Google infectéRésolu/Fermé

Question

Bonjour,

Depuis quelques jours, mes recherches sur google me redirigent vers d'autres sites, souvent les memes, pour antivirus par ex
La raison etant que j'ai telecharger un lien d'un ami sur facebook et depuis c'est l'horreur
J'ai un deuxieme probleme qui s'est cree suite à cela c'est que la navigation sur internet explorer est devenu assez lente

Apres de nombreuses recherches sur le forum je n'ai pas reussi à reparer le probleme tout seul. Je ne suis pas un génie de l'informatique mais je connais quelques termes
Je vous remercie par avance pour votre aide

Configuration: Windows Vista / Internet Explorer 7.0

dédétraqué · Answer

Salut yohanaldo, bienvenu sur CCM


On va vérifier cela, télécharge RSIT (de random/random) sur le bureau ici :
http://images.malwareremoval.com/random/RSIT.exe

- Clique droit sur RSIT.exe qui est sur le bureau et choisir exécuter en tant qu'administrateur

- Clique sur Continue dans la fenêtre
- RSIT téléchargera HijackThis si il n'est pas présent où détecté, alors il faudra accepter la licence
- Poste le contenue des deux rapports, log.txt et info.txt(réduit dans la barre des tâches) à la fin de l'analyse

Les rapports sont dans le dossier ici C:\rsit


@++ :)

yohanaldo · Answer

le rapport info.txt :


info.txt logfile of random's system information tool 1.06 2010-04-19 20:25:21

======Uninstall list======

-->C:\Program Files\Nero\Nero8\nero\uninstall\UNNERO.exe /UNINSTALL
-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
-->C:\Windows\UNNeroBackItUp.exe /UNINSTALL
-->C:\Windows\UNNeroMediaHome.exe /UNINSTALL
-->C:\Windows\UNNeroShowTime.exe /UNINSTALL
-->C:\Windows\UNNeroVision.exe /UNINSTALL
-->C:\Windows\UNRecode.exe /UNINSTALL
32 Bit HP CIO Components Installer-->MsiExec.exe /I{2614F54E-A828-49FA-93BA-45A3F756BFAA}
Ad-Aware Email Scanner for Outlook-->MsiExec.exe /I{338F08AB-C262-42C7-B000-34DE1A475273}
Ad-Aware-->"C:\ProgramData\{52AC600B-5800-407E-99FF-83CD0669760B}\Ad-AwareInstaller.exe" REMOVE=TRUE MODIFY=FALSE
Ad-Aware-->C:\ProgramData\{52AC600B-5800-407E-99FF-83CD0669760B}\Ad-AwareInstaller.exe
Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->MsiExec.exe /X{ECA1A3B6-898F-4DCE-9F04-714CF3BA126B}
Adobe Photoshop Elements 6.0-->msiexec /I {F54AC413-D2C6-4A24-B324-370C223C6250}
Adobe Photoshop Elements 6-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *AdobePE6*
Adobe Reader 8-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *AdobeReader*
Adobe Reader 9.3.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A93000000001}
Adobe Shockwave Player 11.5-->"C:\Windows\system32\Adobe\Shockwave 11\uninstaller.exe"
ADSL Neuf-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *NEUF_FR*
Apple Mobile Device Support-->MsiExec.exe /I{162B71B8-8464-4680-A086-601D555B331D}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
Assistant de connexion Windows Live-->MsiExec.exe /I{DCE8CD14-FBF5-4464-B9A4-E18E473546C7}
ATI Display Driver V8.510.0.0000-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *VGA*
ATK Hotkey UTILITY V1.00.0037-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *ATKHotkey*
ATK Hotkey-->C:\Program Files\InstallShield Installation Information\{3912D529-02BC-4CA8-B5ED-0D0C20EB6003}\setup.exe -runfromtemp -l0x040c -removeonly
Auslogics Disk Defrag-->"C:\Program Files\Auslogics\Auslogics Disk Defrag\unins000.exe"
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
BetClic Poker-->C:\PROGRA~1\BETCLI~1\UNWISE.EXE C:\PROGRA~1\BETCLI~1\INSTALL.LOG
BitTorrent-->C:\Program Files\BitTorrent\uninst.exe
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
Browser Address Error Redirector-->regsvr32 /u /s "C:\Program Files\Google\Google_BAE\BAE.dll"
CamStudio 2.0 Fr-->"C:\Program Files\CamStudio\unins000.exe"
Cartoonist 1.3-->"C:\Program Files\Cartoonist\unins000.exe"
Catalyst Control Center - Branding-->MsiExec.exe /I{E3A5DDF7-17BD-43F1-9EBA-BB136EEB17DC}
CCleaner-->"C:\Program Files\CCleaner\uninst.exe"
DeskScapes-->C:\PROGRA~1\Stardock\OBJECT~1\DESKSC~1\UNWISE.EXE C:\PROGRA~1\Stardock\OBJECT~1\DESKSC~1\INSTALL.LOG
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
DreamMaker-->C:\PROGRA~1\Stardock\OBJECT~1\DREAMM~1\UNWISE.EXE C:\PROGRA~1\Stardock\OBJECT~1\DREAMM~1\INSTALL.LOG
eMule-->"C:\Program Files\eMule\Uninstall.exe"
EVEREST Corporate Edition v5.30-->"C:\Program Files\Lavalys\EVEREST Corporate Edition\unins000.exe"
Freeplayer-->C:\Program Files\Freeplayer\Uninstall.exe
Gestionnaire de Connexion SFR 2009.09-->"C:\Program Files\SFR\Gestionnaire de Connexion SFR\unins000.exe"
Google BAE-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *GoogleBAE*
Google Desktop-->C:\Program Files\Google\Google Desktop Search\GoogleDesktopSetup.exe -uninstall
Google Earth-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *GOOGLE_EARTH*
Google Earth-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3DE5E7D4-7B88-403C-A3FD-2017A8240C5B}\setup.exe" -l0x40c  -removeonly
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Google Web Accelerator-->MsiExec.exe /X{6A1975EB-27E6-491D-94BC-6355FA25F40F}
GoogleDesktop-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *GoogleDesktop*
GoogleToolbar-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *GoogleToolbar*
HDReg France-->MsiExec.exe /I{0ED40D2A-7131-4FE7-941E-5C329336F712}
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
HP Customer Participation Program 9.0-->C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat
HP Imaging Device Functions 9.0-->C:\Program Files\HP\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat
HP OCR Software 9.0-->C:\Program Files\HP\Digital Imaging\OCR\hpzscr01.exe -datfile hpqbud11.dat
HP Photosmart All-In-One Software 9.0-->C:\Program Files\HP\Digital Imaging\{B46AC30C-22D2-4610-B041-1DA7BB29EB57}\setup\hpzscr01.exe -datfile hposcr21.dat
HP Photosmart Essential 3.5-->C:\Program Files\HP\Digital Imaging\PhotosmartEssential\hpzscr01.exe -datfile hpqbud13.dat
HP Smart Web Printing-->MsiExec.exe /X{415CDA53-9100-476F-A7B2-476691E117C7}
HP Solution Center 9.0-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
HP Update-->MsiExec.exe /X{818ABC3C-635C-4651-8183-D0E9640B7DD1}
HPSSupply-->MsiExec.exe /X{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}
ImgBurn-->"C:\Program Files\ImgBurn\uninstall.exe"
Indeo® Software-->C:\Windows\IsUninst.exe -f"C:\Program Files\Ligos\Indeo\Uninst.isu" -c"C:\Program Files\Ligos\Indeo\Indeo System Files\indounin.dll"
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{46ABBC54-1872-4AA3-95E2-F2C063A63F31}
Intel A/V Codecs V2.0-->C:\Windows\IsUninst.exe -fC:\Windows\system32\CDUninst.isu
Intel Wireless WiFi Link Adapters Ver12.0.0.82-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *WLAN*
Intel(R) Matrix Storage Manager V8.2.0.1001-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *IMSM*
Intel® Matrix Storage Manager-->C:\Windows\system32\imsmudlg.exe -uninstall
ITECIR Vista Driver V5.0.4.6-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *CIR*
ITECIR-->C:\Program Files\InstallShield Installation Information\{40580068-9B10-40B5-9548-536CE88AB23C}\setup.exe -runfromtemp -l0x040c -removeonly
Java(TM) 6 Update 15-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Junk Mail filter update-->MsiExec.exe /I{E2DFE069-083E-4631-9B6C-43C48E991DE5}
KaraFun 1.18-->"C:\Program Files\KaraFun\unins000.exe"
K-Lite Codec Pack 4.4.5 (Full)-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
LFP MANAGER 08-->C:\Program Files\EA SPORTS\LFP MANAGER 08\eauninstall.exe
LimeWire 5.4.6-->"C:\Program Files\LimeWire\uninstall.exe"
ManyCam 2.4 (remove only)-->"C:\Program Files\ManyCam 2.4\uninstall.exe"
MAX_FR_Atube Toolbar-->C:\PROGRA~1\MAX_FR~1\UNWISE.EXE   /U C:\PROGRA~1\MAX_FR~1\INSTALL.LOG  
Microsoft .NET Framework 1.1 Security Update (KB953297)-->"C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\M953297\M953297Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 3.5 Language Pack SP1 - fra-->MsiExec.exe /I{3E31821C-7917-367E-938E-E65FC413EA31}
Microsoft .NET Framework 3.5 SP1-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0015-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0019-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0044-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {B165D3C2-40AE-4D39-86F7-E5C87C4264C0}
Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2010 (Beta)-->MsiExec.exe /X{20140000-0016-0409-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office Groove MUI (English) 2010 (Beta)-->MsiExec.exe /X{20140000-00BA-0409-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
Microsoft Office Mondo 2010 (Beta)-->MsiExec.exe /X{20140000-000F-0000-0000-0000000FF1CE}
Microsoft Office Mondo 2010-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\setup.exe" /uninstall MONDO /dll OSETUP.DLL
Microsoft Office MondoOnly MUI (English) 2010 (Beta)-->MsiExec.exe /X{20140000-0102-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2010 (Beta)-->MsiExec.exe /X{20140000-001A-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2010 (Beta)-->MsiExec.exe /X{20140000-0018-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint Viewer 2007 (French)-->MsiExec.exe /X{95120000-00AF-040C-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {14809F99-C601-4D4A-9391-F1E8FAA964C5}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {A0516415-ED61-419A-981D-93596DA74165}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {D66D5A44-E480-4BA4-B4F2-C554F6B30EBB}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9}
Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2010 (Beta)-->MsiExec.exe /X{20140000-0115-0409-0000-0000000FF1CE}
Microsoft Office SharePoint Designer MUI (English) 2010 (Beta)-->MsiExec.exe /X{20140000-0017-0409-0000-0000000FF1CE}
Microsoft Office Visio MUI (English) 2010 (Beta)-->MsiExec.exe /X{20140000-0054-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
Microsoft Works 9 SE-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *works9se*
Microsoft Works-->MsiExec.exe /I{0214A441-A4AB-43A8-8DEF-2F73C5364673}
Mise à jour Microsoft Office Excel 2007 Help  (KB963678)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {B761869A-B85C-40E2-994C-A1CE78AC8F2C}
Mise à jour Microsoft Office Outlook 2007 Help  (KB963677)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {51EFB347-1F3D-4BAC-8B79-F056B904FE21}
Mise à jour Microsoft Office Powerpoint 2007 Help  (KB963669)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {C3DCA38E-005E-41BA-A52A-7C3429F351C3}
Mise à jour Microsoft Office Word 2007 Help  (KB963665)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {81536A04-DBFB-4DB3-978F-0F284590C223}
Module de compatibilité pour Microsoft Office System 2007-->MsiExec.exe /X{90120000-0020-040C-0000-0000000FF1CE}
Module linguistique Microsoft .NET Framework 3.5 SP1- fra-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\setup.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
Nero 8 Essentials-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *Nero8*
Nero 8 Essentials-->MsiExec.exe /X{980B9958-1239-4FC5-8C88-AC5650321036}
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
Neuf - Kit de connexion-->C:\Program Files\Neuf\Kit\uninstall.exe
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Packard Bell ImageWriter-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *ImageWriter*
Packard Bell LCD Test-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *LCDTest*
Packard Bell Updator-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *Updator*
Packardbell EcoButton UTILITY V1.00.01-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *EcoButton*
Packardbell_EcoBtn-->C:\Program Files\InstallShield Installation Information\{7DBCD0B0-F5E1-4072-9B68-EBF32B322756}\setup.exe -runfromtemp -l0x0009 -removeonly
Photo! Web Album 1.2-->"C:\Program Files\Photo!\Photo! Web Album\unins000.exe"
Picasa 2-->"C:\Program Files\Picasa2\Uninstall.exe"
Picasa2-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *Picasa_2*
Poker 770-->"C:\Poker\Poker 770\_SetupCasino_5725_EN.exe" /uninstall
Realtek 8169 8168 8101E 8102E Ethernet Driver-->C:\Program Files\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\setup.exe -runfromtemp -l0x040c -removeonly
Realtek High Definition Audio Driver V6.0.1.5643-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *AUDIO*
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m -nrg2709
Realtek PCI-E Gigabit Ethernet Driver V6.206.0502.2008-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *LAN*
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.55.01-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *RICOH*
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.55.01-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{59F6A514-9813-47A3-948C-8A155460CC2A}\setup.exe" -l0x40c anything
SAMSUNG Mobile Modem Driver Set-->C:\Windows\system32\Samsung_USB_Drivers\3\SSCDUninstall.exe
Samsung Mobile phone USB driver Software-->C:\Windows\system32\Samsung_USB_Drivers\5\SSSDUninstall.exe
SAMSUNG Mobile USB Modem 1.0 Software-->C:\Windows\system32\Samsung_USB_Drivers\1\SS_Uninstall.exe
SAMSUNG Mobile USB Modem Software-->C:\Windows\system32\Samsung_USB_Drivers\2\SSM_Uninstall.exe
Samsung PC Studio 3-->"C:\Program Files\InstallShield Installation Information\{C4A4722E-79F9-417C-BD72-8D359A090C97}\setup.exe" -runfromtemp -l0x040c -removeonly
SeaTools for Windows-->MsiExec.exe /I{98613C99-1399-416C-A07C-1EE1C585D872}
Security Update for Windows Media Encoder (KB954156)-->msiexec.exe /I {E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E} MSIPATCHREMOVE={E836F1B7-43FB-46B0-A0D9-E4D2A5951659} /qb
SetUp My PC-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *SETUPMYPC_FR*
Skype 3.6.2.248-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *SKYPE*
Skype(TM) 4.0-->MsiExec.exe /X{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}
SpeedBit Video Accelerator-->"C:\Program Files\SpeedBit Video Accelerator\VARemove.exe" temp
Spelling Dictionaries Support For Adobe Reader 8-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-800000000003}
Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
StyleXP (remove only)-->"C:\Program Files\TGTSoft\StyleXP\StyleXP-uninstall.exe"
Synaptics Pointing Device driver Ver11.0.4.0-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *TOUCHPAD*
Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
Torrent101-->C:\Program Files\Torrent101\uninst.exe
Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
Update for Outlook 2007 Junk Email Filter (kb979895)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {D45674C6-9127-4C84-8826-93FBC552DF53}
USB 2.0 1.3M UVC WebCam Camera driver V61.005.029.190-->"C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *CAMERA*
USB 2.0 1.3M UVC WebCam-->C:\Windows\Uninstsxga.bat
Utilitaires Sierra-->C:\Program Files\Sierra On-Line\sutil32.exe uninstall
VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B}
VCRedistSetup-->MsiExec.exe /I{3921A67A-5AB1-4E48-9444-C71814CF3027}
Visual C++ 2008 x86 Runtime - (v9.0.30729)-->MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5D14231E27}
Visual C++ 2008 x86 Runtime - v9.0.30729.01-->C:\Windows\system32\msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D14231E27} /qb+ REBOOTPROMPT=""
VLC media player 0.9.8a-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Mail-->MsiExec.exe /I{5DD76286-9BE7-4894-A990-E905E91AC818}
Windows Live Messenger-->MsiExec.exe /X{770F1BEC-2871-4E70-B837-FB8525FFA3B1}
Windows Media Encoder 9 Series-->msiexec.exe /I {E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
Windows Media Encoder 9 Series-->MsiExec.exe /I{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
X10 Hardware(TM)-->C:\Windows\UNWISE.EXE C:\PROGRA~1\X10HAR~1\Install.log

======Security center information======

AV: BitDefender Antivirus
FW: BitDefender Firewall
AS: BitDefender Antispyware
AS: Windows Defender

======System event log======

yohanaldo · Answer

Computer Name: PC-de-yohan
Event Code: 4376
Message: Servicing a requis un redémarrage pour terminer la définition du package KB968816(Security Update) à l'état Installation demandée(Install Requested)
Record Number: 71050
Source Name: Microsoft-Windows-Servicing
Time Written: 20090910010503.000000-000
Event Type: Avertissement
User: AUTORITE NT\SYSTEM

Computer Name: PC-de-yohan
Event Code: 4376
Message: Servicing a requis un redémarrage pour terminer la définition du package KB968816(Security Update) à l'état Installation demandée(Install Requested)
Record Number: 71047
Source Name: Microsoft-Windows-Servicing
Time Written: 20090910010503.000000-000
Event Type: Avertissement
User: AUTORITE NT\SYSTEM

Computer Name: PC-de-yohan
Event Code: 4374
Message: Windows Servicing a déterminé que ce package KB968816(Security Update) n'est pas applicable à ce système.
Record Number: 71007
Source Name: Microsoft-Windows-Servicing
Time Written: 20090910010458.000000-000
Event Type: Avertissement
User: AUTORITE NT\SYSTEM

Computer Name: PC-de-yohan
Event Code: 4374
Message: Windows Servicing a déterminé que ce package KB905866(Update) n'est pas applicable à ce système.
Record Number: 70911
Source Name: Microsoft-Windows-Servicing
Time Written: 20090910010225.000000-000
Event Type: Avertissement
User: AUTORITE NT\SYSTEM

Computer Name: PC-de-yohan
Event Code: 7000
Message: Le service Profos n'a pas pu démarrer en raison de l'erreur : 
Cette demande n'est pas prise en charge.
Record Number: 70822
Source Name: Service Control Manager
Time Written: 20090910000005.000000-000
Event Type: Erreur
User: 

=====Application event log=====

Computer Name: PC-de-yohan
Event Code: 1008
Message: Le service Windows Search tente de supprimer l'ancien catalogue. 

Record Number: 937
Source Name: Microsoft-Windows-Search
Time Written: 20090106173800.000000-000
Event Type: Avertissement
User: 

Computer Name: PC-de-yohan
Event Code: 1530
Message: Windows a détecté que votre fichier de Registre est toujours utilisé par d'autres applications ou services. Le fichier va être déchargé. Les applications ou services qui ont accès à votre Registre risquent de ne pas fonctionner correctement après cela. 

 DÉTAIL - 
 16 user registry handles leaked from \Registry\User\S-1-5-21-2881880658-3555428079-2209020445-1000:
Process 644 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-2881880658-3555428079-2209020445-1000
Process 1824 (\Device\HarddiskVolume2\Program Files\Common Files\Symantec Shared\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-2881880658-3555428079-2209020445-1000
Process 1824 (\Device\HarddiskVolume2\Program Files\Common Files\Symantec Shared\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-2881880658-3555428079-2209020445-1000
Process 1824 (\Device\HarddiskVolume2\Program Files\Common Files\Symantec Shared\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-2881880658-3555428079-2209020445-1000
Process 1824 (\Device\HarddiskVolume2\Program Files\Common Files\Symantec Shared\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-2881880658-3555428079-2209020445-1000
Process 1824 (\Device\HarddiskVolume2\Program Files\Common Files\Symantec Shared\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-2881880658-3555428079-2209020445-1000\Software\Microsoft\SystemCertificates	rust
Process 1824 (\Device\HarddiskVolume2\Program Files\Common Files\Symantec Shared\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-2881880658-3555428079-2209020445-1000\Software\Microsoft\SystemCertificates\My
Process 1824 (\Device\HarddiskVolume2\Program Files\Common Files\Symantec Shared\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-2881880658-3555428079-2209020445-1000\Software\Microsoft\SystemCertificates\CA
Process 1824 (\Device\HarddiskVolume2\Program Files\Common Files\Symantec Shared\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-2881880658-3555428079-2209020445-1000\Software\Policies\Microsoft\SystemCertificates
Process 1824 (\Device\HarddiskVolume2\Program Files\Common Files\Symantec Shared\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-2881880658-3555428079-2209020445-1000\Software\Policies\Microsoft\SystemCertificates
Process 1824 (\Device\HarddiskVolume2\Program Files\Common Files\Symantec Shared\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-2881880658-3555428079-2209020445-1000\Software\Policies\Microsoft\SystemCertificates
Process 1824 (\Device\HarddiskVolume2\Program Files\Common Files\Symantec Shared\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-2881880658-3555428079-2209020445-1000\Software\Policies\Microsoft\SystemCertificates
Process 1824 (\Device\HarddiskVolume2\Program Files\Common Files\Symantec Shared\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-2881880658-3555428079-2209020445-1000\Software\Microsoft\SystemCertificates\Root
Process 1824 (\Device\HarddiskVolume2\Program Files\Common Files\Symantec Shared\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-2881880658-3555428079-2209020445-1000\Software\Microsoft\SystemCertificates\Disallowed
Process 1824 (\Device\HarddiskVolume2\Program Files\Common Files\Symantec Shared\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-2881880658-3555428079-2209020445-1000\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 1824 (\Device\HarddiskVolume2\Program Files\Common Files\Symantec Shared\ccSvcHst.exe) has opened key \REGISTRY\USER\S-1-5-21-2881880658-3555428079-2209020445-1000\Software\Microsoft\SystemCertificates\TrustedPeople

Record Number: 917
Source Name: Microsoft-Windows-User Profiles Service
Time Written: 20090106173500.000000-000
Event Type: Avertissement
User: AUTORITE NT\SYSTEM

Computer Name: PC-de-yohan
Event Code: 8194
Message: Erreur du service de cliché instantané des volumes : erreur lors de l'interrogation de l'interface IVssWriterCallback. hr = 0x80070005. Cette erreur est souvent due à des paramètres de sécurité incorrects dans le processus du rédacteur ou du demandeur. 

Opération :
   Données du rédacteur en cours de collecte

Contexte :
   ID de classe du rédacteur: {e8132975-6f93-4464-a53e-1050253ae220}
   Nom du rédacteur: System Writer
   ID d'instance du rédacteur: {953ddc91-0777-4ed6-a326-27bbf5623234}
Record Number: 907
Source Name: VSS
Time Written: 20090106173015.000000-000
Event Type: Erreur
User: 

Computer Name: PC-de-yohan
Event Code: 10
Message: Le filtre d'événement avec la requête « SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99 » n'a pas pu être réactivé dans l'espace de noms « //./root/CIMV2 » à cause de l'erreur 0x80041003. Les événements ne peuvent pas être délivrés à travers ce filtre tant que le problème ne sera pas corrigé.
Record Number: 820
Source Name: Microsoft-Windows-WMI
Time Written: 20090106152144.000000-000
Event Type: Erreur
User: 

Computer Name: PC-de-yohan
Event Code: 1008
Message: Le service Windows Search tente de supprimer l'ancien catalogue. 

Record Number: 816
Source Name: Microsoft-Windows-Search
Time Written: 20090106152141.000000-000
Event Type: Avertissement
User: 

=====Security event log=====

Computer Name: PC-de-yohan
Event Code: 4634
Message: Fermeture de session d'un compte.

Sujet :
	ID de sécurité :		S-1-5-21-2881880658-3555428079-2209020445-1000
	Nom du compte :		yohan
	Domaine du compte :		PC-de-yohan
	ID du compte :		0x12cfc8e9

Type d'ouverture de session :			7

Cet événement est généré lorsqu'une session ouverte est supprimée. Il peut être associé à un événement d'ouverture de session en utilisant la valeur ID d'ouverture de session. Les ID d'ouverture de session ne sont uniques qu'entre les redémarrages sur un même ordinateur.
Record Number: 24312
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090917155616.297800-000
Event Type: Succès de l'audit
User: 

Computer Name: PC-de-yohan
Event Code: 5032
Message: Le Pare-feu Windows n'a pas pu notifier l'utilisateur qu'il a empêché une application d'accepter des connexions entrantes sur le réseau.

Code d'erreur :	2
Record Number: 24311
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090917155612.460800-000
Event Type: Échec de l'audit
User: 

Computer Name: PC-de-yohan
Event Code: 5032
Message: Le Pare-feu Windows n'a pas pu notifier l'utilisateur qu'il a empêché une application d'accepter des connexions entrantes sur le réseau.

Code d'erreur :	2
Record Number: 24310
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090917155612.460800-000
Event Type: Échec de l'audit
User: 

Computer Name: PC-de-yohan
Event Code: 5032
Message: Le Pare-feu Windows n'a pas pu notifier l'utilisateur qu'il a empêché une application d'accepter des connexions entrantes sur le réseau.

Code d'erreur :	2
Record Number: 24309
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090917155612.460800-000
Event Type: Échec de l'audit
User: 

Computer Name: PC-de-yohan
Event Code: 4672
Message: Privilèges spéciaux attribués à la nouvelle ouverture de session.

Sujet :
	ID de sécurité :		S-1-5-18
	Nom du compte :		SYSTEM
	Domaine du compte :		AUTORITE NT
	ID d'ouverture de session :		0x3e7

Privilèges :		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
Record Number: 24308
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090917133532.764200-000
Event Type: Succès de l'audit
User: 

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"DFSTRACINGON"=FALSE
"FP_NO_HOST_CHECK"=NO
"NUMBER_OF_PROCESSORS"=2
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\Samsung\Samsung PC Studio 3\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 23 Stepping 6, GenuineIntel
"PROCESSOR_LEVEL"=6
"PROCESSOR_REVISION"=1706
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"TRACE_FORMAT_SEARCH_PATH"=\NTREL202.ntdev.corp.microsoft.com\4F18C3A5-CA09-4DBD-B6FC-219FDD4C6BE0\TraceFormat
"USERNAME"=SYSTEM
"windir"=%SystemRoot%

-----------------EOF-----------------



J'ai parcelé la reponse parce que je n'arrive pas à tout envoyer d'un coup

En attendant de tes nouvelles, je te remercie encore pour ton aide

moisalim1 · Answer

Je pense que vous devriez expliqué votre problème un peu différemment, mais plus juste. Votre windows est infecté, mais sûrement pas google.

dédétraqué · Answer

Salut yohanaldo


Télécharge et installe UsbFix par El Desaparecido , C_XX & Chimay8
http://pagesperso-orange.fr/NosTools/Chiquitine29/UsbFix.exe

(!) Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d'avoir été infectées sans les ouvrir.

* Faire un clic droit sur le raccourci UsbFix présent sur ton bureau et choisi "Exécuter en tant qu'administrateur".

* Au menu principal choisis l'option " F " pour français et tape sur [entrée] .

* Au second menu Choisis l'option " 1 " (recherche) et tape sur [entrée]

* Laisse travailler l'outil.

* Ensuite poste le rapport UsbFix.txt qui apparaitra.

Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt )

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Note2 : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.


* Tuto : http://pagesperso-orange.fr/NosTools/usbfix.html 


@++  :)

yohanaldo · Answer

Re dédétraqué

Voici le rapport de UsbFix :


############################## | UsbFix V6.106 |

User : yohan (Administrateurs) # PC-DE-YOHAN
Update on 19/04/2010 by El Desaparecido , C_XX & Chimay8
Start at: 02:30:22 | 21/04/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Core(TM)2 Duo CPU     P7350  @ 2.00GHz
Microsoft® Windows Vista(TM) Édition Familiale Premium  (6.0.6002 32-bit) # Service Pack 2
Internet Explorer 8.0.6001.18904
Windows Firewall Status : Enabled
AV : BitDefender Antivirus 12.0 [ Enabled | Updated ]
FW : BitDefender Firewall[ Enabled ]12.0

C:\ -> Disque fixe local # 220,88 Go (29,28 Go free) [HDD] # NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque CD-ROM
F:\ -> Disque CD-ROM

################## | Elements infectieux |

C:\Windows\System32\autorun.inf  

################## | Registre |


################## | Mountpoints2 |

HKCU\..\..\Explorer\MountPoints2\H
shell\AutoRun\command =H:\SFR.exe 

HKCU\..\..\Explorer\MountPoints2\{30110ff9-d9d4-11de-92cd-ac11ea6793e7}
shell\AutoRun\command =E:\AUTORUN.EXE 

HKCU\..\..\Explorer\MountPoints2\{44ec625a-8a1d-11de-86bb-890121e050c7}
shell\AutoRun\command =E:\SFR.exe 

HKCU\..\..\Explorer\MountPoints2\{a7177b77-52d9-11de-9e94-f228c1dab0e1}
shell\AutoRun\command =E:\AUTOSTARTER.EXE 

HKCU\..\..\Explorer\MountPoints2\{bbebe755-7ca5-11de-9b4d-bc1bf3e599f2}
shell\AutoRun\command =E:\SFR.exe 

HKCU\..\..\Explorer\MountPoints2\{bbebe77c-7ca5-11de-9b4d-00a0c6000000}
shell\AutoRun\command =E:\SFR.exe 

HKCU\..\..\Explorer\MountPoints2\{f1edff29-de54-11dd-817d-c471b15de9e1}
shell\AutoRun\command =F:\AUTOSTARTER.EXE 

################## | Vaccin |

(!) Cet ordinateur n'est pas vacciné !  

################## | ! Fin du rapport # UsbFix V6.106 ! |

dédétraqué · Answer

Salut yohanaldo


(!) Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, caméra, Carte SD, etc...) susceptible d avoir été infectés sans les ouvrir

Pour Vita/7 faire un clique droit sur le raccourci UsbFix présent sur ton bureau et choisi "Exécuter en tant qu'administrateur".

* Au menu principal choisis l'option " F " pour français et tape sur [entrée] .

* Au second menu Choisis l'option " 2 " ( Suppression ) et tape sur [entrée]

* Ton bureau disparaîtra et le pc redémarrera.

* Au redémarrage, UsbFix scannera ton PC, laisse travailler l'outil.

* Ensuite poste le rapport UsbFix.txt qui apparaîtra avec le bureau.

* Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque.( C:\UsbFix.txt )

( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller ) 


-----


Télécharge et installe MalwareByte's Anti-Malware
http://www.malwarebytes.org/mbam/program/mbam-setup.exe

- Mets le à jour

---

- Redémarre en mode sans échec :

Au redémarrage de ton PC tapote sur la touche F8 ou F5, sur l'écran suivant déplace toi avec les flèches de direction et choisis Mode sans échec. Choisis ta session habituelle et non la session Administrateur

---

- Double clique sur le raccourci de MalwareByte's Anti-Malware qui est sur le bureau.
- Sélectionne Exécuter un examen complet si ce n'est pas déjà fait
- clique sur Rechercher

- Une fois le scan terminé, une fenêtre s'ouvre, clique sur  sur OK

- Si MalwareByte's n'a rien détecté, clique sur OK  Un rapport va apparaître ferme-le.

- Si MalwareByte's a détecté des infections, clique sur Afficher les résultats  ensuite sur Supprimer la sélection

- Enregistre le rapport sur ton Bureau comme cela il sera plus facile à retrouver, poste ensuite ce rapport.

Note : Si MalwareByte's  a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur OK

Tutoriel pour MalwareByte's ici : 
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/


@++   :)

yohanaldo · Answer

Bonjour voici le rapport de UsbFix :


############################## | UsbFix V6.106 |

User : yohan (Administrateurs) # PC-DE-YOHAN
Update on 19/04/2010 by El Desaparecido , C_XX & Chimay8
Start at: 14:16:35 | 21/04/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Core(TM)2 Duo CPU     P7350  @ 2.00GHz
Microsoft® Windows Vista(TM) Édition Familiale Premium  (6.0.6002 32-bit) # Service Pack 2
Internet Explorer 8.0.6001.18904
Windows Firewall Status : Enabled
AV : BitDefender Antivirus 12.0 [ Enabled | Updated ]
FW : BitDefender Firewall[ Enabled ]12.0

C:\ -> Disque fixe local # 220,88 Go (29,22 Go free) [HDD] # NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque CD-ROM
F:\ -> Disque CD-ROM

################## | Elements infectieux |

Supprimé ! C:\Windows\System32\autorun.inf 
Supprimé ! C:\$Recycle.Bin\S-1-5-18 
Supprimé ! C:\$Recycle.Bin\S-1-5-21-2881880658-3555428079-2209020445-1000 
Supprimé ! C:\$Recycle.Bin\S-1-5-21-2881880658-3555428079-2209020445-501 

################## | Registre |


################## | Mountpoints2 |

Supprimé ! HKCU\...\Explorer\MountPoints2\H\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{30110ff9-d9d4-11de-92cd-ac11ea6793e7}\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{44ec625a-8a1d-11de-86bb-890121e050c7}\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{a7177b77-52d9-11de-9e94-f228c1dab0e1}\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{bbebe755-7ca5-11de-9b4d-bc1bf3e599f2}\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{bbebe77c-7ca5-11de-9b4d-00a0c6000000}\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{f1edff29-de54-11dd-817d-c471b15de9e1}\Shell\AutoRun\Command  

################## | Listing des fichiers présent |

[21/04/2010 14:16|--a--c---|850] C:\aaw7boot.log 
[18/09/2006 23:43|--a--c---|24] C:\autoexec.bat 
[11/04/2009 08:36|-rahs----|333257] C:\bootmgr 
[28/07/2008 21:52|-ra-sc---|8192] C:\BOOTSECT.BAK 
[28/03/2010 17:44|--a--c---|74] C:\CMLoader.log 
[18/09/2006 23:43|--a--c---|10] C:\config.sys 
[23/04/2008 17:10|--a--c---|2916] C:\files.crc 
[?|?|?] C:\hiberfil.sys 
[02/05/2007 12:03|--a--c---|267864] C:\hpzids01.dll 
[09/01/2009 21:02|-rahsc---|0] C:\IO.SYS 
[09/01/2009 21:02|-rahsc---|0] C:\MSDOS.SYS 
[?|?|?] C:\pagefile.sys 
[28/07/2008 12:34|--a--c---|650] C:\RHDSetup.log 
[24/06/2008 23:41|--a--c---|735209472] C:\Serial.noceurs.French.DVDRiP.DivX.FTT.avi 
[28/07/2008 12:37|--a------|86] C:\setup.log 
[27/08/2009 23:47|--a------|54154] C:	est.log 
[14/10/2009 00:30|--a------|909] C:\updatedatfix.log 
[21/04/2010 14:20|--a--c---|2678] C:\UsbFix.txt 

################## | Vaccination |

# C:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido). 

################## | Upload | 

Veuillez envoyer le fichier : C:\UsbFix_Upload_Me_PC-de-yohan.zip : https://www.ionos.fr/?affiliate_id=77097 
Merci pour votre contribution .  

################## | ! Fin du rapport # UsbFix V6.106 ! |

dédétraqué · Answer

Salut yohanaldo


Faire l'autre partie, le scan avec MalwareByte's Anti-Malware.


@++   :)

yohanaldo · Answer

Bonsoir le scan de MalwareByte me fait beuguer l'ordi à chaque fois (c'est à dire qu'il s'eteint tout seul) donc je fais au mieux pour te le poster vite

dédétraqué · Answer

Salut yohanaldo


Fais alors un examen rapide en mode normal.


@++   :)

yohanaldo · Answer

Bonjour j ai enfin reussi a faire un scan avec malwarebytes sur lequel il a detecté 39 infections. Je les ai supprimé et apparemment google refonctionne
Je suis dsl d'avoir attendu 15 jours mais je te promet que c'est un miracle d'avoir fait le scan en entier sans coupure d'ordi
Si tu peux et si tu souhaite toujours m'aider voici le rapport
cordialement

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Version de la base de données: 4014

Windows 6.0.6002 Service Pack 2 (Safe Mode)
Internet Explorer 8.0.6001.18904

04/05/2010 08:11:39
mbam-log-2010-05-04 (08-11-39).txt

Type d'examen: Examen rapide
Elément(s) analysé(s): 112192
Temps écoulé: 4 minute(s), 49 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 9
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 3
Fichier(s) infecté(s): 25

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\captcha (Worm.KoobFace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ipokoraid (Worm.Koobface) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	orrent101 (Trojan.Swizzor) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmoko (Worm.KoobFace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DMOKO (Worm.KoobFace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\webserver (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\32 Vegas Casino (Adware.21Nova) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\32 Vegas Casino (Adware.21Nova) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Torrent101 (Trojan.Swizzor) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHostpcssc (Worm.KoobFace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\captcha (Worm.KoobFace) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Program Files\Torrent101 (Trojan.Swizzor) -> Quarantined and deleted successfully.
C:\Program Files\Torrent101\Skins (Trojan.Swizzor) -> Quarantined and deleted successfully.
C:\Users\yohan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Torrent101 (Trojan.Swizzor) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Windows\System32\captcha.dll (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Windows\System32\certoko.dll (Worm.Koobface) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers
disoko.sys (Worm.Koobface) -> Quarantined and deleted successfully.
C:\Windows\bill106.exe (PWS.Ldpinch) -> Quarantined and deleted successfully.
C:\Program Files\Torrent101\icon-uninstall.ico (Trojan.Swizzor) -> Quarantined and deleted successfully.
C:\Program Files\Torrent101\session.store (Trojan.Swizzor) -> Quarantined and deleted successfully.
C:\Program Files\Torrent101\settings.ini (Trojan.Swizzor) -> Quarantined and deleted successfully.
C:\Program Files\Torrent101\settings.stp (Trojan.Swizzor) -> Quarantined and deleted successfully.
C:\Program Files\Torrent101\SkinCrafterDll.dll (Trojan.Swizzor) -> Quarantined and deleted successfully.
C:\Program Files\Torrent101\state.dht (Trojan.Swizzor) -> Quarantined and deleted successfully.
C:\Program Files\Torrent101\Torrent101.url (Trojan.Swizzor) -> Quarantined and deleted successfully.
C:\Program Files\Torrent101\uninst.exe (Trojan.Swizzor) -> Quarantined and deleted successfully.
C:\Program Files\Torrent101\Skins\Zorg.skf (Trojan.Swizzor) -> Quarantined and deleted successfully.
C:\Users\yohan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Torrent101\HomePage.lnk (Trojan.Swizzor) -> Quarantined and deleted successfully.
C:\Users\yohan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Torrent101\Uninstall.lnk (Trojan.Swizzor) -> Quarantined and deleted successfully.
C:\Windows\bk23567.dat (KoobFace.Trace) -> Quarantined and deleted successfully.
C:\Windows\fdgg34353edfgdfdf (KoobFace.Trace) -> Quarantined and deleted successfully.
C:\Program Files\webserver\webserver.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Windows\kdiue732.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\Users\yohan\Local Settings\Application Data\010112010146100109.xxe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Users\yohan\Local Settings\Application Data\010112010146114111.xxe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Users\yohan\Local Settings\Application Data\010112010146115119.xxe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Users\yohan\Local Settings\Application Data\0101120101465198.xxe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Users\yohan\Local Settings\Application Datadr_1271010025.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Users\yohan\Local Settings\Application Datadr_1271010364.exe (Worm.KoobFace) -> Quarantined and deleted successfully.

dédétraqué · Answer

Salut yohanaldo


Refais un scan avec RSIT et poste le contenu du rapport log.txt à la fin de l'analyse

Le rapport est dans le dossier ici C:\rsit


@++   :)

yohanaldo · Answer

Salut à toi, voici le rapport log.txt :

Logfile of random's system information tool 1.06 (written by random/random)
Run by yohan at 2010-05-05 18:35:29
Microsoft® Windows Vista(TM) Édition Familiale Premium  Service Pack 2
System drive C: has 25 GB (11%) free of 226 GB
Total RAM: 3070 MB (39% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:35:57, on 05/05/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18904)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\ATK Hotkey\HControlUser.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Luxand\Blink!\LuxandBlinkTray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\ManyCam 2.4\ManyCam.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Google\Web Accelerator\googlewebaccclient.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Users\yohan\Desktop\RSIT.exe
C:\Program Files	rend micro\yohan.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.sfr.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://localhost:9100/proxy.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Google Web Accelerator Helper - {69A87B7D-DE56-4136-9655-716BA50C19C7} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [HControlUser] "C:\Program Files\ATK Hotkey\HcontrolUser.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [Luxand Blink!] C:\Program Files\Luxand\Blink!\LuxandBlinkTray.exe /s
O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [ManyCam] "C:\Program Files\ManyCam 2.4\ManyCam.exe"
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Run Google Web Accelerator.lnk = C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O8 - Extra context menu item: Se&nd to OneNote - res:///105
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O9 - Extra button: (no name) - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: (no name) - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Groom - {66F83792-DAE1-4823-8F20-ADA94B33A4FF} - C:\Program Files\Toox\Groom\Groom.exe (HKCU)
O13 - Gopher Prefix: 
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O22 - SharedTaskScheduler: Deskscapes - {EC654325-1273-C2A9-2B7C-45D29BCE68FB} - C:\PROGRA~1\Stardock\OBJECT~1\DESKSC~1\deskscapes.dll
O22 - SharedTaskScheduler: StardockDreamController - {EC654325-1273-C2A9-2B7C-45D29BCE68FF} - C:\PROGRA~1\Stardock\OBJECT~1\DESKSC~1\DreamControl.dll
O22 - SharedTaskScheduler: Stardock Vista ControlPanel Extension - {EC654325-1273-C2A9-2B7C-45D29BCE68FD} - (no file)
O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Desktop Manager 5.9.911.3589 (GoogleDesktopManager-110309-193829) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: Service SFR Gestionnaire Connexion (ServiceSFRABCD) - SFR & Celliance - C:\Program Files\SFR\Gestionnaire de Connexion SFR\SFRABCDService.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

yohanaldo · Answer

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}]
IDMIEHlprObj Class - C:\Program Files\Internet Download Manager\IDMIECC.dll [2010-04-26 193968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{053F9267-DC04-4294-A72C-58F732D338C0}]
HP Print Clips - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll [2007-03-02 177768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-04-04 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{69A87B7D-DE56-4136-9655-716BA50C19C7}]
&Google Web Accelerator Helper - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll [2007-07-09 311296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL [2009-08-21 4139912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL [2009-08-17 564624]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}]
CBrowserHelperObject Object - C:\Program Files\Google\Google_BAE\BAE.dll [2006-11-09 98304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-07-25 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - Google Web Accelerator - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll [2007-07-09 311296]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184]
"IAAnotif"=C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [2008-05-07 178712]
"HControlUser"=C:\Program Files\ATK Hotkey\HcontrolUser.exe [2008-01-11 98304]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-01-21 61440]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-06-13 6183456]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2008-03-06 1041704]
"Google Desktop Search"=C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2009-11-24 30192]
"toolbar_eula_launcher"=C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe [2007-02-20 28672]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-03-11 49152]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-07-25 149280]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-04-04 36272]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-03-24 952768]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-11-25 81000]
"BCSSync"=C:\Program Files\Microsoft Office\Office14\BCSSync.exe [2009-08-17 85888]
"Luxand Blink!"=C:\Program Files\Luxand\Blink!\LuxandBlinkTray.exe [2010-02-10 6844728]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SmpcSys"=C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe [2008-02-04 1038136]
"BitTorrent DNA"=C:\Program Files\DNA\btdna.exe [2010-03-03 323392]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [2008-01-14 1688872]
"ManyCam"=C:\Program Files\ManyCam 2.4\ManyCam.exe [2009-12-19 1824040]
"IDMan"=C:\Program Files\Internet Download Manager\IDMan.exe [2010-04-29 3220912]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2010-04-01 357696]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Run Google Web Accelerator.lnk - C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler]
Deskscapes - {EC654325-1273-C2A9-2B7C-45D29BCE68FB} - C:\PROGRA~1\Stardock\OBJECT~1\DESKSC~1\deskscapes.dll [2008-03-29 103848]
StardockDreamController - {EC654325-1273-C2A9-2B7C-45D29BCE68FF} - C:\PROGRA~1\Stardock\OBJECT~1\DESKSC~1\DreamControl.dll [2008-05-05 591128]
Stardock Vista ControlPanel Extension - {EC654325-1273-C2A9-2B7C-45D29BCE68FD}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL [2009-08-21 4139912]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=255
"NoDriveTypeAutoRun"=255
"HonorAutoRunSetting"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-05-05 17:01:47 ----D---- C:\Program Files\DAEMON Tools Lite
2010-05-04 14:59:25 ----A---- C:\Windows\system32
toskrnl.exe
2010-05-04 14:59:24 ----A---- C:\Windows\system32
tkrnlpa.exe
2010-05-04 14:59:20 ----A---- C:\Windows\system32\vbscript.dll
2010-05-04 14:59:05 ----A---- C:\Windows\system32\iphlpsvc.dll
2010-05-04 14:52:26 ----A---- C:\Windows\system32\wintrust.dll
2010-05-04 14:52:24 ----A---- C:\Windows\system32\cabview.dll
2010-05-03 14:10:08 ----D---- C:\Users\yohan\AppData\Roaming\IDM
2010-05-03 14:10:08 ----D---- C:\Users\yohan\AppData\Roaming\DMCache
2010-05-03 14:09:45 ----D---- C:\Program Files\Internet Download Manager
2010-05-03 14:04:41 ----D---- C:\Users\yohan\AppData\Roaming\Luxand
2010-05-03 14:03:02 ----A---- C:\Windows\system32\LuxandCredentialProvider.dll
2010-05-03 14:03:01 ----A---- C:\Windows\system32\LuxandBlinkLib12.dll
2010-05-03 14:03:00 ----A---- C:\Windows\system32\LuxandBlinkLib11.dll
2010-05-03 14:02:55 ----D---- C:\Program Files\Luxand
2010-05-03 14:02:55 ----A---- C:\Windows\system32\LuxandBlinkLib1.dll
2010-05-03 14:02:55 ----A---- C:\Windows\system32\LuxandBlink.dll
2010-05-03 13:34:37 ----D---- C:\Program Files\Yamicsoft
2010-04-29 16:22:23 ----A---- C:\Windows\system32\idmmbc.dll
2010-04-26 18:55:46 ----D---- C:\ProgramData\Astar Games
2010-04-21 15:08:03 ----A---- C:\Windows
tbtlog.txt
2010-04-21 14:50:51 ----D---- C:\Users\yohan\AppData\Roaming\Malwarebytes
2010-04-21 14:49:50 ----D---- C:\ProgramData\Malwarebytes
2010-04-21 14:49:50 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-04-21 14:20:54 ----RASHDC---- C:\autorun.inf
2010-04-21 14:16:29 ----AC---- C:\UsbFix.txt
2010-04-21 02:13:11 ----DC---- C:\UsbFix
2010-04-19 20:25:04 ----DC---- C:sit
2010-04-19 01:10:51 ----A---- C:\Windows\system32\lsdelete.exe
2010-04-18 15:46:44 ----D---- C:\Program Files\Power IE
2010-04-12 02:39:09 ----HDC---- C:\ProgramData\{52AC600B-5800-407E-99FF-83CD0669760B}
2010-04-12 02:38:32 ----D---- C:\ProgramData\Lavasoft
2010-04-12 02:38:32 ----D---- C:\Program Files\Lavasoft
2010-04-12 02:30:18 ----D---- C:\Program Files\CCleaner
2010-04-12 01:50:41 ----A---- C:\Windows\msnfix.txt
2010-04-11 16:53:24 ----D---- C:\Program Files\AxBx
2010-04-11 02:53:32 ----D---- C:\Program Files\webserver
2010-04-09 19:19:29 ----D---- C:\Program Files\Microsoft Visual Studio

yohanaldo · Answer

======List of files/folders modified in the last 1 months======

2010-05-05 18:35:57 ----D---- C:\Program Files\Trend Micro
2010-05-05 18:27:51 ----D---- C:\Users\yohan\AppData\Roaming\DNA
2010-05-05 17:22:57 ----D---- C:\Windows\winsxs
2010-05-05 17:08:16 ----D---- C:\Windows
2010-05-05 17:07:38 ----D---- C:\Program Files\DNA
2010-05-05 17:07:16 ----D---- C:\Windows\Temp
2010-05-05 17:07:05 ----D---- C:\Windows\Tasks
2010-05-05 17:01:47 ----RD---- C:\Program Files
2010-05-05 17:00:54 ----D---- C:\Program Files\SpeedBit Video Accelerator
2010-05-05 17:00:52 ----AD---- C:\Windows\System32
2010-05-05 17:00:26 ----D---- C:\Windows\prefetch
2010-05-05 16:56:48 ----D---- C:\Windows\system32\catroot
2010-05-05 16:50:46 ----AD---- C:\Windows\system32\drivers
2010-05-05 16:50:45 ----D---- C:\Program Files\Windows Mail
2010-05-05 16:50:43 ----RSD---- C:\Windows\Fonts
2010-05-04 22:17:26 ----SHD---- C:\Windows\Installer
2010-05-04 22:17:20 ----D---- C:\ProgramData\Microsoft Help
2010-05-04 22:14:33 ----D---- C:\Windows\Debug
2010-05-04 22:13:37 ----RSD---- C:\Windows\assembly
2010-05-04 22:08:42 ----SHD---- C:\System Volume Information
2010-05-04 15:00:23 ----D---- C:\Windows\system32\catroot2
2010-05-04 08:12:54 ----D---- C:\Windows\PolicyDefinitions
2010-05-03 19:57:39 ----D---- C:\Windows\system32\config
2010-05-03 14:36:01 ----D---- C:\Users\yohan\AppData\Roaming\BitTorrent
2010-05-03 14:32:32 ----D---- C:\Program Files\WinRAR
2010-05-03 13:34:44 ----SD---- C:\Users\yohan\AppData\Roaming\Microsoft
2010-05-01 19:15:29 ----D---- C:\Windows\inf
2010-05-01 19:15:29 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-05-01 04:13:43 ----A---- C:\Windows\NeroDigital.ini
2010-04-26 18:55:46 ----HD---- C:\ProgramData
2010-04-25 16:35:56 ----D---- C:\Users\yohan\AppData\Roaming\Samsung
2010-04-25 16:27:57 ----HD---- C:\Program Files\InstallShield Installation Information
2010-04-24 17:48:34 ----RD---- C:\Users
2010-04-21 14:19:53 ----SHD---- C:\$RECYCLE.BIN
2010-04-19 01:49:03 ----D---- C:\Program Files\Google
2010-04-18 15:53:07 ----D---- C:\ProgramData\Google
2010-04-18 15:50:04 ----D---- C:\Windows\Web
2010-04-12 03:27:00 ----D---- C:\Program Files\Common Files\microsoft shared
2010-04-12 03:13:37 ----A---- C:\Windows\win.ini
2010-04-12 02:51:13 ----D---- C:\Windows\system32\Tasks
2010-04-12 02:40:13 ----DC---- C:\Windows\system32\DRVSTORE
2010-04-12 02:32:49 ----D---- C:\Windows\Minidump
2010-04-11 20:21:11 ----D---- C:\Program Files\Steam
2010-04-11 20:20:11 ----D---- C:\Windows\system32\WDI
2010-04-11 20:17:37 ----D---- C:\Windows\system32\Msdtc
2010-04-11 20:17:31 ----D---- C:\Windows\system32\wbem
2010-04-11 20:15:20 ----D---- C:\Windows\system32\spool
2010-04-11 20:15:20 ----D---- C:\Windows\system32\CodeIntegrity
2010-04-11 20:15:08 ----D---- C:\ProgramData\HP Product Assistant
2010-04-11 20:15:08 ----D---- C:\Program Files\Microsoft Works
2010-04-11 20:15:05 ----D---- C:\Windows\registration
2010-04-09 19:19:49 ----D---- C:\Program Files\MSBuild
2010-04-09 19:19:31 ----D---- C:\Program Files\Microsoft Office
2010-04-09 19:15:04 ----D---- C:\Program Files\Microsoft Visual Studio 8
2010-04-09 19:14:55 ----D---- C:\Windows\ShellNew
2010-04-09 18:53:51 ----D---- C:\Program Files\Common Files\InstallShield
2010-04-06 19:52:54 ----A---- C:\Windows\system32\mrt.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2009-11-25 23120]
R1 aswSP;avast! Self Protection; C:\Windows\system32\drivers\aswSP.sys [2009-09-15 114768]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2009-11-25 48560]
R1 kl1;kl1; C:\Windows\system32\DRIVERS\kl1.sys [2009-09-01 128016]
R1 StarOpen;StarOpen; C:\Windows\system32\drivers\StarOpen.sys [2006-07-24 5632]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\DRIVERS\aswFsBlk.sys [2009-09-15 20560]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\DRIVERS\aswMonFlt.sys [2009-09-15 53328]
R2 atksgt;atksgt; C:\Windows\system32\DRIVERS\atksgt.sys [2009-05-31 279712]
R2 lirsgt;lirsgt; C:\Windows\system32\DRIVERS\lirsgt.sys [2009-05-31 25888]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2008-02-15 46592]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2007-07-30 43008]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2007-07-30 38400]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2008-06-10 3839488]
R3 CmBatt;Pilote pour Batterie à méthode de contrôle ACPI Microsoft; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-21 14208]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-06-13 2152344]
R3 itecir;ITECIR Infrared Receiver; C:\Windows\system32\DRIVERS\itecir.sys [2007-12-18 54784]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver; C:\Windows\system32\DRIVERS\ManyCam.sys [2008-01-14 21632]
R3 MTsensor;ATK0100 ACPI UTILITY; C:\Windows\system32\DRIVERS\ATKACPI.sys [2006-12-14 7680]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw5v32.sys [2008-06-26 3662848]
R3 RTHDMIAzAudService;Service for HDMI; C:\Windows\system32\drivers\RtHDMIV.sys [2008-05-29 146848]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-04-11 89088]
R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC); C:\Windows\system32\DRIVERS\snp2uvc.sys [2007-10-01 1769984]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2008-03-06 198960]
R3 X10Hid;X10 Hid Device; C:\Windows\System32\Drivers\x10hid.sys [2006-11-17 13976]
S3 ayw8zk3z;ayw8zk3z; C:\Windows\system32\drivers\ayw8zk3z.sys []
S3 BT;Bluetooth PAN Network Adapter; C:\Windows\system32\DRIVERS\btnetdrv.sys []
S3 BthEnum;Pilote de bloc de demande Bluetooth; C:\Windows\system32\DRIVERS\BthEnum.sys [2008-07-28 23040]
S3 BthPan;Périphérique Bluetooth (réseau personnel); C:\Windows\system32\DRIVERS\bthpan.sys [2008-01-21 92160]
S3 BTHPORT;Pilote de port Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2008-07-28 507904]
S3 BTHUSB;Pilote USB radio Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2008-07-28 30208]
S3 btnetBUs;Bluetooth PAN Bus Service; C:\Windows\System32\Drivers\btnetBus.sys [2008-12-07 30088]
S3 Dot4;Pilote MS IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4.sys [2008-01-21 131584]
S3 Dot4Print;Pilote de classe Imprimante pour IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2008-01-21 16384]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2008-01-21 36864]
S3 drmkaud;Filtre de décodeur DRM (Noyau Microsoft); C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]
S3 HdAudAddService;Pilote de fonction UAA 1.1 Microsoft pour le service High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 IvtBtBUs;IVT Bluetooth Bus Service; C:\Windows\System32\Drivers\IvtBtBus.sys []
S3 massfilter;ZTE Mass Storage Filter Driver; C:\Windows\system32\drivers\massfilter.sys [2008-10-29 7680]
S3 MSKSSRV;Proxy de service de répartition Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Proxy d'horloge de répartition Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]
S3 MSPQM;Proxy de gestion de qualité de répartition Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]
S3 RFCOMM;Périphérique Bluetooth (TDI protocole RFCOMM); C:\Windows\system32\DRIVERS\rfcomm.sys [2008-07-28 149504]
S3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2008-05-02 122368]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM); C:\Windows\system32\DRIVERS\ss_bus.sys [2007-05-02 83592]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter; C:\Windows\system32\DRIVERS\ss_mdfl.sys [2007-05-02 15112]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers; C:\Windows\system32\DRIVERS\ss_mdm.sys [2007-05-02 109704]
S3 sscdbus;SAMSUNG USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\sscdbus.sys [2007-07-03 80552]
S3 sscdmdfl;SAMSUNG Mobile Modem Filter; C:\Windows\system32\DRIVERS\sscdmdfl.sys [2007-07-03 11944]
S3 sscdmdm;SAMSUNG Mobile Modem Drivers; C:\Windows\system32\DRIVERS\sscdmdm.sys [2007-07-03 106792]
S3 StillCam;Pilote d'appareil photo numérique série; C:\Windows\system32\DRIVERS\serscan.sys [2008-01-21 9216]
S3 usbanyka;USB Web Camera; C:\Windows\system32\DRIVERS\UsbAnyka.sys [2007-11-13 17536]
S3 usbscan;Pilote de scanneur USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-21 35328]
S3 VComm;Virtual Serial port driver; C:\Windows\system32\DRIVERS\VComm.sys []
S3 VcommMgr;Bluetooth VComm Manager Service; C:\Windows\System32\Drivers\VcommMgr.sys []
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]
S3 ZTEusbmdm6k;ZTE Proprietary USB Driver; C:\Windows\system32\DRIVERS\ZTEusbmdm6k.sys [2008-10-15 104960]
S3 ZTEusbnet;ZTE USB-NDIS miniport; C:\Windows\system32\DRIVERS\ZTEusbnet.sys [2008-10-13 110080]
S3 ZTEusbnmea;ZTE NMEA Port; C:\Windows\system32\DRIVERS\ZTEusbnmea.sys [2008-10-29 105344]
S3 ZTEusbser6k;ZTE Diagnostic Port; C:\Windows\system32\DRIVERS\ZTEusbser6k.sys [2008-10-15 104960]
S3 ZTEusbvoice;ZTE VoUSB Port; C:\Windows\system32\DRIVERS\ZTEusbvoice.sys [2008-10-15 104960]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2008-01-21 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6; C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [2007-09-11 124832]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-03-06 132424]
R2 ASLDRService;ASLDR Service; C:\Program Files\ATK Hotkey\ASLDRSrv.exe [2007-10-02 94208]
R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-11-25 18752]
R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2008-06-10 692224]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-11-25 138680]
R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 hpqddsvc;Service HP CUE DeviceDiscovery; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R2 HPSLPSVC;HP Network Devices Support; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R2 IAANTMON;Intel(R) Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe [2008-05-07 354840]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [2010-02-05 1229232]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2007-12-03 869672]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-21 21504]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\Windows\system32\IoctlSvc.exe [2006-12-19 81920]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-21 21504]
R2 ServiceSFRABCD;Service SFR Gestionnaire Connexion; C:\Program Files\SFR\Gestionnaire de Connexion SFR\SFRABCDService.exe [2009-09-01 657024]
R2 x10nets;X10 Device Network Service; C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe [2001-11-12 20480]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-11-25 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-11-25 352920]
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2008-01-14 447784]
S2 gupdate;Service Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-31 135664]
S3 aspnet_state;Service d'état ASP.NET; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2009-03-30 31048]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-07-28 647680]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504]
S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2009-11-24 30192]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-04-16 182768]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files\Microsoft Office\Office14\GROOVE.EXE [2009-08-21 30510960]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office  Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2009-08-21 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2009-08-21 4639136]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2008-12-22 104944]
S4 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2008-01-21 21504]

-----------------EOF-----------------

dédétraqué · Answer

Salut yohanaldo 


Supprime ce dossier en gras :
C:\Program Files\webserver

As-tu encore des redirections Google?


@++   :)

yohanaldo · Answer

Re dédétraqué, je n'ai plus de redirection Google et j'ai retrouvé une vitesse de navigation excellente

Je te remercie encore beaucoup

dédétraqué · Answer

Salut yohanaldo


OK super alors, on va vérifier si rien de caché :
Faire un scan avec Nod32 en ligne (il faut utiliser Internet Explorer) ici :

https://www.eset.com/int/home/online-scanner/

(coche toutes les cases à chaque fois, sauf les deux dernières a la fin du scan, sinon le rapport est supprimer) 
A la fin, colle le rapport : C:\Program Files\EsetOnlineScanner\log.txt


@++   :)

yohanaldo · Answer

Bonjour dédétraqué voici le rapport du scan :

A noter qu'il a detecté 3 fichiers qu'il a mis en quarentaine, cependant je ne peux pas les mettre en ligne sinon CCM n'enregistre pas le message, j'ai essayé plusieurs fois et je me suis rendu compte que le probleme venait des liens des 3 fichiers

Tout le reste du rapport y est

merci ;)

yohanaldo · Answer

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=8b9fc39082f9cf4898617a43aa89a265
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-05-07 12:12:16
# local_time=2010-05-07 02:12:16 (+0100, Paris, Madrid (heure d'été))
# country="France"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 86620 86620 0 0
# compatibility_mode=769 16775165 100 98 231 209441531 2671161 0
# compatibility_mode=1280 16777215 100 0 0 0 0 0
# compatibility_mode=2049 16777214 0 5 18468273 18468273 0 0
# compatibility_mode=5892 16776574 100 100 9066787 110696705 0 0
# compatibility_mode=8192 67108863 100 0 8819 8819 0 0
# scanned=175192
# found=3
# cleaned=3
# scan_time=27158

yohanaldo · Answer

# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=8b9fc39082f9cf4898617a43aa89a265
# end=finished
# remove_checked=true
# archives_checked=true  
# unwanted_checked=true  
# unsafe_checked=false  
# antistealth_checked=true  
# utc_time=2010-05-08 02:55:41  
# local_time=2010-05-08 04:55:41 (+0100, Paris, Madrid (heure d'été))  
# country="France"  
# lang=1033  
# osver=6.0.6002 NT Service Pack 2  
# compatibility_mode=512 16777215 100 0 199280 199280 0 0  
# compatibility_mode=769 16775165 100 98 112547 209554191 1948621 0  
# compatibility_mode=1280 16777215 100 0 0 0 0 0  
# compatibility_mode=2049 16777214 0 5 18580933 18580933 0 0  
# compatibility_mode=5892 16776574 100 100 9179447 110809365 0 0  
# compatibility_mode=8192 67108863 100 0 121479 121479 0 0  
# scanned=175307  
# found=0  
# cleaned=0  
# scan_time=29869

dédétraqué · Answer

Salut yohanaldo


Effectivement le dernier rapport est propre, as-tu d'autre souci?


@++   :)

yohanaldo · Answer

Bonjour, j'ai une lenteur extreme de mon ordi. Les pages internet mettent bcp de temps pour s'afficher et mes logiciels aussi. Meme pour naviguer dans mon disque dur

J'ai defragmenté, liberer de l'espace sur le disque dur, utiliser cccleaner, si tu as une idée c'est avec plaisir :)

Autrement merci encore une fois pour l'aide que tu m'as apporté, je n'ai plus de probleme de redirection, c'est génial !!!!!!!!!

dédétraqué · Answer

Salut yohanaldo


Télécharge combofix.exe (de sUBs) sur le bureau :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.geekstogo.com/forum/files/file/197-combofix-by-subs/

Important Désactive ton Antivirus, antispyware et Pare feu avant le scan avec Combofix :
https://forum.pcastuces.com/default.asp
https://www.bleepingcomputer.com/forums/t/114351/how-to-temporarily-disable-your-anti-virus-firewall-and-anti-malware-programs/

==> Sauvegarde ton travail et ferme toutes les fenêtres actives, il peut y avoir un redémarrage du PC. Ne lance aucun programme tant que Combofix n'est pas fini. <==

Double clique sur combofix.exe, clique sur OUI et valide par Entrée 

Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

Combofix est détecté par certains antivirus comme une infection, ne pas en tenir compte, il s'agit d'un faux positif, continue la procédure


@++   :)

yohanaldo · Answer

bonjour dédétraqué voici le rappport ;)
merci

ComboFix 10-05-10.04 - yohan 11/05/2010  17:05:42.1.2 - x86
Microsoft® Windows Vista(TM) Édition Familiale Premium   6.0.6002.2.1252.33.1036.18.3070.2061 [GMT 2:00]
Lancé depuis: c:\users\yohan\Documents\Downloads\Programs\ComboFix.exe
AV: BitDefender Antivirus *On-access scanning enabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
FW: BitDefender Firewall *enabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
SP: BitDefender Antispyware *enabled* (Updated) {8B2012EC-32D4-494F-BC03-832DB3BDF911}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\yohan\Documents\BackupRegistry(20100503).reg
c:\windows\system32\AbaleZip.dll
c:\windows\system32\logs

.
(((((((((((((((((((((((((((((   Fichiers créés du 2010-04-11 au 2010-05-11  ))))))))))))))))))))))))))))))))))))
.

2010-05-11 15:14 . 2010-05-11 15:15	--------	d-----w-	c:\users\yohan\AppData\Local	emp
2010-05-11 15:14 . 2010-05-11 15:14	--------	d-----w-	c:\users\Default\AppData\Local	emp
2010-05-06 14:12 . 2010-05-06 14:12	--------	d-----w-	c:\program files\ESET
2010-05-06 14:10 . 2010-05-06 14:17	--------	d-----w-	c:\programdata\Google Updater
2010-05-06 00:53 . 2010-05-06 00:51	95024	----a-w-	c:\windows\system32\drivers\SBREDrv.sys
2010-05-05 15:01 . 2010-05-05 15:01	--------	d-----w-	c:\program files\DAEMON Tools Lite
2010-05-04 12:59 . 2010-02-23 11:10	212992	----a-w-	c:\windows\system32\drivers\mrxsmb10.sys
2010-05-04 12:59 . 2010-02-23 11:10	79360	----a-w-	c:\windows\system32\drivers\mrxsmb20.sys
2010-05-04 12:59 . 2010-02-23 11:10	106496	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
2010-05-04 12:59 . 2010-02-18 14:07	3548040	----a-w-	c:\windows\system32
toskrnl.exe
2010-05-04 12:59 . 2010-02-18 14:07	3600776	----a-w-	c:\windows\system32
tkrnlpa.exe
2010-05-04 12:59 . 2010-03-05 14:01	420352	----a-w-	c:\windows\system32\vbscript.dll
2010-05-04 12:59 . 2010-02-18 14:07	904576	----a-w-	c:\windows\system32\drivers	cpip.sys
2010-05-04 12:59 . 2010-02-18 11:28	25088	----a-w-	c:\windows\system32\drivers	unnel.sys
2010-05-04 12:59 . 2010-02-18 13:30	200704	----a-w-	c:\windows\system32\iphlpsvc.dll
2010-05-04 12:52 . 2009-12-23 11:33	172032	----a-w-	c:\windows\system32\wintrust.dll
2010-05-04 12:52 . 2010-01-13 17:34	98304	----a-w-	c:\windows\system32\cabview.dll
2010-05-03 12:14 . 2010-05-03 12:14	214448	----a-w-	c:\users\yohan\AppData\Roaming\IDM\idmmzcc3\components\idmmzcc.dll
2010-05-03 12:10 . 2010-05-10 21:27	--------	d-----w-	c:\users\yohan\AppData\Roaming\DMCache
2010-05-03 12:10 . 2010-05-03 14:00	--------	d-----w-	c:\users\yohan\AppData\Roaming\IDM
2010-05-03 12:09 . 2010-05-03 12:09	--------	d-----w-	c:\program files\Internet Download Manager
2010-05-03 12:04 . 2010-05-03 12:04	--------	d-----w-	c:\users\yohan\AppData\Roaming\Luxand
2010-05-03 12:03 . 2010-02-09 23:06	431416	----a-w-	c:\windows\system32\LuxandCredentialProvider.dll
2010-05-03 12:03 . 2010-02-09 23:06	94008	----a-w-	c:\windows\system32\LuxandBlinkLib12.dll
2010-05-03 12:03 . 2010-02-09 23:07	4705080	----a-w-	c:\windows\system32\LuxandBlinkLib11.dll
2010-05-03 12:02 . 2010-05-03 12:02	--------	d-----w-	c:\program files\Luxand
2010-05-03 12:02 . 2010-02-09 23:07	4705080	----a-w-	c:\windows\system32\LuxandBlinkLib1.dll
2010-05-03 12:02 . 2010-02-09 23:06	628536	----a-w-	c:\windows\system32\LuxandBlink.dll
2010-04-29 14:22 . 2009-09-09 08:43	210352	----a-w-	c:\windows\system32\idmmbc.dll
2010-04-26 16:55 . 2010-04-26 16:55	--------	d-----w-	c:\programdata\Astar Games
2010-04-21 12:50 . 2010-04-21 12:50	--------	d-----w-	c:\users\yohan\AppData\Roaming\Malwarebytes
2010-04-21 12:49 . 2010-03-29 22:46	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-21 12:49 . 2010-04-21 12:49	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-04-21 12:49 . 2010-04-21 12:49	--------	d-----w-	c:\programdata\Malwarebytes
2010-04-21 12:49 . 2010-03-29 22:45	20824	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-04-21 12:28 . 2010-04-21 12:28	159267	-c--a-w-	C:\UsbFix_Upload_Me_PC-de-yohan.zip
2010-04-21 00:13 . 2010-04-21 12:28	--------	dc----w-	C:\UsbFix
2010-04-19 18:25 . 2010-04-19 18:25	--------	dc----w-	C:sit
2010-04-18 23:10 . 2010-02-05 09:03	15880	----a-w-	c:\windows\system32\lsdelete.exe
2010-04-18 13:46 . 2010-04-18 13:51	--------	d-----w-	c:\program files\Power IE
2010-04-12 00:40 . 2010-02-05 09:03	64288	----a-w-	c:\windows\system32\drivers\Lbd.sys
2010-04-12 00:39 . 2010-04-12 00:39	--------	dc-h--w-	c:\programdata\{52AC600B-5800-407E-99FF-83CD0669760B}
2010-04-12 00:39 . 2010-02-05 09:04	2954656	-c--a-w-	c:\programdata\{52AC600B-5800-407E-99FF-83CD0669760B}\Ad-AwareInstaller.exe
2010-04-12 00:38 . 2010-04-12 00:40	--------	d-----w-	c:\programdata\Lavasoft
2010-04-12 00:38 . 2010-04-12 00:39	--------	d-----w-	c:\program files\Lavasoft
2010-04-12 00:30 . 2010-04-12 00:30	--------	d-----w-	c:\program files\CCleaner

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-11 14:54 . 2009-01-06 17:29	--------	d-----w-	c:\users\yohan\AppData\Roaming\DNA
2010-05-10 21:29 . 2008-07-28 19:57	716298	----a-w-	c:\windows\system32\perfh00C.dat
2010-05-10 21:29 . 2008-07-28 19:57	144420	----a-w-	c:\windows\system32\perfc00C.dat
2010-05-10 21:26 . 2009-01-06 17:29	--------	d-----w-	c:\program files\DNA
2010-05-06 14:12 . 2008-07-28 10:51	--------	d-----w-	c:\program files\Google
2010-05-05 16:35 . 2010-01-25 01:06	--------	d-----w-	c:\program files\Trend Micro
2010-05-05 15:00 . 2009-05-18 19:09	--------	d-----w-	c:\program files\SpeedBit Video Accelerator
2010-05-05 14:50 . 2006-11-02 11:18	--------	d-----w-	c:\program files\Windows Mail
2010-05-04 20:17 . 2008-07-28 11:00	--------	d-----w-	c:\programdata\Microsoft Help
2010-05-03 12:36 . 2009-01-06 20:33	--------	d-----w-	c:\users\yohan\AppData\Roaming\BitTorrent
2010-04-25 14:35 . 2009-01-18 22:12	--------	d-----w-	c:\users\yohan\AppData\Roaming\Samsung
2010-04-25 14:27 . 2008-07-28 10:27	--------	d--h--w-	c:\program files\InstallShield Installation Information
2010-04-11 18:21 . 2010-03-15 12:41	--------	d-----w-	c:\program files\Steam
2010-04-11 18:15 . 2010-02-05 22:23	--------	d-----w-	c:\programdata\HP Product Assistant
2010-04-11 18:15 . 2008-07-28 10:46	--------	d-----w-	c:\program files\Microsoft Works
2010-04-11 14:53 . 2010-04-11 14:53	--------	d-----w-	c:\program files\AxBx
2010-04-09 17:29 . 2009-01-06 16:33	103896	----a-w-	c:\users\yohan\AppData\Local\GDIPFONTCACHEV1.DAT
2010-04-09 17:19 . 2006-11-02 12:37	--------	d-----w-	c:\program files\MSBuild
2010-04-09 17:15 . 2009-03-08 18:05	--------	d-----w-	c:\program files\Microsoft Visual Studio 8
2010-04-09 16:53 . 2008-07-28 10:32	--------	d-----w-	c:\program files\Common Files\InstallShield
2010-03-30 21:47 . 2010-03-30 21:46	--------	d-----w-	c:\users\yohan\AppData\Roaming\Magic Academy
2010-03-28 18:03 . 2010-03-28 18:03	--------	d-----w-	c:\program files\Lavalys
2010-03-23 00:25 . 2009-01-09 11:07	--------	d-----w-	c:\program files\BetClic Poker
2010-03-19 17:54 . 2009-01-08 04:02	--------	d-----w-	c:\users\yohan\AppData\Roaming\LimeWire
2010-03-19 01:47 . 2010-03-19 01:47	--------	d-----w-	c:\program files\Risk
2010-03-15 12:41 . 2010-03-15 12:41	--------	d-----w-	c:\program files\Common Files\Steam
2010-03-15 12:41 . 2009-01-09 16:38	--------	d-----w-	c:\program files\Sports Interactive
2010-03-14 16:33 . 2010-03-14 16:33	--------	d-----w-	c:\program files\Microsoft Visual Studio .NET 2008
2010-03-14 16:33 . 2010-03-14 16:33	--------	d-----w-	c:\program files\Microsoft Visual Studio .NET 2005
2010-03-14 16:32 . 2010-03-14 16:32	--------	d-----w-	c:\program files\Microsoft Synchronization Services
2010-03-14 16:31 . 2010-03-14 16:31	--------	d-----w-	c:\program files\Microsoft Sync Framework
2010-03-14 16:31 . 2010-03-14 16:31	--------	d-----w-	c:\program files\Microsoft SQL Server Compact Edition
2010-03-14 16:31 . 2010-03-14 16:31	--------	d-----w-	c:\program files\Microsoft.NET
2010-03-14 16:20 . 2010-03-14 16:20	--------	d-----w-	c:\program files\Microsoft Analysis Services
2010-03-03 17:12 . 2010-02-05 22:11	166674	----a-w-	c:\windows\hpoins21.dat
2010-02-23 06:39 . 2010-03-31 02:30	916480	----a-w-	c:\windows\system32\wininet.dll
2010-02-23 06:33 . 2010-03-31 02:30	71680	----a-w-	c:\windows\system32\iesetup.dll
2010-02-23 06:33 . 2010-03-31 02:30	109056	----a-w-	c:\windows\system32\iesysprep.dll
2010-02-23 04:55 . 2010-03-31 02:30	133632	----a-w-	c:\windows\system32\ieUnatt.exe
2010-02-20 23:06 . 2010-03-09 23:04	24064	----a-w-	c:\windows\system32
shhttp.dll
2010-02-20 23:05 . 2010-03-09 23:04	30720	----a-w-	c:\windows\system32\httpapi.dll
2010-02-20 20:53 . 2010-03-09 23:04	411648	----a-w-	c:\windows\system32\drivers\http.sys
2010-02-12 10:32 . 2010-04-03 01:00	293376	----a-w-	c:\windows\system32\browserchoice.exe
2008-07-28 20:00 . 2008-07-28 20:00	8192	--sha-w-	c:\windows\Users\Default\NTUSER.DAT
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
2009-08-17 17:54	564624	----a-w-	c:\progra~1\MICROS~3\Office14\URLREDIR.DLL

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmpcSys"="c:\program files\Packard Bell\SetUpMyPC\SmpSys.exe" [2008-02-04 1038136]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2010-03-03 323392]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-01-14 1688872]
"ManyCam"="c:\program files\ManyCam 2.4\ManyCam.exe" [2009-12-19 1824040]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2010-04-29 3220912]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-05-06 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-05-07 178712]
"HControlUser"="c:\program files\ATK Hotkey\HcontrolUser.exe" [2008-01-11 98304]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"RtHDVCpl"="RtHDVCpl.exe" [2008-06-13 6183456]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-06 1041704]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-11-24 30192]
"toolbar_eula_launcher"="c:\program files\Packard Bell\GOOGLE_EULA\EULALauncher.exe" [2007-02-20 28672]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2009-08-17 85888]
"Luxand Blink!"="c:\program files\Luxand\Blink!\LuxandBlinkTray.exe" [2010-02-09 6844728]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2010-05-06 126976]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Run Google Web Accelerator.lnk - c:\program files\Google\Web Accelerator\GoogleWebAccWarden.exe [2007-7-9 1134592]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~3\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):31,60,76,c3,6d,2c,ca,01

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2881880658-3555428079-2209020445-1000]
"EnableNotifications"=dword:00000001
"EnableNotificationsRef"=dword:00000005

R0 BtHidBus;Bluetooth HID Bus Service;c:\windows\System32\Drivers\BtHidBus.sys [x]
R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-11-24 691696]
R2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 135664]
R3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\system32\Drivers\btnetBus.sys [2008-12-07 30088]
R3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2009-11-24 30192]
R3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\Drivers\IvtBtBus.sys [x]
R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2008-10-29 7680]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2009-08-21 30510960]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2009-08-21 4639136]
R3 usbanyka;USB Web Camera;c:\windows\system32\DRIVERS\UsbAnyka.sys [2007-11-13 17536]
R3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\system32\DRIVERS\ZTEusbnet.sys [2008-10-13 110080]
R3 ZTEusbvoice;ZTE VoUSB Port;c:\windows\system32\DRIVERS\ZTEusbvoice.sys [2008-10-15 104960]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2010-02-05 64288]
S1 aswSP;avast! Self Protection; [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-09-15 20560]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [2009-09-15 53328]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2010-05-06 1285864]
S2 ServiceSFRABCD;Service SFR Gestionnaire Connexion;c:\program files\SFR\Gestionnaire de Connexion SFR\SFRABCDService.exe [2009-09-01 657024]
S3 itecir;ITECIR Infrared Receiver;c:\windows\system32\DRIVERS\itecir.sys [2007-12-18 54784]
S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam.sys [2008-01-14 21632]
S3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-06-25 3662848]
S3 X10Hid;X10 Hid Device;c:\windows\system32\Drivers\x10hid.sys [2006-11-17 13976]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs	REG_MULTI_SZ   	BthServ
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
HPService	REG_MULTI_SZ   	HPSLPSVC
.
Contenu du dossier 'Tâches planifiées'

2010-05-11 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-05 00:48]

2010-05-11 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-07-28 14:10]

2010-05-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 00:35]

2010-05-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 00:35]

2010-05-11 c:\windows\Tasks\User_Feed_Synchronization-{49B6D35B-DB48-4A59-BDD5-455EE97F972C}.job
- c:\windows\system32\msfeedssync.exe [2010-03-31 04:54]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: Se&nd to OneNote - /105
IE: Télécharger avec IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Télécharger le contenu de video FLV avec IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Télécharger tous les liens avec IDM - c:\program files\Internet Download Manager\IEGetAll.htm
Trusted Zone: betclic.fr\www
.
- - - - ORPHELINS SUPPRIMES - - - -

WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)

yohanaldo · Answer

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-11 17:15
Windows 6.0.6002 Service Pack 2 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,40,ea,73,67,bf,83,9f,41,a8,fa,f6,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,40,ea,73,67,bf,83,9f,41,a8,fa,f6,\

[HKEY_USERS\S-1-5-21-2881880658-3555428079-2209020445-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:23,37,f5,99,51,aa,ef,0b,25,59,a1,d1,7a,71,d9,86,41,cf,68,9f,47,80,75,
   5a,29,d3,0f,e0,ca,5f,81,03,e4,ea,2d,16,44,98,f4,8f,a9,31,5e,94,8f,6c,7c,0e,\
"??"=hex:04,35,44,e7,7f,61,2a,34,d3,f0,20,a9,b2,d9,12,0d

[HKEY_USERS\S-1-5-21-2881880658-3555428079-2209020445-1000\Software\SecuROM\License information*]
@Allowed: (Read) (RestrictedCode)
"datasecu"=hex:58,4a,f2,18,36,5c,c1,ce,33,00,35,97,f7,17,99,ef,00,96,3e,cc,e8,
   be,ed,dd,ca,26,1b,dc,64,d4,85,43,5d,88,ec,54,d8,ee,f9,7d,0d,04,f2,c3,6b,67,\
"rkeysecu"=hex:51,ba,a5,5f,f1,6e,0d,dd,91,7a,5f,be,a6,52,d6,a3

[HKEY_USERS\S-1-5-21-2881880658-3555428079-2209020445-1000_Classes\CLSID\{3caa67b9-aa67-4c61-bb45-4ac0ac5f65ab}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:00000081
"Therad"=dword:00000008

[HKEY_USERS\S-1-5-21-2881880658-3555428079-2209020445-1000_Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"scansk"=hex(0):5e,a0,40,d4,63,37,5b,c6,f6,91,86,88,c3,57,e4,6e,53,e8,41,17,fc,
   1b,b8,e2,0d,08,40,c5,cd,e6,ce,19,4d,20,2f,86,c0,36,16,fc,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Heure de fin: 2010-05-11  17:20:37
ComboFix-quarantined-files.txt  2010-05-11 15:20

Avant-CF: 27 887 693 824 octets libres
Après-CF: 28 018 249 728 octets libres

- - End Of File - - 91D81194489F3032CA37A609754580BF

dédétraqué · Answer

Salut yohanaldo


Comment va le PC maintenant...


@++   :)

yohanaldo · Answer

Re dédétraqué

il va bcp mieux, c'est génial je vois pas comment je pourrai te rendre l'appareil mais je te suis vraiment tres reconnaissant

Tu va aider plein de gens avec ton savoir

Merci encore

dédétraqué · Answer

Salut yohanaldo


Bien de rien, pour des raisons de sécurité et surtout pour garder ton PC propre, on va désactiver la restauration système sur tous les lecteurs :

Tutoriel Vista : https://www.commentcamarche.net/faq/13214-vista-desactiver-reactiver-la-restauration-systeme-de-vista


-----


On va faire un ménage des outils téléchargés pour la désinfection, télécharge Tools Cleaner sur le bureau :

http://pc-system.fr/


- Faire un clic droit sur ToolsCleaner2.exe sur le bureau et choisi "Exécuter en tant qu'administrateur".
- Clique sur Recherche et laisse le scan agir.
- Clique sur Suppression pour finaliser.
- Tu peux, si tu le souhaites, te servir des Options facultatives.
- Clique sur Quitter pour obtenir le rapport.
- Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).
- Si des outils restes après le passage de Tools Cleaner, tu pourras les supprimer manuellement ainsi que tous les rapports qui on été généré lors de la désinfection.


-----


Important de mettre à jour Windows et tes logiciels :
Mettre Windows(catégories critique, Services Pack et Services Release) à jour : http://www.windowsupdate.com/windowsupdate/v6/default.aspx

Faire un scan de vulnérabilités afin de vérifier que tes logiciels soit à jour sans failles de sécurités et mettre à jour :
https://www.malekal.com/tester-la-vulnerabilite-de-son-systeme-2/

Faire un ménage des fichiers inutiles et de la base de registre : 
https://www.malekal.com/tutoriel-ccleaner/

Dis moi quand cela est fais où si tu as des soucis et on passe à la résolution du sujet par la suite.


@++ :)

yohanaldo · Answer

Bonjour dédétraqué, voici le rapport de ToolsCleaner, j'ai egalement effectué toutes les operations que tu m'as indiqué

merci  :)

[ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ]

--> Recherche: 

C:\Combofix.txt: trouvé !
C:\UsbFix.txt: trouvé !
C:\Combofix: trouvé !
C:\Qoobox: trouvé !
C:\UsbFix: trouvé !
C:\Rsit: trouvé !
C:\Program Files\Trend Micro\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\hijackthis.log: trouvé !
C:\Qoobox\Quarantine\catchme.log: trouvé !
C:\UsbFix\UsbFix.txt: trouvé !
C:\Users\yohan\Desktop\Rsit.exe: trouvé !
C:\Users\yohan\Documents\Downloads\Programs\ComboFix.exe: trouvé !
C:\Windows\msnfix.txt: trouvé !
C:\Windows\mbr.exe: trouvé !

---------------------------------
--> Suppression: 

C:\Program Files\Trend Micro\HijackThis.exe: supprimé !
C:\Users\yohan\Documents\Downloads\Programs\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Combofix.txt: supprimé !
C:\UsbFix.txt: supprimé !
C:\Program Files\Trend Micro\hijackthis.log: supprimé !
C:\Qoobox\Quarantine\catchme.log: supprimé !
C:\UsbFix\UsbFix.txt: supprimé !
C:\Users\yohan\Desktop\Rsit.exe: supprimé !
C:\Windows\msnfix.txt: supprimé !
C:\Windows\mbr.exe: supprimé !
C:\Combofix: supprimé !
C:\Qoobox: supprimé !
C:\UsbFix: supprimé !
C:\Rsit: supprimé !

dédétraqué · Answer

Salut yohanaldo


Bien de rien, je te donne quelques consignes de sécurité :

-  Windows Update  parfaitement à jour http://www.windowsupdate.com/windowsupdate/v6/default.aspx (catégories critique, Services Pack et Services Release)
- pare-feu bien paramétré, je te conseil ZoneAlarm : 
https://www.malekal.com/tutoriel-zonealarm-firewall/
- antivirus bien paramétré et mis à jour régulièrement (quotidiennement s'il le faut) avec un scan complet régulier (journalier s'il le faut).
- une attitude prudente vis à vis de la navigation (pas de sites douteux : cracks, warez, sexe...) et vis à vis de la messagerie (fichiers joints aux messages doivent être scannés avant d'être ouverts)
- pas de téléchargement illégal, qui est le principal facteur d'infection (µTorrent, BitTorrent, eMule, Limewire, etc..)   https://forum.malekal.com/viewtopic.php?t=893&start=
- une attitude vigilante (être à l'affût d'un fonctionnement inhabituel de son système)
- nettoyage hebdomadaire du système (suppression des fichiers inutiles, nettoyage de la base de registre, scandisk, defrag)
- scan hebdomadaire antispyware, je conseil MalwareByte's Anti-Malware :
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
- un contrôle régulier de la console JAVA pour s'assurer qu'elle est à jour :
https://www.java.com/en/download/uninstalltool.jsp 
- faire régulièrement un scan de vulnérabilités afin de vérifier que tes logiciels soit à jour sans failles de sécurités :
https://www.malekal.com/tester-la-vulnerabilite-de-son-systeme-2/


De bonne lecture si tu veux en savoir plus sur la sécurité et le fonctionnement de Windows :
http://www.malekal.com/menu_windows_general.php
http://www.malekal.com/menu_windows_securite.php

Si tu considères ton problème comme résolu, tu pourras mettre en résolu :
https://www.commentcamarche.net/infos/25917-marquer-un-fil-de-discussion-comme-etant-resolu/

Bonne journée/soirée et bon surf   


@++  :)

yohanaldo · Answer

Salut dédétraqué je vais poster le probleme comme résolu, je conserve ton dernier post en favori pour le consulter de temps en temps, et surtout


un grand MERCIIIIIIIIIIIIIIIIIIIIIIIIIIII !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

dédétraqué · Answer

Salut yohanaldo 


Bien de rien, bon Week end


@++   :)

coachkpn1 · Answer

coucou,
je vois qu'il y a moyen de trouver une solution avec des pro comme vous!
alors j'ai identiquement le même problème. Google me redirectionne vers d'autres sites etc etc ensuite pub pour un anti virus! attention votre pc est infecté etc etc.
donc voici mon rapport usbfix:

############################## | UsbFix 7.019 | [Recherche]

Utilisateur: Christophe (Administrateur) # PC-DE-COACH [PACKARD BELL BV EasyNote MH45]
Mis à jour le 03/08/10 par El Desaparecido / C_XX
Lancé à 22:16:10 | 09/08/2010
Site Web: http://pagesperso-orange.fr/NosTools/index.html
Contact: FindyKill.Contact@gmail.com

CPU: Pentium(R) Dual-Core CPU T4200 @ 2.00GHz
CPU 2: Pentium(R) Dual-Core CPU T4200 @ 2.00GHz
Microsoft® Windows Vista(TM) Édition Familiale Basique  (6.0.6002 32-Bit) # Service Pack 2
Internet Explorer 8.0.6001.18882

Pare-feu Windows: Activé
RAM -> 3000 Mo 
C:\ (%systemdrive%) -> Disque fixe # 453 Go (183 Go libre(s) - 40%) [OS] # NTFS
D:\ -> CD-ROM

################## | Éléments infectieux |


################## | Registre |


################## | Mountpoints2 |

HKCU\.\.\.\.\Explorer\MountPoints2\{afdf8d3d-ba1a-11de-a056-00238b86c625}
Shell\AutoRun\Command = E:\setup_vmc_lite.exe /checkApplicationPresence

HKCU\.\.\.\.\Explorer\MountPoints2\{bbddb0d8-20ea-11df-a313-00238b86c625}
Shell\AutoRun\Command = E:\Setup.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{cffa498c-1114-11df-ac82-00238b86c625}
Shell\AutoRun\Command = E:\DPFMate.exe


################## | Vaccin |

(!) Cet ordinateur n'est pas vacciné!

################## | E.O.F |

coachkpn1 · Answer

Et voici après la suppression...

############################## | UsbFix 7.019 | [Suppression]

Utilisateur: Christophe (Administrateur) # PC-DE-COACH [PACKARD BELL BV EasyNote MH45]
Mis à jour le 03/08/10 par El Desaparecido / C_XX
Lancé à 22:33:45 | 09/08/2010
Site Web: http://pagesperso-orange.fr/NosTools/index.html
Contact: FindyKill.Contact@gmail.com

CPU: Pentium(R) Dual-Core CPU T4200 @ 2.00GHz
CPU 2: Pentium(R) Dual-Core CPU T4200 @ 2.00GHz
Microsoft® Windows Vista(TM) Édition Familiale Basique  (6.0.6002 32-Bit) # Service Pack 2
Internet Explorer 8.0.6001.18882

Pare-feu Windows: Activé
RAM -> 3000 Mo 
C:\ (%systemdrive%) -> Disque fixe # 453 Go (207 Go libre(s) - 46%) [OS] # NTFS
D:\ -> CD-ROM
E:\ -> Disque fixe # 466 Go (257 Go libre(s) - 55%) [Intenso] # FAT32

################## | Éléments infectieux |


################## | Registre |


################## | Mountpoints2 |

Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{afdf8d3d-ba1a-11de-a056-00238b86c625}
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{bbddb0d8-20ea-11df-a313-00238b86c625}
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{cffa498c-1114-11df-ac82-00238b86c625}

################## | Listing |

[09/08/2010 - 22:36:11 | SHD ] 	C:\$Recycle.Bin
[29/05/2009 - 21:21:40 | HD ] 	C:\ACER
[01/06/2009 - 22:36:00 | A | 61762560] 	C:\audio0.ac3
[01/06/2009 - 22:37:02 | A | 370575404] 	C:\audio0.wav
[18/09/2006 - 23:43:36 | A | 24] 	C:\autoexec.bat
[05/12/2009 - 10:04:11 | SHD ] 	C:\Boot
[11/04/2009 - 08:36:36 | RASH | 333257] 	C:\bootmgr
[10/01/2009 - 22:13:08 | RAS | 8192] 	C:\BOOTSECT.BAK
[31/08/2009 - 07:53:11 | D ] 	C:\c53dc37fd9ef829eb2650e4e3a55
[18/09/2006 - 23:43:37 | A | 10] 	C:\config.sys
[02/11/2006 - 14:59:44 | SHD ] 	C:\Documents and Settings
[01/06/2009 - 22:30:48 | A | 347] 	C:\finfos.txt
[10/01/2009 - 14:26:47 | D ] 	C:\Intel
[01/06/2009 - 11:16:11 | RASH | 0] 	C:\IO.SYS
[01/06/2009 - 11:16:11 | RASH | 0] 	C:\MSDOS.SYS
[27/06/2009 - 16:45:04 | RHD ] 	C:\MSOCache
[01/06/2009 - 12:29:16 | D ] 	C:\MWASPI
[29/02/2004 - 17:44:34 | A | 52576] 	C:\orange.bmp
[02/08/2010 - 06:35:02 | ASH | 3460280320] 	C:\pagefile.sys
[21/01/2008 - 04:43:50 | D ] 	C:\PerfLogs
[11/06/2009 - 16:46:13 | D ] 	C:\platodvdripper
[04/08/2010 - 17:08:30 | D ] 	C:\Program Files
[22/04/2010 - 21:35:35 | HD ] 	C:\ProgramData
[01/06/2009 - 18:44:49 | D ] 	C:\Ri4m_TMP
[22/03/2010 - 22:30:42 | A | 333] 	C:\rollback.ini
[09/08/2010 - 15:49:02 | SHD ] 	C:\System Volume Information
[09/08/2010 - 22:36:11 | D ] 	C:\UsbFix
[09/08/2010 - 22:33:55 | A | 2524] 	C:\UsbFix.txt
[29/05/2009 - 16:23:12 | RD ] 	C:\Users
[01/06/2009 - 20:43:14 | A | 140090] 	C:\VTS_01_1.d2v
[09/08/2010 - 21:45:56 | D ] 	C:\Windows
[02/06/2009 - 01:22:09 | A | 771944] 	C:\zumba test 3.avi.A.index
[02/06/2009 - 01:22:09 | A | 772144] 	C:\zumba test 3.avi.index

################## | Vaccin |

C:\Autorun.inf -> Dossier créé par UsbFix (El Desaparecido & C_XX)

################## | E.O.F |

coachkpn1 · Answer

Impossible de faire la suite, télécharger malwarebytes

Petit problème... Internet Explorer n'est pas parvenu à trouver la page www.malwarebytes.org.
Suggestions :
*Rechercher sur Google :

vais essayer de trouver ailleur...

coachkpn1 · Answer

voilà ai réussi à trouver malwarebytes, voici le résultat:
32 fichiers infectés, j'ai supprimé ces fichiers.

Ci-dessous le rapport:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4411

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18882

10/08/2010 9:46:59
mbam-log-2010-08-10 (09-46-59).txt

Type d'examen: Examen complet (C:\|E:\|)
Elément(s) analysé(s): 326381
Temps écoulé: 1 heure(s), 16 minute(s), 17 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 6
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 8
Fichier(s) infecté(s): 76

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
c:\Windows\System32\erokosvc.dll (Worm.KoobFace) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cpqoko6 (Worm.KoobFace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\RegistryDoktorFrNE (Rogue.RegistryDoctor) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\SmartShopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RegistryDoktor_is1 (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\SmartShopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\apto6ko (Worm.KoobFace) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost	apisrvs (Worm.KoobFace) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\ProgramData\15636021 (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1 (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\smartshopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
C:\Program Files\smartshopper\Bin (Adware.SmartShopper) -> Quarantined and deleted successfully.
C:\Program Files\smartshopper\Bin\2.5.0 (Adware.SmartShopper) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RegistryDoktor 4.1 (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SmartShopper (Adware.SmartShopper) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
c:\Windows\System32\erokosvc.dll (Worm.KoobFace) -> Delete on reboot.
C:\Program Files\RegistryDoktor 4.1\Cl.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\RegistryDoktor.exe (Rogue.AntiMalwarePro) -> Quarantined and deleted successfully.
C:\Users\Christophe\AppData\Localdr_1268943333.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Users\Christophe\AppData\Localdr_1269383642.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Users\Christophe\AppData\Local\Temp\_2B17.tmp (Trojan.Lukicsel) -> Quarantined and deleted successfully.
C:\Users\Christophe\Desktop\o.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\Christophe\Documents\programme\WinRAR.3.30-fr\WinRAR.3.30.FR\patch-WinRAR 3.30\WinRAR 3.30.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully.
C:\Windows\bill104.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\imapioko.sys (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\EngineAP.dll (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\FolderPaths.txt (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\ScheduleAP.txt (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\Task.dat (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1	ask.xml (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\unins000.dat (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\unins000.exe (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\200812.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\200901.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\200902.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\200903.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\200904.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\200905.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\20090601.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\20090602.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\20090603.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\20090706.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\20090714.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\20090721.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\20090729.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\20090805.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\20090819.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\20090901.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\20090921.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\20091006.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\20091023.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\20091104.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\20091114.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\20091130.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\20091218.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\20091231.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\20100118.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\20100130.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\20100212.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\20100302.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\20100323.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\20100416.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\20100506.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\20100527.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\20100621.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\Program Files\RegistryDoktor 4.1\definitions\20100630.cab (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RegistryDoktor 4.1\Désinstaller Registry Doktor 4.1.lnk (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RegistryDoktor 4.1\Registry Doktor 4.1.lnk (Rogue.RegistryDoktor) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SmartShopper\SmartShopper - Comapre product prices.lnk (Adware.SmartShopper) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SmartShopper\SmartShopper - Compare travel rate.lnk (Adware.SmartShopper) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SmartShopper\SmartShopper Help.lnk (Adware.SmartShopper) -> Quarantined and deleted successfully.
C:\Users\Public\Desktop\Registry Doktor 4.1.lnk (Rogue.RegistryDoctor) -> Quarantined and deleted successfully.
C:\Windows\System32\crt.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\Windows\System32\cryptnet32.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Windows\System32\shimg.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\Christophe\Local Settings\Application Datadr_1268930579.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Users\Christophe\Local Settings\Application Datadr_1268930584.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Users\Christophe\Local Settings\Application Datadr_1268943333.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Users\Christophe\Local Settings\Application Datadr_1268943638.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Users\Christophe\Local Settings\Application Datadr_1268943642.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Users\Christophe\Local Settings\Application Datadr_1269274834.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Users\Christophe\Local Settings\Application Datadr_1269287305.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Users\Christophe\Local Settings\Application Datadr_1269287311.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Users\Christophe\Local Settings\Application Datadr_1269287315.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Users\Christophe\Local Settings\Application Datadr_1269287319.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Users\Christophe\Local Settings\Application Datadr_1269287323.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Users\Christophe\Local Settings\Application Datadr_1269383642.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Windows\bk20856.dat (KoobFace.Trace) -> Quarantined and deleted successfully.
C:\Windows\bk23567.dat (KoobFace.Trace) -> Quarantined and deleted successfully.
C:\Windows\fdgg34353edfgdfdf (KoobFace.Trace) -> Quarantined and deleted successfully.
C:\Windows\ligh (Koobface.Trace) -> Quarantined and deleted successfully.

coachkpn1 · Answer

voici maintenant le rapport Log txt de Hijack this:


Logfile of random's system information tool 1.08 (written by random/random)
Run by Christophe at 2010-08-10 10:02:44
Microsoft® Windows Vista(TM) Édition Familiale Basique  Service Pack 2
System drive C: has 216 GB (47%) free of 464 GB
Total RAM: 3000 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:03:17, on 10/08/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18882)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\PACKARD BELL\SetUpMyPC\SmpSys.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\CyberLink\PowerCinema\PCMAgent.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\CLML\CLMLSvc.exe
C:\Program Files\CyberLink\PlayMovie\PMVService.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Belgium Identity Card\beid35gui.exe
C:\Program Files\HP\HP Software Update\hpwuschd2.exe
C:\Program Files\Fighters\VIRUSfighter\vfproTray.exe
C:\Program Files\Fighters\SPAMfighter\sfagent.exe
C:\Program Files\Adobe\Reader 9.0\Readereader_sl.exe
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Nokia\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe
C:\Windows\system32\wuauclt.exe
C:\Users\Christophe\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G342BN0G\RSIT[1].exe
C:\Program Files	rend micro\Christophe.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O1 - Hosts: ::1 localhost
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: LimeWire Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetupMyPC\SmpSys.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [PCMAgent] "C:\Program Files\CyberLink\PowerCinema\PCMAgent.exe"
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\CyberLink\PowerCinema\Kernel\CLML\CLMLSvc.exe"
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\CyberLink\PlayMovie\PMVService.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [beid] "C:\Program Files\Belgium Identity Card\beid35gui.exe" /startup
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [NokiaMusic FastStart] "C:\Program Files\Nokia\Ovi Player\NokiaOviPlayer.exe" /command:faststart
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SWPROguard] C:\Program Files\Fighters\SPYWAREfighter\SWPROTray.exe
O4 - HKLM\..\Run: [VFPROguard] C:\Program Files\Fighters\VIRUSfighter\VFPROTray.exe
O4 - HKLM\..\Run: [sfagent] C:\Program Files\Fighters\SPAMfighter\sfagent.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\PACKARD BELL\SetUpMyPC\SmpSys.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [RegDokFRScheduler] C:\Program Files\RegistryDoktor 4.1\RegistryDoktor.exe SCHEDULER
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

coachkpn1 · Answer

part II


O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Afficher ou masquer l'HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: cryptnet32 - cryptnet32.dll (file missing)
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: @%SystemRoot%\system32\aelupsvc.dll,-1 (AeLookupSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe
O23 - Service: @%systemroot%\system32\appinfo.dll,-100 (Appinfo) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: @%SystemRoot%\system32\audiosrv.dll,-204 (AudioEndpointBuilder) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\audiosrv.dll,-200 (Audiosrv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: AV Engine Scanning Service - Preventon Technologies Limited - C:/Program Files/Common Files/Common Toolkit Suite/AVEngine/AVScanningService.exe
O23 - Service: @%SystemRoot%\system32\bfe.dll,-1001 (BFE) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\qmgr.dll,-1000 (BITS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @%systemroot%\system32\browser.dll,-100 (Browser) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\bthserv.dll,-101 (BthServ) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\certprop.dll,-11 (CertPropSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Common Toolkit Service - SPAMfighter - C:\Program Files\Common Files\Common Toolkit Suite\FighterSuiteService.exe
O23 - Service: @%SystemRoot%\system32\cryptsvc.dll,-1001 (CryptSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @oleres.dll,-5012 (DcomLaunch) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe
O23 - Service: @%SystemRoot%\system32\dhcpcsvc.dll,-100 (Dhcp) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\dnsapi.dll,-101 (Dnscache) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\dot3svc.dll,-1102 (dot3svc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\dps.dll,-500 (DPS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\eapsvc.dll,-1 (EapHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\emdmgmt.dll,-1000 (EMDMgmt) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Packard Bell\Packard Bell Recovery Management\Service\ETService.exe
O23 - Service: @%SystemRoot%\system32\wevtsvc.dll,-200 (Eventlog) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @comres.dll,-2450 (EventSystem) - Unknown owner - C:\Windows\system32\svchost.exe

coachkpn1 · Answer

Part III


O23 - Service: Easybits Shared Services for Windows (ezSharedSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\fdPHost.dll,-100 (fdPHost) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\fdrespub.dll,-100 (FDResPub) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Desktop Manager 5.9.911.3589 (GoogleDesktopManager-110309-193829) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: @gpapi.dll,-112 (gpsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Service Google Update (gupdate1c9e2b02172f5b6) (gupdate1c9e2b02172f5b6) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: @%SystemRoot%\System32\hidserv.dll,-101 (hidserv) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\kmsvc.dll,-6 (hkmsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: hpqcxs08 - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Service HP CUE DeviceDiscovery (hpqddsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: HP Network Devices Support (HPSLPSVC) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\ikeext.dll,-501 (IKEEXT) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\IPBusEnum.dll,-102 (IPBusEnum) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\iphlpsvc.dll,-200 (iphlpsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe
O23 - Service: @comres.dll,-2946 (KtmRm) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\srvsvc.dll,-100 (LanmanServer) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\wkssvc.dll,-100 (LanmanWorkstation) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\lltdres.dll,-1 (lltdsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\lmhsvc.dll,-101 (lmhosts) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\mmcss.dll,-100 (MMCSS) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\FirewallAPI.dll,-23090 (MpsSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe
O23 - Service: @%SystemRoot%\system32\iscsidsc.dll,-5000 (MSiSCSI) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\msimsg.dll,-27 (msiserver) - Unknown owner - C:\Windows\system32\msiexec.exe
O23 - Service: @%SystemRoot%\system32\qagentrt.dll,-6 (napagent) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: Net Driver HPZ12 - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32
etlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe
O23 - Service: @%SystemRoot%\system32
etman.dll,-109 (Netman) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32
etprof.dll,-246 (netprofm) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32
lasvc.dll,-1 (NlaSvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Norton Internet Security - Nero AG - (no file)
O23 - Service: @%SystemRoot%\system32
sisvc.dll,-200 (nsi) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\p2psvc.dll,-8004 (p2pimsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\p2psvc.dll,-8006 (p2psvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\pcasvc.dll,-1 (PcaSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\pla.dll,-500 (pla) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: @%SystemRoot%\system32\umpnpmgr.dll,-100 (PlugPlay) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Pml Driver HPZ12 - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\p2psvc.dll,-8002 (PNRPAutoReg) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\p2psvc.dll,-8000 (PNRPsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\polstore.dll,-5010 (PolicyAgent) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\profsvc.dll,-300 (ProfSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32asauto.dll,-200 (RasAuto) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32asmans.dll,-200 (RasMan) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @regsvc.dll,-1 (RemoteRegistry) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe
O23 - Service: @oleres.dll,-5010 (RpcSs) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe
O23 - Service: @%SystemRoot%\System32\SCardSvr.dll,-1 (SCardSvr) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\schedsvc.dll,-100 (Schedule) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\certprop.dll,-13 (SCPolicySvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\sdrsvc.dll,-107 (SDRSVC) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\Sens.dll,-200 (SENS) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: @%SystemRoot%\System32\SessEnv.dll,-1026 (SessionEnv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\shsvcs.dll,-12288 (ShellHWDetection) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe
O23 - Service: @%SystemRoot%\system32\SLUINotify.dll,-103 (SLUINotify) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe
O23 - Service: SPAMfighter Update Service - SPAMfighter ApS - C:\Program Files\Fighters\SPAMfighter\sfus.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe
O23 - Service: @%systemroot%\system32\ssdpsrv.dll,-100 (SSDPSRV) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\sstpsvc.dll,-200 (SstpSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wiaservc.dll,-9 (stisvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\swprv.dll,-103 (swprv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\sysmain.dll,-1000 (SysMain) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\TabSvc.dll,-100 (TabletInputService) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32	apisrv.dll,-10100 (TapiSrv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32	bssvc.dll,-100 (TBS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32	ermsrv.dll,-268 (TermService) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\shsvcs.dll,-8192 (Themes) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\mmcss.dll,-102 (THREADORDER) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32	rkwks.dll,-1 (TrkWks) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\servicing\TrustedInstaller.exe,-100 (TrustedInstaller) - Unknown owner - C:\Windows\servicing\TrustedInstaller.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe
O23 - Service: @%systemroot%\system32\upnphost.dll,-213 (upnphost) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\dwm.exe,-2000 (UxSms) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe
O23 - Service: @%SystemRoot%\system32\w32time.dll,-200 (W32Time) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wcncsvc.dll,-3 (wcncsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\WcsPlugInService.dll,-200 (WcsPlugInService) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\wdi.dll,-502 (WdiServiceHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\wdi.dll,-500 (WdiSystemHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\webclnt.dll,-100 (WebClient) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wecsvc.dll,-200 (Wecsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wercplsupport.dll,-101 (wercplsupport) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wersvc.dll,-100 (WerSvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%ProgramFiles%\Windows Defender\MsMpRes.dll,-103 (WinDefend) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\winhttp.dll,-100 (WinHttpAutoProxySvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wbem\wmisvc.dll,-205 (Winmgmt) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wsmsvc.dll,-101 (WinRM) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wlansvc.dll,-257 (Wlansvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\wmpnetwk.exe
O23 - Service: @%SystemRoot%\system32\wpcsvc.dll,-100 (WPCSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wpdbusenum.dll,-100 (WPDBusEnum) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wscsvc.dll,-200 (wscsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\SearchIndexer.exe,-103 (WSearch) - Unknown owner - C:\Windows\system32\SearchIndexer.exe
O23 - Service: @%systemroot%\system32\wuaueng.dll,-105 (wuauserv) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wudfsvc.dll,-1000 (wudfsvc) - Unknown owner - C:\Windows\system32\svchost.exe

coachkpn1 · Answer

Part IV

======Scheduled tasks folder======

C:\Windows	asks\Google Software Updater.job
C:\Windows	asks\GoogleUpdateTaskMachineCore.job
C:\Windows	asks\GoogleUpdateTaskMachineUA.job
C:\Windows	asks\ParetoLogic Registration.job
C:\Windows	asks\Registry_Doktor.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0347C33E-8762-4905-BF09-768834316C61}]
HP Print Enhancer - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-10-22 328248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-07-14 278192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll [2010-07-14 814648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
LimeWire Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2010-03-28 1196936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-05-03 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}]
HP Smart BHO Class - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-10-22 517688]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{D4027C7F-154A-4066-A1AD-4243D8127440} - LimeWire Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2010-03-28 1196936]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-07-14 278192]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2007-06-08 894512]
"Google Desktop Search"=C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2010-03-23 30192]
"SmpcSys"=C:\Program Files\Packard Bell\SetupMyPC\SmpSys.exe [2008-07-07 1038136]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-08-04 6265376]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2008-08-12 150040]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2008-08-12 170520]
"Persistence"=C:\Windows\system32\igfxpers.exe [2008-08-12 145944]
"eRecoveryService"= []
"PCMAgent"=C:\Program Files\CyberLink\PowerCinema\PCMAgent.exe [2008-03-21 143360]
"CLMLServer"=C:\Program Files\CyberLink\PowerCinema\Kernel\CLML\CLMLSvc.exe [2008-04-11 196608]
"PlayMovie"=C:\Program Files\CyberLink\PlayMovie\PMVService.exe [2008-03-31 172032]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"beid"=C:\Program Files\Belgium Identity Card\beid35gui.exe [2009-06-04 2056192]
"AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [2010-03-16 47392]
"NokiaMusic FastStart"=C:\Program Files\Nokia\Ovi Player\NokiaOviPlayer.exe [2010-03-04 2192672]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2010-06-09 49208]
""= []
"SWPROguard"=C:\Program Files\Fighters\SPYWAREfighter\SWPROTray.exe [2010-03-11 586376]
"VFPROguard"=C:\Program Files\Fighters\VIRUSfighter\VFPROTray.exe [2010-03-11 684680]
"sfagent"=C:\Program Files\Fighters\SPAMfighter\sfagent.exe [2010-02-18 386696]
"QuickTime Task"=C:\Program Files\QuickTime Alternative\QTTask.exe [2010-03-17 421888]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]
"NokiaMServer"=C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup []
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2010-07-21 141608]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SmpcSys"=C:\Program Files\PACKARD BELL\SetUpMyPC\SmpSys.exe [2008-07-07 1038136]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [2008-04-28 1828136]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-05-29 68856]
"PC Suite Tray"=C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe [2009-06-25 1414144]
"RegDokFRScheduler"=C:\Program Files\RegistryDoktor 4.1\RegistryDoktor.exe SCHEDULER []
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-21 202240]

coachkpn1 · Answer

Part V

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Users\Christophe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet32]
cryptnet32.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2008-07-11 208896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=0
"NoDriveTypeAutoRun"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=0
"NoDriveAutoRun"=0
"NoDriveTypeAutoRun"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 3 months======

2010-08-10 10:02:45 ----D---- C:\Program Files	rend micro
2010-08-10 10:02:44 ----D---- C:sit
2010-08-10 10:02:15 ----D---- C:\Users\Christophe\AppData\Roaming\HPAppData
2010-08-09 23:00:11 ----D---- C:\Users\Christophe\AppData\Roaming\Malwarebytes
2010-08-09 23:00:04 ----A---- C:\Windows\system32\drivers\mbamswissarmy.sys
2010-08-09 23:00:03 ----D---- C:\ProgramData\Malwarebytes
2010-08-09 23:00:03 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-08-09 23:00:03 ----A---- C:\Windows\system32\drivers\mbam.sys
2010-08-09 22:36:14 ----RASHD---- C:\Autorun.inf
2010-08-09 22:33:45 ----A---- C:\UsbFix.txt
2010-08-09 22:15:29 ----D---- C:\UsbFix
2010-08-04 17:08:30 ----D---- C:\Program Files\iPod
2010-07-14 15:35:05 ----A---- C:\Windows\system32\xinput1_1.dll
2010-07-14 15:35:03 ----A---- C:\Windows\system32\xactengine2_1.dll
2010-07-14 15:34:57 ----A---- C:\Windows\system32\xactengine2_0.dll
2010-07-14 15:34:57 ----A---- C:\Windows\system32\x3daudio1_0.dll
2010-07-14 15:34:57 ----A---- C:\Windows\system32\d3dx9_29.dll
2010-07-14 15:34:56 ----A---- C:\Windows\system32\d3dx9_27.dll
2010-07-14 15:34:56 ----A---- C:\Windows\system32\d3dx9_26.dll
2010-07-14 15:34:56 ----A---- C:\Windows\system32\d3dx9_25.dll
2010-07-14 15:34:56 ----A---- C:\Windows\system32\d3dx9_24.dll
2010-07-14 15:29:00 ----D---- C:\Program Files\Ubisoft
2010-06-27 14:32:42 ----A---- C:\Windows\system32\drivers\pccsmcfd.sys
2010-06-12 16:36:36 ----D---- C:\Windows\system32\Adobe
2010-05-27 16:17:51 ----A---- C:\Windows\system32\drivers\ActionReplayDS.sys
2010-05-27 16:16:23 ----D---- C:\Program Files\Datel
2010-05-26 22:57:16 ----A---- C:\Windows\system32\javaws.exe
2010-05-26 22:57:16 ----A---- C:\Windows\system32\javaw.exe
2010-05-26 22:57:16 ----A---- C:\Windows\system32\java.exe
2010-05-26 22:57:16 ----A---- C:\Windows\system32\deployJava1.dll
2010-05-25 05:38:36 ----D---- C:\Program Files\Ask.com
2010-05-19 14:21:07 ----D---- C:\Users\Christophe\AppData\Roaming\Dofus.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
2010-05-19 14:18:37 ----D---- C:\Users\Christophe\AppData\Roaming\Reg.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
2010-05-19 14:18:37 ----D---- C:\Users\Christophe\AppData\Roaming\app
2010-05-19 14:18:34 ----D---- C:\Users\Christophe\AppData\Roaming\Dofus-2.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
2010-05-19 14:18:34 ----D---- C:\Users\Christophe\AppData\Roaming\Dofus 2
2010-05-18 22:09:22 ----D---- C:\Program Files\Dofus 2
2010-05-18 22:09:21 ----D---- C:\Program Files\Common Files\Adobe AIR
2010-05-18 16:35:16 ----A---- C:\Windows\system32\dns-sd.exe
2010-05-18 16:35:16 ----A---- C:\Windows\system32\dnssd.dll

======List of files/folders modified in the last 3 months======

2010-08-10 10:02:59 ----D---- C:\Users\Christophe\AppData\Roaming\LimeWire
2010-08-10 10:02:55 ----D---- C:\Windows\Prefetch
2010-08-10 10:02:47 ----D---- C:\Windows\Temp
2010-08-10 10:02:45 ----D---- C:\Program Files
2010-08-10 10:00:38 ----SHD---- C:\Windows\Installer
2010-08-10 09:58:55 ----D---- C:\Windows\Tasks
2010-08-10 09:56:49 ----D---- C:\Program Files\Common Files\Common Toolkit Suite
2010-08-10 09:56:24 ----D---- C:\Windows\system32\drivers
2010-08-10 09:56:24 ----D---- C:\Windows\System32
2010-08-10 09:55:21 ----D---- C:\Windows\Performance
2010-08-10 09:46:59 ----HD---- C:\ProgramData
2010-08-10 09:46:58 ----D---- C:\Windows
2010-08-10 08:13:58 ----SHD---- C:\System Volume Information
2010-08-09 22:36:11 ----SHD---- C:\$Recycle.Bin
2010-08-09 22:35:52 ----D---- C:\Windows\inf
2010-08-09 22:35:52 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-08-09 10:45:47 ----SD---- C:\Windows\Downloaded Program Files
2010-08-07 22:52:18 ----A---- C:\Windows\NeroDigital.ini
2010-08-04 17:09:03 ----D---- C:\Program Files\iTunes
2010-08-04 17:08:29 ----D---- C:\Program Files\Common Files\Apple
2010-07-14 20:17:35 ----HD---- C:\Program Files\InstallShield Installation Information
2010-07-14 20:06:08 ----D---- C:\ProgramData\Google
2010-07-14 15:35:03 ----RSD---- C:\Windows\assembly
2010-07-14 15:35:00 ----D---- C:\Windows\Microsoft.NET
2010-07-13 18:39:12 ----D---- C:\Users\Christophe\AppData\Roaming\HpUpdate
2010-06-29 00:00:16 ----D---- C:\Windows\system32\catroot2
2010-06-27 21:13:16 ----D---- C:\Windows\system32\catroot
2010-06-27 14:34:58 ----D---- C:\Windows\SoftwareDistribution
2010-06-27 14:34:55 ----D---- C:\Windows\system32\drivers\UMDF
2010-06-27 14:34:21 ----D---- C:\Windows\Globalization
2010-06-27 14:34:18 ----D---- C:\Program Files\Nokia
2010-06-27 14:34:02 ----RSD---- C:\Windows\Fonts
2010-06-27 14:33:39 ----D---- C:\Program Files\Common Files\Nokia
2010-06-27 14:33:10 ----D---- C:\Windows\winsxs
2010-06-27 14:32:42 ----DC---- C:\Windows\system32\DRVSTORE
2010-06-27 09:07:49 ----D---- C:\ProgramData\Adobe
2010-06-27 09:07:49 ----D---- C:\Program Files\Common Files\Adobe
2010-06-27 09:07:43 ----D---- C:\Program Files\Adobe
2010-06-20 13:36:43 ----A---- C:\Windows\win.ini
2010-06-20 13:35:52 ----D---- C:\Windows	wain_32
2010-06-20 13:32:34 ----D---- C:\Users\Christophe\AppData\Roaming\Apple Computer
2010-06-20 11:02:38 ----D---- C:\Program Files\Bonjour
2010-06-16 12:55:35 ----D---- C:\Windows\LiveKernelReports
2010-06-12 16:37:21 ----D---- C:\Windows\system32\Macromed
2010-06-02 20:16:04 ----SD---- C:\Users\Christophe\AppData\Roaming\Microsoft
2010-05-30 09:02:14 ----D---- C:\ProgramData\Common Toolkit Suite
2010-05-26 22:57:13 ----D---- C:\Program Files\Java
2010-05-25 05:38:41 ----D---- C:\Windows\system32\Tasks
2010-05-25 05:38:12 ----D---- C:\Program Files\LimeWire
2010-05-18 22:09:22 ----D---- C:\Users\Christophe\AppData\Roaming\Adobe
2010-05-18 22:09:21 ----D---- C:\Program Files\Common Files
2010-05-13 10:01:50 ----A---- C:\Windows\DVDShrink.txt
2010-05-13 09:55:33 ----D---- C:\Program Files\Google

coachkpn1 · Answer

Part VI:

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 PxHelp20;PxHelp20; C:\Windows\System32\Drivers\PxHelp20.sys [2009-01-10 43528]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; \??\C:\Program Files\CyberLink\PlayMovie\000.fcl [2008-03-31 41456]
R2 int15;int15; \??\C:\Windows\system32\drivers\int15.sys [2008-07-16 15392]
R2 NPF;NetGroup Packet Filter Driver; C:\Windows\system32\drivers
pf.sys [2009-10-21 50704]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2008-07-11 2381312]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-08-04 2161496]
R3 netr73;RT73 USB Wireless LAN Card Driver for Vista; C:\Windows\system32\DRIVERS
etr73.sys [2008-03-04 489984]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2008-08-06 124928]
R3 RTSTOR;Realtek USB 2.0 Card Reader; C:\Windows\system32\drivers\RTSTOR.SYS [2008-02-20 60416]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2007-06-08 187448]
R3 usbvideo;Périphérique vidéo USB (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-21 134016]
S1 SRTSP;SRTSP; \??\C:\Windows\system32\drivers\NIS\1000000.07D\SRTSP.SYS []
S1 SRTSPX;SRTSPX; \??\C:\Windows\system32\drivers\NIS\1000000.07D\SRTSPX.SYS []
S3 ACSSCR;ACR38 Smart Card Reader; C:\Windows\system32\DRIVERS\a38usbxp.sys [2004-04-30 24832]
S3 ActionReplayDS;ActionReplayDS; C:\Windows\System32\Drivers\ActionReplayDS.sys [2007-02-08 29184]
S3 AVFSFilter;AVFSFilter; C:\Windows\system32\DRIVERS\avfsfilter.sys [2010-03-11 10264]
S3 BthAvrcp;Profil AVRCP Bluetooth; C:\Windows\system32\DRIVERS\BthAvrcp.sys [2008-07-10 15872]
S3 BthEnum;Service d'énumérateur Bluetooth; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-04-11 22528]
S3 BthPan;Périphérique Bluetooth (réseau personnel); C:\Windows\system32\DRIVERS\bthpan.sys [2008-01-21 92160]
S3 BTHPORT;Pilote de port Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2009-04-11 507904]
S3 BTHUSB;Pilote USB radio Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2009-04-11 29696]
S3 Dot4;Pilote MS IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4.sys [2008-01-21 131584]
S3 Dot4Print;Pilote de classe Imprimante pour IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2008-01-21 16384]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2008-01-21 36864]
S3 drmkaud;Filtre de décodeur DRM (Noyau Microsoft); C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]
S3 HdAudAddService;Pilote de fonction UAA 1.1 Microsoft pour le service High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 MSKSSRV;Proxy de service de répartition Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Proxy d'horloge de répartition Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]
S3 MSPQM;Proxy de gestion de qualité de répartition Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]
S3 NAVENG;NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVENG.SYS []
S3 NAVEX15;NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVEX15.SYS []
S3 NETw5v32;Pilote de carte Intel(R) Wireless WiFi Link pour Windows Vista 32 bits ; C:\Windows\system32\DRIVERS\NETw5v32.sys [2008-04-28 3658752]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 PIXMCV;Victor Communication PIX-MCV Driver; C:\Windows\System32\Drivers\pixmcvc.sys [2004-06-03 33792]
S3 PIXMCVA;Victor PIX-MCV Audio Capture; C:\Windows\System32\Drivers\pixmcva.sys [2004-03-20 38144]
S3 PIXMCVV;Victor PIX-MCV Video Capture; C:\Windows\System32\Drivers\pixmcvv.sys [2004-03-27 32768]
S3 RFCOMM;Périphérique Bluetooth (TDI protocole RFCOMM); C:\Windows\system32\DRIVERSfcomm.sys [2009-04-11 148992]
S3 StillCam;Pilote d'appareil photo numérique série; C:\Windows\system32\DRIVERS\serscan.sys [2008-01-21 9216]
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2010-04-19 41984]
S3 usbaudio;Pilote USB audio (WDM); C:\Windows\system32\drivers\usbaudio.sys [2009-04-11 73216]
S3 USBCCID;Lecteur de cartes à puce USB; C:\Windows\system32\DRIVERS\usbccid.sys [2009-04-11 30208]
S3 usbscan;Pilote de scanneur USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-21 35328]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2010-06-10 144176]
R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2010-05-18 345376]
R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R2 Common Toolkit Service;Common Toolkit Service; C:\Program Files\Common Files\Common Toolkit Suite\FighterSuiteService.exe [2010-02-18 684680]
R2 ETService;Empowering Technology Service; C:\Program Files\Packard Bell\Packard Bell Recovery Management\Service\ETService.exe [2008-07-16 24576]
R2 ezSharedSvc;Easybits Shared Services for Windows; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R2 hpqddsvc;Service HP CUE DeviceDiscovery; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R2 HPSLPSVC;HP Network Devices Support; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2008-02-18 877864]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-21 21504]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\Windows\system32\IoctlSvc.exe [2006-12-19 81920]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-21 21504]
R2 SPAMfighter Update Service;SPAMfighter Update Service; C:\Program Files\Fighters\SPAMfighter\sfus.exe [2010-02-18 189064]
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R3 ServiceLayer;ServiceLayer; C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe [2010-02-26 652800]
S2 AV Engine Scanning Service;AV Engine Scanning Service; C:/Program Files/Common Files/Common Toolkit Suite/AVEngine/AVScanningService.exe []
S2 gupdate1c9e2b02172f5b6;Service Google Update (gupdate1c9e2b02172f5b6); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-06-01 133104]
S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-08-12 190448]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-01-10 654848]
S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2010-03-23 30192]
S3 iPod Service;Service de l'iPod; C:\Program Files\iPod\bin\iPodService.exe [2010-07-21 540968]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2008-04-28 529704]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

-----------------EOF-----------------

coachkpn1 · Answer

Voilà pour la partie Log Txt, c'est fini... :-)

mais dans tous les cas, je tiens à vous remercier si vous savez y jeter un coup d'oeil.

coachkpn1 · Answer

Voilà, je viens de tester et jusque là, plus de redirection google.
ouf.
merci pour la ligne de conduite donnée lors du dernier cas, ça marche!
amicalement.

Google infecté

46 réponses

Discussions similaires

Newsletters