probléme exoclick RESOLU

alou · le 24 septembre 2009

salut,

je suis en combat avec ce fichu viirus que je n' arrive pas à supprimer définitivement, après avoir cherché, j' en appelle à la communauté merci d 'avance !! voici le rapport fait avec hijackthis :

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:51:50, on 24/09/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe

C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe

C:\WINDOWS\system32\inetsrv\inetinfo.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Eset\nod32krn.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\snmp.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\DAEMON Tools\daemon.exe

C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe

C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\Program Files\Analog Devices\SoundMAX\Smax4.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Eset\nod32kui.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Pinnacle\Shared Files\Programs\Scheduler\PCLEScheduler.exe

C:\WINDOWS\system32\IcoSauve.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Winamp\winamp.exe

C:\Program Files\Outlook Express\msimn.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Documents and Settings\ALI\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/search?q=%s

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: (no name) - {150E44D5-314A-4E8C-A11C-B806C6882AEF} - (no file)

O2 - BHO: (no name) - {339f7a5b-1ecb-456c-a310-46d331dcab04} - (no file)

O2 - BHO: (no name) - {48BACDF8-1B76-49C1-97B8-9A494E316683} - (no file)

O2 - BHO: (no name) - {606895aa-eac6-4e64-9004-5c133a010415} - (no file)

O2 - BHO: (no name) - {B8DC1FE9-889D-4559-8090-FF2E5EFA9086} - (no file)

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: (no name) - {E35A634B-DC92-4F89-8236-6ADBCA79927B} - (no file)

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install

O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [Cloneur Expert Monitor] "C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe"

O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [xvs] C:\WINDOWS\system32\xvs.exe \u

O4 - HKLM\..\Run: [soundMax] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray

O4 - HKLM\..\Run: [uVS11 Preload] "C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe"

O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"

O4 - HKLM\..\Run: [soundMAXPnP] "C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon

O4 - HKUS\S-1-5-19\..\RunOnce: [nltide1] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\RunOnce: [nltide2] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\RunOnce: [nltide1] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')

O4 - Startup: IcoSauve.lnk = C:\WINDOWS\system32\IcoSauve.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: Pinnacle Scheduler.lnk = ?

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/51.28/uploader2.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://www.zebulon.fr/scan8/oscan8.cab

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab

O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/a...gnerADP-2.0.cab

O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O20 - AppInit_DLLs: fheykv.dll rvzbuo.dll

O21 - SSODL: uMOlFo - {2496A76E-8E3C-0DC4-A958-343C5BE15689} - C:\WINDOWS\system32\amw.dll

O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

--

End of file - 8980 bytes

Modifié le 7 octobre 2009 par alou

Le sioux · le 24 septembre 2009

Bonsoir alou et bienvenue sur Zébulon

Ton PC est en SP2 et tu utilises IE 7 , on en est au SP3 et à IE8. Le faite de ne pas mettre Windows à jour, IE et les différents autres programmes présents sur ton PC cree des failles de sécurité exploitables par les malwares. On verra cela ensemble par la suite quand ton PC sera désinfecté.

Ton Windows est une version nLite non officielle, je voudrais savoir si tu possèdes la licence avant de poursuivre...

Si cela peux t'aider, commence par lire ces deux sujets :

Comment participer a un forum

Retrouver ses messages et activer la notification par email

1) OTM de Old_Timer

Télécharge OTM de Old_Timer sur ton Bureau.
Double clique sur OTM.exe afin de lancer l'outil.
Copie la liste qui se trouve en citation ci-dessous :

:reg

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{150E44D5-314A-4E8C-A11C-B806C6882AEF}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{339f7a5b-1ecb-456c-a310-46d331dcab04}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{48BACDF8-1B76-49C1-97B8-9A494E316683}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{606895aa-eac6-4e64-9004-5c133a010415}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B8DC1FE9-889D-4559-8090-FF2E5EFA9086}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E35A634B-DC92-4F89-8236-6ADBCA79927B}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"xvs"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLs"=””

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

"uMOlFo"=-

:files

C:\WINDOWS\system32\xvs.exe

C:\WINDOWS\system32\fheykv.dll

C:\WINDOWS\system32\rvzbuo.dll

C:\WINDOWS\system32\amw.dll

:commands

[emptytemp]

[reboot]

et colle-la dans le cadre de gauche de OTM : "Paste instructions for item to be moved".
Clique sur le bouton MoveIt!
Attends la fin du travail de l'outil puis ferme OTM.

Note: Un redémarrage du PC pourra être nécessaire, clique sur Oui/Yes quand cela te sera demandé.

2) Random's System Information Tool (RSIT)

Tuto : http://forum.pcastuces.com/randoms_system_...rsit-f31s31.htm.

Télécharge Random's System Information Tool (RSIT) de random/random et sauvegarde-le sur ton Bureau.

Double-clique sur RSIT.exe afin de lancer RSIT.(Si tu es sous Vista, fais un clic droit dessus et choisis « Exécuter en tant qu'administrateur»).
Clique sur Continue à l'écran Disclaimer.
Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.
Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.

--> Poste en réponse :

* Le contenu de log.txt (<<qui sera affiché) ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).

Note : Les deux rapports sont également sauvegardés dans %systemroot%\rsit

* Le rapport de OTM (contenu du fichier Lecteur\_OTM\MovedFiles\********_******.log - les *** sont des chiffres représentant la date [moisjourannée] et l'heure) [Lecteur représente la partition depuis laquelle OTM a été lancé, généralement C:]

@ suivre.

Modifié le 25 septembre 2009 par Le sioux

alou · le 25 septembre 2009

salut mr Sioux! er merci de m' aider voici les deux rapports ..

LE PREMIER :[/b]

All processes killed

========== REGISTRY ==========

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{150E44D5-314A-4E8C-A11C-B806C6882AEF}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{150E44D5-314A-4E8C-A11C-B806C6882AEF}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{339f7a5b-1ecb-456c-a310-46d331dcab04}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{339f7a5b-1ecb-456c-a310-46d331dcab04}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{48BACDF8-1B76-49C1-97B8-9A494E316683}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48BACDF8-1B76-49C1-97B8-9A494E316683}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{606895aa-eac6-4e64-9004-5c133a010415}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{606895aa-eac6-4e64-9004-5c133a010415}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B8DC1FE9-889D-4559-8090-FF2E5EFA9086}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B8DC1FE9-889D-4559-8090-FF2E5EFA9086}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E35A634B-DC92-4F89-8236-6ADBCA79927B}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E35A634B-DC92-4F89-8236-6ADBCA79927B}\ not found.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\xvs deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\"AppInit_DLLs"|”” /E : value set successfully!

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\uMOlFo deleted successfully.

========== FILES ==========

File/Folder C:\WINDOWS\system32\xvs.exe not found.

File/Folder C:\WINDOWS\system32\fheykv.dll not found.

File/Folder C:\WINDOWS\system32\rvzbuo.dll not found.

DllUnregisterServer procedure not found in C:\WINDOWS\system32\amw.dll

C:\WINDOWS\system32\amw.dll NOT unregistered.

File move failed. C:\WINDOWS\system32\amw.dll scheduled to be moved on reboot.

========== COMMANDS ==========

[EMPTYTEMP]

User: Administrateur

->Temp folder emptied: 910777 bytes

->Temporary Internet Files folder emptied: 1559821 bytes

->Java cache emptied: 0 bytes

User: ALI

->Temp folder emptied: 455012856 bytes

File delete failed. C:\Documents and Settings\ALI\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.

->Temporary Internet Files folder emptied: 50138569 bytes

->Java cache emptied: 0 bytes

User: All Users

User: All Users.WINDOWS

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: Default User.WINDOWS

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 35539 bytes

User: LocalService.AUTORITE NT

->Temp folder emptied: 0 bytes

File delete failed. C:\Documents and Settings\LocalService.AUTORITE NT\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.

->Temporary Internet Files folder emptied: 33174 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService.AUTORITE NT

->Temp folder emptied: 66016 bytes

->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 2114013 bytes

%systemroot%\System32 .tmp files removed: 11500606 bytes

Windows Temp folder emptied: 1819104 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 499,08 mb

OTM by OldTimer - Version 3.0.0.6 log created on 09252009_093423

Files moved on Reboot...

DllUnregisterServer procedure not found in C:\WINDOWS\system32\amw.dll

C:\WINDOWS\system32\amw.dll NOT unregistered.

File move failed. C:\WINDOWS\system32\amw.dll scheduled to be moved on reboot.

Registry entries deleted on Reboot...

LE SECOND :

nfo.txt logfile of random's system information tool 1.06 2009-09-25 09:38:56

======Uninstall list======

-->"C:\Program Files\InstallShield Installation Information\{BB8AE808-F003-4C7F-B56B-8C80EEAFFE23}\setup.exe" --u:{BB8AE808-F003-4C7F-B56B-8C80EEAFFE23}

-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0

-->MsiExec.exe /I{403EF592-953B-4794-BCEF-ECAB835C2095}

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf

Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe

Adobe Flash Player 9 Plugin-->MsiExec.exe /X{008F31A9-4B8E-4411-AA19-2CB3C8DD7507}

Adobe Shockwave Player-->MsiExec.exe /X{A7DB362E-16DC-4E29-8A34-E74381E00B5B}

Apple Mobile Device Support-->MsiExec.exe /I{C337BDAF-CB4E-47E2-BE1A-CB31BB7DD0E3}

Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}

Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe

Avanquest update-->C:\Program Files\InstallShield Installation Information\{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}\setup.exe -runfromtemp -l0x040c -removeonly

Canon Internet Library for ZoomBrowser EX-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{9E75AF24-815C-4BD1-9A05-F96866CC6005}

Canon PhotoRecord-->C:\WINDOWS\IsUn040c.exe -fC:\PROGRA~1\Canon\ZOOMBR~1\..\PhotoRecord\Uninst.isu -c"C:\PROGRA~1\Canon\ZOOMBR~1\..\PhotoRecord\Program\uninstdll.dll"

Canon Utilities File Viewer Utility 1.2-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{755D3B4E-D3A3-4D05-99D8-FC35E26A331C}

Canon Utilities PhotoStitch 3.1-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{F11A403B-0DE9-4953-B790-7A2F014FBB2B}

Canon Utilities RemoteCapture 2.7-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{AB3AC39D-9915-435D-ACC4-9881E75326BC}

Canon Utilities ZoomBrowser EX-->MsiExec.exe /X{C1D76D7A-F3BB-47EA-A746-5B1E2FFC1DF2}

CanoScan Toolbox 4.1-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BCE46757-7674-4416-BEDB-68205A60409E}\setup.exe" -l0x40c

CartoExploreur 3D 1.10-->"C:\Program Files\Bayo\Setup\CartoExploreur 3D 1.10\unins000.exe"

cGPSmapper Free 0097-->"C:\Program Files\cGPSmapper\unins000.exe"

Client Windows Rights Management avec Service Pack 2-->MsiExec.exe /X{1D13221B-42DE-4B3C-A43F-0F6AF3CF3DA2}

Cloneur Expert-->C:\Program Files\Micro Application\Cloneur Expert\MediaBuilder.exe -uninstall

eMule-->"C:\Program Files\eMule\Uninstall.exe"

Fenêtre d'appareil photo Canon pour ZoomBrowser EX-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{5ADA9741-0570-4096-B5FE-1D55E57537D4}

Garmin City Navigator Europe v8-->MsiExec.exe /X{3879E12E-DA5B-4451-B973-DA0E2FEE7039}

Garmin TOPO Swiss East-->"C:\Garmin\TOPO Swiss East\unins000.exe"

Garmin TOPO Swiss West-->"C:\Garmin\TOPO Swiss West\unins000.exe"

Gpstrack 2008-->MsiExec.exe /X{A666A3CB-C3B8-4ACB-B278-5ED5124EFD6E}

Guitar Pro 5.2-->"C:\Program Files\Guitar Pro 5\unins000.exe"

HijackThis 2.0.2-->"C:\Documents and Settings\ALI\Bureau\HijackThis.exe" /uninstall

HP Deskjet 5400 series-->C:\Program Files\HP\Digital Imaging\{EB57A16E-500D-43d7-85B9-FBE279EBBA6E}\setup\hpzscr01.exe -datfile hpfscr05.dat

HP Extended Capabilities 5.0-->C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat

HP Image Zone Express-->MsiExec.exe /X{FE64AE29-0883-4C70-8388-DC026019C900}

HP Imaging Device Functions 5.0-->C:\Program Files\HP\Digital Imaging\DigitalImagingMonitor\hpzscr01.exe -datfile hpqbud01.dat

HP Product Assistant-->MsiExec.exe /I{36FDBE6E-6684-462B-AE98-9A39A1B200CC}

HP Solution Center & Imaging Support Tools 5.0-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat

HP Update-->MsiExec.exe /X{FE57DE70-95DE-4B64-9266-84DA811053DB}

IKEA Home Planner-->MsiExec.exe /I{B3276CB1-20B6-4AF9-AAEC-E72C83816495}

Intel® PRO Network Connections 11.2.0.69-->MsiExec.exe /i{2222B364-0854-4265-B32E-A142DB9DC7BB} ARPREMOVE=1

InterVideo DeviceService-->MsiExec.exe /I{521AAD14-5030-44BB-8B0E-5CE65FCE57E0}

iTunes-->MsiExec.exe /I{99ECF41F-5CCA-42BD-B8B8-A8333E2E2944}

Java 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}

Java 6 Update 4-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160040}

Java 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}

Java SE Runtime Environment 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160000}

KC Softwares IDPhotoStudio-->"C:\Program Files\KC Softwares\IDPhotoStudio\unins000.exe"

K-Lite Codec Pack 2.71 Full-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"

Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"

MapSource Product Install-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{47D50190-9DAD-4FFE-9EFA-6D278B2C4810}\Setup.exe" -l0x40c AddRemove

MapSource Product Install-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B8BFB69F-BBBA-48A9-A788-851222571C77}\setup.exe" -l0x40c AddRemove

MFCDLL Shared Library - Retail Version-->MsiExec.exe /I{51D569E2-8A28-11D2-B962-006097C4DE24}

Microsoft ® C Runtime Library-->MsiExec.exe /I{51D569E0-8A28-11D2-B962-006097C4DE24}

Microsoft ® C++ Runtime Library-->MsiExec.exe /I{51D569E3-8A28-11D2-B962-006097C4DE24}

Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"

Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}

Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}

Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe

Microsoft Office PowerPoint Viewer 2003-->MsiExec.exe /X{90AF040C-6000-11D3-8CFE-0150048383C9}

Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9}

Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}

Microsoft Windows Media Video 9 VCM-->RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmv9vcm.inf, Uninstall

Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - FRA\install.exe

MSXML 3.0-->MsiExec.exe /I{930E3A4D-70B7-4D0D-AF8D-0B351A9B55BE}

MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}

MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}

MSXML 4.0 SP2 and SOAP Toolkit 3.0-->MsiExec.exe /I{32343DB6-9A52-40C9-87E4-5E7C79791C87}

MSXML 6.0 Parser (KB933579)-->MsiExec.exe /I{1787603C-E6E3-42D4-8034-55F358486F1D}

Nero 7 Premium-->MsiExec.exe /I{4781569D-5404-1F26-4B2B-6DF444441031}

NOD32 Antivirus System-->C:\Program Files\Eset\Setup\setup.exe /UNINSTALL

NVIDIA Drivers-->C:\WINDOWS\system32\nvudisp.exe UninstallGUI

OgcDrv 2.12-->"C:\Program Files\Bayo\Setup\OgcDrv 2.12\unins000.exe"

OmniPage SE-->MsiExec.exe /I{6249C22D-E6A8-407B-BA8B-40298848ED94}

Panda ActiveScan 2.0-->C:\Program Files\Panda Security\ActiveScan 2.0\as2uninst.exe

Permis de construire Expert CAD-->"C:\Program Files\Anuman Interactive\Permis de construire Expert CAD\unins000.exe"

Photo d'identité 2008 v3.4-->"C:\Program Files\Emjysoft\Photo\unins000.exe"

Picasa 3-->"C:\Program Files\Google\Picasa3\Uninstall.exe"

Pinnacle PCTV-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3C02ED4F-46B0-4E9E-87F7-47AEBA4031C8}\Setup.exe" -l0x40c -L0x40c UNINSTALL

QuickTime-->MsiExec.exe /I{C78EAC6F-7A73-452E-8134-DBB2165C5A68}

RealPlayer-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0

Réseau Antilles Bayo 0007-Q0-->"C:\Program Files\Bayo\Setup\Réseau Antilles Bayo 0007-Q0\unins000.exe"

Réseau Antilles BdAlti 2007-Q1-->"C:\Program Files\Bayo\Setup\Réseau Antilles BdAlti 2007-Q1\unins000.exe"

Réseau Antilles BdNyme 2003-Q1-->"C:\Program Files\Bayo\Setup\Réseau Antilles BdNyme 2003-Q1\unins000.exe"

Réseau France Bayo 0013-Q0-->"C:\Program Files\Bayo\Setup\Réseau France Bayo 0013-Q0\unins000.exe"

Réseau France BdAlti 2006-Q2-->"C:\Program Files\Bayo\Setup\Réseau France BdAlti 2006-Q2\unins000.exe"

Réseau France BdNyme 2004-Q4-->"C:\Program Files\Bayo\Setup\Réseau France BdNyme 2004-Q4\unins000.exe"

Réseau France NavTeq 2006-Q1-->"C:\Program Files\Bayo\Setup\Réseau France NavTeq 2006-Q1\unins000.exe"

Réseau France POI 2006-Q1-->"C:\Program Files\Bayo\Setup\Réseau France POI 2006-Q1\unins000.exe"

Réseau France TopoNyme 2004-Q4-->"C:\Program Files\Bayo\Setup\Réseau France TopoNyme 2004-Q4\unins000.exe"

Réseau Guyane Bayo 0004-Q0-->"C:\Program Files\Bayo\Setup\Réseau Guyane Bayo 0004-Q0\unins000.exe"

Réseau Guyane BdAlti 2003-Q1-->"C:\Program Files\Bayo\Setup\Réseau Guyane BdAlti 2003-Q1\unins000.exe"

Réseau Guyane BdNyme 2003-Q1-->"C:\Program Files\Bayo\Setup\Réseau Guyane BdNyme 2003-Q1\unins000.exe"

Réseau Reunion Bayo 0007-Q0-->"C:\Program Files\Bayo\Setup\Réseau Reunion Bayo 0007-Q0\unins000.exe"

Réseau Reunion BdAlti 2007-Q1-->"C:\Program Files\Bayo\Setup\Réseau Reunion BdAlti 2007-Q1\unins000.exe"

Réseau Reunion BdNyme 2007-Q1-->"C:\Program Files\Bayo\Setup\Réseau Reunion BdNyme 2007-Q1\unins000.exe"

Security Update for Microsoft .NET Framework 2.0 (KB917283)-->C:\WINDOWS\system32\msiexec.exe /promptrestart /uninstall {967B098A-042D-4367-BAC9-8BC11684174F} /package {7131646D-CD3C-40F4-97B9-CD9E4E6262EF}

Security Update pour Microsoft .NET Framework 2.0 (KB922770)-->C:\WINDOWS\system32\msiexec.exe /promptrestart /uninstall {0E92DD42-76F5-4EF2-B381-F9C1D72BE23D} /package {7131646D-CD3C-40F4-97B9-CD9E4E6262EF}

Sierra Home Architecte-->C:\WINDOWS\IsUn040c.exe -fC:\SIERRA\SHAF\Uninst.isu

Sony Ericsson PC Suite 4.010.00-->C:\Program Files\InstallShield Installation Information\{2FFE93F0-BB72-4E52-8761-354D1AAA9387}\ISAdmin.exe -runfromtemp -l0x040c -removeonly

SoundMAX-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\setup.exe" -l0x40c -removeonly

TrekMap v2-->MsiExec.exe /X{46E7E808-5AD2-44B6-B52C-68EB15182D8A}

Ulead VideoStudio 11-->C:\Program Files\InstallShield Installation Information\{F99F9E24-EE2F-47FD-AEB0-FDB82859B5C9}\setup.exe -runfromtemp -l0x0409

VideoLAN VLC media player 0.8.6f-->C:\Program Files\VideoLAN\VLC\uninstall.exe

Winamp (remove only)-->"C:\Program Files\Winamp\UninstWA.exe"

Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"

Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"

======Hosts File======

127.0.0.1 localhost

Securitycenter WMI appears to be broken

======System event log======

Computer Name: ALOU

Event Code: 10

Message: Ce lecteur ne semble pas prendre en charge la lecture audio numérique.

Record Number: 47929

Source Name: redbook

Time Written: 20090918131954.000000+120

Event Type: Informations

User:

Computer Name: ALOU

Event Code: 10

Message: Ce lecteur ne semble pas prendre en charge la lecture audio numérique.

Record Number: 47928

Source Name: redbook

Time Written: 20090918131954.000000+120

Event Type: Informations

User:

Computer Name: ALOU

Event Code: 3095

Message: Cet ordinateur est configuré en tant que membre d'un groupe de travail,

et non en tant que membre d'un domaine. Il n'est pas nécessaire

d'exécuter le service Accès réseau dans cette configuration.

Record Number: 47927

Source Name: NETLOGON

Time Written: 20090918131953.000000+120

Event Type: erreur

User:

Computer Name: ALOU

Event Code: 6005

Message: Le service d'Enregistrement d'événement a démarré.

Record Number: 47926

Source Name: EventLog

Time Written: 20090918131943.000000+120

Event Type: Informations

User:

Computer Name: ALOU

Event Code: 6009

Message: Microsoft ® Windows ® 5.01. 2600 Service Pack 2 Uniprocessor Free.

Record Number: 47925

Source Name: EventLog

Time Written: 20090918131943.000000+120

Event Type: Informations

User:

=====Application event log=====

Computer Name: ALOU

Event Code: 1003

Message: Le paramètre TraceFileName ne se trouve pas dans le Registre.

Le fichier de suivi utilisé par défaut est .

Record Number: 4267

Source Name: EvntAgnt

Time Written: 20090718230212.000000+120

Event Type: Avertissement

User:

Computer Name: ALOU

Event Code: 1

Message:

Record Number: 4266

Source Name: Bonjour Service

Time Written: 20090718230209.000000+120

Event Type: Informations

User:

Computer Name: ALOU

Event Code: 0

Message:

Record Number: 4265

Source Name: Capture Device Service

Time Written: 20090718230207.000000+120

Event Type: Informations

User:

Computer Name: ALOU

Event Code: 0

Message:

Record Number: 4264

Source Name: Capture Device Service

Time Written: 20090718230207.000000+120

Event Type: Informations

User:

Computer Name: ALOU

Event Code: 0

Message:

Record Number: 4263

Source Name: Capture Device Service

Time Written: 20090718230207.000000+120

Event Type: Informations

User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe

"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\WBEM;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\system32\WindowsPowerShell\v1.0;C:\Program Files\Intel\DMIX;C:\Program Files\Fichiers communs\Ulead Systems\MPEG;C:\Program Files\QuickTime\QTSystem\

"windir"=%SystemRoot%

"FP_NO_HOST_CHECK"=NO

"OS"=Windows_NT

"PROCESSOR_ARCHITECTURE"=x86

"PROCESSOR_LEVEL"=15

"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 2 Stepping 9, GenuineIntel

"PROCESSOR_REVISION"=0209

"NUMBER_OF_PROCESSORS"=1

"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.PSC1

"TEMP"=%SystemRoot%\TEMP

"TMP"=%SystemRoot%\TEMP

"DEVMGR_SHOW_DETAILS"=1

"CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip

"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip

-----------------EOF-----------------

A+

Le sioux · le 25 septembre 2009

Bonjour alou

Afin de poursuivre, il me manque :

1) Une réponse à ma question :

Ton Windows est une version nLite non officielle, je voudrais savoir si tu possèdes la licence avant de poursuivre...

2) Le contenu de log.txt ( rapport de RSIT )

Note : Les deux rapports sont également sauvegardés dans %systemroot%\rsit

@ suivre.

alou · le 25 septembre 2009

Bonjour alou

Afin de poursuivre, il me manque :

1) Une réponse à ma question :

2) Le contenu de log.txt ( rapport de RSIT )

Note : Les deux rapports sont également sauvegardés dans %systemroot%\rsit

@ suivre.

RE..

je possède bien la licence;

2/ voici le rapport qu 'il te manque :

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 15:35:07, on 25/09/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\DAEMON Tools\daemon.exe

C:\Program Files\Micro Application\Cloneur Expert\TrueImageMonitor.exe

C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Analog Devices\SoundMAX\Smax4.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Eset\nod32kui.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Pinnacle\Shared Files\Programs\Scheduler\PCLEScheduler.exe

C:\WINDOWS\system32\IcoSauve.exe

C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe

C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe

C:\WINDOWS\system32\inetsrv\inetinfo.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Eset\nod32krn.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\System32\snmp.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Outlook Express\msimn.exe

C:\Program Files\Anuman Interactive\Permis de construire Expert CAD\Permis de construire Expert CAD.exe

C:\Program Files\Winamp\winamp.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Documents and Settings\ALI\Bureau\RSIT.exe

C:\Documents and Settings\ALI\Bureau\ALI.exe