[Résolu] PC infecté à nettoyer

bullbizar · le 20 décembre 2010

Bonjour,

Suite à la mise en place d'une connexion internet adsl (512Ko) sur le PC des enfants (Il en était dépourvu) P4, 512Mo RAM, DD 60Go, ces derniers se plaignent de la lenteur de leur machine.

Ils utilisaient leur PC pour jouer à des jeux sur cd ou ramenés d'internet.

Je joins le rapport hijackthis pour analyse et suis attentif à tout conseil et suggestions.

Merci par avance et à bientôt.

Thanos · le 22 décembre 2010

salut

Poste plutôt ces rapports =>

Télécharge random's system information tool (RSIT) par random/random et sauvegarde-le sur le Bureau.

Double-clique sur RSIT.exe afin de lancer RSIT.
Clique Continue à l'écran Disclaimer.
Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.
Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).
Si tu ne vois pas ces deux rapports, tu les trouveras dans le dossier C:\rsit

bullbizar · le 23 décembre 2010

salut

Poste plutôt ces rapports =>

Télécharge random's system information tool (RSIT) par random/random et sauvegarde-le sur le Bureau.

Double-clique sur RSIT.exe afin de lancer RSIT.

Clique Continue à l'écran Disclaimer.

Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.

Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).

Si tu ne vois pas ces deux rapports, tu les trouveras dans le dossier C:\rsit

Bonjour,

Merci Thanos,

Je te joins les 2 rapports

Autre question, je n'arrive pas à installer windows live mesenger.

Logfile of random's system information tool 1.08 (written by random/random)

Run by user at 2010-12-23 21:27:44

Microsoft Windows XP Professionnel Service Pack 2

System drive C: has 10 GB (26%) free of 38 GB

Total RAM: 511 MB (27% free)

HijackThis download failed

======Scheduled tasks folder======

C:\windows\tasks\Ad-Aware Update (Weekly).job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2008-12-08 1067352]

{8a6264b5-a8f2-494b-8f37-cf898a763e42} - Net Games Toolbar - C:\Program Files\Net_Games\tbNet0.dll [2009-07-15 2224152]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2007-09-17 8491008]

"SiSPower"=SiSPower.dll,ModeAgent []

"SoundMan"=C:\windows\SOUNDMAN.EXE [2005-06-20 77824]

"RaidTool"=C:\Program Files\VIA\RAID\raid_tool.exe [2005-06-20 1056768]

"wcmdmgr"=C:\WINDOWS\wt\updater\wcmdmgrl.exe [2002-09-27 20480]

"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2007-09-17 81920]

"KernelFaultCheck"=C:\windows\system32\dumprep 0 -k []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]

"HOMR-09BB4389E7"=C:\windows\system32\.vbe [2010-12-23 10000]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"=C:\windows\system32\ctfmon.exe [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

C:\windows\system32\dumprep 0 -k []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]

C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe /NoDialog []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]

nwiz.exe /install []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]

C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe -onlytray []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^user^Menu Démarrer^Programmes^Démarrage^Product Registration.lnk]

E:\ATR1.EXE /remind /language=FRA /PRNM=Product []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^user^Menu Démarrer^Programmes^Démarrage^Sid Registration.lnk]

E:\ATR1.exe /remind /language=FRA /PRNM=Sid/PRMP=PIRS/SKUN=PCXX/GTYP=STRY []

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage

Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

C:\Documents and Settings\user\Menu Démarrer\Programmes\Démarrage

PowerReg Scheduler.exe

Reboot.exe

Scol.lnk - C:\Program Files\SCOL\UsmWin.exe

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDrives"=0

"NoDriveTypeAutoRun"=145

"DisallowRun"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoResolveSearch"=1

"NoDriveTypeAutoRun"=227

"NoDrives"=0

"NoDriveAutoRun"=67108863

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\Program Files\RY's GAMES\Serious Sam\Bin\SeriousSam.exe"="C:\Program Files\RY's GAMES\Serious Sam\Bin\SeriousSam.exe:*:Enabled:SeriousSam"

"C:\Program Files\EA Games\MOHAA\MOHAA.exe"="C:\Program Files\EA Games\MOHAA\MOHAA.exe:*:Enabled:Medal of Honor Allied Assault"

"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

"D:\Pc Gamer\Serious Sam 2\Bin\Sam2.exe"="D:\Pc Gamer\Serious Sam 2\Bin\Sam2.exe:*:Disabled:Sam2"

"C:\Program Files\Duke Nukem - Manhattan Project\prism3d.exe"="C:\Program Files\Duke Nukem - Manhattan Project\prism3d.exe:*:Disabled:prism3d"

"C:\Program Files\TmNationsForever\TmForever.exe"="C:\Program Files\TmNationsForever\TmForever.exe:*:Enabled:TmForever"

"C:\Program Files\Raven\SOF GOLD\SoF.exe"="C:\Program Files\Raven\SOF GOLD\SoF.exe:*:Enabled:SoF"

"C:\Program Files\TrackMania Nations ESWC\TmNationsESWC.exe"="C:\Program Files\TrackMania Nations ESWC\TmNationsESWC.exe:*:Enabled:TmNationsESWC"

"C:\Program Files\GameTop.com\Extreme Racers\Extreme Racers.exe"="C:\Program Files\GameTop.com\Extreme Racers\Extreme Racers.exe:*:Enabled:Cipher Game Engine"

"D:\Nexuiz\nexuiz.exe"="D:\Nexuiz\nexuiz.exe:*:Enabled:Nexuiz"

"C:\Program Files\www.SmallGames.ws\Beach Head - Desert War\BH2Game\BH2.exe"="C:\Program Files\www.SmallGames.ws\Beach Head - Desert War\BH2Game\BH2.exe:*:Enabled:BH2"

"C:\Program Files\Sierra\SWAT 4\Content\System\Swat4.exe"="C:\Program Files\Sierra\SWAT 4\Content\System\Swat4.exe:*:Enabled:SWAT 4"

"C:\Program Files\Microsoft Games\Age of Empires II The Conquerors Expansion Trial\age2_x1t.exe"="C:\Program Files\Microsoft Games\Age of Empires II The Conquerors Expansion Trial\age2_x1t.exe:*:Enabled:Age of Empires II Expansion"

"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"

"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"

"C:\Documents and Settings\user\Local Settings\temp\Rar$EX02.984\Nexuiz\nexuiz.exe"="C:\Documents and Settings\user\Local Settings\temp\Rar$EX02.984\Nexuiz\nexuiz.exe:*:Enabled:Nexuiz"

"C:\Games\Nexuiz\nexuiz-sdl.exe"="C:\Games\Nexuiz\nexuiz-sdl.exe:*:Enabled:Nexuiz"

"C:\Games\Nexuiz\nexuiz.exe"="C:\Games\Nexuiz\nexuiz.exe:*:Enabled:Nexuiz"

"C:\Program Files\UrbanTerror\ioUrbanTerror.exe"="C:\Program Files\UrbanTerror\ioUrbanTerror.exe:*:Enabled:ioUrbanTerror"

"C:\Program Files\MotoGP2\motogp2.exe"="C:\Program Files\MotoGP2\motogp2.exe:*:Enabled:motogp2"

"C:\Program Files\Zone.com Deluxe Games\Hexic Deluxe\HexicDeluxe.exe"="C:\Program Files\Zone.com Deluxe Games\Hexic Deluxe\HexicDeluxe.exe:*:Disabled:Hexic Deluxe"

"C:\Program Files\SCOL\UsmWin.exe"="C:\Program Files\SCOL\UsmWin.exe:*:Enabled:UsmWin"

"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"

"C:\Program Files\Internet Download Manager\IDMan.exe"="C:\Program Files\Internet Download Manager\IDMan.exe:*:Enabled:Internet Download Manager (IDM)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"

"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"

======File associations======

.scr - config - "%1" %*

======List of files/folders created in the last 3 months======

2010-12-23 21:27:44 ----D---- C:\rsit

2010-12-23 21:27:44 ----D---- C:\Program Files\trend micro

2010-12-23 18:45:58 ----D---- C:\Documents and Settings\user\Application Data\MSNInstaller

2010-12-23 13:30:46 ----A---- C:\windows\Active Setup Log.txt

2010-12-21 20:24:57 ----D---- C:\Program Files\Yacc Yet Another CSO Compressor

2010-12-20 21:18:11 ----A---- C:\windows\imsins.BAK

2010-12-19 21:20:00 ----D---- C:\Documents and Settings\user\Application Data\DMCache

2010-12-19 20:36:03 ----A---- C:\windows\system32\drivers\SBREDrv.sys

2010-12-19 19:19:49 ----D---- C:\Program Files\Mozilla Firefox

======List of files/folders modified in the last 3 months======

2010-12-23 21:27:44 ----RD---- C:\Program Files

2010-12-23 21:25:21 ----D---- C:\windows\Prefetch

2010-12-23 20:56:38 ----D---- C:\windows\temp

2010-12-23 20:56:33 ----SD---- C:\windows\Tasks

2010-12-23 20:55:20 ----D---- C:\windows\system32

2010-12-23 20:55:20 ----AD---- C:\WINDOWS

2010-12-23 20:55:11 ----D---- C:\windows\wt

2010-12-23 20:53:19 ----A---- C:\windows\SchedLgU.Txt

2010-12-23 20:52:53 ----D---- C:\windows\system32\drivers

2010-12-23 19:40:47 ----SHD---- C:\windows\Installer

2010-12-23 18:45:29 ----HD---- C:\windows\inf

2010-12-23 18:45:27 ----D---- C:\Program Files\MSN

2010-12-23 18:21:36 ----D---- C:\windows\system32\CatRoot2

2010-12-20 22:22:08 ----D---- C:\windows\system32\Adobe

2010-12-20 21:18:46 ----AC---- C:\windows\system32\PerfStringBackup.INI

2010-12-20 21:13:22 ----SD---- C:\Documents and Settings\user\Application Data\Microsoft

2010-12-20 21:10:35 ----D---- C:\Games

2010-12-20 21:07:58 ----HD---- C:\Program Files\InstallShield Installation Information

2010-12-20 20:25:27 ----SHD---- C:\Config.Msi

2010-12-20 19:18:37 ----D---- C:\windows\Turtix Rescue Adventure

2010-12-20 19:17:17 ----D---- C:\Program Files\MyPlayCity.com

2010-12-20 19:12:33 ----D---- C:\Program Files\GameTop.com

2010-12-20 19:11:57 ----D---- C:\Program Files\Fichiers communs\Ahead

2010-12-20 19:06:51 ----D---- C:\Program Files\Common Files

2010-12-20 19:05:10 ----D---- C:\Program Files\EA Games

2010-12-20 19:04:46 ----D---- C:\Program Files\GunWarrior

2010-12-20 19:04:12 ----D---- C:\Program Files\GrudgeMatchPool

2010-12-20 19:03:48 ----D---- C:\Program Files\goldminerjoe_full

2010-12-20 19:02:33 ----D---- C:\Program Files\Dweep Gold

2010-12-20 19:02:11 ----D---- C:\Program Files\Bud Redhead

2010-12-20 18:41:33 ----D---- C:\Program Files\My Worst Day WW2

2010-12-20 18:39:55 ----D---- C:\Program Files\Woody Woodpecker

2010-12-20 18:39:03 ----D---- C:\Program Files\Tropix

2010-12-20 18:12:56 ----HD---- C:\Program Files\Zero G Registry

2010-12-20 18:10:07 ----D---- C:\Program Files\Mindscape

2010-12-20 18:10:04 ----AC---- C:\windows\win.ini

2010-12-20 18:09:33 ----D---- C:\Program Files\MagicBall

2010-12-20 18:09:10 ----D---- C:\Program Files\Laser Dolphin

2010-12-20 18:07:04 ----D---- C:\Program Files\Invadazoid

2010-12-20 11:42:06 ----D---- C:\Program Files\Beach Soccer

2010-12-19 19:20:47 ----D---- C:\Documents and Settings\user\Application Data\Mozilla

2010-12-14 19:17:40 ----A---- C:\dumpconsole.txt

2010-12-14 19:11:36 ----D---- C:\Documents and Settings\user\Application Data\Adobe

2010-12-14 19:11:36 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe

2010-12-10 08:38:40 ----AC---- C:\windows\password.ini

2010-12-05 20:45:33 ----AC---- C:\windows\NeroDigital.ini

2010-12-04 19:41:11 ----RSHDC---- C:\windows\system32\dllcache

2010-11-05 11:40:49 ----D---- C:\Program Files\Luxor

2010-10-22 16:40:42 ----D---- C:\EMBIRD32

2010-10-09 09:46:04 ----D---- C:\Program Files\Net_Games

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 fsbts;fsbts; C:\windows\system32\Drivers\fsbts.sys [2009-11-23 33920]

R0 Lbd;Lbd; C:\windows\system32\DRIVERS\Lbd.sys [2010-07-06 64288]

R0 prohlp02;StarForce Protection Helper Driver v2; C:\windows\System32\drivers\prohlp02.sys [2004-08-09 114016]

R0 PxHelp20;PxHelp20; C:\windows\System32\Drivers\PxHelp20.sys [2008-07-04 44944]

R0 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:\windows\System32\drivers\sfdrv01.sys [2005-08-10 50688]

R0 sfhlp01;StarForce Protection Helper Driver; C:\windows\System32\drivers\sfhlp01.sys [2003-12-01 4832]

R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\windows\System32\drivers\sfhlp02.sys [2005-05-16 6656]

R0 sfvfs02;StarForce Protection VFS Driver (version 2.x); C:\windows\System32\drivers\sfvfs02.sys [2005-11-03 63488]

R0 uagp35;Filtre AGP version 3.5 Microsoft; C:\windows\system32\DRIVERS\uagp35.sys [2004-08-04 44672]

R0 viamraid;viamraid; C:\windows\system32\DRIVERS\viamraid.sys [2005-06-20 60928]

R1 intelppm;Pilote de processeur Intel; C:\windows\system32\DRIVERS\intelppm.sys [2004-08-04 40320]

R1 prodrv06;StarForce Protection Environment Driver v6; C:\windows\System32\drivers\prodrv06.sys [2004-08-09 53920]

R1 SiSkp;SiSkp; C:\windows\system32\DRIVERS\srvkp.sys [2005-06-09 11904]

R2 fssfltr;FssFltr; C:\windows\system32\DRIVERS\fssfltr_tdi.sys [2008-12-08 55136]

R2 tandpl;tandpl; C:\windows\System32\drivers\tandpl.sys [2003-04-19 4736]

R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\windows\system32\drivers\ALCXWDM.SYS [2005-06-20 2324480]

R3 HidUsb;Pilote de classe HID Microsoft; C:\windows\system32\DRIVERS\hidusb.sys [2001-08-17 9600]

R3 mouhid;Pilote HID de souris; C:\windows\system32\DRIVERS\mouhid.sys [2001-08-23 12288]

R3 nv;nv; C:\windows\system32\DRIVERS\nv4_mini.sys [2007-09-17 6853088]

R3 pfc;Padus ASPI Shell; C:\windows\system32\drivers\pfc.sys [2006-10-02 10368]

R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\windows\System32\Drivers\RootMdm.sys [2002-09-07 5888]

R3 SISNIC;Pilote de carte Fast Ethernet PCI SiS; C:\windows\system32\DRIVERS\sisnic.sys [2004-08-03 32768]

S3 CCDECODE;Décodeur sous-titre fermé; C:\windows\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]

S3 FETND5BV;VIA Rhine-Family Fast Ethernet Adapter Driver Service; C:\windows\system32\DRIVERS\fetnd5bv.sys [2005-03-18 42496]

S3 FETNDIS;Pilote NT de carte VIA PCI 10/100Mo Fast Ethernet; C:\windows\system32\DRIVERS\fetnd5.sys [2001-08-17 27165]

S3 FXDRV;FXDRV; \??\E:\Fxdrv.sys []

S3 Lavasoft Kernexplorer;Lavasoft helper driver; \??\C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys []

S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\windows\system32\drivers\MSTEE.sys [2004-08-03 5504]

S3 NABTSFEC;Codec NABTS/FEC VBI; C:\windows\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]

S3 NdisIP;Connection TV/vidéo Microsoft; C:\windows\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]

S3 SiS315;SiS315; C:\windows\system32\DRIVERS\sisgrp.sys [2005-06-08 247296]

S3 SLIP;Détrameur décalage BDA; C:\windows\system32\DRIVERS\SLIP.sys [2004-08-03 11136]

S3 streamip;BDA IPSink; C:\windows\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]

S3 TSP;TSP; \??\C:\WINDOWS\system32\drivers\klif.sys []

S3 upperdev;upperdev; C:\windows\system32\DRIVERS\usbser_lowerflt.sys []

S3 usbaudio;Pilote USB audio (WDM); C:\windows\system32\drivers\usbaudio.sys [2004-08-03 59264]

S3 usbccgp;Pilote parent générique USB Microsoft; C:\windows\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]

S3 USBSTOR;Pilote de stockage de masse USB; C:\windows\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]

S3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\windows\system32\DRIVERS\usbuhci.sys [2004-08-04 20480]

S3 usbvideo;Périphérique vidéo USB (WDM); C:\windows\System32\Drivers\usbvideo.sys [2004-08-03 78464]

S3 Wdf01000;Wdf01000; C:\windows\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]

S3 WSTCODEC;Codec Teletext standard; C:\windows\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]

S3 zeaiyk;zeaiyk; \??\C:\windows\system32\02.tmp []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Ad-Aware 2007 Service; C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe [2007-06-05 561152]

R2 MDM;Machine Debug Manager; C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]

R2 nlsX86cc;Nalpeiron Licensing Service; C:\windows\system32\nlssrv32.exe [2009-12-18 57344]

R2 NVSvc;NVIDIA Display Driver Service; C:\windows\system32\nvsvc32.exe [2007-09-17 155716]

R2 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2008-12-04 226640]

R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]

S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [2010-12-19 1375992]

S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe [2008-02-10 68096]

S3 aspnet_state;ASP.NET State Service; C:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]

S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]

S3 fsssvc;Windows Live Contrôle parental; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2008-12-08 533344]

S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]

S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-04-07 430592]

-----------------EOF-----------------

info.txt logfile of random's system information tool 1.08 2010-12-23 21:27:47

======Uninstall list======

_Peter Pan (By RY's)-->C:\PROGRA~1\RY'SGA~1\PETERP~1\UNWISE.EXE C:\PROGRA~1\RY'SGA~1\PETERP~1\INSTALL.LOG

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf

Aargon-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Twilight\Aargon\Uninst.isu"

Ad-Aware-->"C:\Documents and Settings\All Users\Application Data\{65893B95-F47B-4483-B883-86BA181E9B54}\Ad-AwareInstall.exe" REMOVE=TRUE MODIFY=FALSE

Ad-Aware-->C:\Documents and Settings\All Users\Application Data\{65893B95-F47B-4483-B883-86BA181E9B54}\Ad-AwareInstall.exe

Adobe Flash Player 10 Plugin-->C:\windows\system32\Macromed\Flash\FlashUtil10l_Plugin.exe -maintain plugin

Adobe Illustrator CS-->RunDll32 "C:\Program Files\Fichiers communs\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll",LaunchSetup "C:\Program Files\InstallShield Installation Information\{91A4AD99-69CE-4745-97B7-0E0DFBECFDE5}\setup.exe"

Adobe Photoshop CS-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EFB21DE7-8C19-4A88-BB28-A766E16493BC}\setup.exe" -l0x40c

Adobe Reader 6.0.1 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A00000000001}

Adobe Shockwave Player 11.5-->"C:\windows\system32\Adobe\Shockwave 11\uninstaller.exe"

Adobe SVG Viewer 3.0-->C:\Program Files\Fichiers communs\Adobe\SVG Viewer 3.0\Uninstall\Winstall.exe -u -fC:\Program Files\Fichiers communs\Adobe\SVG Viewer 3.0\Uninstall\Install.log

Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe

Assistant de connexion Windows Live-->MsiExec.exe /I{D6E592B3-67DA-4BBB-9783-E1838FB253A2}

AviSynth 2.5-->"C:\Program Files\AviSynth 2.5\Uninstall.exe"

BATMAN VENGEANCE-->C:\WINDOWS\UbiSoft\SetupUbi.exe -uninstall BATMAN VENGEANCE

Cars Quatre Roues - Aventures à Radiator Springs-->"C:\Games\Uninstall_Cars Quatre Roues - Aventures à Radiator Springs\Uninstall Cars Quatre Roues - Aventures à Radiator Springs.exe"

CCleaner-->"C:\Program Files\CCleaner\uninst.exe"

Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}

Color Efex Pro 3.0 Complete-->D:\Programme files\Photoshop-ImageReadyCs\Modules externes\Nik Software\Color Efex Pro 3.0 Complete\uninstall.exe

Comanche 4 Demo-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\NovaLogic\Comanche 4 Demo\Uninst.isu"

Comanche 4-->C:\windows\IsUninst.exe -f"C:\Program Files\NovaLogic\Comanche 4\Uninst.isu"

Cooking Academy-->"C:\Program Files\Games\Cooking Academy\unins000.exe"

Cryo-Networks - SCOL-->C:\Program Files\SCOL\scolsetup.exe C:\Program Files\SCOL

Dfine 2.0-->D:\Programme files\Photoshop-ImageReadyCs\Modules externes\Nik Software\Dfine 2.0\uninstall.exe

DVD PixPlay-->"C:\Program Files\DVD PixPlay\unins000.exe"

EAX Unified-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\EAX Unified\Uninst.isu"

Electric 1.0-->C:\WINDOWS\iun6002.exe "D:\irunin.ini"

EVEREST Home Edition v2.20-->"C:\Program Files\Lavalys\EVEREST Home Edition\unins000.exe"

Free Window Registry Repair-->C:\PROGRA~1\FREEWI~1\UNWISE.EXE C:\PROGRA~1\FREEWI~1\INSTALL.LOG

Galerie de photos Windows Live-->MsiExec.exe /X{43563ACB-371B-4C58-8979-B192B390424C}

Global Operations-->C:\Program Files\InstallShield Installation Information\{ED5AACB5-F387-4DF0-961D-C2E5EA8702CF}\setup.exe -l0x9 Uninstall

Grapher 4-->MsiExec.exe /I{E1330943-B9CD-4398-AAFC-C245929F5AAC}

HijackThis 2.0.2-->"G:\HijackThis.exe" /uninstall

Imagenomic Portraiture 2.0 Plug-in (build 2006)-->C:\Program Files\Imagenomic\Portraiture 2 Plug-in\uninst.exe

Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe

Installation Windows Live-->MsiExec.exe /I{3CCB732A-E472-4CF9-B1EE-F18365341FE0}

Junk Mail filter update-->MsiExec.exe /I{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}

K2000, La Revanche de KITT-->C:\PROGRA~1\Davilex\K2000_~1\UNWISE.EXE C:\PROGRA~1\Davilex\K2000_~1\INSTALL.LOG

Lecteur Windows Media 10-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall

LightWeight Ninja-->C:\PROGRA~1\Drengin.net\LWNinja\UNWISE.EXE C:\PROGRA~1\Drengin.net\LWNinja\INSTALL.LOG

Little Fighter 2 1.9c-->C:\Program Files\LittleFighter2\LF2_v1.9c\uninst.exe

Lizardtech DjVu Control-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{105CFC7C-6992-11D5-BD9D-000102C10FD8}\Setup.exe" -l0x40c

Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe

Microsoft Kernel-Mode Driver Framework Feature Pack 1.5-->"C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe"

Microsoft Office Live Add-in 1.3-->MsiExec.exe /I{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}

Microsoft Office Outlook Connector-->MsiExec.exe /I{95120000-0120-040C-0000-0000000FF1CE}

Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9}

Microsoft Search Enhancement Pack-->MsiExec.exe /I{299CF645-48C7-4FA1-8BCD-5CE200CF180D}

Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}

Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}

Microsoft Sync Framework Runtime Native v1.0 (x86)-->MsiExec.exe /I{8A74E887-8F0F-4017-AF53-CBA42211AAA5}

Microsoft Sync Framework Services Native v1.0 (x86)-->MsiExec.exe /I{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022-->MsiExec.exe /X{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}

MotoGP2-->"C:\Program Files\MotoGP2\unins001.exe"

Mozilla Firefox (3.6.13)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe

MSN-->C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARP

MSVC80_x86-->MsiExec.exe /I{212748BB-0DA5-46DE-82A1-403736DC9F27}

MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}

Need For Speed Hot Pursuit 2-->C:\Program Files\EA Games\Need For Speed Hot Pursuit 2\EAUninstall.exe

Net_Games Toolbar-->C:\PROGRA~1\NET_GA~1\UNWISE.EXE /U C:\PROGRA~1\NET_GA~1\INSTALL.LOG

NVIDIA Drivers-->C:\WINDOWS\system32\nvudisp.exe UninstallGUI

Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}

Paint Shop Pro 7-->MsiExec.exe /I{0F211D27-C463-43A9-9B8A-12CA8D6D90DE}

Panda Craze-->"C:\Program Files\Panda Craze\ReflexiveArcade\unins000.exe"

PC Connectivity Solution-->MsiExec.exe /I{AC599724-5755-48C1-ABE7-ABB857652930}

Perles de rocaille 2.01-->"C:\Program Files\Perles de rocaille\uninstall.exe"

Realtek AC'97 Audio-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" -l0x40c -removeonly

Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}

Shadow Illuminator Pro-->MsiExec.exe /X{8B1D967A-032F-44D1-A8CC-D38816D5217F}

Sharpener Pro 3.0-->D:\Programme files\Photoshop-ImageReadyCs\Modules externes\Nik Software\Sharpener Pro 3.0\uninstall.exe

SiS Mirage Graphics-->Rundll32 SiSInst.dll,Uninstall VGA,R,oem15.inf

SONIC HEROES TRIAL-->C:\Program Files\Sega\SONICHEROES TRIAL\unsetup.exe

Speed Boat By RY's-->C:\WINDOWS\unin040c.exe -f"C:\Program Files\RY's Games\Speed Boat\DeIsL1.isu" -c"C:\Program Files\RY's Games\Speed Boat\_ISREG32.DLL"

Spider-Man 2-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{2F7655DD-793E-40C6-B348-DE67C109F6FF}

The Mummy-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{44EAF482-99EB-11D4-8BB4-0080C87AF2C6}\setup.exe"

the names of god-->C:\Program Files\the names of god\uninstall.exe

Turtix Rescue Adventure-->"C:\WINDOWS\Turtix Rescue Adventure\uninstall.exe" "/U:C:\Program Files\Turtix Rescue Adventure\Uninstall\uninstall.xml"

VIA Platform Device Manager-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{20D4A895-748C-4D88-871C-FDB1695B0169}

VIA Rhine-Family Fast Ethernet Adapter-->Rundll32.exe vuins32.dll,vuins32Ex $Rhine $VIA

Visual C++ 2008 x86 Runtime - (v9.0.30729)-->MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5D14231E27}

Visual C++ 2008 x86 Runtime - v9.0.30729.01-->C:\windows\system32\msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D14231E27} /qb+ REBOOTPROMPT=""

Viveza 2-->C:\Program Files\Nik Software\Viveza 2\Uninstall Viveza 2.exe

VLC media player 0.9.9-->C:\Program Files\VideoLAN\VLC\uninstall.exe

WildTangent Updater-->C:\WINDOWS\wt\updater\wcmdmgr.exe -uninstall wcmdmgr.exe

WildTangent Web Driver-->C:\WINDOWS\wt\updater/wcmdmgr -uninstall wtwebdriver

Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"

Windows Installer 3.1 (KB893803)-->"C:\windows\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"

Windows Live Call-->MsiExec.exe /I{01523985-2098-43AF-9C97-12B07BE02A9B}

Windows Live Communications Platform-->MsiExec.exe /I{F69E83CF-B440-43F8-89E6-6EA80712109B}

Windows Live Contrôle parental-->MsiExec.exe /X{EB8BAA0D-11EF-4EDC-A960-2AB7CA8F53F0}

Windows Live Mail-->MsiExec.exe /I{63DC2DA0-2A6C-4C38-9249-B75395458657}

Windows Live Messenger-->MsiExec.exe /X{059C042E-796A-4ACC-A81A-ECC2010BB78C}

Windows Live Sync-->MsiExec.exe /X{67D0313C-4F15-437D-9A2D-C1564088A26A}

Windows Live Toolbar-->MsiExec.exe /X{915809D6-1F93-45F2-9699-5F1DA64DC24B}

Windows Live Writer-->MsiExec.exe /X{2231CE39-B963-4B9D-823A-F412ECA637B1}

Windows Media Format Runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll

WinZip-->"C:\Program Files\WinZip\WINZIP32.EXE" /uninstall

Yacc 0.4.0.3-->C:\Program Files\Yacc Yet Another CSO Compressor\uninst.exe

======Security center information======

AV: Lavasoft Ad-Watch Live! Antivirus (disabled)

======System event log======

Computer Name: HOMR-09BB4389E7

Event Code: 6009

Message: Microsoft ® Windows ® 5.01. 2600 Service Pack 2 Uniprocessor Free.

Record Number: 1703

Source Name: EventLog

Time Written: 20071109113150.000000+060

Event Type: Informations

User:

Computer Name: HOMR-09BB4389E7

Event Code: 36

Message: Le service de temps n'a pas pu synchroniser l'heure système de 49152

secondes car aucun fournisseur de temps n'a pu fournir de datage

utilisable. L'horloge système n'est pas synchronisée.

Record Number: 1702

Source Name: W32Time

Time Written: 20071109110234.000000+060

Event Type: Avertissement

User:

Computer Name: HOMR-09BB4389E7

Event Code: 9

Message: Le périphérique \Device\Ide\IdePort0 n'a pas répondu dans le délai imparti.

Record Number: 1701

Source Name: atapi

Time Written: 20071109100525.000000+060

Event Type: erreur

User:

Computer Name: HOMR-09BB4389E7

Event Code: 9

Message: Le périphérique \Device\Ide\IdePort0 n'a pas répondu dans le délai imparti.

Record Number: 1700

Source Name: atapi

Time Written: 20071109100525.000000+060

Event Type: erreur

User:

Computer Name: HOMR-09BB4389E7

Event Code: 7034

Message: Le service Ad-Aware 2007 Service s'est terminé de façon inattendue pour la 1ème fois.

Record Number: 1699

Source Name: Service Control Manager

Time Written: 20330825052224.000000+060

Event Type: erreur

User:

=====Application event log=====

Computer Name: HOMR-09BB4389E7

Event Code: 0

Message:

Record Number: 5

Source Name: SeaPort

Time Written: 20091202211853.000000+060

Event Type: Informations

User:

Computer Name: HOMR-09BB4389E7

Event Code: 4609

Message: Le système d'événements de COM+ a détecté un code de renvoi erroné lors de son traitement interne. Le HRESULT est 80070005 à partir de la ligne 44 de d:\qxp_slp\com\com1x\src\events\tier1\eventsystemobj.cpp. Contactez les services du Support Technique Microsoft pour signaler cette erreur.

Record Number: 4

Source Name: EventSystem

Time Written: 20091202211728.000000+060

Event Type: erreur

User:

Computer Name: HOMR-09BB4389E7

Event Code: 1000

Message: Application défaillante tropix2.exe, version 0.0.0.0, module défaillant tropix2.exe, version 0.0.0.0, adresse de défaillance 0x001a22a6.

Record Number: 3

Source Name: Application Error

Time Written: 20091202191203.000000+060

Event Type: erreur

User:

Computer Name: HOMR-09BB4389E7

Event Code: 1800

Message: Le service Centre de sécurité Windows a démarré.

Record Number: 2

Source Name: SecurityCenter

Time Written: 20091202191125.000000+060

Event Type: Informations

User:

Computer Name: HOMR-09BB4389E7

Event Code: 0

Message:

Record Number: 1

Source Name: SeaPort

Time Written: 20091202191108.000000+060

Event Type: Informations

User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe

"FP_NO_HOST_CHECK"=NO

"NUMBER_OF_PROCESSORS"=1

"OS"=Windows_NT

"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\PC Connectivity Solution;C:\Program Files\Fichiers communs\Ulead Systems\MPEG

"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

"PROCESSOR_ARCHITECTURE"=x86

"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 9, GenuineIntel

"PROCESSOR_LEVEL"=15

"PROCESSOR_REVISION"=0409

"TEMP"=%SystemRoot%\TEMP

"TMP"=%SystemRoot%\TEMP

"windir"=%SystemRoot%

-----------------EOF-----------------

Modifié le 23 décembre 2010 par bullbizar

bullbizar · le 6 janvier 2011

Bonjour,

je ne sais pas si Thanos n'est pas encore revenu de vacances et s'il a oublié?

Désolé pour mon up et merci encore.

Thanos · le 10 janvier 2011

salut

Désolé d'avoir zappé ton sujet!!

Petite remarque: le pc est vulnérable car Windows n'est pas à jour, et il n'est pas protégé par un antivirus...à méditer surtout si le pc est utilisé par les gamins

Ceci dit, on mettra en place les protections après.

Dans l'immédiat =>

Un petit scan supplémentaire avec un programme que tu vas pouvoir conserver: si tu le possède déjà, passe l'étape de l'installation et va directement à la mise à jour >>

Télécharge Malwarebytes' Anti-Malware (MBAM)

Branche tous les supports amovibles que tu possèdes avant de faire ce scan (clé usb/disque dur externe etc)

Double clique sur le fichier téléchargé pour lancer le processus d'installation.
Dans l'onglet "Mise à jour", clique sur le bouton "Recherche de mise à jour": si le pare-feu demande l'autorisation à MBAM de se connecter, accepte.
Une fois la mise à jour terminée, rends-toi dans l'onglet "Recherche".
Sélectionne "Exécuter un examen complêt"
Clique sur "Rechercher"
L'analyse démarre, le scan est relativement long, c'est normal.
A la fin de l'analyse, un message s'affiche :
L'examen s'est terminé normalement. Clique sur 'Afficher les résultats' pour afficher tous les objets trouvés.
Clique sur "Ok" pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
Ferme tes navigateurs.
Si des malwares ont été détectés, clique sur Afficher les résultats.
Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport et poste-le dans ta prochaine réponse.

Après ca, relance RSIT: un seul rapport sera produit, poste le à la suite du rapport de MBAM.

bullbizar · le 11 janvier 2011

Salut Thanos,

Pas de problème pour le zapping, je n'ai jamais douté de la bonne foi des membres de ce forum, j'y ai toujours trouvé l'aide nécessaire.

Je te poste les deux logs demandés.Bonne analyse et Merci encore.

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Version de la base de données: 5504

Windows 5.1.2600 Service Pack 2

Internet Explorer 7.0.5730.13

11/01/2011 19:19:17

mbam-log-2011-01-11 (19-19-17).txt

Type d'examen: Examen complet (C:\|D:\|)

Elément(s) analysé(s): 261470

Temps écoulé: 46 minute(s), 57 seconde(s)

Processus mémoire infecté(s): 1

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 4

Valeur(s) du Registre infectée(s): 1

Elément(s) de données du Registre infecté(s): 3

Dossier(s) infecté(s): 1

Fichier(s) infecté(s): 12

Processus mémoire infecté(s):

c:\documents and settings\user\application data\EoRezo\EoRezo\softwareupdatehp.exe (Rogue.Eorezo) -> 1864 -> Unloaded process successfully.

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):

HKEY_CURRENT_USER\Software\EoRezo (Rogue.Eorezo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo (Rogue.Eorezo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Windowsfirwall (Worm.Sohanad) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\eoRezo_is1 (Rogue.Eorezo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SoftwareHelper (Rogue.Eorezo) -> Value: SoftwareHelper -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (PUM.Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):

c:\program files\eoRezo (Rogue.Eorezo) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):

c:\documents and settings\user\application data\EoRezo\EoRezo\softwareupdatehp.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.

c:\program files\eoRezo\eorezo.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.

c:\documents and settings\user\application data\EoRezo\EoRezo\softwareupdate.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.

c:\documents and settings\user\Bureau\backups\backup-20110110-214816-704.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.

c:\system volume information\_restore{d94a209a-92b7-4305-a1dd-2d9f1f42301a}\RP187\A0284519.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.

d:\system volume information\_restore{d94a209a-92b7-4305-a1dd-2d9f1f42301a}\RP167\A0227785.EXE (Malware.Packer.Gen) -> Quarantined and deleted successfully.

d:\Winrar3.51\Patch09c.exe (Trojan.Generic) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\sexy girls.scr (Trojan.Delf) -> Quarantined and deleted successfully.

c:\WINDOWS\inf\smss.exe (Trojan.Delf) -> Quarantined and deleted successfully.

c:\program files\eoRezo\confmedia.cyp (Rogue.Eorezo) -> Quarantined and deleted successfully.

c:\program files\eoRezo\unins000.dat (Rogue.Eorezo) -> Quarantined and deleted successfully.

c:\program files\eoRezo\unins000.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.

Logfile of random's system information tool 1.08 (written by random/random)

Run by user at 2011-01-11 19:35:02

Microsoft Windows XP Professionnel Service Pack 2

System drive C: has 2 GB (6%) free of 38 GB

Total RAM: 511 MB (37% free)

HijackThis download failed

======Scheduled tasks folder======

C:\windows\tasks\Ad-Aware Update (Weekly).job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}]

IDMIEHlprObj Class - C:\Program Files\Internet Download Manager\IDMIECC.dll [2010-12-23 202160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]

AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]

Conduit Engine - C:\Program Files\ConduitEngine\ConduitEngine.dll [2010-11-13 3913000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2008-12-08 1067352]

{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - Barre d'outils MSN - C:\Program Files\MSN Toolbar\01.01.2607.0\fr\msntb.dll [2005-02-07 203464]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2007-09-17 8491008]

"SiSPower"=SiSPower.dll,ModeAgent []

"SoundMan"=C:\windows\SOUNDMAN.EXE [2005-06-20 77824]

"RaidTool"=C:\Program Files\VIA\RAID\raid_tool.exe [2005-06-20 1056768]

"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2007-09-17 81920]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]

"HOMR-09BB4389E7"=C:\windows\system32\.vbe [2011-01-11 10000]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"=C:\windows\system32\ctfmon.exe [2004-08-04 15360]

"IDMan"=C:\Program Files\Internet Download Manager\IDMan.exe [2010-12-23 3274136]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eorezo]

C:\Program Files\EoRezo\eorezo.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]

C:\Program Files\Internet Download Manager\IDMan.exe [2010-12-23 3274136]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMBooster]

C:\Program Files\Iminent\IMBooster\IMBooster.exe /warmup []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Iminent.Notifier]

C:\Program Files\Iminent\SearchTheWeb\Iminent.Notifier.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

C:\windows\system32\dumprep 0 -k []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]

C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe /NoDialog []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]

nwiz.exe /install []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]

C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe -onlytray []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Software Informer]

C:\Program Files\Software Informer\softinfo.exe -autorun []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wcmdmgr]

C:\WINDOWS\wt\updater\wcmdmgrl.exe [2002-09-27 20480]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Gamma Loader.lnk]

C:\PROGRA~1\FICHIE~1\Adobe\CALIBR~1\ADOBEG~1.EXE [2003-11-15 110592]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]

C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE [2004-12-14 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^user^Menu Démarrer^Programmes^Démarrage^Product Registration.lnk]

E:\ATR1.EXE /remind /language=FRA /PRNM=Product []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^user^Menu Démarrer^Programmes^Démarrage^Reboot.exe]

C:\Documents and Settings\user\Menu Démarrer\Programmes\Démarrage\Reboot.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^user^Menu Démarrer^Programmes^Démarrage^Scol.lnk]

C:\PROGRA~1\SCOL\UsmWin.exe [1999-05-26 36864]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^user^Menu Démarrer^Programmes^Démarrage^Sid Registration.lnk]

E:\ATR1.exe /remind /language=FRA /PRNM=Sid/PRMP=PIRS/SKUN=PCXX/GTYP=STRY []

C:\Documents and Settings\user\Menu Démarrer\Programmes\Démarrage

Notification de cadeaux MSN.lnk - C:\Documents and Settings\user\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe