Aller au contenu

  • Pas encore inscrit ?

    Pourquoi ne pas vous inscrire ? C'est simple, rapide et gratuit.
    Pour en savoir plus, lisez Les avantages de l'inscription... et la Charte de Zébulon.
    De plus, les messages que vous postez en tant qu'invité restent invisibles tant qu'un modérateur ne les a pas validés. Inscrivez-vous, ce sera un gain de temps pour tout le monde, vous, les helpeurs et les modérateurs ! :wink:

Alerte récurrente de l'antivirus

jezabel

Par jezabel
dans Analyses et éradication malwares

 Partager

Messages recommandés

Falkra Devil Member !

Falkra

Posté(e)
Posté(e)
Très prudente sur Internet, je vois pas où j'ai pu attraper ces sales bestioles ! T'as une idée, toi ?

 

Prudente ? Je pense que tu as eu ça là :

 

C:\Program Files\eMule\emule.exe

 

Un petit point sur les risques du P2P en matière de sécurité logicielle (par Ogu) :

img-103332veltm.jpg

Lien vers le commentaire
Partager sur d’autres sites
Falkra Devil Member !

Falkra

Posté(e)
Posté(e)

Mets en quarantaine.

 

 

Je te recommande un scan complet avec Antivir. Mets-le à jour d'abord (clic droit, start update sur l'icône près de l'horloge).

Une fois à jour, double-clique sur son icône près de l'horloge, cela ouvre l'interface principale, puis clique sur "Scan system now" à droite de "Last complete system scan".

 

/!\ Cela peut être long.

Tu peux sauvegarder le rapport en fin de parcours (bouton "Report").

 

Si Antivir détecte des fichiers infectés, mets en quarantaine (choisis "Move to quarantine" dans la liste des actions. Tu peux automatiser ce type d'action en cochant une case), comme ci dessous :

 

img-112858s188k.gif

Cela permet de ne pas rester à la surveiller. :P

Lien vers le commentaire
Partager sur d’autres sites
jezabel Member

jezabel

Posté(e)
  • Auteur
Posté(e)

Emule, je l'utilise de façon très ponctuelle et jamais pour attraper du GENKEY. Ceci dit, il faudra que je l'utilise avec encore plus de prudence quoi...

 

Voilà le rapport de Antivir :

 

Avira AntiVir Personal

Report file date: dimanche 7 décembre 2008 20:53

 

Scanning for 1075399 virus strains and unwanted programs.

 

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows Vista

Windows version: (Service Pack 1) [6.0.6001]

Boot mode: Normally booted

Username: SYSTEM

Computer name: NEGRE

 

Version information:

BUILD.DAT : 8.2.0.337 16934 Bytes 18/11/2008 13:05:00

AVSCAN.EXE : 8.1.4.10 315649 Bytes 28/11/2008 08:37:21

AVSCAN.DLL : 8.1.4.0 40705 Bytes 17/07/2008 20:55:16

LUKE.DLL : 8.1.4.5 164097 Bytes 17/07/2008 20:55:16

LUKERES.DLL : 8.1.4.0 12033 Bytes 17/07/2008 20:55:16

ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 20:21:54

ANTIVIR1.VDF : 7.1.0.56 411136 Bytes 09/11/2008 19:39:04

ANTIVIR2.VDF : 7.1.0.160 571392 Bytes 30/11/2008 19:13:50

ANTIVIR3.VDF : 7.1.0.195 219648 Bytes 05/12/2008 17:08:42

Engineversion : 8.2.0.42

AEVDF.DLL : 8.1.0.6 102772 Bytes 15/10/2008 16:23:38

AESCRIPT.DLL : 8.1.1.17 336251 Bytes 05/12/2008 17:08:50

AESCN.DLL : 8.1.1.5 123251 Bytes 07/11/2008 19:40:26

AERDL.DLL : 8.1.1.3 438645 Bytes 05/11/2008 19:40:40

AEPACK.DLL : 8.1.3.4 393591 Bytes 11/11/2008 19:40:59

AEOFFICE.DLL : 8.1.0.32 196987 Bytes 05/12/2008 17:08:48

AEHEUR.DLL : 8.1.0.74 1519990 Bytes 05/12/2008 17:08:47

AEHELP.DLL : 8.1.2.0 119159 Bytes 20/11/2008 17:09:16

AEGEN.DLL : 8.1.1.6 323955 Bytes 29/11/2008 08:36:30

AEEMU.DLL : 8.1.0.9 393588 Bytes 15/10/2008 16:23:28

AECORE.DLL : 8.1.5.2 172405 Bytes 29/11/2008 08:36:29

AEBB.DLL : 8.1.0.3 53618 Bytes 15/10/2008 16:23:26

AVWINLL.DLL : 1.0.0.12 15105 Bytes 17/07/2008 20:55:16

AVPREF.DLL : 8.0.2.0 38657 Bytes 17/07/2008 20:55:16

AVREP.DLL : 8.0.0.2 98344 Bytes 01/08/2008 06:00:37

AVREG.DLL : 8.0.0.1 33537 Bytes 17/07/2008 20:55:16

AVARKT.DLL : 1.0.0.23 307457 Bytes 15/04/2008 16:51:23

AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 17/07/2008 20:55:16

SQLITE3.DLL : 3.3.17.1 339968 Bytes 15/04/2008 16:51:24

SMTPLIB.DLL : 1.2.0.23 28929 Bytes 17/07/2008 20:55:17

NETNT.DLL : 8.0.0.1 7937 Bytes 15/04/2008 16:51:24

RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 17/07/2008 20:55:14

RCTEXT.DLL : 8.0.52.0 86273 Bytes 17/07/2008 20:55:14

 

Configuration settings for the scan:

Jobname..........................: Complete system scan

Configuration file...............: c:\program files\antivir personaledition classic\sysscan.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: on

Scan boot sector.................: on

Boot sectors.....................: C:,

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: on

Scan all files...................: All files

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: high

Deviating risk categories........: +APPL,+GAME,+JOKE,+PCK,+SPR,

 

Start of the scan: dimanche 7 décembre 2008 20:53

 

Starting search for hidden objects.

'85376' objects were checked, '0' hidden objects were found.

 

The scan of running processes will be started

Scan process 'msfeedssync.exe' - '0' Module(s) have been scanned

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'taskeng.exe' - '1' Module(s) have been scanned

Scan process 'firefox.exe' - '1' Module(s) have been scanned

Scan process 'mstinit.exe' - '1' Module(s) have been scanned

Scan process 'NMIndexStoreSvr.exe' - '1' Module(s) have been scanned

Scan process 'NMIndexingService.exe' - '1' Module(s) have been scanned

Scan process 'NMBgMonitor.exe' - '1' Module(s) have been scanned

Scan process 'MaxMenuMgr.exe' - '1' Module(s) have been scanned

Scan process 'jusched.exe' - '1' Module(s) have been scanned

Scan process 'IAAnotif.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'acrotray.exe' - '1' Module(s) have been scanned

Scan process 'MSASCui.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'dwm.exe' - '1' Module(s) have been scanned

Scan process 'taskeng.exe' - '1' Module(s) have been scanned

Scan process 'SearchIndexer.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'ULCDRSvr.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'TCPSVCS.EXE' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'SyncServices.exe' - '1' Module(s) have been scanned

Scan process 'inetinfo.exe' - '1' Module(s) have been scanned

Scan process 'IAANTmon.exe' - '1' Module(s) have been scanned

Scan process 'AdskScSrv.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'a2service.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'Ati2evxx.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'SLsvc.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'audiodg.exe' - '0' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'Ati2evxx.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'lsm.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'wininit.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

54 processes with 54 modules were scanned

 

Starting master boot sector scan:

Master boot sector HD0

[iNFO] No virus was found!

 

Start scanning boot sectors:

Boot sector 'C:\'

[iNFO] No virus was found!

 

Starting to scan the registry.

The registry was scanned ( '42' files ).

 

 

Starting the file scan:

 

Begin scan in 'C:\'

C:\hiberfil.sys

[WARNING] The file could not be opened!

C:\pagefile.sys

[WARNING] The file could not be opened!

C:\Program Files\AntiVir PersonalEdition Classic\avnotify.exe

[WARNING] The file could not be opened!

 

 

End of the scan: dimanche 7 décembre 2008 21:55

Used time: 1:02:36 Hour(s)

 

The scan has been done completely.

 

26916 Scanning directories

643299 Files were scanned

0 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

0 files were deleted

0 files were repaired

0 files were moved to quarantine

0 files were renamed

3 Files cannot be scanned

643296 Files not concerned

8840 Archives were scanned

3 Warnings

0 Notes

85376 Objects were scanned with rootkit scan

0 Hidden objects were found

Lien vers le commentaire
Partager sur d’autres sites
Falkra Devil Member !

Falkra

Posté(e)
Posté(e)

Ca doit aller pourtant, ou alors tu la réinfectes avec du contenu à toi, mais on ne voit rien dans le rapport.

 

Télécharge random's system information tool (RSIT) par random/random et sauvegarde-le sur le Bureau.

  • Double-clique sur RSIT.exe afin de lancer RSIT.
  • Clique Continue à l'écran Disclaimer.
  • Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
  • Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (<<qui sera affiché) ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).
  • NB : Les rapports sont sauvegardés dans le dossier C:\rsit
    Ca fait deux rapports donc. :P

Lien vers le commentaire
Partager sur d’autres sites
jezabel Member

jezabel

Posté(e)
  • Auteur
Posté(e)

log.txt :

Logfile of random's system information tool 1.04 (written by random/random)

Run by nègre at 2008-12-07 22:07:46

Microsoft® Windows Vista™ Professionnel Service Pack 1

System drive C: has 131 GB (55%) free of 238 GB

Total RAM: 3199 MB (64% free)

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:07:55, on 07/12/2008

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

 

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Adobe\Acrobat 7.0\Distillr\acrotray.exe

C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\Program Files\Maxtor\OneTouch Status\MaxMenuMgr.exe

C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

C:\Windows\System32\drivers\mstinit.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Users\nègre\Desktop\RSIT.exe

C:\Users\nègre\nègre.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

F3 - REG:win.ini: load=C:\Windows\System32\drivers\mstinit.exe

O1 - Hosts: ::1 localhost

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL

O4 - HKLM\..\Run: [iAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [uVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

O4 - HKLM\..\Policies\Explorer\Run: [Mstsc] C:\Windows\System\mstsc.exe /waitservice

O4 - HKCU\..\Policies\Explorer\Run: [CmSTP] C:\Users\NGRE~1\AppData\Local\Temp\cmstp.exe /waitservice

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [spool] C:\Users\NGRE~1\AppData\Roaming\spoolsv.exe /waitservice (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [spool] C:\Users\NGRE~1\AppData\Roaming\spoolsv.exe /waitservice (User 'Default user')

O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll

O10 - Broken Internet access because of LSP provider 'c:\program files\bonjour\mdnsnsp.dll' missing

O13 - Gopher Prefix:

O16 - DPF: {E3E6FFEE-748F-43BA-87AE-B1F1B11ED193} (MegaMocapWeb Control) - http://www.charactermotion.com/products/po...egaMocapWeb.ocx

O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe

O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe

O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files\Maxtor\Sync\SyncServices.exe

O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

 

--

End of file - 8330 bytes

 

======Scheduled tasks folder======

 

C:\Windows\tasks\User_Feed_Synchronization-{1559A6B9-87C7-4552-AD27-F2EAF32344CB}.job

 

======Registry dump======

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]

Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]

C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-09-15 1562960]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]

SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]

AcroIEToolbarHelper Class - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2004-12-14 225280]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2004-12-14 225280]

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]

"Acrobat Assistant 7.0"=C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe [2004-12-14 483328]

"avgnt"=C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe [2008-07-17 266497]

"CloneCDElbyCDFL"=C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe [2002-11-02 45056]

"IAAnotif"=C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [2007-10-03 178712]

"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-01 153136]

"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]

"UVS10 Preload"=C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe [2006-03-06 36864]

"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-03-28 413696]

"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]

"mxomssmenu"=C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe [2008-07-21 169312]

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]

"Mstsc"=C:\Windows\System\mstsc.exe [2008-09-05 86016]

 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-06-27 152872]

 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]

"CmSTP"=C:\Users\NGRE~1\AppData\Local\Temp\cmstp.exe [2008-09-05 86016]

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

"EnableLUA"=0

"EnableUIADesktopToggle"=0

 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDriveTypeAutoRun"=145

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7f8781a5-bec9-11dc-a8d6-00196610b979}]

shell\Auto\command - cmd /C launch.bat

shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL cmd /C launch.bat

 

 

======List of files/folders created in the last 1 months======

 

2008-12-07 22:07:46 ----D---- C:\rsit

2008-12-07 20:28:28 ----A---- C:\Users\nègre\AppData\Roaming\spoolsv.exe

2008-12-07 19:21:09 ----D---- C:\_OTMoveIt

2008-12-07 19:19:57 ----A---- C:\Windows\cisvc.exe

2008-11-30 16:18:30 ----A---- C:\Windows\ntbtlog.txt

2008-11-30 14:13:44 ----A---- C:\Windows\system32\wups2.dll

2008-11-30 14:13:43 ----A---- C:\Windows\system32\wucltux.dll

2008-11-30 14:13:43 ----A---- C:\Windows\system32\wuaueng.dll

2008-11-30 14:13:43 ----A---- C:\Windows\system32\wuauclt.exe

2008-11-30 14:13:32 ----A---- C:\Windows\system32\wups.dll

2008-11-30 14:13:32 ----A---- C:\Windows\system32\wudriver.dll

2008-11-30 14:13:31 ----A---- C:\Windows\system32\wuapi.dll

2008-11-30 14:13:28 ----A---- C:\Windows\system32\wuwebv.dll

2008-11-30 14:13:28 ----A---- C:\Windows\system32\wuapp.exe

2008-11-28 12:16:45 ----A---- C:\Windows\logman.exe

2008-11-28 12:12:32 ----D---- C:\Users\nègre\AppData\Roaming\Malwarebytes

2008-11-28 12:12:26 ----D---- C:\ProgramData\Malwarebytes

2008-11-28 12:12:26 ----D---- C:\Program Files\Malwarebytes' Anti-Malware

2008-11-28 09:41:01 ----A---- C:\Windows\system32\connect.dll

2008-11-28 09:40:59 ----A---- C:\Windows\system32\PortableDeviceApi.dll

2008-11-28 09:40:55 ----A---- C:\Windows\system32\WindowsCodecsExt.dll

2008-11-28 09:40:55 ----A---- C:\Windows\system32\WindowsCodecs.dll

2008-11-28 09:40:55 ----A---- C:\Windows\system32\PhotoMetadataHandler.dll

2008-11-20 19:06:34 ----A---- C:\Windows\system32\gpprefcl.dll

2008-11-14 00:11:56 ----D---- C:\Program Files\SupraASCIIArt

2008-11-12 19:32:22 ----A---- C:\Windows\system32\msxml3.dll

2008-11-12 19:32:20 ----A---- C:\Windows\system32\msxml6.dll

 

======List of files/folders modified in the last 1 months======

 

2008-12-07 22:07:55 ----D---- C:\Windows\Prefetch

2008-12-07 22:07:53 ----D---- C:\Windows\Temp

2008-12-07 19:32:32 ----D---- C:\Program Files\Mozilla Firefox

2008-12-07 19:28:12 ----D---- C:\Windows\System32

2008-12-07 19:28:12 ----D---- C:\Windows\inf

2008-12-07 19:28:12 ----A---- C:\Windows\system32\PerfStringBackup.INI

2008-12-07 19:25:13 ----D---- C:\Windows\system32\inetsrv

2008-12-07 19:23:40 ----A---- C:\Windows\Ulead32.ini

2008-12-07 19:21:10 ----D---- C:\Windows\system32\drivers

2008-12-07 19:21:10 ----D---- C:\Windows\system

2008-12-07 19:19:57 ----D---- C:\Windows

2008-12-07 13:50:05 ----D---- C:\Program Files\AntiVir PersonalEdition Classic

2008-12-07 13:50:04 ----D---- C:\ProgramData\AntiVir PersonalEdition Classic

2008-12-07 13:49:34 ----SHD---- C:\Windows\Installer

2008-12-04 20:27:01 ----SHD---- C:\System Volume Information

2008-11-30 16:47:12 ----D---- C:\Windows\rescache

2008-11-30 16:29:16 ----D---- C:\Windows\winsxs

2008-11-30 16:19:13 ----D---- C:\Windows\system32\catroot

2008-11-30 16:18:32 ----D---- C:\Windows\system32\fr-FR

2008-11-30 14:25:40 ----D---- C:\Users\nègre\AppData\Roaming\OpenOffice.org2

2008-11-29 15:31:17 ----HD---- C:\ProgramData

2008-11-29 15:27:51 ----D---- C:\Program Files\a-squared Free

2008-11-29 15:27:35 ----D---- C:\Program Files\CCleaner

2008-11-29 15:27:18 ----D---- C:\Program Files\Eraser

2008-11-29 15:27:05 ----RD---- C:\Program Files

2008-11-29 15:26:17 ----D---- C:\Program Files\Spybot - Search & Destroy

2008-11-29 15:22:36 ----D---- C:\Program Files\SpywareBlaster

2008-11-29 08:18:48 ----D---- C:\Windows\system32\catroot2

2008-11-22 14:35:55 ----A---- C:\Windows\NeroDigital.ini

2008-11-21 09:51:15 ----D---- C:\ProgramData\Spybot - Search & Destroy

2008-11-21 09:46:33 ----D---- C:\Windows\Debug

 

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

 

R1 avgio;avgio; \??\C:\Program Files\AntiVir PersonalEdition Classic\avgio.sys [2007-02-27 11840]

R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2008-11-28 75072]

R1 CSC;Offline Files Driver; C:\Windows\system32\drivers\csc.sys [2008-01-19 350720]

R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2007-03-01 28352]

R2 ElbyCDIO;ElbyCDIO Driver; C:\Windows\System32\Drivers\ElbyCDIO.sys [2002-11-29 16320]

R2 ROB_A;Pinnacle WDM PCTV Audio Capture; C:\Windows\system32\DRIVERS\rob_a.sys [2003-02-10 17664]

R2 ROB_V;Pinnacle WDM PCTV Video Capture; C:\Windows\system32\drivers\rob_v.sys [2003-04-11 125568]

R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2007-12-21 3478528]

R3 avgntflt;avgntflt; \??\C:\Program Files\AntiVir PersonalEdition Classic\avgntflt.sys [2008-05-31 52032]

R3 ElbyCDFL;ElbyCDFL; C:\Windows\System32\Drivers\ElbyCDFL.sys [2002-11-28 15360]

R3 HabuFltr;Habu Mouse; C:\Windows\system32\drivers\habu.sys [2006-10-23 27776]

R3 HdAudAddService;Pilote de fonction UAA 1.1 Microsoft pour le service High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]

R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2008-01-25 106496]

S3 61883;Pilote d'unité 61883; C:\Windows\system32\DRIVERS\61883.sys [2008-01-19 45696]

S3 Avc;Périphérique AVC; C:\Windows\system32\DRIVERS\avc.sys [2008-01-19 40448]

S3 driverhardwarev2;driverhardwarev2; \??\C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys [2008-11-02 15360]

S3 drmkaud;Filtre de décodeur DRM (Noyau Microsoft); C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]

S3 gmer;gmer; C:\Windows\System32\DRIVERS\gmer.sys [2007-08-08 70001]

S3 MSDV;Microsoft DV Camera and VCR; C:\Windows\system32\DRIVERS\msdv.sys [2008-01-19 52608]

S3 MSKSSRV;Proxy de service de répartition Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]

S3 MSPCLOCK;Proxy d'horloge de répartition Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]

S3 MSPQM;Proxy de gestion de qualité de répartition Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]

S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]

S3 MXOPSWD;Maxtor OneTouch Security Driver; C:\Windows\system32\DRIVERS\mxopswd.sys [2007-05-03 22152]

S3 Point32;Microsoft IntelliPoint Filter Driver; C:\Windows\system32\DRIVERS\point32k.sys [2006-11-07 24064]

S3 usbscan;Pilote de scanneur USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-19 35328]

S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]

S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

 

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

 

R2 a2free;a-squared Free Service; C:\Program Files\a-squared Free\a2service.exe [2008-02-04 366712]

R2 AntiVirScheduler;AntiVir PersonalEdition Classic Scheduler; C:\Program Files\AntiVir PersonalEdition Classic\sched.exe [2008-10-24 68865]

R2 AntiVirService;AntiVir PersonalEdition Classic Guard; C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe [2008-10-24 151297]

R2 AppHostSvc;@%windir%\system32\inetsrv\iisres.dll,-30011; C:\Windows\system32\svchost.exe [2008-01-19 21504]

R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2007-12-21 643072]

R2 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2008-02-06 79360]

R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2008-01-19 21504]

R2 IAANTMON;Intel® Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe [2007-10-03 358936]

R2 IISADMIN;@%windir%\system32\inetsrv\iisres.dll,-30007; C:\Windows\system32\inetsrv\inetinfo.exe [2008-01-19 13824]

R2 Maxtor Sync Service;Maxtor Service; C:\Program Files\Maxtor\Sync\SyncServices.exe [2008-07-21 193888]

R2 simptcp;@%SystemRoot%\system32\simptcp.dll,-200; C:\Windows\System32\tcpsvcs.exe [2006-11-02 9728]

R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2005-01-31 49152]

R2 W3SVC;@%windir%\system32\inetsrv\iisres.dll,-30003; C:\Windows\system32\svchost.exe [2008-01-19 21504]

R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]

R3 WAS;@%windir%\system32\inetsrv\iisres.dll,-30001; C:\Windows\system32\svchost.exe [2008-01-19 21504]

S2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe []

S2 mi-raysat_3dsmax9_32;mental ray 3.5 Satellite (32-bit); C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe [2006-09-29 65536]

S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2007-07-19 72704]

S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2008-01-19 21504]

S3 aspnet_state;@%windir%\system32\inetsrv\iisres.dll,-30009; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-01-05 33800]

S3 Fax;@%systemroot%\system32\fxsresm.dll,-118; C:\Windows\system32\fxssvc.exe [2008-01-19 523776]

S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-03-06 654848]

S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-03 69632]

S3 maconfservice;Ma-Config Service; C:\Program Files\ma-config.com\maconfservice.exe [2008-11-02 195752]

S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-06-29 800040]

S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2008-01-19 21504]

S3 wbengine;@%systemroot%\system32\wbengine.exe,-104; C:\Windows\system32\wbengine.exe [2008-01-19 917504]

S3 WMSvc;@%windir%\system32\inetsrv\iisres.dll,-20001; C:\Windows\system32\inetsrv\wmsvc.exe [2008-01-19 11264]

 

-----------------EOF-----------------

 

 

 

et info.txt :

info.txt logfile of random's system information tool 1.04 2008-12-07 22:07:56

 

======Uninstall list======

 

-->C:\Program Files\Nero\Nero 7\\nero\uninstall\UNNERO.exe /UNINSTALL

-->C:\Windows\UNNeroBackItUp.exe /UNINSTALL

-->C:\Windows\UNNeroMediaHome.exe /UNINSTALL

-->C:\Windows\UNNeroShowTime.exe /UNINSTALL

-->C:\Windows\UNNeroVision.exe /UNINSTALL

-->C:\Windows\UNRecode.exe /UNINSTALL

-->MsiExec.exe /I{9A346205-EA92-4406-B1AB-50379DA3F057}

3dsmax ancillary install-->MsiExec.exe /I{7C8B5E63-821A-4DFB-BDFA-19854D88EC5C}

7-Zip 4.42-->"C:\Program Files\7-Zip\Uninstall.exe"

Ad-Aware SE Personal-->C:\PROGRA~1\Lavasoft\AD-AWA~1\UNWISE.EXE C:\PROGRA~1\Lavasoft\AD-AWA~1\INSTALL.LOG

Adobe Acrobat 7.0-->msiexec /I {AC76BA86-1033-F400-8796-100000000002}

Adobe Anchor Service CS3-->MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}

Adobe Asset Services CS3-->MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}

Adobe Bridge 1.0-->MsiExec.exe /I{B74D4E10-6884-0000-0000-000000000101}

Adobe Bridge CS3-->MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}

Adobe Bridge Start Meeting-->MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}

Adobe Camera Raw 4.0-->MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}

Adobe CMaps-->MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}

Adobe Color - Photoshop Specific-->MsiExec.exe /I{A2D81E70-2A98-4A08-A628-94388B063C5E}

Adobe Color Common Settings-->C:\Program Files\Common Files\Adobe\Installers\6c8e2cb4fd241c55406016127a6ab2e\Setup.exe

Adobe Color Common Settings-->MsiExec.exe /I{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}

Adobe Color EU Recommended Settings-->MsiExec.exe /I{73B5D990-04EA-4751-B10F-5534770B91F2}

Adobe Color JA Extra Settings-->MsiExec.exe /I{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}

Adobe Color NA Extra Settings-->MsiExec.exe /I{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}

Adobe Common File Installer-->MsiExec.exe /I{8EDBA74D-0686-4C99-BFDD-F894678E5101}

Adobe Default Language CS3-->MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}

Adobe Device Central CS3-->MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}

Adobe ExtendScript Toolkit 2-->C:\Program Files\Common Files\Adobe\Installers\3e054d2218e7aa282c2369d939e58ff\Setup.exe

Adobe ExtendScript Toolkit 2-->MsiExec.exe /I{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}

Adobe Flash CS3 Professional-->C:\Program Files\Common Files\Adobe\Installers\b2b4b1546e74314f8131ded43e4bd9d\Setup.exe

Adobe Flash CS3-->MsiExec.exe /I{80FD3971-8482-49C8-BA8C-B6464A15882F}

Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe

Adobe Flash Player 9 ActiveX-->MsiExec.exe /X{BC4F8E84-5E29-49EC-B4E7-E6F9CB50986C}

Adobe Flash Player ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe

Adobe Flash Video Encoder-->MsiExec.exe /I{1B0BCA28-1F11-4D60-8A2F-DEBE04B5341E}

Adobe Fonts All-->MsiExec.exe /I{6ABE0BEE-D572-4FE8-B434-9E72A289431B}

Adobe Help Center 1.0-->MsiExec.exe /I{E9787678-119F-4D52-B551-6739B2B22101}

Adobe Help Viewer CS3-->MsiExec.exe /I{04AF207D-9A77-465A-8B76-991F6AB66245}

Adobe Illustrator CS2-->msiexec /I {7F9A0582-482D-4F0B-B85C-C1418418077F}

Adobe InDesign CS2 Trial-->msiexec /I{7F4C8163-F259-49A0-A018-2857A90578BC}

Adobe Linguistics CS3-->MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078}

Adobe PDF Library Files-->MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}

Adobe Photoshop CS2-->msiexec /I {236BB7C4-4419-42FD-040C-2E257A25E34D}

Adobe Photoshop CS3-->C:\Program Files\Common Files\Adobe\Installers\32e9033392a51340b32fdc6ad893ab7\Setup.exe

Adobe Photoshop CS3-->MsiExec.exe /I{BF794769-8875-4E01-B7BE-E00104604F4A}

Adobe Premiere Pro CS3 Functional Content-->MsiExec.exe /I{50F102CA-4BE2-41A9-9810-5BB05EB91B9A}

Adobe Premiere Pro CS3-->C:\Program Files\Common Files\Adobe\Installers\32fdd767b4383606e8168e834af5d90\Setup.exe

Adobe Premiere Pro CS3-->MsiExec.exe /I{58DCEEE5-532E-44F4-B1D7-A146EF9E9FDA}

Adobe Reader 9 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A90000000001}

Adobe Setup-->MsiExec.exe /I{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}

Adobe Setup-->MsiExec.exe /I{82503EA7-7E08-4AA8-90E9-BE4D0A6D453F}

Adobe Setup-->MsiExec.exe /I{926DEB4E-2B0A-4C5C-AE4A-BF6C06949702}

Adobe Setup-->MsiExec.exe /I{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}

Adobe Setup-->MsiExec.exe /I{BB81360F-041C-4CF7-B15E-71380D154244}

Adobe Shockwave Player-->C:\Windows\System32\Macromed\SHOCKW~1\UNWISE.EXE C:\Windows\System32\Macromed\SHOCKW~1\Install.log

Adobe Stock Photos 1.0-->MsiExec.exe /I{786C5747-0C40-4930-9AFE-113BCE553101}

Adobe Stock Photos CS3-->MsiExec.exe /I{29E5EA97-5F74-4A57-B8B2-D4F169117183}

Adobe SVG Viewer 3.0-->C:\Program Files\Common Files\Adobe\SVG Viewer 3.0\Uninstall\Winstall.exe -u -fC:\Program Files\Common Files\Adobe\SVG Viewer 3.0\Uninstall\Install.log

Adobe Type Support-->MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}

Adobe Update Manager CS3-->MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}

Adobe Version Cue CS3 Client-->MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}

Adobe WinSoft Linguistics Plugin-->MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}

Adobe XMP DVA Panels CS3-->MsiExec.exe /I{0224CACC-994D-45F8-B973-D65056EA9C2F}

Adobe XMP Panels CS3-->MsiExec.exe /I{D5A31AB1-345D-47C7-A87B-036A669F6DF1}

Apple Software Update-->MsiExec.exe /I{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}

a-squared Free 3.0-->"C:\Program Files\a-squared Free\unins000.exe"

ATI - Software Uninstall Utility-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe

Autodesk 3ds Max 9 32-bit-->MsiExec.exe /I{E96D4088-AAC5-437F-9E39-EC0E387897B4}

Autodesk DWF Viewer 7-->MsiExec.exe /I{9A346205-EA92-4406-B1AB-50379DA3F057}

Avira AntiVir Personal - Free Antivirus-->C:\Program Files\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE

Backburner-->MsiExec.exe /I{3D347E6D-5A03-4342-B5BA-6A771885F379}

CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"

CloneCD-->"C:\Program Files\Elaborate Bytes\CloneCD\ccd-uninst.exe" /D="C:\Program Files\Elaborate Bytes\CloneCD"

Clothes Converter 3.0-->"C:\Program Files\3D Utils\Clothes Converter\unins000.exe"

Colin McRae - DiRT-->"C:\Program Files\Codemasters\Colin McRae - DiRT\unins000.exe"

Corel Painter IX-->MsiExec.exe /I{A0383B7D-81A2-49D3-BE06-C0FD9EFB9DFC}

Digital Element Aurora-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CDA31C03-D67C-48DF-BFE9-B0519818341E}\Setup.exe"

DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER

e-Carte Bleue La Banque Postale-->"C:\Program Files\InstallShield Installation Information\{11B0F8D4-FD80-4800-ABA8-50D28FF769AF}\setup.exe" -runfromtemp -l0x040c -removeonly

eMule-->"C:\Program Files\eMule\Uninstall.exe"

FBX Plugin 2006.08 for Max 9.0-->C:\Program Files\Autodesk\FBX\FbxPlugins\2006.08\Max90\Uninstall.exe

FileZilla (remove only)-->"C:\Program Files\FileZilla\uninstall.exe"

finalToon R2.0-->MsiExec.exe /I{1A7EC1C1-CF8D-42DF-86B3-FC3A87FC8F85}

HijackThis 2.0.2-->"C:\Users\nègre\HijackThis.exe" /uninstall

Indeo® software-->C:\Windows\IsUninst.exe -f"C:\Program Files\Intel\Indeo\Uninst.isu" -c"C:\Program Files\Intel\Indeo\SavedSystemFiles\indounin.dll"

Inkscape 0.46-->C:\Program Files\Inkscape\Uninstall.exe

Intel® Matrix Storage Manager-->C:\Windows\System32\Imsmudlg.exe

Java 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}

Java 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}

Java 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}

K-Lite Codec Pack 3.2.5 Full-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"

Kptic-->MsiExec.exe /X{4312AB5F-7C43-461E-B48B-EDFA6B9CD3D6}

Ma-Config.com-->MsiExec.exe /X{DD987A54-122B-4CFD-A8C5-5577027A6B78}

Macromedia Extension Manager-->MsiExec.exe /I{3C8C9FB3-5FDF-40B4-B314-EAD722728C76}

Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"

Maxtor Manager-->"C:\Program Files\InstallShield Installation Information\{4D36E953-4456-4F8F-BC44-90BC4AA59889}\setup.exe" -runfromtemp -l0x040c -removeonly

Maxtor Manager-->MsiExec.exe /I{4D36E953-4456-4F8F-BC44-90BC4AA59889}

Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}

Mozilla Firefox (3.0.4)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe

Mozilla Thunderbird (2.0.0.17)-->C:\Program Files\Mozilla Thunderbird\uninstall\helper.exe

MP3 Player Utilities 3.79-->MsiExec.exe /I{7784A172-61F1-445E-8368-601607E0DD22}

MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}

MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}

MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}

MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}

Nero 7-->MsiExec.exe /X{CF097717-F174-4144-954A-FBC4BF301036}

neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}

Notepad++-->C:\Program Files\Notepad++\uninstall.exe

OpenAL-->"C:\Program Files\OpenAL\OalinstGridRelease.exe" /U

OpenOffice.org 2.2-->MsiExec.exe /I{7FD7F10E-0666-4C9F-A0A8-422EA5E31C4C}

PDF Settings-->MsiExec.exe /I{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}

PHP 5.2.3-->MsiExec.exe /I{F66C0680-EBE5-4A01-BC13-D5F360CFA0EF}

Poser 7-->C:\Windows\unvise32.exe C:\Program Files\e frontier\Poser 7\uninstal.log

PoserFusion for 3ds Max-->"C:\Program Files\Autodesk\3ds Max 9\unins000.exe"

QuickTime-->MsiExec.exe /I{1838C5A2-AB32-4145-85C1-BB9B8DFA24CD}

Realtek 8169, 8168, 8101E and 8102E Ethernet Network Card Driver for Windows Vista-->C:\Program Files\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\setup.exe -runfromtemp -l0x040c -removeonly

Safari-->MsiExec.exe /I{F0E8F94D-6E68-4B35-92DF-3AA6DC6A6768}

SmartSound Quicktracks Plugin-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}

Spelling Dictionaries Support For Adobe Reader 8-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-800000000003}

Spybot - Search & Destroy 1.5.2.20-->"C:\Windows\unins000.exe"

Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins001.exe"

SpywareBlaster v3.5.1-->"C:\Program Files\SpywareBlaster\unins000.exe"

Storm Angel (remove only)-->"C:\Program Files\StormAngel\uninst.exe"

Ulead VideoStudio 10-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E188D820-1218-4E28-8BCA-91134C3664C2}\Setup.exe" -l0x9

Uniblue RegistryBooster 2-->"C:\Program Files\Uniblue\RegistryBooster 2\unins000.exe"

Vue 6 xStream 32bit-->C:\Program Files\e-on software\Vue 6 xStream\Uninstall.exe

WinAce Archiver-->"C:\Program Files\WinAce\SXUNINST.EXE" "C:\Program Files\WinAce\SXUNINST.INI"

Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}

WinISO 5.3-->"C:\Program Files\WinISO\unins000.exe"

Xpand Rally Xtreme-->C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{025D4907-5D2E-4146-95F7-54E18BE087DA} /Z"UNINSTALL"

 

=====HijackThis Backups=====

 

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)

O13 - Gopher Prefix:

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKCU\..\Policies\Explorer\Run: [MstInit] C:\Users\NGRE~1\LOCALS~1\APPLIC~1\MICROS~1\mstinit.exe /waitservice

O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [Mstsc] C:\Users\NGRE~1\LOCALS~1\APPLIC~1\mstsc.exe /waitservice (User 'Default user')

O4 - HKLM\..\Policies\Explorer\Run: [Logman] C:\Windows\logman.exe /waitservice

O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [Mstsc] C:\Users\NGRE~1\LOCALS~1\APPLIC~1\mstsc.exe /waitservice (User 'SYSTEM')

O4 - HKCU\..\Policies\Explorer\Run: [CmSTP] C:\Windows\System\cmstp.exe /waitservice

O4 - HKLM\..\Policies\Explorer\Run: [ComRepl] C:\Windows\System\comrepl.exe /waitservice

O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [iEudinit] C:\Windows\System32\drivers\ieudinit.exe /waitservice (User 'Default user')

O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [iEudinit] C:\Windows\System32\drivers\ieudinit.exe /waitservice (User 'SYSTEM')

F3 - REG:win.ini: load=C:\Windows\System32\drivers\clipsrv.exe

O4 - HKCU\..\Policies\Explorer\Run: [Cisvc] C:\Windows\cisvc.exe /waitservice

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [CmSTP] C:\Windows\System32\drivers\cmstp.exe /waitservice (User 'Default user')

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)

O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [CmSTP] C:\Windows\System32\drivers\cmstp.exe /waitservice (User 'SYSTEM')

 

======Hosts File======

 

127.0.0.1 www.007guard.com

127.0.0.1 007guard.com

127.0.0.1 008i.com

127.0.0.1 www.008k.com

127.0.0.1 008k.com

127.0.0.1 www.00hq.com

127.0.0.1 00hq.com

127.0.0.1 010402.com

127.0.0.1 www.032439.com

127.0.0.1 032439.com

 

======Security center information======

 

AV: Avira AntiVir PersonalEdition

AV: Avira AntiVir PersonalEdition (outdated)

AS: Avira AntiVir PersonalEdition

AS: AVG Anti-Spyware (disabled) (outdated)

AS: Windows Defender

AS: Avira AntiVir PersonalEdition (outdated)

 

======Environment variables======

 

"ComSpec"=%SystemRoot%\system32\cmd.exe

"FP_NO_HOST_CHECK"=NO

"OS"=Windows_NT

"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC

"PROCESSOR_ARCHITECTURE"=x86

"TEMP"=%SystemRoot%\TEMP

"TMP"=%SystemRoot%\TEMP

"USERNAME"=SYSTEM

"windir"=%SystemRoot%

"PROCESSOR_LEVEL"=6

"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 2, GenuineIntel

"PROCESSOR_REVISION"=0f02

"NUMBER_OF_PROCESSORS"=2

"Path"=C:\PHP\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Common Files\Ulead Systems\MPEG;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\Common Files\Adobe\AGL\;C:\inetpub\Php;C:\Program Files\Autodesk\Backburner\;C:\Program Files\Common Files\Autodesk Shared\;C:\Program Files\QuickTime\QTSystem\

"PHPRC"=C:\PHP\

"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip

"QTJAVA"=C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip

 

-----------------EOF-----------------

Lien vers le commentaire
Partager sur d’autres sites
Falkra Devil Member !

Falkra

Posté(e)
Posté(e)

Ok, ça régénère par un petit bout planqué.

 

Le logiciel qui suit n'est à utiliser que prescrit par un helper qualifié et formé à l'outil.

Ne pas utiliser en dehors de ce cas de figure ou seul : dangereux.

 

Télécharge combofix.exe de sUBs et sauvegarde le sur ton bureau (et pas ailleurs).

  • Assure toi que tous les programmes sont fermés avant de commencer.
  • Double-clique combofix.exe afin de l'exécuter.
  • Clique sur "Oui" au message de Limitation de Garantie qui s'affiche.
  • On va te proposer de télécharger et installer la console de récupération, clique sur "Oui" au message, autorise le téléchargement dans ton firewall si demandé, puis accepte le message de contrat utilisateur final.
  • Le bureau disparaît, c'est normal, et il va revenir.
  • Ne ferme pas la fenêtre qui s'ouvre, tu te retrouverais avec un bureau vide.
  • Lorsque l'analyse sera terminée, un rapport apparaîtra.
  • Copie-colle ce rapport dans ta prochaine réponse.
    Le rapport se trouve dans : C:\Combofix.txt (si jamais).

Lien vers le commentaire
Partager sur d’autres sites
jezabel Member

jezabel

Posté(e)
  • Auteur
Posté(e)

hop :

ComboFix 08-12-06.06 - nègre 2008-12-07 22:52:56.1 - NTFSx86

Microsoft® Windows Vista™ Professionnel 6.0.6001.1.1252.1.1036.18.2137 [GMT 1:00]

Lancé depuis: c:\users\nègre\Desktop\ComboFix.exe

* Un nouveau point de restauration a été créé

.

 

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

 

c:\users\nègre\nègre.exe

 

.

((((((((((((((((((((((((((((( Fichiers créés du 2008-11-07 au 2008-12-07 ))))))))))))))))))))))))))))))))))))

.

 

2008-12-07 22:07 . 2008-12-07 22:07 <REP> d-------- C:\rsit

2008-12-07 20:28 . 2008-09-05 18:03 86,016 --a------ c:\users\nègre\AppData\Roaming\spoolsv.exe

2008-12-07 19:21 . 2008-12-07 19:21 <REP> d-------- C:\_OTMoveIt

2008-12-07 19:19 . 2008-09-05 18:03 86,016 --a------ c:\windows\System32\drivers\mstinit.exe

2008-12-07 19:19 . 2008-09-05 18:03 86,016 --a------ c:\windows\System32\drivers\cmstp.exe

2008-12-07 19:19 . 2008-09-05 18:03 86,016 --a------ c:\windows\system\mstsc.exe

2008-12-07 19:19 . 2008-09-05 18:03 86,016 --a------ c:\windows\cisvc.exe

2008-12-07 17:44 . 2008-12-07 17:44 401,720 --a------ c:\users\nègre\HiJackThis.exe

2008-12-07 17:44 . 2008-12-07 17:44 401,720 --a------ c:\users\nègre\HiJackThis.exe

2008-11-30 14:13 . 2008-10-16 22:13 1,809,944 --a------ c:\windows\System32\wuaueng.dll

2008-11-30 14:13 . 2008-10-16 21:56 1,524,736 --a------ c:\windows\System32\wucltux.dll

2008-11-30 14:13 . 2008-10-16 22:12 561,688 --a------ c:\windows\System32\wuapi.dll

2008-11-30 14:13 . 2008-10-16 14:08 162,064 --a------ c:\windows\System32\wuwebv.dll

2008-11-30 14:13 . 2008-10-16 21:55 83,456 --a------ c:\windows\System32\wudriver.dll

2008-11-30 14:13 . 2008-10-16 22:09 51,224 --a------ c:\windows\System32\wuauclt.exe

2008-11-30 14:13 . 2008-10-16 22:09 43,544 --a------ c:\windows\System32\wups2.dll

2008-11-30 14:13 . 2008-10-16 22:08 34,328 --a------ c:\windows\System32\wups.dll

2008-11-30 14:13 . 2008-10-16 13:56 31,232 --a------ c:\windows\System32\wuapp.exe

2008-11-28 12:16 . 2008-09-05 18:03 86,016 --a------ c:\windows\logman.exe

2008-11-28 12:12 . 2008-11-28 12:12 <REP> d-------- c:\users\nègre\AppData\Roaming\Malwarebytes

2008-11-28 12:12 . 2008-11-28 12:12 <REP> d-------- c:\users\All Users\Malwarebytes

2008-11-28 12:12 . 2008-11-28 12:12 <REP> d-------- c:\programdata\Malwarebytes

2008-11-28 12:12 . 2008-12-07 17:52 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware

2008-11-28 12:12 . 2008-12-03 19:52 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys

2008-11-28 12:12 . 2008-12-03 19:52 15,504 --a------ c:\windows\System32\drivers\mbam.sys

2008-11-28 09:41 . 2008-10-21 06:25 1,645,568 --a------ c:\windows\System32\connect.dll

2008-11-28 09:40 . 2008-08-28 04:40 712,704 --a------ c:\windows\System32\WindowsCodecs.dll

2008-11-28 09:40 . 2008-08-28 04:40 425,472 --a------ c:\windows\System32\PhotoMetadataHandler.dll

2008-11-28 09:40 . 2008-08-28 04:40 347,136 --a------ c:\windows\System32\WindowsCodecsExt.dll

2008-11-28 09:40 . 2008-10-22 04:57 241,152 --a------ c:\windows\System32\PortableDeviceApi.dll

2008-11-20 19:06 . 2008-08-17 11:33 678,408 --a------ c:\windows\System32\gpprefcl.dll

2008-11-14 23:43 . 2008-12-02 23:33 54,156 --ah----- c:\windows\QTFont.qfn

2008-11-14 23:43 . 2008-11-14 23:43 1,409 --a------ c:\windows\QTFont.for

2008-11-14 00:11 . 2008-11-14 00:19 <REP> d-------- c:\program files\SupraASCIIArt

2008-11-12 19:32 . 2008-09-10 04:40 1,334,272 --a------ c:\windows\System32\msxml6.dll

2008-11-12 19:32 . 2008-09-05 06:14 1,191,936 --a------ c:\windows\System32\msxml3.dll

2008-11-12 19:32 . 2008-08-27 02:05 212,480 --a------ c:\windows\System32\drivers\mrxsmb10.sys

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-12-07 21:53 6,553,600 --sha-w c:\users\nègre\NTUSER.DAT

2008-12-07 21:53 6,553,600 --sha-w c:\users\nègre\NTUSER.DAT

2008-12-07 21:52 4,980,736 --sha-w c:\users\Cécile\NTUSER.DAT

2008-12-07 21:52 4,980,736 --sha-w c:\users\Cécile\NTUSER.DAT

2008-12-07 16:44 401,720 ----a-w c:\users\nègre\HiJackThis.exe

2008-12-07 16:44 401,720 ----a-w c:\users\nègre\HiJackThis.exe

2008-12-07 12:50 --------- d-----w c:\programdata\AntiVir PersonalEdition Classic

2008-11-30 13:25 --------- d-----w c:\users\nègre\AppData\Roaming\OpenOffice.org2

2008-11-29 14:27 --------- d-----w c:\program files\Eraser

2008-11-29 14:27 --------- d-----w c:\program files\CCleaner

2008-11-29 14:27 --------- d-----w c:\program files\a-squared Free

2008-11-29 14:26 --------- d-----w c:\program files\Spybot - Search & Destroy

2008-11-29 14:22 --------- d-----w c:\program files\SpywareBlaster

2008-11-28 11:12 --------- d-----w c:\users\nègre\AppData\Roaming\Malwarebytes

2008-11-21 08:51 --------- d-----w c:\programdata\Spybot - Search & Destroy

2008-11-03 18:20 --------- d-----w c:\programdata\ma-config.com

2008-11-03 18:20 --------- d-----w c:\program files\ma-config.com

2008-10-23 21:58 --------- d-s---w c:\users\Cécile\AppData\Roaming\Microsoft

2008-10-23 09:20 --------- d-----w c:\users\Cécile\AppData\Roaming\Mozilla

2008-10-20 20:35 --------- d-----w c:\program files\Codemasters

2008-10-20 12:39 --------- d--h--w c:\program files\InstallShield Installation Information

2008-10-20 12:39 --------- d-----w c:\programdata\Codemasters

2008-10-20 08:07 444,952 ----a-w c:\windows\System32\wrap_oal.dll

2008-10-20 08:07 109,080 ----a-w c:\windows\System32\OpenAL32.dll

2008-10-20 08:07 107,888 ----a-w c:\windows\System32\CmdLineExt.dll

2008-10-20 08:07 --------- d-----w c:\program files\OpenAL

2008-10-17 13:32 --------- d-----w c:\program files\Athens 2004

2008-10-15 18:00 --------- d-----w c:\program files\Windows Mail

2008-10-11 14:26 --------- d-----w c:\program files\Mozilla Thunderbird

2008-10-02 03:49 827,392 ----a-w c:\windows\System32\wininet.dll

2008-09-30 15:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll

2008-09-18 05:09 3,601,464 ----a-w c:\windows\System32\ntkrnlpa.exe

2008-09-18 05:09 3,549,240 ----a-w c:\windows\System32\ntoskrnl.exe

2008-09-18 04:56 147,456 ----a-w c:\windows\System32\Faultrep.dll

2008-09-18 04:56 125,952 ----a-w c:\windows\System32\wersvc.dll

2008-09-18 02:16 2,032,640 ----a-w c:\windows\System32\win32k.sys

2008-09-05 17:03 86,016 ----a-w c:\users\nègre\AppData\Roaming\spoolsv.exe

2008-07-25 19:44 174 --sha-w c:\program files\desktop.ini

2008-07-19 20:18 446,230,875 ----a-w c:\users\NGRE~2\setup-2.bin

2007-07-29 15:27 705,496 ----a-w c:\users\Public\installer-39506-17-CCleaner-French.exe

2008-08-01 12:25 88 --sh--r c:\windows\System32\412DB83299.sys

2008-08-01 12:25 1,682 --sha-w c:\windows\System32\KGyGaAvL.sys

.

 

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 483328]

"avgnt"="c:\program files\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-17 266497]

"CloneCDElbyCDFL"="c:\program files\Elaborate Bytes\CloneCD\ElbyCheck.exe" [2002-11-02 45056]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712]

"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]

"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]

"UVS10 Preload"="c:\program files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe" [2006-03-06 36864]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-03-28 413696]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"mxomssmenu"="c:\program files\Maxtor\OneTouch Status\maxmenumgr.exe" [2008-07-21 169312]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]

"Mstsc"="c:\windows\System\mstsc.exe" [2008-09-05 86016]

 

[HKEY_USERS\.DEFAULT\software\microsoft\windows\Currentversion\policies\explorer\Run]

"Spool"="c:\users\NGRE~1\AppData\Roaming\spoolsv.exe" [2008-09-05 86016]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.ac3filter"= ac3filter.acm

"msacm.dvacm"= c:\progra~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm

"msacm.MPEGacm"= c:\progra~1\COMMON~1\ULEADS~1\MPEG\MPEGacm.acm

"msacm.ulmp3acm"= c:\progra~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3989977098-1871649959-1308902764-1000]

"EnableNotificationsRef"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{1EFFDF73-D9E3-4C6C-B3D5-572BF799D683}"= TCP:c:\program files\Autodesk\Backburner\server.exe:backburner 2.3 server

"{EF66DF6C-DA40-45C1-87DB-8C8CD56C78EA}"= UDP:c:\program files\Autodesk\Backburner\server.exe:backburner 2.3 server

"{9EE07DAA-DE6A-4924-BB2E-E5C2DA965D7A}"= TCP:c:\program files\Autodesk\Backburner\manager.exe:backburner 2.3 manager

"{BDF8EE40-D180-4EEF-B4A3-FAB199706B47}"= UDP:c:\program files\Autodesk\Backburner\manager.exe:backburner 2.3 manager

"{D8772E15-1791-43BA-915A-33D7A8346CAB}"= TCP:c:\program files\Autodesk\Backburner\monitor.exe:backburner 2.3 monitor

"{22BDD7DB-4DF1-460B-81EF-4FA39FB0F374}"= UDP:c:\program files\Autodesk\Backburner\monitor.exe:backburner 2.3 monitor

"{CE680527-609F-4227-AB3F-967E5C0D980C}"= TCP:c:\program files\Autodesk\3ds Max 9\3dsmax.exe:Autodesk 3ds Max 9 32-bit

"{02308735-8423-4751-9DE6-19B2CE867FB5}"= UDP:c:\program files\Autodesk\3ds Max 9\3dsmax.exe:Autodesk 3ds Max 9 32-bit

"UDP Query User{68D8289C-AC6C-4BB1-88FF-0B375A2CCE79}c:\\program files\\e frontier\\poser 7\\poser.exe"= TCP:c:\program files\e frontier\poser 7\poser.exe:Poser executable file

"TCP Query User{B3352131-6F2A-479E-8193-75EBEAB1057F}c:\\program files\\e frontier\\poser 7\\poser.exe"= UDP:c:\program files\e frontier\poser 7\poser.exe:Poser executable file

"UDP Query User{F1AF1368-BD28-4034-8B5E-CFCB681ED088}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer

"TCP Query User{12130006-A756-478F-8350-A625D7AD49D0}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer

"UDP Query User{FD3D117B-435F-4A6F-840C-59F0AF7EBF3A}c:\\program files\\trackmania nations eswc\\tmnationseswc.exe"= TCP:c:\program files\trackmania nations eswc\tmnationseswc.exe:TmNationsESWC

"TCP Query User{7B0D2CD4-2934-4116-9DD5-BAAAC49137AD}c:\\program files\\trackmania nations eswc\\tmnationseswc.exe"= UDP:c:\program files\trackmania nations eswc\tmnationseswc.exe:TmNationsESWC

"UDP Query User{63C68E0B-E628-46E7-AF02-FF6567452470}c:\\program files\\trackmania nations eswc\\tmnationseswc.exe"= TCP:c:\program files\trackmania nations eswc\tmnationseswc.exe:TmNationsESWC

"TCP Query User{3458B4F8-D98B-47FC-920C-8C6C18C46A0C}c:\\program files\\trackmania nations eswc\\tmnationseswc.exe"= UDP:c:\program files\trackmania nations eswc\tmnationseswc.exe:TmNationsESWC

"UDP Query User{66DE1193-8C2A-42A0-89F9-778AD65F3D23}c:\\program files\\bittorrent\\bittorrent.exe"= TCP:c:\program files\bittorrent\bittorrent.exe:bittorrent

"TCP Query User{F770785C-5EE1-4BB8-B1B7-6F0AA7092B3A}c:\\program files\\bittorrent\\bittorrent.exe"= UDP:c:\program files\bittorrent\bittorrent.exe:bittorrent

"UDP Query User{30697472-32B7-47CE-9948-5DF7A2902B6A}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox

"TCP Query User{C7E05A58-C8CA-49DE-A792-22CE12C1DA02}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox

"UDP Query User{042A9DB3-D99B-4295-BE20-6066B3262F80}c:\\movamp\\mnt\\usr\\local\\apache2\\bin\\apache.exe"= TCP:c:\movamp\mnt\usr\local\apache2\bin\apache.exe:Apache HTTP Server

"TCP Query User{6584065A-BD88-4B61-A88A-31C4FF5499CC}c:\\movamp\\mnt\\usr\\local\\apache2\\bin\\apache.exe"= UDP:c:\movamp\mnt\usr\local\apache2\bin\apache.exe:Apache HTTP Server

"UDP Query User{8BFB18A1-FDF2-4023-BDBF-11EDF87E0A8B}c:\\movamp\\mnt\\usr\\local\\mysql\\bin\\mysqld.exe"= TCP:c:\movamp\mnt\usr\local\mysql\bin\mysqld.exe:mysqld

"TCP Query User{66FB58E2-F4C9-4AB3-88BE-BFE9841DF6BD}c:\\movamp\\mnt\\usr\\local\\mysql\\bin\\mysqld.exe"= UDP:c:\movamp\mnt\usr\local\mysql\bin\mysqld.exe:mysqld

"UDP Query User{37CFCF5D-67EC-4852-BF46-12B5566FDC00}c:\\users\\nègre\\desktop\\movamp\\mnt\\usr\\local\\mysql\\bin\\mysqld.exe"= TCP:c:\users\nègre\desktop\movamp\mnt\usr\local\mysql\bin\mysqld.exe:mysqld.exe

"TCP Query User{855681DF-0EA4-4E63-B32C-B0DD78A0AD0E}c:\\users\\nègre\\desktop\\movamp\\mnt\\usr\\local\\mysql\\bin\\mysqld.exe"= UDP:c:\users\nègre\desktop\movamp\mnt\usr\local\mysql\bin\mysqld.exe:mysqld.exe

"{33A95756-696B-4836-9D08-430E0FE02039}"= TCP:4669:eMule

"{C5B64F91-4D43-4799-820B-1F0F988247E4}"= TCP:4669:eMule

"UDP Query User{A586B216-43B6-4DDE-A657-B20CBB8B37A3}c:\\program files\\e-on software\\vue 6 xstream\\application\\vue 6 xstream.eon"= Disabled:TCP:c:\program files\e-on software\vue 6 xstream\application\vue 6 xstream.eon:Vue 6 xStream.eon

"TCP Query User{A3CC07CE-D840-48CE-B795-7DF4D5FDBC47}c:\\program files\\e-on software\\vue 6 xstream\\application\\vue 6 xstream.eon"= Disabled:UDP:c:\program files\e-on software\vue 6 xstream\application\vue 6 xstream.eon:Vue 6 xStream.eon

"{BDD52BD1-B142-4688-A82D-1EEA08237D86}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour

"{5C785D1E-6BB8-4695-9C23-332E52000DDB}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour

"UDP Query User{1F3A92C8-E523-4EBE-AFE7-0B630A6809D0}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule

"TCP Query User{6378C20E-A87F-45B5-9903-F75DA0C14DD0}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule

"UDP Query User{2AC4B52F-1005-4264-8947-B068E6B65FFC}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule

"TCP Query User{D7922AA8-3FDB-483D-AD39-73F7E0636F77}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule

"TCP Query User{5D729616-852C-441D-BCB8-E72AFC0D7001}c:\\program\\green border\\sea battle\\seabattle.exe"= UDP:c:\program\green border\sea battle\seabattle.exe:Green Border Sea Battle

"UDP Query User{788CBDBF-4169-4CAC-A55E-EA44E6D345A8}c:\\program\\green border\\sea battle\\seabattle.exe"= TCP:c:\program\green border\sea battle\seabattle.exe:Green Border Sea Battle

"TCP Query User{67A4B2DC-9ABF-496C-93E9-BE85CE82F77E}c:\\users\\nègre\\desktop\\das_boot_1.0\\das boot.exe"= UDP:c:\users\nègre\desktop\das_boot_1.0\das boot.exe:das boot.exe

"UDP Query User{6E3423CE-578B-4AD6-87D9-31773CB93A0E}c:\\users\\nègre\\desktop\\das_boot_1.0\\das boot.exe"= TCP:c:\users\nègre\desktop\das_boot_1.0\das boot.exe:das boot.exe

"TCP Query User{C6BED574-ED13-44B6-9A5B-758924C6FF78}c:\\program files\\netintellgames\\net sea war 4\\seawar.exe"= UDP:c:\program files\netintellgames\net sea war 4\seawar.exe:Net Sea War

"UDP Query User{1220AA84-28E6-4049-B4E8-17F68580271F}c:\\program files\\netintellgames\\net sea war 4\\seawar.exe"= TCP:c:\program files\netintellgames\net sea war 4\seawar.exe:Net Sea War

"TCP Query User{10D2B4EA-A0DE-4B7E-85CF-2443A0593B9E}c:\\program files\\codemasters\\colin mcrae - dirt\\dirt.exe"= UDP:c:\program files\codemasters\colin mcrae - dirt\dirt.exe:DiRT Executable

"UDP Query User{F7E527C9-B506-4D4C-AEFF-27358B6C7EF6}c:\\program files\\codemasters\\colin mcrae - dirt\\dirt.exe"= TCP:c:\program files\codemasters\colin mcrae - dirt\dirt.exe:DiRT Executable

"{C7222D63-E7F1-49F2-ABCB-33BF3D89FD18}"= UDP:48113:LocalSubnet:LocalSubnet:maconfig_tcp

"{FBDD44DF-EF1B-46FC-86C8-A1B2F2B1C4FA}"= TCP:48113:LocalSubnet:LocalSubnet:maconfig_udp

"{2D24A0FB-ABE2-477A-9497-8EB7095BB6B2}"= UDP:c:\program files\ma-config.com\maconfservice.exe:maconfservice

"{4076580F-88EC-4EC6-9E1E-383B02A41206}"= TCP:c:\program files\ma-config.com\maconfservice.exe:maconfservice

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]

"DoNotAllowExceptions"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]

"c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent

 

R2 Maxtor Sync Service;Maxtor Service;"c:\program files\Maxtor\Sync\SyncServices.exe" [2008-07-21 193888]

R3 HabuFltr;Habu Mouse;c:\windows\system32\drivers\habu.sys [2008-02-08 27776]

S3 maconfservice;Ma-Config Service;"c:\program files\ma-config.com\maconfservice.exe" [2008-11-02 195752]

S3 WMSvc;Service de gestion Web;c:\windows\system32\inetsrv\wmsvc.exe [2008-06-14 11264]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{10bfe7f9-7067-11dd-9454-00196610b979}]

\shell\AutoRun\command - .\Encryption Tool\MaxtorEncryption.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7f8781a5-bec9-11dc-a8d6-00196610b979}]

\shell\Auto\command - cmd /C launch.bat

\shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL cmd /C launch.bat

 

*Newly Created Service* - PROCEXP90

.

Contenu du dossier 'Tâches planifiées'

 

2008-12-07 c:\windows\Tasks\User_Feed_Synchronization-{1559A6B9-87C7-4552-AD27-F2EAF32344CB}.job

- c:\windows\system32\msfeedssync.exe [2008-01-19 08:33]

.

.

------- Examen supplémentaire -------

.

uStart Page = about:blank

uInternet Settings,ProxyOverride = *.local

IE: Convertir en Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convertir en un fichier PDF existant - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convertir la cible du lien en Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convertir la cible du lien en un fichier PDF existant - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convertir la sélection en Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convertir la sélection en un fichier PDF existant - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convertir les liens sélectionnés en fichier Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convertir les liens sélectionnés en un fichier PDF existant - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

 

c:\windows\Downloaded Program Files\MegaMocapWeb.ocx - O16 -: {E3E6FFEE-748F-43BA-87AE-B1F1B11ED193}

hxxp://www.charactermotion.com/products/powermoves/megamocap/MegaMocapWeb.ocx

FireFox -: Profile - c:\users\nègre\AppData\Roaming\Mozilla\Firefox\Profiles\wa6gzygd.default\

FireFox -: prefs.js - STARTUP.HOMEPAGE -

FF -: plugin - c:\program files\ma-config.com\nphardwaredetection.dll

FF -: plugin - c:\users\nègre\AppData\Roaming\Mozilla\Firefox\Profiles\wa6gzygd.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll

.

 

**************************************************************************

 

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-12-07 22:55:15

Windows 6.0.6001 Service Pack 1 NTFS

 

Recherche de processus cachés ...

 

Recherche d'éléments en démarrage automatique cachés ...

 

Recherche de fichiers cachés ...

 

Scan terminé avec succès

Fichiers cachés: 0

 

**************************************************************************

.

Heure de fin: 2008-12-07 22:56:39

ComboFix-quarantined-files.txt 2008-12-07 21:56:37

 

Avant-CF: 139 274 121 216 octets libres

Après-CF: 139,298,209,792 octets libres

 

233 --- E O F --- 2008-12-04 17:11:19

Lien vers le commentaire
Partager sur d’autres sites
Falkra Devil Member !

Falkra

Posté(e)
Posté(e)

:!: Ce qui suit n'est que pour ta machine, et ta machine seulement.

Ne surtout pas utiliser sur une autre machine : dangereux.

 

Avant tout, branche tes périphériques amovibles (clés USB, disques durs externes, etc).

 

  • Ouvre le Bloc-notes. Vérifie que dans le menu "Format", le "retour automatique à la ligne" est désactivé. Copie colle ceci dedans :

Killall::

 

File::

c:\windows\System32\drivers\cmstp.exe

c:\windows\system\mstsc.exe

c:\windows\cisvc.exe

c:\windows\logman.exe

 

Registry::

[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]

"Mstsc"=-

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7f8781a5-bec9-11dc-a8d6-00196610b979}]

  • Sauvegarde cela comme fichier texte nommé CFScript, sur le bureau.
     
  • Fais un glisser/déposer de ce fichier CFscript sur le fichier ComboFix.exe comme sur la capture

img-2258535my8h.gif

  • Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises: c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
  • Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
  • Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

Lien vers le commentaire
Partager sur d’autres sites

Rejoindre la conversation

Vous pouvez publier maintenant et vous inscrire plus tard. Si vous avez un compte, connectez-vous maintenant pour publier avec votre compte.
Remarque : votre message nécessitera l’approbation d’un modérateur avant de pouvoir être visible.

Invité
Répondre à ce sujet…

×   Collé en tant que texte enrichi.   Coller en tant que texte brut à la place

  Seulement 75 émoticônes maximum sont autorisées.

×   Votre lien a été automatiquement intégré.   Afficher plutôt comme un lien

×   Votre contenu précédent a été rétabli.   Vider l’éditeur

×   Vous ne pouvez pas directement coller des images. Envoyez-les depuis votre ordinateur ou insérez-les depuis une URL.

×
 Partager
Aller sur la liste des sujets

  • En ligne récemment   0 membre est en ligne

    • Aucun utilisateur enregistré regarde cette page.
×
×
  • Créer...