analyse de rapport hijackthis

[bruce lee]

Re,

 

Télécharge Flash_Disinfector.exe de sUBs : http://www.techsupportforum.com/sectools/s...Disinfector.exe et execute le

 

Refais un nouveau scan avec combofix puis poste le rapport.

 

@+

[toutclic]

je l'ai deja celui la et je l'ai deja fait plusieurs fois meme mais je fais ce que tu me dit

voici le rapport

 

ComboFix 07-06-18.2 - C:\Documents and Settings\Herwan BOUDRA\Bureau\ComboFix.exe

"Herwan BOUDRA" - 2007-06-20 22:31:27 - Service Pack 2 NTFS

 

 

((((((((((((((((((((((((( Files Created from 2007-05-20 to 2007-06-20 )))))))))))))))))))))))))))))))

 

 

2007-06-20 22:30 26,112 --a------ C:\WINDOWS\system32\nircmd.exe

2007-06-20 22:29 2,829 --a------ C:\WINDOWS\War3Unin.pif

2007-06-20 22:29 18,031 --a------ C:\WINDOWS\War3Unin.dat

2007-06-20 22:29 126,976 --a------ C:\WINDOWS\War3Unin.exe

2007-06-20 22:23 <REP> d-------- C:\Program Files\Warcraft III

2007-06-20 13:30 49,152 --a------ C:\WINDOWS\nircmd.exe

2007-06-19 20:50 2,404,352 --a------ C:\Program Files\haloce.exe

2007-06-19 20:42 <REP> d-------- C:\Program Files\Fichiers communs\logishrd

2007-06-19 12:47 36,864 --a------ C:\WINDOWS\system32\EGameEncrypt.dll

2007-06-18 21:17 <REP> d-------- C:\DOCUME~1\HERWAN~1\APPLIC~1\Dev-Cpp

2007-06-18 21:16 <REP> d-------- C:\Dev-Cpp

2007-06-18 20:55 <REP> d-------- C:\Program Files\Fichiers communs\Agnitum Shared

2007-06-18 20:33 <REP> d-------- C:\DOCUME~1\LOCALS~1\Bureau

2007-06-18 20:32 <REP> d---s---- C:\DOCUME~1\LOCALS~1\Favoris

2007-06-18 20:25 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat

2007-06-18 20:24 <REP> d-------- C:\WINDOWS\Internet Logs

2007-06-18 19:18 <REP> d-------- C:\Program Files\Microsoft Games

2007-06-18 19:15 <REP> d-------- C:\Program Files\Windows Live

2007-06-18 18:03 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google

2007-06-18 17:57 <REP> d-------- C:\Program Files\Mu~Intensity

2007-06-13 09:34 <REP> drahs---- C:\autorun.inf

2007-05-29 16:52 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll

2007-05-29 16:52 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll

2007-05-29 16:52 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys

2007-05-29 16:36 <REP> d-------- C:\DOCUME~1\HERWAN~1\APPLIC~1\Hamachi

2007-05-29 16:35 25,544 --a------ C:\WINDOWS\system32\drivers\hamachi.sys

2007-05-29 16:35 <REP> d-------- C:\Program Files\Hamachi

2007-05-29 13:47 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy

2007-05-28 11:06 <REP> d-------- C:\DOCUME~1\HERWAN~1\APPLIC~1\dvdcss

2007-05-26 18:13 <REP> d-------- C:\Program Files\DAEMON Tools

2007-05-24 13:22 796,672 --a------ C:\WINDOWS\GPInstall.exe

 

 

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

 

2007-06-19 10:44:04 -------- d--h--w C:\Program Files\InstallShield Installation Information

2007-06-19 06:16:44 -------- d-----w C:\DOCUME~1\HERWAN~1\APPLIC~1\BitTorrent

2007-06-18 17:15:38 -------- d-----w C:\Program Files\Messenger Plus! Live

2007-06-18 17:15:37 -------- d-----w C:\Program Files\MSN Messenger

2007-06-18 16:07:37 -------- d-----w C:\Program Files\Google

2007-06-18 15:57:32 -------- d-----w C:\Program Files\Mu~Intensity_S2

2007-06-17 19:33:21 -------- d-----w C:\Program Files\ElcomSoft

2007-06-17 19:32:54 -------- d-----w C:\Program Files\TrackMania Nations ESWC

2007-06-16 15:25:23 -------- d-----w C:\Program Files\JkDefrag

2007-06-14 11:53:31 -------- d-----w C:\DOCUME~1\HERWAN~1\APPLIC~1\ArcSoft

2007-06-13 15:57:36 -------- d-----w C:\Program Files\Valve Lan

2007-06-13 15:57:17 74,630 ----a-w C:\WINDOWS\system32\perfc00C.dat

2007-06-13 15:57:17 466,974 ----a-w C:\WINDOWS\system32\perfh00C.dat

2007-06-13 07:25:33 -------- d-----w C:\Program Files\TrackMania United

2007-05-27 16:15:48 976 ----a-w C:\WINDOWS\eReg.dat

2007-05-27 16:11:56 -------- d-----w C:\Program Files\EA Games

2007-05-26 16:18:23 -------- d-----w C:\Program Files\TrackMania Sunrise

2007-05-26 15:47:40 -------- d-----w C:\Program Files\Fichiers communs\Ahead

2007-05-09 13:29:11 -------- d-----w C:\DOCUME~1\HERWAN~1\APPLIC~1\Google

2007-05-09 13:28:13 -------- d-----w C:\Program Files\Fichiers communs\ArcSoft

2007-05-09 13:28:11 -------- d-----w C:\Program Files\My Book

2007-05-09 13:27:47 339,968 ----a-w C:\WINDOWS\system32\WDBtnMgr.exe

2007-05-08 17:20:20 -------- d-----w C:\Program Files\DivX

2007-05-08 16:21:36 -------- d-----w C:\Program Files\TrackMania

2007-05-06 14:03:19 682,232 ----a-w C:\WINDOWS\system32\drivers\sptd.sys

2007-04-30 18:10:42 -------- d-----w C:\Program Files\Sony Corporation

2007-04-30 17:16:04 284 ----a-w C:\DOCUME~1\HERWAN~1\APPLIC~1\ViewerApp.dat

2007-04-30 17:00:45 50 --sha-w C:\AUTOEXEC.BAT

2007-04-30 15:46:10 745,600 ----a-w C:\WINDOWS\system32\aswBoot.exe

2007-04-30 15:41:55 85,952 -c--a-w C:\WINDOWS\system32\drivers\aswmon.sys

2007-04-30 15:41:42 94,552 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys

2007-04-30 15:39:41 23,416 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys

2007-04-30 15:38:51 43,176 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys

2007-04-30 15:37:23 26,888 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys

2007-04-30 15:35:28 95,872 ----a-w C:\WINDOWS\system32\AVASTSS.scr

2007-04-28 09:53:28 -------- d-----w C:\DOCUME~1\HERWAN~1\APPLIC~1\teamspeak2

2007-04-27 11:50:00 -------- d-----w C:\Program Files\HardwareDetection

2007-04-26 08:21:34 72,624 ----a-w C:\WINDOWS\system32\drivers\khips.sys

2007-04-26 08:21:30 302,000 ----a-w C:\WINDOWS\system32\drivers\fwdrv.sys

2007-04-24 09:15:09 -------- d-----w C:\Program Files\eEye Digital Security

2007-04-24 09:14:51 -------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard

2007-04-22 09:56:43 -------- d-----w C:\Program Files\Microsoft FrontPage Express

2007-04-21 14:30:28 -------- d-----w C:\Program Files\Wolfenstein - Enemy Territory

2007-04-20 23:58:10 -------- d-----w C:\DOCUME~1\HERWAN~1\APPLIC~1\BitDownload

2007-04-03 11:57:32 108,144 ----a-w C:\WINDOWS\system32\CmdLineExt.dll

2007-04-01 21:11:15 71,744 ----a-w C:\DOCUME~1\HERWAN~1\APPLIC~1\GDIPFONTCACHEV1.DAT

2007-03-30 06:48:10 50,808 ----a-w C:\WINDOWS\system32\anifix1.dll

2005-05-13 16:12:00 217,073 --sha-r C:\WINDOWS\meta4.exe

2005-10-24 10:13:58 66,560 --sha-r C:\WINDOWS\MOTA113.exe

2005-10-13 20:27:00 422,400 --sha-r C:\WINDOWS\x2.64.exe

2005-10-07 18:14:52 308,224 --sha-r C:\WINDOWS\system32\avisynth.dll

2005-07-14 11:31:20 27,648 --sha-r C:\WINDOWS\system32\AVSredirect.dll

2005-06-26 14:32:28 616,448 --sha-r C:\WINDOWS\system32\cygwin1.dll

2005-06-21 21:37:42 45,568 --sha-r C:\WINDOWS\system32\cygz.dll

2004-01-24 23:00:00 70,656 --sha-r C:\WINDOWS\system32\i420vfw.dll

2006-04-27 09:24:24 2,945,024 --sha-r C:\WINDOWS\system32\Smab.dll

2005-02-28 12:16:22 240,128 --sha-r C:\WINDOWS\system32\x.264.exe

2004-01-24 23:00:00 70,656 --sha-r C:\WINDOWS\system32\yv12vfw.dll

 

 

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

 

 

*Note* empty entries & legit default entries are not shown

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 02:56]

{53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2005-05-31 01:04]

{9030D464-4C02-4ABF-8ECC-5164760863C6}=C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-07-07 13:29]

{AA58ED58-01DD-4d91-8333-CF10577473F7}=c:\program files\google\googletoolbar2.dll [2007-01-19 23:56]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2003-11-07 10:21]

"RTHDCPL"="RTHDCPL.EXE" [2005-06-29 06:25 C:\WINDOWS\RTHDCPL.EXE]

"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2005-04-29 07:56]

"Mouse Suite 98 Daemon"="ICO.EXE" [2002-03-14 17:46 C:\WINDOWS\system32\ico.exe]

"ISBMgr.exe"="C:\Program Files\Sony\ISB Utility\ISBMgr.exe" [2004-02-20 15:12]

"CloneCDTray"="C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 21:21]

"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 17:42]

"WD Button Manager"="WDBtnMgr.exe" [2007-05-09 15:27 C:\WINDOWS\system32\WDBtnMgr.exe]

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [2006-07-07 18:45]

"ccleaner"="C:\Program Files\CCleaner\ccleaner.exe" [2007-01-29 18:34]

"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 10:59]

"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55]

"eMuleAutoStart"="D:\eMule\eMule.exe" [2006-09-14 16:15]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]

VESWinlogon.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"appinit_dlls"=anifix1.dll

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"

"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" /background

"eMuleAutoStart"=D:\eMule\eMule.exe -AutoStart

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"SonyPowerCfg"=C:\Program Files\Sony\VAIO Power Management\SPMgr.exe

"WD Button Manager"=WDBtnMgr.exe

"NeroFilterCheck"=C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe

"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - netsvcs

UxTuneUp

 

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\S]

Auto\command- tel.xls.exe

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{14daba8c-d3be-11db-a1bc-0016ce137a70}]

Auto\command- G:\tel.xls.exe

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tel.xls.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{16c3b3ea-0856-11dc-a208-0016ce137a70}]

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{176b66e3-1741-11dc-a225-ef002c6e84d0}]

Auto\command- tel.xls.exe

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tel.xls.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{36baa6ab-1974-11dc-a22b-c764f33e74d2}]

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{36de3fa5-e29a-11db-a1d2-b3a9519f44d3}]

Auto\command- G:\tel.xls.exe

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tel.xls.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3a120065-d936-11db-a1c3-c3810f7589dc}]

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{69502562-d9fd-11db-a1c5-e8abc5b275d1}]

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6f26a533-db84-11db-a1c7-001060d12b93}]

Auto\command- tel.xls.exe

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tel.xls.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6f33e219-d487-11db-a1bf-0016ce137a70}]

Auto\command- tel.xls.exe

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tel.xls.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{77b3091e-d3fe-11db-a1bd-001060d12b93}]

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{78493500-df7d-11db-a1cb-af74580586d3}]

Auto\command- G:\tel.xls.exe

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tel.xls.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8d06f086-0f49-11dc-a217-0016ce137a70}]

Auto\command- H:\tel.xls.exe

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tel.xls.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9089d99d-e033-11db-a1cc-fc4a053b29d2}]

Auto\command- tel.xls.exe

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tel.xls.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9089d9b1-e033-11db-a1cc-fc4a053b29d2}]

Auto\command- tel.xls.exe

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tel.xls.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a1e84cde-c426-11db-a187-0016ce137a70}]

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a2ef1dfc-e0e0-11db-a1cd-901196d4a3dd}]

Auto\command- tel.xls.exe

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tel.xls.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aaeec51b-091c-11dc-a20a-0016ce137a70}]

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aaeec51d-091c-11dc-a20a-0016ce137a70}]

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c66fb02c-180b-11dc-a227-83f6cdef18dc}]

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{da6e1dd8-d15d-11db-a1b7-0016ce137a70}]

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f836734f-1d0a-11dc-a234-0016ce137a70}]

Auto\command- tel.xls.exe

AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tel.xls.exe

 

 

Contents of the 'Scheduled Tasks' folder

2007-06-15 15:15:00 C:\WINDOWS\tasks\Maintenance en 1 clic.job

 

**************************************************************************

 

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net

Rootkit scan 2007-06-20 22:36:02

Windows 5.1.2600 Service Pack 2 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

 

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\(VFILT)]

 

 

Completion time: 2007-06-20 22:38:16

C:\ComboFix2.txt ... 2007-06-20 13:39

 

--- E O F ---

Modifié le 20 juin 2007 par toutclic

[bruce lee]

re,

 

Si durant la procédure ci-dessous, il y a des étapes que tu n'as pas reussi a faire, merci de continuer la procédure jusqu'au bout et de les signaler dans ta prochaine reponse.

 

Je te conseille d'enregistrer la page web compléte sous Internet Explorer comme ceci :

 

* Clique sur Fichier/Enregistrer sous Dans Type, choisis : Archive web (fichier seul (*.mht) / Enregistre la sur le bureau,comme cela tu retrouvera la mise en forme ou imprime cette réponse. Une partie de la désinfection se déroulera en mode sans échec.

 

 

1/ ouvre le Bloc-notes (Démarrer\Tous les programmes\Accessoires\Bloc-notes)

 

2/ copie ce qui est en citation ci-dessous (sans le mot citation) par sélection puis Ctrl-C :

 

REGEDIT4

 

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\S]

 

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{14daba8c-d3be-11db-a1bc-0016ce137a70}]

 

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{16c3b3ea-0856-11dc-a208-0016ce137a70}]

 

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{176b66e3-1741-11dc-a225-ef002c6e84d0}]

 

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{36baa6ab-1974-11dc-a22b-c764f33e74d2}]

 

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{36de3fa5-e29a-11db-a1d2-b3a9519f44d3}]

 

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3a120065-d936-11db-a1c3-c3810f7589dc}]

 

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{69502562-d9fd-11db-a1c5-e8abc5b275d1}]

 

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6f26a533-db84-11db-a1c7-001060d12b93}]

 

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6f33e219-d487-11db-a1bf-0016ce137a70}]

 

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{77b3091e-d3fe-11db-a1bd-001060d12b93}]

 

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{78493500-df7d-11db-a1cb-af74580586d3}]

 

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8d06f086-0f49-11dc-a217-0016ce137a70}]

 

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9089d99d-e033-11db-a1cc-fc4a053b29d2}]

 

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9089d9b1-e033-11db-a1cc-fc4a053b29d2}]

 

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a1e84cde-c426-11db-a187-0016ce137a70}]

 

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a2ef1dfc-e0e0-11db-a1cd-901196d4a3dd}]

 

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aaeec51b-091c-11dc-a20a-0016ce137a70}]

 

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aaeec51d-091c-11dc-a20a-0016ce137a70}]

 

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c66fb02c-180b-11dc-a227-83f6cdef18dc}]

 

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{da6e1dd8-d15d-11db-a1b7-0016ce137a70}]

 

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f836734f-1d0a-11dc-a234-0016ce137a70}]

 

-Enregistrez ce fichier reg dans : Bureau

-Nom du fichier : fixme.reg

-Type du fichier : tous les fichiers

-cliquez sur Enregistrer

-quittez le Bloc Notes

 

 

3/Télécharge puis installe http://www.ewido.net/en/download

Une fois AVG AS lancé, clique sur Mise à jour

Ferme le programme.

 

 

 

4/Démarre en mode sans échec http://cybersecurite.xooit.com/t88-Demarre...s-echec.htm#665

 

 

5/ Relance AVG AS puis choisis l'onglet Analyse

Puis l'onglet Paramètres

Sous la question Comment réagir ?, clique sur Actions recommandées et choisis Quarantaine

Reclique sur l'onglet Analyse puis réalise une Analyse complète du système

 

Si un fichier infecté est détecté en fin d'analyse

Clique sur Appliquer toutes les actions

 

Clique sur Enregistrer le rapport puis sur Enregistrer le rapport sous

Enregistre ce fichier texte sur ton bureau

 

 

6/Utilisation du fichier: fixme.reg précedemment créé

- double cliquez sur le fichier (Bureau) / Acceptez l'avertissement concernant la fusion / ne pas s'étonner de ne rien voir / validez le message disant que la fusion est terminée.

 

7/Redémarre en mode normal

 

8/Poste le rapport d'AVG Anti spyware 7.5.

 

Bon courage, et si tu as la moindre question n'hésite surtout pas

 

@+