curbfragfrag.zb0o5k4 c'est quoi ça ! à l'aide

le 28 avril 2008

Je te remercie Thanos pour ton coup de main.

Thanos · le 28 avril 2008

salut @ vous deux

Désolé pour le délai de réponse

Kaloukokine, voilà ce que tu vas faire stp >>

1) Commence par désactiver l'UAC comme ceci pour qu'il n'interfère pas avec la désinfection > http://www.google.fr/url?sa=t&client=p...NIWfJdETjpNsBvg

Tu le réactivera en toute fin de désinfection.

2) Télécharge et éxécute le programme Lop S&D de Eric_71 & Angeldark comme indiqué dans le tutoriel suivant > http://eric.71.mespages.googlepages.com/lop.sd.exe

Une fois ceci fait, poste le rapport.

3) Il y a deux antivirus sur ton pc: est ce que tu as essayé de désinstaller Norton ? Il ne faut en conserver qu'un (je te conseille de garder Antivir).

Télécharge Norton_Removal_Tool sur ton bureau.

Double clique sur l'icône de Norton Removal tool pour lancer l'utilitaire. Suis les indications à l'écran : il est possible que tu doives redémarrer plusieurs fois.

4) Poste le rapport fait avec DSS stp. (voir mon message plus haut)

Poste les deux rapports demandés stp: si il ya une chose que tu ne comprends pas, ou si tu as besoin de précisions, n'hésite pas

Modifié le 28 avril 2008 par Thanos

le 29 avril 2008

Re lu, voici le premier rapport fai ak DSS:

Deckard's System Scanner v20071014.68

Run by Kalou on 2008-04-28 10:52:10

Computer is in Normal Mode.

--------------------------------------------------------------------------------

-- Last 5 Restore Point(s) --

11: 2008-04-27 03:17:57 UTC - RP146 - Supprimé Desktop SMS

10: 2008-04-27 00:07:35 UTC - RP145 - Point de contrôle planifié

9: 2008-04-24 23:10:03 UTC - RP144 - Windows Update

8: 2008-04-24 21:33:42 UTC - RP143 - Point de contrôle planifié

7: 2008-04-22 00:30:38 UTC - RP142 - Installed Google Toolbar for Internet Explorer

-- First Restore Point --

1: 2008-04-13 01:58:07 UTC - RP135 - Windows Update

Backed up registry hives.

Performed disk cleanup.

-- HijackThis (run as Kalou.exe) -----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:55:01, on 28/04/2008

Platform: Windows Vista (WinNT 6.00.1904)

MSIE: Internet Explorer v7.00 (7.00.6000.16643)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\Program Files\Synaptics\SynTP\SynTPStart.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE

C:\Windows\RtHDVCpl.exe

C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe

C:\Program Files\TOSHIBA\Toshiba Online Product Information\TOPI.exe

C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe

C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe

C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe

C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe

C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe

C:\Program Files\TOSHIBA\Registration\ToshibaRegistration.exe

C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Program Files\Windows Mail\WinMail.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Synaptics\SynTP\SynToshiba.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe

C:\Program Files\Google\GoogleToolbarNotifier\1.2.911.3380\GoogleToolbarNotifier.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avnotify.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Windows\system32\conime.exe

C:\Program Files\Internet Explorer\ieuser.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Windows\system32\Macromed\Flash\FlashUtil9e.exe

C:\Users\Kalou\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M7WAE0SD\dss[1].exe

C:\PROGRA~1\TRENDM~1\HIJACK~1\Kalou.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [startCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

O4 - HKLM\..\Run: [synTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe

O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup

O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe"

O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE

O4 - HKLM\..\Run: [smoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe

O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe

O4 - HKLM\..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe

O4 - HKLM\..\Run: [symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [TOSCDSPD] TOSCDSPD.EXE

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.911.3380\GoogleToolbarNotifier.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: eBay - Achetez, Vendez - {76577871-04EC-495E-A12B-91F7C3600AFA} - http://rover.ebay.com/rover/1/709-44555-9400-3/4 (file missing)

O9 - Extra button: Amazon.fr - {8A918C1D-E123-4E36-B562-5C1519E434CE} - http://www.amazon.fr/exec/obidos/redirect-...1&site=home (file missing)

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O13 - Gopher Prefix:

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/...NPUpldfr-fr.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{744AAB96-F28D-420A-9586-2091B4C5692B}: NameServer = 80.10.246.134 80.10.246.7

O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe

O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe

O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe

O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

O23 - Service: TOSHIBA Bluetooth Service - Unknown owner - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (file missing)

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--

End of file - 9400 bytes

-- File Associations -----------------------------------------------------------

All associations okay.

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

All drivers whitelisted.

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 AntiVirScheduler (AntiVir PersonalEdition Classic Scheduler) - "c:\program files\avira\antivir personaledition classic\sched.exe" <Not Verified; Avira GmbH; AntiVir Workstation>

R2 CFSvcs (ConfigFree Service) - c:\program files\toshiba\configfree\cfsvcs.exe <Not Verified; TOSHIBA CORPORATION; ConfigFree>

R2 TNaviSrv (TOSHIBA Navi Support Service) - c:\program files\toshiba\toshiba dvd player\tnavisrv.exe <Not Verified; TOSHIBA Corporation; TOSHIBA DVD Player>

R2 TODDSrv (TOSHIBA Optical Disc Drive Service) - c:\windows\system32\toddsrv.exe <Not Verified; TOSHIBA Corporation; TDCSrv Application>

S2 LiveUpdate Notice Ex (LiveUpdate Notice Service Ex) - "c:\program files\common files\symantec shared\ccsvchst.exe" /h cccommon (file missing)

S2 TOSHIBA Bluetooth Service - c:\program files\toshiba\bluetooth toshiba stack\tosbtsrv.exe (file missing)

-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {6bdd1fc1-810f-11d0-bec7-08002be2092f}

Description: Contrôleur hôte compatible IEE 1394 RICOH OHCI

Device ID: PCI\VEN_1180&DEV_0832&SUBSYS_FF101179&REV_05\4&B216F0A&0&30A4

Manufacturer: RICOH

Name: Contrôleur hôte compatible IEE 1394 RICOH OHCI

PNP Device ID: PCI\VEN_1180&DEV_0832&SUBSYS_FF101179&REV_05\4&B216F0A&0&30A4

Service: ohci1394

Class GUID: {a0a588a4-c46f-4b37-b7ea-c82fe89870c6}

Description: Contrôleur hôte numérique sécurisé compatible SDA

Device ID: PCI\VEN_1180&DEV_0822&SUBSYS_FF101179&REV_22\4&B216F0A&0&31A4

Manufacturer: Fournisseur de contrôleur hôte numérique sécurisé compatible SDA

Name: Contrôleur hôte numérique sécurisé compatible SDA

PNP Device ID: PCI\VEN_1180&DEV_0822&SUBSYS_FF101179&REV_22\4&B216F0A&0&31A4

Service: sdbus

-- Scheduled Tasks -------------------------------------------------------------

2008-04-28 10:55:00 418 --ah----- C:\Windows\Tasks\User_Feed_Synchronization-{271C5EF0-A05F-4E47-A9A3-A167B29FD4C7}.job

-- Files created between 2008-03-28 and 2008-04-28 -----------------------------

2008-04-28 10:54:53 0 d-------- C:\Program Files\Trend Micro

2008-04-26 23:41:33 0 d-------- C:\Program Files\CCleaner

2008-04-25 19:21:12 0 d-------- C:\Program Files\Common Files\Adobe

2008-04-21 20:30:51 0 d-------- C:\Users\All Users\Google

2008-04-21 20:30:49 0 d-------- C:\Program Files\Google

2008-04-16 21:13:06 0 d-------- C:\Users\All Users\Avira

2008-04-16 21:13:06 0 d-------- C:\Program Files\Avira

-- Find3M Report ---------------------------------------------------------------

2008-04-28 10:35:37 690832 --a------ C:\Windows\system32\perfh00C.dat

2008-04-28 10:35:37 117572 --a------ C:\Windows\system32\perfc00C.dat

2008-04-25 19:21:12 0 d-------- C:\Program Files\Common Files

2008-04-24 17:57:08 0 d-------- C:\Users\Kalou\AppData\Roaming\Google

2008-04-21 20:26:07 0 d-------- C:\Program Files\Java

2008-04-17 15:44:08 0 d-------- C:\Program Files\Common Files\Symantec Shared

2008-04-16 21:06:20 0 d-------- C:\Program Files\Symantec

2008-04-16 16:30:23 0 d-------- C:\Users\Kalou\AppData\Roaming\Adobe

2008-04-16 15:00:48 0 d-------- C:\Users\Kalou\AppData\Roaming\vlc

2008-04-15 19:35:21 0 d-------- C:\Users\Kalou\AppData\Roaming\Toshiba

2008-04-14 16:59:36 0 d-------- C:\Users\Kalou\AppData\Roaming\Macromedia

2008-04-14 16:41:09 0 d-------- C:\Users\Kalou\AppData\Roaming\ATI

2008-04-13 08:28:56 0 d-------- C:\Program Files\Windows Mail

2008-03-08 16:57:02 0 d-------- C:\Program Files\Circle Developement

2008-03-06 17:31:33 0 d-------- C:\Program Files\eMule

2008-02-08 11:34:40 174 --ahs---- C:\Program Files\desktop.ini

2008-02-06 12:31:22 45 ---h----- C:\Windows\dvis4280.dat

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [14/09/2007 02:42]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [22/02/2008 04:25]

"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [10/11/2006 06:35]

"SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [15/08/2007 09:31]

"RtHDVCpl"="RtHDVCpl.exe" [09/08/2007 13:26 C:\Windows\RtHDVCpl.exe]

"NDSTray.exe"="NDSTray.exe" []

"topi"="C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe" [10/07/2007 03:24]

"Camera Assistant Software"="C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" [22/05/2007 05:50]

"TPwrMain"="C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE" [29/03/2007 05:39]

"SmoothView"="C:\Program Files\Toshiba\SmoothView\SmoothView.exe" [03/04/2007 11:52]

"00TCrdMain"="C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe" [22/05/2007 11:32]

"Toshiba Registration"="C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe" [04/05/2007 07:05]

"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [12/03/2007 10:22]

"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [16/04/2008 22:16]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [11/01/2008 22:16]

"MSConfig"="C:\Windows\system32\msconfig.exe" [02/11/2006 05:45]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [05/02/2008 14:23]

"TOSCDSPD"="TOSCDSPD.EXE" []

"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [18/10/2007 11:34]

"Speech Recognition"="C:\Windows\Speech\Common\sapisvr.exe" [02/11/2006 05:45]

"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.911.3380\GoogleToolbarNotifier.exe" [21/04/2008 20:30]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"=2 (0x2)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoFolderOptions"=0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]

@="IEEE 1394 Bus host controllers"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]

@="SBP2 IEEE 1394 Devices"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

@="SecurityDevices"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\1 mags 16 more]

"C:\ProgramData\Curb Start Acid.o72lvtz"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Size Time]

"C:\ProgramData\curbfragfrag.zb0o5k4"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc EMDMgmt TabletInputService wlansvc WPDBusEnum

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{60483932-d657-11dc-9f92-00164467c2cc}]

Auto\command- AdobeR.exe e

AutoRun\command- C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{60483937-d657-11dc-9f92-00164467c2cc}]

AutoRun\command- D:\LaunchU3.exe -a

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]

C:\Windows\system32\unregmp2.exe /ShowWMP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]

%SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI

-- End of Deckard's System Scanner: finished at 2008-04-28 10:56:04 ------------

Et voici le dernier:

-----------------------[ Lop S&D 4.2.0-2 XP/Vista ]---------------------

[ Windows 'Longhorn' (NT 6.0) Workstation Build 6000 ]

[ USER : Kalou ] [ "C:\Lop SD" ] [ Selection : 1 ]

[ 28/04/2008 | 20:00:21,03 ] [ PC : PC-DE-KALOU ]

[ MAJ : 27-04-2008 | 11:15 ]

[ UAC => 0 ]

-------------[ Listing des dossiers dans Application Data ]------------

[16/04/2008|16:30] C:\Users\Kalou\AppData\Roaming\Adobe\Linguistics

[14/04/2008|16:59] C:\Users\Kalou\AppData\Roaming\Adobe\Flash Player

[14/04/2008|16:41] C:\Users\Kalou\AppData\Roaming\Adobe\Acrobat

[14/04/2008|16:41] C:\Users\Kalou\AppData\Roaming\ATI\ACE

[26/04/2008|23:46] C:\Users\Kalou\AppData\Roaming\Google\Local Search History

[26/04/2008|23:56] C:\Users\Kalou\AppData\Roaming\Macromedia\Flash Player

[27/04/2008|12:52] C:\Users\Kalou\AppData\Roaming\Microsoft\ModŠles

[26/04/2008|21:55] C:\Users\Kalou\AppData\Roaming\Microsoft\MSN Messenger

[26/04/2008|19:40] C:\Users\Kalou\AppData\Roaming\Microsoft\Excel

[25/04/2008|20:48] C:\Users\Kalou\AppData\Roaming\Microsoft\Word

[25/04/2008|20:37] C:\Users\Kalou\AppData\Roaming\Microsoft\?preuve

[25/04/2008|18:20] C:\Users\Kalou\AppData\Roaming\Microsoft\HTML Help

[25/04/2008|17:19] C:\Users\Kalou\AppData\Roaming\Microsoft\Office

[25/04/2008|16:39] C:\Users\Kalou\AppData\Roaming\Microsoft\Forms

[25/04/2008|16:38] C:\Users\Kalou\AppData\Roaming\Microsoft\Outlook

[19/04/2008|21:29] C:\Users\Kalou\AppData\Roaming\Microsoft\Publisher

[16/04/2008|21:46] C:\Users\Kalou\AppData\Roaming\Microsoft\Requˆtes

[16/04/2008|18:55] C:\Users\Kalou\AppData\Roaming\Microsoft\Clip Organizer

[16/04/2008|14:54] C:\Users\Kalou\AppData\Roaming\Microsoft\OIS

[14/04/2008|18:36] C:\Users\Kalou\AppData\Roaming\Microsoft\Macros compl‚mentaires

[14/04/2008|18:07] C:\Users\Kalou\AppData\Roaming\Microsoft\Internet Explorer

[14/04/2008|17:09] C:\Users\Kalou\AppData\Roaming\Microsoft\Crypto

[14/04/2008|16:59] C:\Users\Kalou\AppData\Roaming\Microsoft\eHome

[14/04/2008|16:58] C:\Users\Kalou\AppData\Roaming\Microsoft\Media Player

[14/04/2008|16:41] C:\Users\Kalou\AppData\Roaming\Microsoft\IdentityCRL

[14/04/2008|16:41] C:\Users\Kalou\AppData\Roaming\Microsoft\Speech

[14/04/2008|16:41] C:\Users\Kalou\AppData\Roaming\Microsoft\Windows

[14/04/2008|16:41] C:\Users\Kalou\AppData\Roaming\Microsoft\Network

[14/04/2008|16:41] C:\Users\Kalou\AppData\Roaming\Microsoft\Protect

[14/04/2008|16:41] C:\Users\Kalou\AppData\Roaming\Microsoft\Credentials

[14/04/2008|16:11] C:\Users\Kalou\AppData\Roaming\Microsoft\SystemCertificates

[15/04/2008|19:35] C:\Users\Kalou\AppData\Roaming\Toshiba\TOSHIBA Online Product Information

[27/04/2008|23:01] C:\Users\Kalou\AppData\Roaming\vlc\vlcrc

[16/04/2008|15:00] C:\Users\Kalou\AppData\Roaming\vlc\cache

----------------[ Tâches planifiées dans C:\Windows\tasks ]---------------

[28/04/2008 20:00][--ah-----] C:\Windows\tasks\User_Feed_Synchronization-{271C5EF0-A05F-4E47-A9A3-A167B29FD4C7}.job

[28/04/2008 19:52][--ah-----] C:\Windows\tasks\SA.DAT

[28/04/2008 19:51][--a------] C:\Windows\tasks\SCHEDLGU.TXT

------[ Listing des dossiers dans C:\ProgramData ]------

[05/02/2008|23:37] C:\ProgramData\Admin Inter 1 Mags

[25/04/2008|19:21] C:\ProgramData\Adobe

[02/11/2006|09:02] C:\ProgramData\Application Data

[14/09/2007|04:08] C:\ProgramData\ATI

[16/04/2008|21:13] C:\ProgramData\Avira

[05/02/2008|11:25] C:\ProgramData\Bureau

[05/02/2008|23:37] C:\ProgramData\Curb Start Acid.o72lvtz

[05/02/2008|23:16] C:\ProgramData\curbfragfrag.84dfsrm

[05/02/2008|23:16] C:\ProgramData\curbfragfrag.8mnzu

[16/04/2008|22:17] C:\ProgramData\curbfragfrag.zb0o5k4

[02/11/2006|09:02] C:\ProgramData\Desktop

[02/11/2006|09:02] C:\ProgramData\Documents

[05/02/2008|11:25] C:\ProgramData\Favoris

[02/11/2006|09:02] C:\ProgramData\Favorites

[21/04/2008|20:30] C:\ProgramData\Google

[24/04/2008|21:13] C:\ProgramData\intragreatsetup

[05/02/2008|11:25] C:\ProgramData\Menu D‚marrer

[06/02/2008|00:16] C:\ProgramData\Messenger Plus!

[06/02/2008|10:07] C:\ProgramData\Microsoft

[05/02/2008|11:25] C:\ProgramData\ModŠles

[27/04/2008|19:07] C:\ProgramData\ProgramData.rar

[02/11/2006|09:02] C:\ProgramData\Start Menu

[02/11/2006|09:02] C:\ProgramData\Templates

[14/09/2007|04:01] C:\ProgramData\Toshiba

[05/02/2008|11:29] C:\ProgramData\ToshibaEurope

[14/09/2007|03:52] C:\ProgramData\Ulead Systems

[05/02/2008|13:31] C:\ProgramData\WLInstaller

---------------[ Listing des dossiers dans C:\Program Files ]--------------

[25/04/2008|19:21] C:\Program Files\Adobe

[14/09/2007|03:29] C:\Program Files\ATI

[14/09/2007|03:32] C:\Program Files\ATI Technologies

[16/04/2008|21:13] C:\Program Files\Avira

[05/02/2008|04:13] C:\Program Files\Camera Assistant Software for Toshiba

[26/04/2008|23:41] C:\Program Files\CCleaner

[08/03/2008|16:57] C:\Program Files\Circle Developement

[25/04/2008|19:21] C:\Program Files\Common Files

[08/02/2008|11:34] C:\Program Files\desktop.ini

[06/03/2008|17:31] C:\Program Files\eMule

[05/02/2008|11:25] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]

[21/04/2008|20:30] C:\Program Files\Google

[14/09/2007|04:17] C:\Program Files\IDM

[05/02/2008|04:19] C:\Program Files\InstallShield Installation Information

[13/04/2008|08:28] C:\Program Files\Internet Explorer

[14/09/2007|03:52] C:\Program Files\InterVideo

[21/04/2008|20:26] C:\Program Files\Java

[14/09/2007|03:54] C:\Program Files\ltmoh

[05/02/2008|23:04] C:\Program Files\Messenger Plus! Live

[06/02/2008|08:41] C:\Program Files\Microsoft CAPICOM 2.1.0.2

[02/11/2006|08:37] C:\Program Files\Microsoft Games

[06/02/2008|08:48] C:\Program Files\Microsoft Office

[06/02/2008|08:47] C:\Program Files\Microsoft.NET

[02/11/2006|08:42] C:\Program Files\Movie Maker

[02/11/2006|08:37] C:\Program Files\MSBuild

[02/11/2006|08:37] C:\Program Files\MSN

[14/09/2007|02:30] C:\Program Files\MSXML 4.0

[14/09/2007|04:19] C:\Program Files\myphotobook

[06/02/2008|12:31] C:\Program Files\PhotoFiltre Studio

[16/02/2008|13:50] C:\Program Files\Project64 1.6

[14/09/2007|03:54] C:\Program Files\Realtek

[05/02/2008|04:17] C:\Program Files\REALTEK RTL8187B Wireless LAN Driver

[02/11/2006|08:37] C:\Program Files\Reference Assemblies

[14/09/2007|03:37] C:\Program Files\Synaptics

[05/02/2008|04:18] C:\Program Files\TOSHIBA

[28/04/2008|10:54] C:\Program Files\Trend Micro

[14/09/2007|03:49] C:\Program Files\Ulead Systems

[02/11/2006|09:01] C:\Program Files\Uninstall Information

[06/02/2008|13:54] C:\Program Files\VideoLAN

[05/02/2008|21:12] C:\Program Files\Windows Calendar

[02/11/2006|08:42] C:\Program Files\Windows Collaboration

[14/09/2007|03:23] C:\Program Files\Windows Defender

[02/11/2006|08:42] C:\Program Files\Windows Journal

[05/02/2008|15:59] C:\Program Files\Windows Live

[13/04/2008|08:28] C:\Program Files\Windows Mail

[14/09/2007|03:52] C:\Program Files\Windows Media Components

[05/02/2008|21:12] C:\Program Files\Windows Media Player

[05/02/2008|11:25] C:\Program Files\Windows NT

[02/11/2006|08:42] C:\Program Files\Windows Photo Gallery

[05/02/2008|21:12] C:\Program Files\Windows Sidebar

[27/04/2008|18:50] C:\Program Files\WinRAR

------[ Listing des dossiers dans C:\Program Files\Common Files ]------

[25/04/2008|19:21] C:\Program Files\Common Files\Adobe

[06/02/2008|08:48] C:\Program Files\Common Files\DESIGNER

[14/09/2007|03:52] C:\Program Files\Common Files\InstallShield

[14/09/2007|03:28] C:\Program Files\Common Files\Java

[06/02/2008|08:49] C:\Program Files\Common Files\microsoft shared

[02/11/2006|07:18] C:\Program Files\Common Files\Services

[02/11/2006|07:18] C:\Program Files\Common Files\SpeechEngines

[28/04/2008|19:50] C:\Program Files\Common Files\Symantec Shared

[06/02/2008|08:47] C:\Program Files\Common Files\System

[14/09/2007|04:01] C:\Program Files\Common Files\Toshiba Shared

[14/09/2007|03:52] C:\Program Files\Common Files\Ulead Systems

[05/02/2008|15:59] C:\Program Files\Common Files\WindowsLiveInstaller

---------------------------[ Process ]--------------------------

... 72

iexplore.exe ~ [5632]

----------------------[ Recherche avec S_Lop ]---------------------

C:\ProgramData\Curb Start Acid.o72lvtz

-----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------

C:\ProgramData\Admin Inter 1 Mags

C:\ProgramData\Admin Inter 1 Mags\Support aim.exe

C:\Program Files\Circle Developement

----------------------[ Verification du Registre ]----------------------

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

..... OK !

--------------------[ Verification du fichier Hosts ]---------------------

Fichier Hosts PROPRE

----------------[ Recherche de fichiers avec Catchme ]-----------------

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-04-28 20:00:42

Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden files ...

scan completed successfully

hidden processes: 0

hidden files: 0

--------------------[ Recherche d'autres infections ]---------------------

=> C:\Users\Kalou\Music\Ragga\098 METAL SOUND - JOUE PAS AVEC LE CRACK RMX.mp3

/!\ [Fich:27][Doss:5] C:\Users\Kalou\AppData\Local\Temp

/!\ [Fich:62][Doss:1] C:\Users\Kalou\AppData\Roaming\MICROS~1\Windows\Cookies

/!\ [Fich:978][Doss:4] C:\Users\Kalou\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5

[ UAC => 1 ]

--------------------[ Fin du rapport a 20:01:10,00 ]----------------------

Merci!

Thanos · le 29 avril 2008

salut

L'UAC toujours désactivé, continue comme ceci stp >>

Relance Lop S&D

Choisis cette fois ci l'Option 2 ( Suppression )
Ne ferme pas la fenêtre lors de la suppression !
Poste le rapport généré ( C:\lopR.txt ).

(Si le Bureau ne réapparaît pas presse Ctrl + Alt + Suppr, Onglet Fichier, Nouvelle tâche, tape explorer.exe et valide)

Par curiosité: as tu utilisé Norton_Removal_Tool ?

@++

le 29 avril 2008

salut

L'UAC toujours désactivé, continue comme ceci stp >>

Relance Lop S&D

Choisis cette fois ci l'Option 2 ( Suppression )

Ne ferme pas la fenêtre lors de la suppression !

Poste le rapport généré ( C:\lopR.txt ).

(Si le Bureau ne réapparaît pas presse Ctrl + Alt + Suppr, Onglet Fichier, Nouvelle tâche, tape explorer.exe et valide)

Par curiosité: as tu utilisé Norton_Removal_Tool ?

@++

********************************************************************************

********************************************Salut , oui j'ai utilisé Norton-Removal-Tool, si tu me le demande c'est parce que ça n'a peut être pas marcher alors!! Je t'envoi la dernière analyse que tu ma conseillé.

-----------------------[ Lop S&D 4.2.0-2 XP/Vista ]---------------------

[ Windows 'Longhorn' (NT 6.0) Workstation Build 6000 ]

[ USER : Kalou ] [ "C:\Lop SD" ] [ Selection : 2 ]

[ 29/04/2008 | 18:27:05,86 ] [ PC : PC-DE-KALOU ]

[ MAJ : 27-04-2008 | 11:15 ]

[ UAC => 0 ]

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION /////////////////////////////

Supprimé! - C:\ProgramData\Admin Inter 1 Mags\Support aim.exe

Supprimé! - C:\ProgramData\Curb Start Acid.o72lvtz

Supprimé! - C:\ProgramData\Admin Inter 1 Mags

Supprimé! - C:\Program Files\Circle Developement

Restauré! - Fichier Hosts

//////////////////////////////////////-\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

-------------[ Listing des dossiers dans Application Data ]------------

[16/04/2008|16:30] C:\Users\Kalou\AppData\Roaming\Adobe\Linguistics

[14/04/2008|16:59] C:\Users\Kalou\AppData\Roaming\Adobe\Flash Player

[14/04/2008|16:41] C:\Users\Kalou\AppData\Roaming\Adobe\Acrobat

[14/04/2008|16:41] C:\Users\Kalou\AppData\Roaming\ATI\ACE

[26/04/2008|23:46] C:\Users\Kalou\AppData\Roaming\Google\Local Search History

[26/04/2008|23:56] C:\Users\Kalou\AppData\Roaming\Macromedia\Flash Player

[28/04/2008|21:56] C:\Users\Kalou\AppData\Roaming\Microsoft\Word

[28/04/2008|21:40] C:\Users\Kalou\AppData\Roaming\Microsoft\?preuve

[28/04/2008|21:39] C:\Users\Kalou\AppData\Roaming\Microsoft\ModŠles

[28/04/2008|21:37] C:\Users\Kalou\AppData\Roaming\Microsoft\Office