DefaultUrl: "hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch"
.
.
.
.
.

---- Internet Explorer Version 7.0.5730.11 ----

+-[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Search bar: hxxp://home.microsoft.com/search/lobby/search.asp
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start page: hxxp://www.google.fr/

+-[HKEY_USERS\S-1-5-21-484763869-602162358-725345543-1004\..\Internet Explorer\Main]

Search bar: hxxp://home.microsoft.com/search/lobby/search.asp
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start page: hxxp://www.google.fr/

+-[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157
Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Search bar: hxxp://home.microsoft.com/search/lobby/search.asp
Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Start page: hxxp://www.msn.com/

+-[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

Tabs: hxxp://ieframe.dll/tabswelcome.htm

+---------------------------------------------------------------------------+

[~2401 Bytes] - "C:\Ad-Report-Scan-21.02.2009.log"
-

End at: 11:01:12 | 21/02/2009
.
+-----------------| E.O.F - 59 Lines
.
krazy 11 Messages postés vendredi 20 février 2009Date d'inscription 21 février 2009 Dernière intervention - 21 févr. 2009 à 12:08
je ne suis pas sur que mon dernier message soit passé...je le renvoi donc...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:02:33, on 21/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\atwtusb.exe
C:\Program Files\KMaestro\KMaestro.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\TBLMOUSE.EXE
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\yz dock 0.8.3 French English Japan German Spanish + 37 Docklets\YzDock.exe
C:\Program Files\HomePlayer\HomePlayer.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O3 - Toolbar: The Weather Channel Toolbar - {2E5E800E-6AC0-411E-940A-369530A35E43} - C:\WINDOWS\system32\TwcToolbarIe7.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [BtcMaestro] C:\Program Files\KMaestro\KMaestro.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MSN Update] dllcon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Microsoft Features] ms32cfg.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: HomePlayer.lnk = C:\Program Files\HomePlayer\HomePlayer.exe
O4 - Startup: Raccourci vers YzDock.lnk = C:\Program Files\yz dock 0.8.3 French English Japan German Spanish + 37 Docklets\YzDock.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O9 - Extra 'Tools' menuitem: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Correcteur - {F7C8E5F6-B6D1-45db-8D91-2BCFA5DF11A9} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote K - IE 7.htm (HKCU)
O9 - Extra button: Dictionnaires - {F9B969E8-58D0-4dd9-AC8A-EE2336FF8F65} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote D - IE 7.htm (HKCU)
O9 - Extra button: Guides - {FA089E36-3F1B-4c51-9A1A-C4E7012483AF} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote G - IE 7.htm (HKCU)
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Update Service (gupdate1c98c5c3233d0ca) (gupdate1c98c5c3233d0ca) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\RpcSandraSrv.exe
O23 - Service: Steganos Live Encryption Engine (Version 503) [Service] (SLEE_503_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE503.exe (file missing)
O23 - Service: Steganos Live Encryption Engine 8.1 [Service] (SLEE_81_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE81.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
krazy1 111 Messages postés mercredi 19 décembre 2007Date d'inscription 23 mars 2013 Dernière intervention - 22 févr. 2009 à 10:49
....? plus de reponse...peut-etre en W-E...?
geoffrey5 13751 Messages postés dimanche 20 mai 2007Date d'inscriptionContributeur sécuritéStatut 21 mai 2010 Dernière intervention - 21 févr. 2009 à 11:30
0
Utile
2
Ok... Plus de traces de MyWebSearch.

▶ Télécharge RegCleaner

▶ Une fois installé, double-clique sur son icône pour l'exécuter

▶ Dans la barre de menu, clique sur Options puis sélectionne Language => Select language

▶ recherche French.rlg et double-clique dessus pour appliquer la langue

▶ Clique ensuite sur Outils dans la barre de menu

▶ Sélectionne Nettoyage du registre => Nettoyeur de registre automatique

▶ RegCleaner va alors lancer le nettoyage automatiquement

▶ Coche ensuite les entrées invalides qui sont apparues dans la fenêtre et clique sur Supprimer sélections => Terminer => Quitter


Et ensuite refais un nouveau rapport hijackthis stp
krazy 11 Messages postés vendredi 20 février 2009Date d'inscription 21 février 2009 Dernière intervention - 21 févr. 2009 à 11:46
J'ai installé regcleaner mais quand je double clique sur le raccourcis la pendule de la souris se met en route quelques secondes mais aucunes fenetres ne s'ouvre...pourtant quand je fait ctrl alt supr le programme tourne ...!? je choisi donc de terminer le programme...j'ai essayé plusieur foir mais pas de changement...j'ai desisntallé et reinstalle...meme probleme...!
krazy 11 Messages postés vendredi 20 février 2009Date d'inscription 21 février 2009 Dernière intervention - 21 févr. 2009 à 12:03
apres un ultime essais ca a fonctionné...mais j'ai reessayé ensuite et ca recommence...mystere...enfin...j'ai fais le nettoyage comme tu me l'as indiqué...voici le rapport hickjackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:02:33, on 21/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\atwtusb.exe
C:\Program Files\KMaestro\KMaestro.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\TBLMOUSE.EXE
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\yz dock 0.8.3 French English Japan German Spanish + 37 Docklets\YzDock.exe
C:\Program Files\HomePlayer\HomePlayer.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O3 - Toolbar: The Weather Channel Toolbar - {2E5E800E-6AC0-411E-940A-369530A35E43} - C:\WINDOWS\system32\TwcToolbarIe7.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [BtcMaestro] C:\Program Files\KMaestro\KMaestro.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MSN Update] dllcon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Microsoft Features] ms32cfg.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: HomePlayer.lnk = C:\Program Files\HomePlayer\HomePlayer.exe
O4 - Startup: Raccourci vers YzDock.lnk = C:\Program Files\yz dock 0.8.3 French English Japan German Spanish + 37 Docklets\YzDock.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O9 - Extra 'Tools' menuitem: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Correcteur - {F7C8E5F6-B6D1-45db-8D91-2BCFA5DF11A9} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote K - IE 7.htm (HKCU)
O9 - Extra button: Dictionnaires - {F9B969E8-58D0-4dd9-AC8A-EE2336FF8F65} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote D - IE 7.htm (HKCU)
O9 - Extra button: Guides - {FA089E36-3F1B-4c51-9A1A-C4E7012483AF} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote G - IE 7.htm (HKCU)
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Update Service (gupdate1c98c5c3233d0ca) (gupdate1c98c5c3233d0ca) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\RpcSandraSrv.exe
O23 - Service: Steganos Live Encryption Engine (Version 503) [Service] (SLEE_503_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE503.exe (file missing)
O23 - Service: Steganos Live Encryption Engine 8.1 [Service] (SLEE_81_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE81.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
krazy 11 Messages postés vendredi 20 février 2009Date d'inscription 21 février 2009 Dernière intervention - 21 févr. 2009 à 14:44
0
Utile
...??? plus de reponse...???
geoffrey5 13751 Messages postés dimanche 20 mai 2007Date d'inscriptionContributeur sécuritéStatut 21 mai 2010 Dernière intervention - 21 févr. 2009 à 15:06
0
Utile
1
▶ Télécharge Combofix de sUBs


▶ et enregistre le sur le Bureau.


▶ désactive tes protections et ferme toutes tes applications(antivirus, parefeu, garde en temps réel de l'antispyware)


Voici le tutoriel officiel de Bleeping Computer pour savoir l utiliser :

http://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix


Je te conseille d'installer la console de récupération !!


ensuite envois le rapport et refais un nouveau rapport hijackthis stp
krazy1 111 Messages postés mercredi 19 décembre 2007Date d'inscription 23 mars 2013 Dernière intervention - 21 févr. 2009 à 15:52
voici le rapport combofix:
ComboFix 09-02-19.01 - krazy 2009-02-21 15:39:00.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.1535.1040 [GMT 1:00]
Lancé depuis: c:\documents and settings\krazy\Bureau\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Internet Explorer\fxavx.ini
c:\windows\patch.exe
c:\windows\SW_Win2000X48.DLL
c:\windows\system32\d3d8caps.dat
c:\windows\system32\ftpupd.exe
c:\windows\system32\Ultra.dll

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-01-21 au 2009-02-21 ))))))))))))))))))))))))))))))))))))
.

2009-02-21 15:26 . 2009-02-21 15:26 <REP> d-------- c:\windows\LastGood
2009-02-21 11:52 . 2009-02-21 11:59 <REP> d-------- c:\program files\RegCleaner
2009-02-21 10:58 . 2009-02-21 10:59 <REP> d-------- c:\program files\Ad-remover
2009-02-20 20:42 . 2009-02-20 20:42 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-20 20:42 . 2009-02-20 20:42 <REP> d-------- c:\documents and settings\krazy\Application Data\Malwarebytes
2009-02-20 20:42 . 2009-02-20 20:42 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-20 20:42 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-20 20:42 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-20 17:29 . 2009-02-20 20:02 <REP> d-------- C:\ToolBar SD
2009-02-19 00:13 . 2009-02-19 17:28 54,156 --ah----- c:\windows\QTFont.qfn
2009-02-19 00:13 . 2009-02-19 00:13 1,409 --a------ c:\windows\QTFont.for
2009-02-15 09:40 . 2009-02-15 09:40 <REP> d-------- c:\program files\VirtualDubMOD
2009-02-11 16:17 . 2009-02-21 12:21 <REP> d-------- c:\documents and settings\All Users\Application Data\Google Updater
2009-02-06 19:39 . 2009-02-06 19:39 308,600 --a------ c:\windows\WLXPGSS.SCR
2009-02-06 18:52 . 2009-02-06 18:52 49,504 --a------ c:\windows\system32\sirenacm.dll
2009-02-01 16:45 . 2009-02-01 16:45 <REP> d-------- c:\program files\Windows Journal Viewer
2009-02-01 16:20 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
2009-02-01 16:12 . 2009-02-01 16:20 <REP> d-------- c:\windows\system32\XPSViewer
2009-02-01 16:12 . 2009-02-01 16:12 <REP> d-------- c:\program files\Reference Assemblies
2009-02-01 16:12 . 2009-02-01 16:12 <REP> d-------- c:\program files\MSBuild
2009-02-01 16:12 . 2009-02-01 16:12 212 --a------ c:\windows\system32\spupdsvc.inf
2009-02-01 16:11 . 2009-02-01 16:25 <REP> d-------- c:\windows\SxsCaPendDel
2009-02-01 16:11 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-02-01 16:11 . 2008-07-06 13:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll
2009-02-01 16:11 . 2008-07-06 11:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-01 16:11 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-02-01 16:11 . 2008-07-06 13:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-01 16:11 . 2008-07-06 13:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-02-01 16:11 . 2008-07-06 13:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-01-30 21:55 . 2009-02-21 08:41 <REP> d-------- c:\documents and settings\krazy\.homeplayer
2009-01-30 21:54 . 2009-01-30 21:55 <REP> d-------- c:\program files\HomePlayer
2009-01-23 18:24 . 2009-02-21 15:29 <REP> d-------- c:\documents and settings\krazy\Tracing
2009-01-23 18:19 . 2009-01-23 18:19 <REP> d-------- c:\program files\Microsoft Silverlight
2009-01-23 18:18 . 2008-12-08 17:01 55,136 --a------ c:\windows\system32\drivers\fssfltr_tdi.sys
2009-01-23 18:17 . 2009-01-23 18:17 <REP> d-------- c:\program files\Microsoft SQL Server Compact Edition
2009-01-23 18:17 . 2006-11-29 13:06 3,426,072 --a------ c:\windows\system32\d3dx9_32.dll
2009-01-23 18:14 . 2009-01-23 18:14 <REP> d-------- c:\program files\Windows Live SkyDrive
2009-01-23 18:14 . 2009-01-23 18:18 <REP> d-------- c:\program files\Microsoft
2009-01-23 17:43 . 2009-01-23 17:43 <REP> d-------- c:\program files\Fichiers communs\Windows Live

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-21 14:32 34,944 ----a-w c:\documents and settings\krazy\Application Data\GDIPFONTCACHEV1.DAT
2009-02-21 14:27 --------- d-----w c:\program files\Windows Live
2009-02-15 08:35 --------- d-----w c:\documents and settings\krazy\Application Data\MiniLyrics
2009-02-13 11:58 --------- d-----w c:\program files\Google
2009-02-06 18:43 --------- d-----w c:\program files\TuneUp Utilities 2008
2009-01-11 15:45 3,532 ----a-w C:\drmHeader.bin
2009-01-10 11:25 --------- d-----w c:\program files\Winamp3
2009-01-10 11:13 --------- d-----w c:\documents and settings\All Users\Application Data\Babylon
2009-01-10 10:58 --------- d-----w c:\documents and settings\Administrateur\Application Data\EAST Technologies
2009-01-09 15:06 --------- d-----w c:\documents and settings\krazy\Application Data\Babylon
2009-01-09 13:35 --------- d-----w c:\documents and settings\krazy\Application Data\DivX
2009-01-09 13:34 --------- d-----w c:\program files\divx
2009-01-09 12:21 --------- d-----w c:\program files\XnView
2009-01-09 12:19 --------- d-----w c:\program files\My-Tool
2009-01-09 12:19 --------- d-----w c:\program files\Conduit
2009-01-05 20:24 10,886,008 ----a-w c:\windows\system32\SpoonUninstall.exe
2009-01-05 20:16 --------- d-----w c:\program files\Free Audio Pack
2009-01-04 13:48 --------- d-----w c:\program files\Minilyrics
2009-01-04 13:02 --------- d-----w c:\program files\Illustrate
2009-01-04 13:02 --------- d-----w c:\documents and settings\krazy\Application Data\AccurateRip
2009-01-03 14:17 --------- d-----w c:\documents and settings\krazy\Application Data\XnView
2009-01-02 10:16 --------- d-----w c:\program files\Babylon
2009-01-01 22:08 --------- d-----w c:\program files\PhotoFiltre
2008-12-26 10:34 --------- d-----w c:\program files\The Weather Channel Toolbar
2008-12-26 10:27 --------- d-----w c:\program files\The Weather Channel FW
2008-12-24 23:48 --------- d-----w c:\program files\AVIConverter
2008-12-23 10:44 1,555 ---ha-w C:\hpothb07.dat
2008-12-22 12:47 --------- d-----w c:\program files\EasySearch
2008-12-20 22:47 826,368 ----a-w c:\windows\system32\wininet.dll
2008-12-11 00:33 86,016 ----a-w c:\windows\system32\dpl100.dll
2008-12-11 00:33 200,704 ----a-w c:\windows\system32\dtu100.dll
2008-12-09 02:28 593,920 ----a-w c:\windows\system32\dpuGUI11.dll
2008-12-09 02:28 57,344 ----a-w c:\windows\system32\dpv11.dll
2008-12-09 02:28 344,064 ----a-w c:\windows\system32\dpus11.dll
2008-12-09 02:28 294,912 ----a-w c:\windows\system32\dpu11.dll
2008-06-27 20:55 2,585,872 ----a-w c:\program files\WindowsInstaller-KB893803-v2-x86.exe
2007-11-09 17:35 5,837,392 ----a-w c:\program files\mozilla-firefox_mozilla_firefox_2.0.0.9_francais_11003.exe
2007-05-12 08:03 685,056 ----a-w c:\program files\FLV PlayerRCSetup.exe
2006-12-04 19:54 4,558,086 ----a-w c:\program files\Installation de FreeGo 3.exe
2006-11-10 18:07 824 ----a-w c:\program files\mpc5.reg
2006-11-10 18:07 778 ----a-w c:\program files\ffdsasetts.reg
2006-11-10 18:07 1,446 ----a-w c:\program files\ffdssetts.reg
2006-11-10 18:06 4,704 ----a-w c:\program files\satsukidecodersettings.ini
2006-09-05 15:44 4,264,176 ----a-w c:\program files\CI.EXE
2006-08-16 18:35 13,736,064 ----a-w c:\program files\GoogleEarthWin.exe
2006-07-24 07:56 1,458,008 ----a-w c:\program files\ccsetup131.exe
2005-09-09 18:55 35 ----a-w c:\program files\SCSSDist.ini
2006-05-29 14:40 7,296,000 ----a-w c:\program files\mozilla firefox\plugins\libvlc.dll
2008-10-19 09:58 49,152 ----a-w c:\program files\mozilla firefox\components\SiteVacuumXPCOM.dll
2006-10-25 15:51 37,664 --sha-w c:\windows\fidbox.dat
2005-01-31 21:55 56 -csh--r c:\windows\system32\D0978C548B.sys
2008-09-19 11:35 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008091920080920\index.dat
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" [2007-03-18 630784]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-06-05 335872]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-05-29 790528]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"BtcMaestro"="c:\program files\KMaestro\KMaestro.exe" [2003-01-08 163840]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"fssui"="c:\program files\Windows Live\Family Safety\fsui.exe" [2009-02-06 454000]
"atwtusb"="atwtusb.exe" [2005-09-21 c:\windows\system32\ATWTUSB.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\krazy\Menu D‚marrer\Programmes\D‚marrage\
HomePlayer.lnk - c:\program files\HomePlayer\HomePlayer.exe [2007-11-06 294912]
Raccourci vers YzDock.lnk - c:\program files\yz dock 0.8.3 French English Japan German Spanish + 37 Docklets\YzDock.exe [2006-10-29 386560]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.imc"= imc32.acm
"VIDC.JPGL"= jpgl.dll
"vidc.X264"= x264vfw.dll
"VIDC.PIM1"= PCLEPIM1.dll
"VIDC.SP54"= SP5X_32.DLL
"VIDC.SP55"= SP5X_32.DLL
"VIDC.SP56"= SP5X_32.DLL
"VIDC.SP57"= SP5X_32.DLL
"VIDC.SP58"= SP5X_32.DLL

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\[u]0/uSsiEfr.exe

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Gamma Loader.exe.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
backup=c:\windows\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^krazy^Menu Démarrer^Programmes^Démarrage^Anti-Pub.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^krazy^Menu Démarrer^Programmes^Démarrage^BitTorrent.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^krazy^Menu Démarrer^Programmes^Démarrage^Pika Backup.lnk]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\antiware
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDNewsAgent
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDOESRV
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDSwitchAgent
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gah95on6
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Heri
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IncrediMail
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstantTray
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IW_Drop_Icon
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Media Pass
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mzlzkik
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Booster
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\salm
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows SA

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
--a------ 2004-08-22 16:05 81920 c:\program files\D-Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DW6]
--a------ 2008-10-06 09:41 793712 c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
--a------ 2006-11-13 13:07 1289000 c:\program files\Microsoft ActiveSync\wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-03-28 22:37 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RocketDock]
--a------ 2007-03-18 23:05 630784 c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
--a--c--- 2002-04-11 03:19 69632 c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiteVacuum]
--a------ 2008-12-22 13:47 421965 c:\program files\EasySearch\SiteVacuumClient.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
-----c--- 2004-06-03 21:05 32881 c:\program files\Java\j2re1.4.2_05\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"VSSERV"=2 (0x2)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe"
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9
"RocketDock"="c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"PinnacleDriverCheck"=c:\windows\system32\PSDrvCheck.exe
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
"DAEMON Tools-1033"="c:\program files\D-Tools\daemon.exe" -lang 1033
"SoundMAX"="c:\program files\Analog Devices\SoundMAX\Smax4.exe" /tray
"Share-to-Web Namespace Daemon"=c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe"
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"WinampAgent"="c:\program files\Winamp3\winampa.exe"
"SearchSettings"=c:\program files\Search Settings\SearchSettings.exe
"au"=c:\program files\Dealio\DealioAU.exe
"Babylon Client"=c:\program files\Babylon\Babylon-Pro\Babylon.exe -AutoStart

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Adobe\\Acrobat 5.0\\Reader\\AcroRd32.exe"=
"c:\\Program Files\\eMule 0.47a MorphXT v8.14 [Par Ratiatum.com]\\eMule.exe"=
"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2007.SP1\\sandra.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\eMule 0.47a MorphXT v8.14 [Par Ratiatum.com]\\eMule0.47c\\emule.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2007.SP1\\Win32\\RpcDataSrv.exe"=
"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2007.SP1\\RpcSandraSrv.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\HomePlayer\\HomePlayer.exe"=
"c:\\Program Files\\HomePlayer\\VLC\\vlc.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"14671:UDP"= 14671:UDP:emuleM
"8080:TCP"= 8080:TCP:freebrowser
"1234:TCP"= 1234:TCP:freebrowser
"990:TCP"= 990:TCP:N560
"999:TCP"= 999:TCP:N560
"5678:TCP"= 5678:TCP:N560
"5679:UDP"= 5679:UDP:N560
"5721:TCP"= 5721:TCP:N560
"10422:TCP"= 10422:TCP:BitComet 10422 TCP
"10422:UDP"= 10422:UDP:BitComet 10422 UDP
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R1 aiptektp;HyperPen;c:\windows\system32\drivers\aiptektp.sys [2007-01-29 22272]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-01-23 55136]
R3 DCamUSBNW812;NW812 USB PC Camera;c:\windows\system32\drivers\pcam812.sys [2007-02-26 182380]
R3 Lower812;812 audio lower filter;c:\windows\system32\drivers\lower812.sys [2007-02-26 9808]
S0 ElbyVCD;ElbyVCD;c:\windows\system32\DRIVERS\ElbyVCD.sys --> c:\windows\system32\DRIVERS\ElbyVCD.sys [?]
S2 Ca533av;Icatch(IV) Video Camera Device;c:\windows\system32\drivers\Ca533av.sys [2008-09-06 515803]
S2 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [2009-02-06 533360]
S2 gupdate1c98c5c3233d0ca;Google Update Service (gupdate1c98c5c3233d0ca);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-11 133104]
S2 SLEE_503_DRIVER;Steganos Live Encryption Engine (Version 503) [Driver];\??\c:\windows\system32\drivers\SLEE503.sys --> c:\windows\system32\drivers\SLEE503.sys [?]
S2 SLEE_81_DRIVER;Steganos Live Encryption Engine 8.1 [Driver];\??\c:\windows\system32\drivers\SLEE81.sys --> c:\windows\system32\drivers\SLEE81.sys [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2006-05-09 34944]
S3 pctvvbi;PCTVVBI;c:\windows\system32\drivers\pctvvbi.sys [2004-07-27 6400]
S4 CleanService;CleanService;c:\program files\StompSoft\Digital File Shredder Pro\CleanService.exe --> c:\program files\StompSoft\Digital File Shredder Pro\CleanService.exe [?]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{18ff1866-4fa9-11db-bee3-000cf18e0c6a}]
\Shell\AutoRun\command - K:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{18ff1867-4fa9-11db-bee3-000cf18e0c6a}]
\Shell\AutoRun\command - L:\start.exe
\Shell\FramaKey\command - L:\start.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6ac6e8ce-50a2-11db-bee4-000cf18e0c6a}]
\Shell\AutoRun\command - G:\LaunchU3.exe
.
Contenu du dossier 'Tâches planifiées'

2009-02-21 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-11 16:17]

2009-02-21 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-11 16:19]

2009-02-21 c:\windows\Tasks\Maintenance en 1 clic.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 08:23]
.
- - - - ORPHELINS SUPPRIMES - - - -

HKU-Default-Run-Windows Guard - waumgrd.exe
HKU-Default-Run-win update - wupfyny.exe
HKU-Default-Run-MSN Update - dllcon.exe
HKU-Default-Run-Microsoft Features - ms32cfg.exe
MSConfigStartUp-CloneCDElbyCDFL - c:\program files\Elaborate Bytes\CloneCD\ElbyCheck.exe
MSConfigStartUp-Gestionnaire Antidote - c:\program files\Druide\Antidote\Antidote\Gestionnaire Antidote.exe
MSConfigStartUp-RamBoostXp - c:\program files\RamBoost XP\rambxpfr.exe
MSConfigStartUp-WinampAgent - c:\program files\Winamp\winampa.exe
MSConfigStartUp-Microsoft Features - ms32cfg.exe
MSConfigStartUp-Windows Guard - waumgrd.exe


.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mWindow Title =
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Translate with &Babylon - c:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
Trusted Zone: secuser.com\www
FF - ProfilePath - c:\documents and settings\krazy\Application Data\Mozilla\Firefox\Profiles\vsgi8iiw.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch
FF - prefs.js: browser.search.selectedEngine - Babylon
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - component: c:\program files\Mozilla Firefox\components\SiteVacuumXPCOM.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1487.6512\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npagent.dll
FF - plugin: c:\program files\Virtools\3D Life Player\npvirtools.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-21 15:40:40
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,eb,90,21,59,c0,
11,32,72,c8,28,51,af,b0,29,a3,98,8f,34,da,fa,9f,de,81,1e,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,e4,6b,15,2c,9f,
19,96,96,71,3b,04,66,8b,46,0d,96,28,1c,02,db,15,36,3b,c5,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,6c,f0,d5,da,a0,
a0,56,77,25,da,ec,7e,55,20,c9,26,a8,8c,71,6a,c1,93,7b,e5,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:6b,65,49,6a,7e,99,74,f7,8e,0f,4f,df,f9,
47,be,27,3e,1e,9e,e0,57,5a,93,61,d8,56,24,9f,c4,86,58,7b,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,dd,47,a3,a2,a5,
24,f0,67,cd,44,cd,b9,a6,33,6c,cd,54,fb,83,75,98,1c,fe,76,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,13,65,1b,54,95,
0f,46,fd,b0,18,ed,a7,3f,8d,37,a4,a9,53,2e,06,7f,34,db,29,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:31,77,e1,ba,b1,f8,68,02,37,55,0a,cc,b8,
51,61,3c,31,77,e1,ba,b1,f8,68,02,31,9b,6b,96,ab,c6,ec,06,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:aa,52,c6,00,84,3c,26,64,27,95,bd,69,04,
f7,4d,58,83,6c,56,8b,a0,85,96,ab,7e,ca,ea,8e,3a,05,5c,66,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,11,43,20,16,f6,
29,1c,81,51,fa,6e,91,28,9e,14,cc,9c,30,49,d5,bb,75,72,51,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:37,a4,aa,c3,a6,15,56,0a,17,96,47,2a,b6,
68,4d,63,b1,cd,45,5a,a8,c4,f8,b9,0c,1c,45,99,e2,70,e4,9a,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:f8,31,0f,a9,5f,a0,ec,fb,ca,01,a0,a7,25,
4d,4e,35,e3,0e,66,d5,eb,bc,2f,6b,07,33,de,9c,73,5d,71,9e,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,1d,80,0d,27,41,
77,48,88,fa,ea,66,7f,d4,3b,6b,70,f9,d7,c3,68,d9,41,72,15,6c,43,2d,1e,aa,22,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\EPSON Printer and Utilities\PrinterDrivers]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\InstallShield Uninstall Information\{A8BB9906-E618-406A-B161-7383AFF46C39}]
@DACL=(02 0000)
"LogFile"="c:\\Program Files\\InstallShield Installation Information\\{A8BB9906-E618-406A-B161-7383AFF46C39}\\Setup.ilg"
"StatusText"="L'installation EasyRecovery Professional prépare InstallShield Wizard, lequel vous guidera pour l'installation du logiciel. Veuillez patienter."

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\Windows SR 2.0\-]
@DACL=(02 0000)
"-"="-"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(744)
c:\windows\system32\Ati2evxx.dll
.
Heure de fin: 2009-02-21 15:50:09
ComboFix-quarantined-files.txt 2009-02-21 14:50:07

Avant-CF: 15 974 588 416 octets libres
Après-CF: 16,056,209,408 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /fastdetect /noguiboot /NoExecute=OptIn

Current=2 Default=2 Failed=3 LastKnownGood=1 Sets=,1,2,3,4,5,6,7,8,9
402 --- E O F --- 2009-02-11 15:56:09

et le rapport hickjackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:53:12, on 21/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\KMaestro\KMaestro.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\TBLMOUSE.EXE
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\yz dock 0.8.3 French English Japan German Spanish + 37 Docklets\YzDock.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O3 - Toolbar: The Weather Channel Toolbar - {2E5E800E-6AC0-411E-940A-369530A35E43} - C:\WINDOWS\system32\TwcToolbarIe7.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [BtcMaestro] C:\Program Files\KMaestro\KMaestro.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: HomePlayer.lnk = C:\Program Files\HomePlayer\HomePlayer.exe
O4 - Startup: Raccourci vers YzDock.lnk = C:\Program Files\yz dock 0.8.3 French English Japan German Spanish + 37 Docklets\YzDock.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O9 - Extra 'Tools' menuitem: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Correcteur - {F7C8E5F6-B6D1-45db-8D91-2BCFA5DF11A9} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote K - IE 7.htm (HKCU)
O9 - Extra button: Dictionnaires - {F9B969E8-58D0-4dd9-AC8A-EE2336FF8F65} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote D - IE 7.htm (HKCU)
O9 - Extra button: Guides - {FA089E36-3F1B-4c51-9A1A-C4E7012483AF} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote G - IE 7.htm (HKCU)
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Update Service (gupdate1c98c5c3233d0ca) (gupdate1c98c5c3233d0ca) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\RpcSandraSrv.exe
O23 - Service: Steganos Live Encryption Engine (Version 503) [Service] (SLEE_503_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE503.exe (file missing)
O23 - Service: Steganos Live Encryption Engine 8.1 [Service] (SLEE_81_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE81.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
geoffrey5 13751 Messages postés dimanche 20 mai 2007Date d'inscriptionContributeur sécuritéStatut 21 mai 2010 Dernière intervention - 22 févr. 2009 à 17:13
0
Utile
1
Bonjour,

relance hijackthis en cliquant sur scan only et coches ces lignes stp :

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O9 - Extra button: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O9 - Extra 'Tools' menuitem: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O23 - Service: Google Update Service (gupdate1c98c5c3233d0ca) (gupdate1c98c5c3233d0ca) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Steganos Live Encryption Engine (Version 503) [Service] (SLEE_503_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE503.exe (file missing)

puis tu cliques sur fix checked.

ensuite :

Télécharge CCleaner

Tu auras un tutoriel pour l'installer et l'utiliser correctement.

Est-ce que tu as encore des problèmes ??
krazy1 111 Messages postés mercredi 19 décembre 2007Date d'inscription 23 mars 2013 Dernière intervention - 22 févr. 2009 à 18:55
Bonjour,

J'ai appliqué ce que tu m'as indiqué...je n'ai plus eu le message de l'antivirus du depart par contre hier j'ai eu presque le meme mais localisé dans le disque dur "I" --> I\systeme volume information\_restore\...
d'autre part je suis allé dans le registre et j'ai vu qu'il restait des traces de steganos...que dois-je en faire..les supprimer...?
geoffrey5 13751 Messages postés dimanche 20 mai 2007Date d'inscriptionContributeur sécuritéStatut 21 mai 2010 Dernière intervention - 22 févr. 2009 à 21:12
0
Utile
1
Oui tu peux supprimer les traces de Steganos, on s'occupera des virus qui sont dans la restauration quand tu n'auras plus de problèmes...

Est-ce que tu as encore d'autres problèmes ??
krazy1 111 Messages postés mercredi 19 décembre 2007Date d'inscription 23 mars 2013 Dernière intervention - 22 févr. 2009 à 22:14
j'ai essayé de virer les valeurs "steganos" dans le registre mais certaines valeurs refusent de se barrer...!

celles la entre autre...
DeviceDesc REG_SZ Steganos Live Encryption Engine (version 503) [service]
DeviceDesc REG_SZ Steganos Live Encryption Engine 8.1 [driver]
DeviceDesc REG_SZ Steganos Live Encryption Engine 8.1 [service]
DeviceDesc REG_SZ Steganos antiteft Encryption Engine 13 [driver]

il doit y en avoir une 20aine en tout environs...je ne sais pas si c'est important...
a part ca apparemment plus de probleme...
geoffrey5 13751 Messages postés dimanche 20 mai 2007Date d'inscriptionContributeur sécuritéStatut 21 mai 2010 Dernière intervention - 22 févr. 2009 à 22:18
0
Utile
1
As-tu essayé de les supprimer en mode sans échec ??
krazy1 111 Messages postés mercredi 19 décembre 2007Date d'inscription 23 mars 2013 Dernière intervention - 22 févr. 2009 à 22:19
non j'ai juste essayé en mode normal...dois je le faire en mode sans echec...?
geoffrey5 13751 Messages postés dimanche 20 mai 2007Date d'inscriptionContributeur sécuritéStatut 21 mai 2010 Dernière intervention - 22 févr. 2009 à 22:23
0
Utile
1
Essaye oui
krazy1 111 Messages postés mercredi 19 décembre 2007Date d'inscription 23 mars 2013 Dernière intervention - 22 févr. 2009 à 22:41
J'ai essayé mais rien a faire...impossible a virer...!
geoffrey5 13751 Messages postés dimanche 20 mai 2007Date d'inscriptionContributeur sécuritéStatut 21 mai 2010 Dernière intervention - 22 févr. 2009 à 22:42
0
Utile
1
Bizarre :s

Télécharge CCleaner

Tu auras un tutoriel pour l'installer et l'utiliser correctement.
krazy1 111 Messages postés mercredi 19 décembre 2007Date d'inscription 23 mars 2013 Dernière intervention - 22 févr. 2009 à 22:44
je l'ai deja passe...j'ai aussi tune up utility...mais rien a faire...!
geoffrey5 13751 Messages postés dimanche 20 mai 2007Date d'inscriptionContributeur sécuritéStatut 21 mai 2010 Dernière intervention - 22 févr. 2009 à 22:45
0
Utile
1
Tu as aussi fais un nettoyage du registre en cherchant les erreurs ??
krazy1 111 Messages postés mercredi 19 décembre 2007Date d'inscription 23 mars 2013 Dernière intervention - 22 févr. 2009 à 22:45
c'est a dire...?
geoffrey5 13751 Messages postés dimanche 20 mai 2007Date d'inscriptionContributeur sécuritéStatut 21 mai 2010 Dernière intervention - 22 févr. 2009 à 22:47
0
Utile
1
regarde le tutoriel que je t'ai donné et fais ce qui est écrit tout en bas de la page..
krazy1 111 Messages postés mercredi 19 décembre 2007Date d'inscription 23 mars 2013 Dernière intervention - 22 févr. 2009 à 22:49
oui je l'ai fait plusieurs fois...mais pas en mode sans echec...
geoffrey5 13751 Messages postés dimanche 20 mai 2007Date d'inscriptionContributeur sécuritéStatut 21 mai 2010 Dernière intervention - 22 févr. 2009 à 23:22
0
Utile
1
Ok... Refais un nouveau rapport hijackthis stp
krazy1 111 Messages postés mercredi 19 décembre 2007Date d'inscription 23 mars 2013 Dernière intervention - 23 févr. 2009 à 06:37
bonjour,

voila le rapport...:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 06:37:17, on 23/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Windows Live\Family Safety\fsssvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\atwtusb.exe
C:\Program Files\KMaestro\KMaestro.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Live\Family Safety\fsui.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\TBLMOUSE.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\yz dock 0.8.3 French English Japan German Spanish + 37 Docklets\YzDock.exe
C:\Program Files\HomePlayer\HomePlayer.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O3 - Toolbar: The Weather Channel Toolbar - {2E5E800E-6AC0-411E-940A-369530A35E43} - C:\WINDOWS\system32\TwcToolbarIe7.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [BtcMaestro] C:\Program Files\KMaestro\KMaestro.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: HomePlayer.lnk = C:\Program Files\HomePlayer\HomePlayer.exe
O4 - Startup: Raccourci vers YzDock.lnk = C:\Program Files\yz dock 0.8.3 French English Japan German Spanish + 37 Docklets\YzDock.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Correcteur - {F7C8E5F6-B6D1-45db-8D91-2BCFA5DF11A9} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote K - IE 7.htm (HKCU)
O9 - Extra button: Dictionnaires - {F9B969E8-58D0-4dd9-AC8A-EE2336FF8F65} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote D - IE 7.htm (HKCU)
O9 - Extra button: Guides - {FA089E36-3F1B-4c51-9A1A-C4E7012483AF} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote G - IE 7.htm (HKCU)
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Update Service (gupdate1c98c5c3233d0ca) (gupdate1c98c5c3233d0ca) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\RpcSandraSrv.exe
O23 - Service: SLEE_503_SERVICE - Unknown owner - C:\WINDOWS\system32\SLEE503.exe (file missing)
O23 - Service: SLEE_81_SERVICE - Unknown owner - C:\WINDOWS\system32\SLEE81.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
geoffrey5 13751 Messages postés dimanche 20 mai 2007Date d'inscriptionContributeur sécuritéStatut 21 mai 2010 Dernière intervention - 23 févr. 2009 à 16:52
0
Utile
1
Bonjour,

mis à part les virus dans la restauration, est-ce que tu as encore des problèmes ??
krazy1 111 Messages postés mercredi 19 décembre 2007Date d'inscription 23 mars 2013 Dernière intervention - 23 févr. 2009 à 17:20
mis a part les valeurs "steganos" du registre que je n'arrive pas a eliminer ça a l'air d'aller...
geoffrey5 13751 Messages postés dimanche 20 mai 2007Date d'inscriptionContributeur sécuritéStatut 21 mai 2010 Dernière intervention - 23 févr. 2009 à 19:37
0
Utile
1
Quelle idée d'avoir mis un antivirus de ce genre aussi lol

tu peux faire ceci pour terminer stp :

Voici un excellent petit logiciel très utile qui te permettra de savoir les nouvelles mises à jour disponibles pour les différents logiciels installés sur ton PC :

▶ Télécharge Update Checker

▶ Installe le avec les paramètres par défaut en cliquant chaques fois sur Suivant.

▶ Une fois installé, patiente quelques secondes et tu verras apparaître une icône verte dans ta barre des tâches te signalant qu'il y a des mises à jour disponibles.

▶ Double-cliques sur l'icône pour être redirrigé sur le site de téléchargement des mises à jour.

Un conseil : n'installe pas les BETA qui sont listées en dessous.

▶ Tu installes les mises à jour que tu désires, les plus importantes sont :

● Java

● Adobe Reader

● Adobe Flash Player

● Internet explorer


Ensuite :


Pour supprimer toutes les traces des logiciels qui ont servi à traiter les infections spécifiques :

▶ Télécharge Toolscleaner sur ton Bureau


▶ Double-clique sur ToolsCleaner2.exe et laisse le travailler
▶ Clique sur Recherche et laisse le scan se terminer.
▶ Clique sur Suppression pour finaliser.
▶ Tu peux, si tu le souhaites, te servir des Options facultatives.
▶ Clique sur Quitter, pour que le rapport puisse se créer.
▶ Le rapport (TCleaner.txt) se trouve à la racine de votre disque dur (C:\)...colle le dans ta réponse


Ensuite :


Désactive et réactive la Restauration du système :


Le fait de faire cette manipulation va supprimer tous les virus qui auraient pu se loger dans les
points de restauration que tu avais créé auparavant.. Il est donc recommandé de la faire :


1 Dans la barre des tâches de Windows, clique sur Démarrer.

2 Clique avec le bouton droit de la souris sur Poste de travail puis clique sur Propriétés.

3 Dans l'onglet Restauration du système, coche "Désactiver la Restauration du système"

4 Clique sur Appliquer.

5 Ensuite décoche "Désactiver la restauration du systeme"

6 clique sur appliquer puis ok

7 vas créer un point de restauration en cliquant sur démarrer => tous les programmes => accessoires =>

outils systeme => restauration du systeme => créer un point de restauration => tu mets un nom

(exemple : après désinfection sur CCM) puis tu valides.


Tu peux mettre ton problème résolu !! Comment mettre résolu ??


IMPORTANT : lire les quelques liens pour la prévention et la sécurité de votre PC qui se trouvent en bas de la page !!


WOT - Extension pour ton navigateur internet :

Voici une extension à télécharger qui te permettra, en faisant tes recherches sur google, de savoir si le site proposé lors de tes recherches est un site de confiance ou un site à éviter car il pourrait infecter ton PC :


Pour Firefox : https://addons.mozilla.org/fr/firefox/addon/3456

Pour internet explorer : http://www.mywot.com/en/download/ie

krazy1 111 Messages postés mercredi 19 décembre 2007Date d'inscription 23 mars 2013 Dernière intervention - 23 févr. 2009 à 20:29
ca y est j'ai appliqué tout ce que tu m'as indiqué...
voici le rapport:

[ Rapport ToolsCleaner version 2.3.2 (par A.Rothstein & dj QUIOU) ]

-->- Recherche:

C:\Combofix.txt: trouvé !
C:\cleannavi.txt: trouvé !
C:\TB.txt: trouvé !
C:\Combofix: trouvé !
C:\Qoobox: trouvé !
C:\Toolbar SD: trouvé !
C:\Documents and Settings\krazy\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\krazy\Bureau\ToolBarSD.exe: trouvé !
C:\Program Files\HijackThis: trouvé !
C:\Program Files\HiJackThis\HijackThis.exe: trouvé !
C:\Program Files\HiJackThis\hijackthis.log: trouvé !

---------------------------------
-->- Suppression:

C:\Documents and Settings\krazy\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Documents and Settings\krazy\Bureau\ToolBarSD.exe: supprimé !
C:\Program Files\HiJackThis\HijackThis.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\cleannavi.txt: supprimé !
C:\TB.txt: supprimé !
C:\Program Files\HiJackThis\hijackthis.log: supprimé !
C:\Combofix: supprimé !
C:\Qoobox: supprimé !
C:\Toolbar SD: supprimé !
C:\Program Files\HijackThis: supprimé !

Fichiers temporaires nettoyés !

Je pensais que steganos ameliorait la securité pendant la navigation sur le net....je ne savais pas que c'etait en plus un anti virus sinon je ne l'aurais pas installé...!!!

en tout cas je te remercie pour l'aide que tu m'as apporté...pour mettre le post en "resolu" je n'ai pas tout compris...je dois etre un peu fatigué...ou nul...!!! je vais trouver...!
probleme virus systeme volume information - page 2