infection cheval de troie

[christian ajaccio]

Bonjour
Mon anti virus a detecter un cheval de troie "FakeAlert-FAB!989480C34E58"
je n'ai acces qu'a ma messagerie et au net, plus d'acces au autres logiciel ni au programmes "vide"
tout les 1/4 heure le pc se relance redemarrage
je ne peux faire aucun telechargement
merci de me venir en aide

[christian ajaccio]

je n'ai pas pu enregistrer Téléchargez USBFix et OTL
je suis sous Windows xp version 2002 service pack 3

[jeanmimigab]

hello,

C'est pas gagné ton histoire ...

est-ce que tu as un autre ordinateur sous la main pour graver un CD ?

[christian ajaccio]

Oui j'ai un pc avec une clef USB

[jeanmimigab]

ok,

on vas utiliser ce que l'on appelle un live CD pour désinfecter ton PC...
Le but est de démarrer sur un CD contenant certains outils de désinfection...

Il te faut un CD vierge sous la main...

Sur le pc qui fonctionne bien, fais cela...

Insère un CD (ou un DVD) vierge dans ton graveur...si une fenêtre s'ouvre te demandant ce que tu veux faire, ferme cette fenêtre.

• Télécharge OTLPENet.iso sur ton bureau.
• Insère un CD vierge dans ton graveur, si une fenêtre s'ouvre te demandant ce que tu veux faire, ferme cette fenêtre.
• Fais un double-clic sur l'icône d'OTLPENet.iso et suis les instructions pour graver le CD/DVD automatiquement

Note : Le CD gravé, vous devez maintenant redémarrer votre machine sur le lecteur CDROM

Si ton pc ne boot pas automatiquement sur le CD, je t'invite sur ce lien : http://forum.malekal.com/booter-sur-dvd-t9447.html
= Le setup se charge en RAM


= Une fois le CD lancé Windows se charge (comptez 15 à 20 minutes) vous arrivez sur le bureau REATOGO-X-PE



= Double cliquer sur OTLPE

= Une fenêtre s'ouvre : Do you wish to load the remote registry ; Cliquez sur YES



= Une seconde : Do you wish to load remote user profile(s) for scanning ;choisis ta session et Clique sur YES



= Veillez à ce que la case "Automatically Load All Remaining Users" soit cochée et cliquez sur "OK"



=OTL se lance tu arrives sur cette fenêtre



Sur ton pc sain, tu utilises une clé usb pour sauver le contenu du cadre ci dessous dans un fichier bloc notes , et tu connecte ta clef USB au PC infecté afin de le retrouver facilement.
Une fois la clef branchée, clique sur l'icône "computer" afin de trouver ta clef USB et le fichier bloc note que tu as créer, ouvre le et copie l'intégralité de son contenu sous" Custom Scan box"
Note: OTLPE est en Anglais donc:
Tout sélectionner = select all
copier = copy
coller = paste

SAVEMBR:0
NetSvcs
%systemroot%\system32\drivers\*.sys /lockedfiles
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
sptd.sys
explorer.exe
userinit.exe
winlogon.exe
tcpip.sys
Sfloppy.sys
Changer.sys
cdrom.sys
disk.sys
ndis.sys
usbscan.sys
usbprint.sys
tdtcp.sys
tdpipe.sys
swmidi.sys
splitter.sys
rdpwd.sys
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
RASACD.SYS
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles

* cliques Run Scan pour démarrer le scan.
* une fois terminé , le fichier se trouve là C:\OTL.txt
* copie_colle le sur ta clef USB et poste son contenu dans ta prochaine réponse

[Skynet]

merci de ta reponse de pro
voici le fichier OLT

Code: Tout sélectionner

OTL logfile created on: 4/25/2011 9:38:18 PM - Run
OTLPE by OldTimer - Version 3.1.46.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy
 
2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 86.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): C:\pagefile.sys 4092 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 66.04 Gb Total Space | 21.08 Gb Free Space | 31.92% Space Free | Partition Type: NTFS
Drive D: | 6.94 Gb Total Space | 0.77 Gb Free Space | 11.03% Space Free | Partition Type: NTFS
Drive E: | 1.55 Gb Total Space | 1.32 Gb Free Space | 85.10% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
[color=#E56717]========== Win32 Services (SafeList) ==========[/color]
 
SRV - File not found [Disabled] --  -- (HidServ)
SRV - [2010/01/15 08:49:20 | 000,227,232 | -H-- | M] (McAfee, Inc.) [On_Demand] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2007/11/28 12:45:37 | 000,155,136 | -H-- | M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\System32\imapihp.exe -- (ImapiService)
SRV - [2007/10/30 14:12:10 | 000,065,536 | -H-- | M] (France Telecom SA) [Auto] -- C:\Program Files\Fichiers communs\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe -- (FTRTSVC)
SRV - [2007/06/08 04:06:42 | 000,172,131 | RH-- | M] (Hewlett-Packard Ltd) [On_Demand] -- C:\WINDOWS\system32\flcdlock.exe -- (FLCDLOCK)
SRV - [2007/05/22 12:03:00 | 001,010,424 | -H-- | M] (Sonic Solutions) [On_Demand] -- C:\Program Files\Fichiers communs\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe -- (RoxMediaDB9)
SRV - [2007/05/08 03:38:46 | 000,540,448 | -H-- | M] (PDF Complete Inc) [Auto] -- C:\Program Files\PDF Complete\pdfsvc.exe -- (pdfcDispatcher)
SRV - [2007/05/03 08:31:12 | 000,074,656 | RH-- | M] (MicroVision Development, Inc.) [On_Demand] -- C:\Program Files\Fichiers communs\SureThing Shared\stllssvr.exe -- (stllssvr)
SRV - [2007/04/19 08:35:46 | 000,075,304 | -H-- | M] (Hewlett-Packard Company) [Auto] -- C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe -- (LightScribeService)
SRV - [2007/02/22 15:50:00 | 000,144,960 | -H-- | M] (McAfee, Inc.) [Auto] -- C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe -- (McShield)
SRV - [2007/02/22 15:50:00 | 000,054,872 | -H-- | M] (McAfee, Inc.) [Auto] -- C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe -- (McTaskManager)
SRV - [2007/01/04 14:48:52 | 000,112,152 | RH-- | M] (InterVideo) [Auto] -- C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr)
SRV - [2006/12/19 06:24:50 | 000,104,000 | -H-- | M] (McAfee, Inc.) [Auto] -- C:\Program Files\McAfee\Common Framework\FrameworkService.exe -- (McAfeeFramework)
SRV - [2004/10/21 22:24:18 | 000,073,728 | -H-- | M] (Macrovision Corporation) [On_Demand] -- C:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT)
 
 
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
 
DRV - File not found [Kernel | On_Demand] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand] --  -- (UIUSys)
DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)
DRV - File not found [Kernel | System] --  -- (PCIDump)
DRV - File not found [Kernel | System] --  -- (lbrtfdc)
DRV - File not found [Kernel | System] --  -- (i2omgmt)
DRV - File not found [Kernel | System] --  -- (Changer)
DRV - [2008/03/13 08:51:52 | 000,057,536 | -H-- | M] (FTDI Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ftdibus.sys -- (FTDIBUS)
DRV - [2008/03/13 08:50:02 | 000,072,000 | -H-- | M] (FTDI Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ftser2k.sys -- (FTSER2K)
DRV - [2007/11/05 04:37:02 | 000,034,688 | -H-- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand] -- C:\WINDOWS\system32\pcampr5.sys -- (PCAMPR5)
DRV - [2007/10/30 13:31:38 | 000,032,128 | -H-- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand] -- C:\WINDOWS\system32\pcandis5.sys -- (PCANDIS5)
DRV - [2007/07/09 11:17:36 | 000,095,744 | RH-- | M] (Option NV) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Gt51Ip.sys -- (GT72NDISIPXP)
DRV - [2007/06/26 10:38:46 | 000,051,968 | RH-- | M] (Option N.V.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\gt72ubus.sys -- (GT72UBUS)
DRV - [2007/06/08 03:49:46 | 000,030,008 | RH-- | M] (Hewlett-Packard Development Company L.P.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\DAMDrv.sys -- (DAMDrv)
DRV - [2007/05/07 09:14:02 | 002,206,976 | -H-- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\NETw4x32.sys -- (NETw4x32) Pilote de carte Intel(R)
DRV - [2007/03/30 10:38:14 | 000,008,064 | RH-- | M] (Option N.V.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\gtptser.sys -- (GTPTSER)
DRV - [2007/03/29 10:19:36 | 000,012,416 | -H-- | M] (Intel Corporation) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)
DRV - [2007/02/22 15:50:00 | 000,170,408 | -H-- | M] (McAfee, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mfehidk.sys -- (mfehidk)
DRV - [2007/02/12 06:56:44 | 000,625,664 | -H-- | M] (Conexant Systems Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\CHDAud.sys -- (HdAudAddService)
DRV - [2007/02/08 15:05:30 | 000,028,120 | -H-- | M] (Roxio) [File_System | System] -- C:\WINDOWS\system32\drivers\DLARTL_M.SYS -- (DLARTL_M)
DRV - [2007/02/08 15:05:30 | 000,012,856 | -H-- | M] (Roxio) [File_System | System] -- C:\WINDOWS\system32\drivers\DLACDBHM.SYS -- (DLACDBHM)
DRV - [2006/12/20 18:56:44 | 000,988,800 | -H-- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)
DRV - [2006/12/20 18:56:00 | 000,209,664 | -H-- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys -- (HSFHWAZL)
DRV - [2006/12/20 18:55:56 | 000,730,112 | -H-- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2006/11/30 06:24:58 | 000,008,192 | -H-- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | System] -- C:\WINDOWS\system32\drivers\eabfiltr.sys -- (eabfiltr)
DRV - [2006/11/30 03:50:00 | 000,072,264 | -H-- | M] (McAfee, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mfeavfk.sys -- (mfeavfk)
DRV - [2006/11/30 03:50:00 | 000,064,360 | -H-- | M] (McAfee, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mfeapfk.sys -- (mfeapfk)
DRV - [2006/11/30 03:50:00 | 000,052,136 | -H-- | M] (McAfee, Inc.) [Kernel | System] -- C:\WINDOWS\system32\drivers\mfetdik.sys -- (mfetdik)
DRV - [2006/11/30 03:50:00 | 000,034,152 | -H-- | M] (McAfee, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mfebopk.sys -- (mfebopk)
DRV - [2006/11/30 03:50:00 | 000,031,944 | -H-- | M] (McAfee, Inc.) [Kernel | System] -- C:\Program Files\McAfee\VirusScan Enterprise\mferkdk.sys -- (mferkdk)
DRV - [2006/10/26 11:22:08 | 000,009,432 | -H-- | M] (Roxio) [File_System | Auto] -- C:\WINDOWS\system32\DLA\DLADResM.SYS -- (DLADResM)
DRV - [2006/10/26 11:21:34 | 000,094,648 | -H-- | M] (Roxio) [File_System | Auto] -- C:\WINDOWS\system32\DLA\DLAUDFAM.SYS -- (DLAUDFAM)
DRV - [2006/10/26 11:21:34 | 000,035,096 | -H-- | M] (Roxio) [File_System | Auto] -- C:\WINDOWS\system32\DLA\DLABMFSM.SYS -- (DLABMFSM)
DRV - [2006/10/26 11:21:32 | 000,097,848 | -H-- | M] (Roxio) [File_System | Auto] -- C:\WINDOWS\system32\DLA\DLAUDF_M.SYS -- (DLAUDF_M)
DRV - [2006/10/26 11:21:30 | 000,026,296 | -H-- | M] (Roxio) [File_System | Auto] -- C:\WINDOWS\system32\DLA\DLAOPIOM.SYS -- (DLAOPIOM)
DRV - [2006/10/26 11:21:28 | 000,032,472 | -H-- | M] (Roxio) [File_System | Auto] -- C:\WINDOWS\system32\DLA\DLABOIOM.SYS -- (DLABOIOM)
DRV - [2006/10/26 11:21:26 | 000,014,520 | -H-- | M] (Roxio) [File_System | Auto] -- C:\WINDOWS\system32\DLA\DLAPoolM.SYS -- (DLAPoolM)
DRV - [2006/10/26 11:21:24 | 000,104,536 | -H-- | M] (Roxio) [File_System | Auto] -- C:\WINDOWS\system32\DLA\DLAIFS_M.SYS -- (DLAIFS_M)
DRV - [2006/06/28 05:54:00 | 000,009,472 | -H-- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\CPQBttn.sys -- (HBtnKey)
DRV - [2006/05/29 12:04:50 | 000,217,088 | RH-- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\sis163u.sys -- (SIS163u)
DRV - [2005/07/24 22:04:08 | 000,048,640 | RH-- | M] (Prolific Technology Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ser2pl.sys -- (Ser2pl)
DRV - [2005/03/15 11:04:00 | 000,161,792 | -H-- | M] (OmniVision Technologies, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ov530vid.sys -- (ovt530)
DRV - [2005/02/23 08:58:56 | 000,011,776 | -H-- | M] (Arcsoft, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\afc.sys -- (Afc)
 
 
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
 
 
[color=#E56717]========== Internet Explorer ==========[/color]
 
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.troner.net/
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\christian_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\christian_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr/
IE - HKU\christian_ON_C\..\URLSearchHook: {AEEC3B59-CA98-4EBA-A140-57B94E283583} - Reg Error: Key error. File not found
IE - HKU\christian_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\christian_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
 
 
IE - HKU\systemprofile_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
O1 HOSTS File: ([2009/09/08 21:12:15 | 000,327,749 | RH-- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: 127.0.0.1   http://www.007guard.com
O1 - Hosts: 127.0.0.1   007guard.com
O1 - Hosts: 127.0.0.1   008i.com
O1 - Hosts: 127.0.0.1   http://www.008k.com
O1 - Hosts: 127.0.0.1   008k.com
O1 - Hosts: 127.0.0.1   http://www.00hq.com
O1 - Hosts: 127.0.0.1   00hq.com
O1 - Hosts: 127.0.0.1   010402.com
O1 - Hosts: 127.0.0.1   http://www.032439.com
O1 - Hosts: 127.0.0.1   032439.com
O1 - Hosts: 127.0.0.1   http://www.0scan.com
O1 - Hosts: 127.0.0.1   0scan.com
O1 - Hosts: 127.0.0.1   1000gratisproben.com
O1 - Hosts: 127.0.0.1   http://www.1000gratisproben.com
O1 - Hosts: 127.0.0.1   1001namen.com
O1 - Hosts: 127.0.0.1   http://www.1001namen.com
O1 - Hosts: 127.0.0.1   100888290cs.com
O1 - Hosts: 127.0.0.1   http://www.100888290cs.com
O1 - Hosts: 127.0.0.1   http://www.100sexlinks.com
O1 - Hosts: 127.0.0.1   100sexlinks.com
O1 - Hosts: 127.0.0.1   10sek.com
O1 - Hosts: 127.0.0.1   http://www.10sek.com
O1 - Hosts: 127.0.0.1   http://www.1-2005-search.com
O1 - Hosts: 127.0.0.1   1-2005-search.com
O1 - Hosts: 11212 more lines...
O2 - BHO: (Aide pour le lien d'Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\ScriptCl.dll (McAfee, Inc.)
O2 - BHO: (Programme d'aide de l'Assistant de connexion Windows Live) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (ST) - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll (Google Inc.)
O2 - BHO: (MSNToolBandBHO) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll (Microsoft Corporation)
O2 - BHO: (no name) - {F0626A63-410B-45E2-99A1-3F2475B2D695} - No CLSID value found.
O2 - BHO: (Fast Browser Search Toolbar Helper) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll ()
O3 - HKLM\..\Toolbar: (Fast Browser Search Toolbar) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll ()
O3 - HKLM\..\Toolbar: (Iadah Toolbar) - {3EA8D036-C9E7-4721-BCDF-C13D00C4CC39} - C:\Program Files\DevNet\Toolbar\DevNet.dll (DevNet)
O3 - HKLM\..\Toolbar: (MSN) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (no name) - {CEDDA62D-5FBE-4AB2-AE2E-5E069F444444} - No CLSID value found.
O3 - HKLM\..\Toolbar: (barre d'outils Orange) - {D3028143-6145-4318-99D3-3EDCE54A95A9} - C:\Program Files\Orange Toolbar FR\ToolbarContainer101000313.dll (Copernic Inc.)
O3 - HKU\christian_ON_C\..\Toolbar\WebBrowser: (Fast Browser Search Toolbar) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll ()
O3 - HKU\christian_ON_C\..\Toolbar\WebBrowser: (MSN) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll (Microsoft Corporation)
O3 - HKU\christian_ON_C\..\Toolbar\WebBrowser: (barre d'outils Orange) - {D3028143-6145-4318-99D3-3EDCE54A95A9} - C:\Program Files\Orange Toolbar FR\ToolbarContainer101000313.dll (Copernic Inc.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Asfplayer] C:\Program Files\Linksys\Compact Wireless-G Internet Video Camera\asfplayer.exe ()
O4 - HKLM..\Run: [BEWINTERNET-FR-DMESessionManager] C:\Program Files\OrangeBS\BEWInternet\SessionManager\SessionManager.exe (France Telecom SA)
O4 - HKLM..\Run: [CardDetector] C:\Program Files\CardDetector\ICON225\CardDetector.exe (France Telecom SA)
O4 - HKLM..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\Cpqset.exe ()
O4 - HKLM..\Run: [GBMLite8AgentLaCie] C:\Program Files\Genie-Soft\GBALite8LaCie\GBMAgent.exe (Genie-soft)
O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
O4 - HKLM..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe (Intel Corporation)
O4 - HKLM..\Run: [McAfeeUpdaterUI] C:\Program Files\McAfee\Common Framework\UdaterUI.exe (McAfee, Inc.)
O4 - HKLM..\Run: [PDF Complete] C:\Program Files\PDF Complete\pdfsty.exe (PDF Complete Inc)
O4 - HKLM..\Run: [PTHOSTTR] C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [Reminder] C:\WINDOWS\CREATOR\Remind_XP.exe ()
O4 - HKLM..\Run: [RoxioDragToDisc] C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe (Roxio)
O4 - HKLM..\Run: [Scheduler] C:\WINDOWS\SMINST\Scheduler.exe ()
O4 - HKLM..\Run: [ShStatEXE] C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE (McAfee, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched]  File not found
O4 - HKLM..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe (InterVideo Inc.)
O4 - HKU\.DEFAULT..\Run: [OrangePlayer] C:\program files\orange\media player\Media Player.exe (Orange)
O4 - HKU\christian_ON_C..\Run: [GBMLite8AgentLaCie] C:\Program Files\Genie-Soft\GBALite8LaCie\GBMAgent.exe (Genie-soft)
O4 - HKU\christian_ON_C..\Run: [ISUSPM] C:\Program Files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O4 - HKU\christian_ON_C..\Run: [LightScribe Control Panel] C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard Company)
O4 - HKU\christian_ON_C..\Run: [OrangePlayer] C:\program files\orange\media player\Media Player.exe (Orange)
O4 - HKU\christian_ON_C..\Run: [YnnAflICEeXU] C:\Documents and Settings\All Users\Application Data\YnnAflICEeXU.exe (WinTrust)
O4 - HKU\LocalService_ON_C..\Run: [OrangePlayer] C:\program files\orange\media player\Media Player.exe (Orange)
O4 - HKU\NetworkService_ON_C..\Run: [OrangePlayer] C:\program files\orange\media player\Media Player.exe (Orange)
O4 - Startup: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe (InterVideo Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Logiciel de Synchronisation Orange.lnk = C:\Program Files\Orange\Logiciel de Synchronisation Orange\Voxsync.exe (Voxmobili)
O4 - Startup: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\christian\Menu Démarrer\Programmes\Démarrage\e-Backup Scheduler.lnk = C:\Program Files\Inachis\e-Backup\eBackup.exe (Inachis)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\christian_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 95 00 00 00  [binary data]
O7 - HKU\christian_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\systemprofile_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab (QuickTime Object)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {1F75C3DC-38E2-4424-A028-217AA4CB43CA} http://192.168.1.198/adm/NetCamMotionDetect.cab (NetCamMotionDetect Control)
O16 - DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} http://picasaweb.google.fr/s/v/57.07/uploader2.cab (UploadListView Class)
O16 - DPF: {6EBC6744-5383-4213-AD5E-66434ECA1812} http://download.sp.f-secure.com/ols/nordnet/orange/so-4.1/resources/fslauncher.cab (F-Secure Online Scanner Launcher)
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-2.0.cab (AdVerifierADPCtrl Class)
O16 - DPF: {899F550F-1C77-48F8-BC90-E7BEC97A2D43} http://download.sp.f-secure.com/ols/nordnet/orange/fs/resources/fslauncher.cab (F-Secure Online Scanner 4.0 Launcher)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {8ED1093F-319E-48EC-A9F2-971236F0CC21} http://ipeyeanywhere.marmitek.com/UltraCamX.cab (UltraCamX Class)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} http://orange.securitoo.com/ols/fscax.cab (F-Secure Online Scanner 3.3)
O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} http://office.microsoft.com/officeupdate/content/opuc4.cab (Office Update Installation Engine)
O16 - DPF: {CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA} http://javadl-esd.sun.com/update/1.5.0/jinstall-1_5_0_12-windows-i586.cab (Java Plug-in 1.5.0_12)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {D7208880-9B7A-43E1-AABB-8C888A5704F9} http://192.168.1.198/NetCamPlayerWeb11gv2.cab (NetCamPlayerWeb11gv2 Control)
O16 - DPF: {D9D72A92-132E-46EC-A6F1-896B19227142} http://www.ipcam-view.net/ActiveX/ax4web.cab (mpeg4 ActiveX Plugin for web v2)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\DeviceNP: DllName - DeviceNP.dll - C:\WINDOWS\System32\DeviceNP.dll (Hewlett-Packard Limited)
O24 - Desktop Components:0 (Ma page d'accueil) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\HP Cityscape.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\HP Cityscape.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/11/27 18:50:21 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2004/04/30 11:01:00 | 000,000,053 | -HS- | M] () - D:\Autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{025726f1-9f1d-11dc-a6c2-001b77a67dac}\Shell - "" = AutoRun
O33 - MountPoints2\{025726f1-9f1d-11dc-a6c2-001b77a67dac}\Shell\AutoRun\command - "" = G:\LaunchU3.exe
O33 - MountPoints2\{1d7375c8-7617-11de-a951-001b77a67dac}\Shell\Shell00\Command - "" = G:\Start.exe
O33 - MountPoints2\{4d324d67-1aa2-11e0-ab8b-001b77a67dac}\Shell - "" = AutoRun
O33 - MountPoints2\{4d324d67-1aa2-11e0-ab8b-001b77a67dac}\Shell\AutoRun\command - "" = G:\AutoRunCardDetector.exe
O33 - MountPoints2\{5f9e2c53-621d-11de-a935-001b77a67dac}\Shell\AutoRun\command - "" = G:\Delivery.exe
O33 - MountPoints2\{c20a465d-0f61-11e0-ab8a-001b77a67dac}\Shell - "" = AutoRun
O33 - MountPoints2\{c20a465d-0f61-11e0-ab8a-001b77a67dac}\Shell\AutoRun\command - "" = G:\ReadMe.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
 
[2011/04/25 13:30:06 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\christian\Recent
[2011/04/25 12:55:26 | 000,114,688 | -H-- | C] (SoftThinks) -- C:\WINDOWS\System32\chg.exe
[2011/04/25 11:35:51 | 000,580,608 | -H-- | C] (OldTimer Tools) -- C:\Documents and Settings\christian\Mes documents\OTL.exe
[2011/04/25 09:55:47 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\christian\Application Data\Malwarebytes
[2011/04/25 09:55:39 | 000,038,224 | -H-- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/04/25 09:55:39 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Malwarebytes' Anti-Malware
[2011/04/25 09:55:38 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/04/25 09:54:30 | 000,020,952 | -H-- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/04/25 09:54:29 | 000,000,000 | -H-D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/04/25 09:53:02 | 007,622,112 | -H-- | C] (Malwarebytes Corporation                                    ) -- C:\Documents and Settings\christian\Mes documents\malwarebytes-anti-malware_malwarebytes_anti-malware_1.50_francais_215092.exe
[2011/04/25 09:46:39 | 007,622,112 | -H-- | C] (Malwarebytes Corporation                                    ) -- C:\Documents and Settings\christian\Bureau\malwarebytes-anti-malware_malwarebytes_anti-malware_1.50_francais_215092.exe
[2011/04/23 19:18:22 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\christian\Menu Démarrer\Programmes\Windows Recovery
[2011/04/23 18:45:47 | 000,569,344 | -H-- | C] (WinTrust) -- C:\Documents and Settings\All Users\Application Data\YnnAflICEeXU.exe
[2007/12/21 04:05:55 | 000,348,160 | -H-- | C] ( ) -- C:\WINDOWS\System32\lexlog.dll
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
 
[2011/04/25 13:30:00 | 000,001,054 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/04/25 13:30:00 | 000,000,440 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{9450FA3F-53BC-41B1-9C0E-CFB53A24A102}.job
[2011/04/25 12:56:48 | 000,002,206 | -H-- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/04/25 12:55:35 | 000,001,000 | -H-- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2011/04/25 12:55:26 | 000,114,688 | -H-- | M] (SoftThinks) -- C:\WINDOWS\System32\chg.exe
[2011/04/25 12:55:24 | 000,001,050 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/04/25 12:55:21 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/04/25 12:55:19 | 2138,492,928 | -HS- | M] () -- C:\hiberfil.sys
[2011/04/25 11:35:46 | 000,580,608 | -H-- | M] (OldTimer Tools) -- C:\Documents and Settings\christian\Mes documents\OTL.exe
[2011/04/25 09:55:39 | 000,000,784 | -H-- | M] () -- C:\Documents and Settings\All Users\Bureau\Malwarebytes' Anti-Malware.lnk
[2011/04/25 09:55:39 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Malwarebytes' Anti-Malware
[2011/04/25 09:53:02 | 007,622,112 | -H-- | M] (Malwarebytes Corporation                                    ) -- C:\Documents and Settings\christian\Mes documents\malwarebytes-anti-malware_malwarebytes_anti-malware_1.50_francais_215092.exe
[2011/04/25 09:46:39 | 007,622,112 | -H-- | M] (Malwarebytes Corporation                                    ) -- C:\Documents and Settings\christian\Bureau\malwarebytes-anti-malware_malwarebytes_anti-malware_1.50_francais_215092.exe
[2011/04/23 19:20:34 | 000,000,040 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\~18538292
[2011/04/23 19:18:24 | 000,000,813 | -H-- | M] () -- C:\Documents and Settings\christian\Bureau\Windows Recovery.lnk
[2011/04/23 19:18:17 | 000,000,344 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\18538292
[2011/04/23 18:45:46 | 000,569,344 | -H-- | M] (WinTrust) -- C:\Documents and Settings\All Users\Application Data\YnnAflICEeXU.exe
[2011/04/23 07:51:29 | 000,002,537 | -H-- | M] () -- C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Microsoft Excel.lnk
[2011/04/21 15:23:03 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Microsoft Silverlight
[2011/04/18 15:10:43 | 000,002,557 | -H-- | M] () -- C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Microsoft Word.lnk
[2011/04/15 12:14:38 | 000,369,688 | -H-- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/04/15 01:59:54 | 000,512,462 | -H-- | M] () -- C:\WINDOWS\System32\perfh00C.dat
[2011/04/15 01:59:54 | 000,442,548 | -H-- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/04/15 01:59:54 | 000,085,998 | -H-- | M] () -- C:\WINDOWS\System32\perfc00C.dat
[2011/04/15 01:59:54 | 000,071,842 | -H-- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/04/15 01:59:33 | 000,001,374 | -H-- | M] () -- C:\WINDOWS\imsins.BAK
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
[color=#E56717]========== Files Created - No Company Name ==========[/color]
 
[2011/04/25 09:55:39 | 000,000,784 | -H-- | C] () -- C:\Documents and Settings\All Users\Bureau\Malwarebytes' Anti-Malware.lnk
[2011/04/23 19:20:34 | 000,000,040 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\~18538292
[2011/04/23 19:18:24 | 000,000,813 | -H-- | C] () -- C:\Documents and Settings\christian\Bureau\Windows Recovery.lnk
[2011/04/23 19:18:17 | 000,000,344 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\18538292
[2011/01/09 06:07:25 | 000,004,652 | -H-- | C] () -- C:\Documents and Settings\christian\bewinternet-fr-dmeLauncher.sav
[2010/12/10 19:25:46 | 000,000,004 | -H-- | C] () -- C:\WINDOWS\vx86036.dat
[2010/07/11 00:47:25 | 000,245,192 | -H-- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/05/09 05:04:43 | 000,162,304 | -H-- | C] () -- C:\WINDOWS\System32\ztvunrar36.dll
[2010/05/09 05:04:43 | 000,077,312 | -H-- | C] () -- C:\WINDOWS\System32\ztvunace26.dll
[2009/11/01 11:09:31 | 000,000,032 | -H-- | C] () -- C:\Documents and Settings\christian\Local Settings\Application Data\art.udk
[2009/11/01 11:09:17 | 000,000,017 | -H-- | C] () -- C:\Documents and Settings\christian\Local Settings\Application Data\19720201.dat
[2009/11/01 11:09:16 | 000,000,037 | -H-- | C] () -- C:\WINDOWS\iltwain.ini
[2009/09/07 13:15:58 | 000,493,429 | -H-- | C] () -- C:\Documents and Settings\christian\Local Settings\Application Data\soagbnjv_nav.dat
[2009/09/07 13:15:58 | 000,004,059 | -H-- | C] () -- C:\Documents and Settings\christian\Local Settings\Application Data\soagbnjv.dat
[2009/06/28 14:55:48 | 000,684,377 | -H-- | C] () -- C:\WINDOWS\unins000.exe
[2009/06/28 14:55:48 | 000,003,410 | -H-- | C] () -- C:\WINDOWS\unins000.dat
[2009/06/01 10:43:43 | 000,000,013 | -H-- | C] () -- C:\Documents and Settings\christian\usb001
[2009/02/17 13:37:58 | 000,000,059 | -H-- | C] () -- C:\WINDOWS\yesmessenger.ini
[2008/08/30 18:02:18 | 000,002,951 | -H-- | C] () -- C:\Documents and Settings\christian\Application Data\RealCADDPrefV4.06
[2008/08/30 18:02:18 | 000,000,003 | -H-- | C] () -- C:\Documents and Settings\christian\Application Data\RealCADDOpenRecent
[2008/08/28 14:53:57 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2008/07/07 12:15:05 | 000,240,640 | -H-- | C] () -- C:\WINDOWS\System32\NMOCOD.DLL
[2008/05/05 13:34:53 | 000,002,528 | -H-- | C] () -- C:\Documents and Settings\christian\Application Data\$_hpcst$.hpc
[2008/04/09 15:23:28 | 000,000,032 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\ezsid.dat
[2008/04/03 16:48:24 | 000,045,056 | RH-- | C] () -- C:\WINDOWS\System32\unwlsdrv.exe
[2008/02/06 16:49:19 | 000,015,428 | -H-- | C] () -- C:\Documents and Settings\christian\RefEdit.exd
[2008/02/04 12:23:10 | 000,693,792 | -H-- | C] () -- C:\WINDOWS\System32\OGACheckControl.DLL
[2007/12/29 20:50:52 | 000,005,483 | -H-- | C] () -- C:\Program Files\FichierVisionneuse.jbf
[2007/12/21 03:59:41 | 000,442,368 | RH-- | C] () -- C:\WINDOWS\System32\softcoin.dll
[2007/12/21 03:59:40 | 000,319,488 | RH-- | C] () -- C:\WINDOWS\System32\gencoin.dll
[2007/12/17 13:42:27 | 000,003,935 | -H-- | C] () -- C:\Program Files\dolphinMF.gif
[2007/12/17 13:42:27 | 000,001,280 | -H-- | C] () -- C:\Program Files\dolphinappy.gif
[2007/12/06 14:25:14 | 000,081,408 | -H-- | C] () -- C:\Documents and Settings\christian\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/11/30 15:55:07 | 000,000,101 | -H-- | C] () -- C:\WINDOWS\jascreg.ini
[2007/11/30 15:51:42 | 000,005,885 | -H-- | C] () -- C:\Program Files\CAMUNWISE.INI
[2007/11/30 15:50:21 | 000,047,104 | -H-- | C] () -- C:\WINDOWS\System32\Wh2Robo.dll
[2007/11/30 14:06:54 | 000,000,379 | -H-- | C] () -- C:\WINDOWS\ODBC.INI
[2007/11/30 04:35:02 | 000,000,280 | -H-- | C] () -- C:\WINDOWS\System32\epoPGPsdk.dll.sig
[2007/11/30 04:15:18 | 000,147,456 | -H-- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4859.dll
[2007/11/28 13:13:03 | 000,204,800 | -H-- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2007/11/28 13:13:03 | 000,200,704 | -H-- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2007/11/28 13:13:03 | 000,192,512 | -H-- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2007/11/28 13:13:03 | 000,192,512 | -H-- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2007/11/28 13:13:03 | 000,188,416 | -H-- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2007/11/28 13:13:03 | 000,020,480 | -H-- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2007/11/28 13:12:06 | 000,056,056 | -H-- | C] () -- C:\WINDOWS\System32\DLAAPI_W.DLL
[2007/11/28 13:12:06 | 000,000,169 | -H-- | C] () -- C:\WINDOWS\wininit.ini
[2007/11/28 13:11:19 | 000,000,664 | -H-- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2007/11/28 13:01:31 | 000,356,352 | -H-- | C] () -- C:\WINDOWS\System32\AegisI5Installer.exe
[2007/11/28 12:56:07 | 000,000,132 | -H-- | C] () -- C:\Documents and Settings\christian\Local Settings\Application Data\fusioncache.dat
[2007/11/28 12:51:32 | 000,029,682 | -H-- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2007/11/27 19:43:33 | 000,004,205 | -H-- | C] () -- C:\WINDOWS\ODBCINST.INI
[2007/11/27 19:42:30 | 000,369,688 | -H-- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2007/11/27 18:52:59 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2007/11/27 18:47:37 | 000,021,892 | -H-- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2007/06/08 04:05:38 | 000,274,432 | -H-- | C] () -- C:\WINDOWS\System32\flcdlmsg.dll
[2006/03/02 08:00:00 | 000,673,088 | -H-- | C] () -- C:\WINDOWS\System32\mlang.dat
[2006/03/02 08:00:00 | 000,512,462 | -H-- | C] () -- C:\WINDOWS\System32\perfh00C.dat
[2006/03/02 08:00:00 | 000,442,548 | -H-- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2006/03/02 08:00:00 | 000,322,810 | -H-- | C] () -- C:\WINDOWS\System32\perfi00C.dat
[2006/03/02 08:00:00 | 000,272,128 | -H-- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2006/03/02 08:00:00 | 000,218,003 | -H-- | C] () -- C:\WINDOWS\System32\dssec.dat
[2006/03/02 08:00:00 | 000,085,998 | -H-- | C] () -- C:\WINDOWS\System32\perfc00C.dat
[2006/03/02 08:00:00 | 000,071,842 | -H-- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2006/03/02 08:00:00 | 000,049,152 | -H-- | C] () -- C:\WINDOWS\System32\powercfg.exe
[2006/03/02 08:00:00 | 000,046,258 | -H-- | C] () -- C:\WINDOWS\System32\mib.bin
[2006/03/02 08:00:00 | 000,034,108 | -H-- | C] () -- C:\WINDOWS\System32\perfd00C.dat
[2006/03/02 08:00:00 | 000,028,626 | -H-- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2006/03/02 08:00:00 | 000,004,569 | -H-- | C] () -- C:\WINDOWS\System32\secupd.dat
[2006/03/02 08:00:00 | 000,001,804 | -H-- | C] () -- C:\WINDOWS\System32\dcache.bin
[2006/03/02 08:00:00 | 000,000,741 | -H-- | C] () -- C:\WINDOWS\System32\noise.dat
[2002/05/28 14:55:42 | 013,107,200 | -H-- | C] () -- C:\WINDOWS\System32\oembios.bin
[2002/05/28 14:54:40 | 000,004,605 | -H-- | C] () -- C:\WINDOWS\System32\oembios.dat
[2002/03/13 10:46:46 | 000,053,248 | -H-- | C] () -- C:\WINDOWS\System32\ZLIB.DLL
[1998/12/11 21:00:16 | 000,065,536 | -H-- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL
[1998/06/23 13:50:28 | 000,798,659 | -H-- | C] () -- C:\WINDOWS\System32\MFC42ENU.DLL
[1998/02/13 08:02:14 | 000,004,375 | -H-- | C] () -- C:\WINDOWS\System32\mmc.ini
 
[color=#E56717]========== LOP Check ==========[/color]
 
[2009/05/13 12:15:44 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\christian\Application Data\Autodesk
[2009/02/24 16:32:19 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\christian\Application Data\DriverCure
[2009/11/01 11:10:03 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\christian\Application Data\Fugawi
[2009/08/24 13:51:51 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\christian\Application Data\Genie-Soft
[2011/02/22 16:59:50 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\christian\Application Data\Icones
[2007/11/28 13:53:00 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\christian\Application Data\InterVideo
[2011/04/25 07:47:39 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\christian\Application Data\Media Player
[2009/03/16 16:28:47 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\christian\Application Data\OfficeUpdate12
[2009/03/16 18:36:30 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\christian\Application Data\OpenOffice.org
[2007/11/30 16:06:35 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\christian\Application Data\SampleView
[2008/05/07 15:52:54 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\christian\Application Data\Uniblue
[2008/07/29 15:19:05 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\christian\Application Data\Uwatec
[2008/01/07 16:34:54 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\christian\Application Data\V-Planner
[2009/12/09 18:44:04 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\christian\Application Data\Voxmobili
[2009/05/13 12:12:01 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Autodesk
[2010/05/16 17:35:30 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Downloaded Installations
[2009/02/25 18:37:46 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\DriverCure
[2010/04/10 05:09:44 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\F-Secure
[2009/11/03 12:52:36 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Fugawi
[2007/11/28 13:31:21 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\LightScribe
[2009/02/24 16:31:51 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\ParetoLogic
[2010/08/17 15:10:25 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Suunto
[2011/04/25 13:30:00 | 000,000,440 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{9450FA3F-53BC-41B1-9C0E-CFB53A24A102}.job
 
[color=#E56717]========== Purity Check ==========[/color]
 
 
< End of report >

[jeanmimigab]

très bien,

On va traiter une grande partie de l'infection avec la procédure qui suit...

Redémarre le pc avec le CD OTLPE comme tu l'as fais la première fois...

Relance OTLPE et cette fois ci copie/colle le contenu de cette citation dans le cadre blanc d'OTLPE (en utilisant ta clef USB pour le transfert du document.txt)

:OTL
O2 - BHO: (no name) - {F0626A63-410B-45E2-99A1-3F2475B2D695} - No CLSID value found. => Infection BT (PUP.FbSearch)
O2 - BHO: (Fast Browser Search Toolbar Helper) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll ()
O3 - HKLM\..\Toolbar: (Fast Browser Search Toolbar) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll ()
O3 - HKLM\..\Toolbar: (Iadah Toolbar) - {3EA8D036-C9E7-4721-BCDF-C13D00C4CC39} - C:\Program Files\DevNet\Toolbar\DevNet.dll (DevNet)
O3 - HKU\christian_ON_C\..\Toolbar\WebBrowser: (Fast Browser Search Toolbar) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll ()
O4 - HKU\christian_ON_C..\Run: [YnnAflICEeXU] C:\Documents and Settings\All Users\Application Data\YnnAflICEeXU.exe (WinTrust)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\christian_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O32 - AutoRun File - [2007/11/27 18:50:21 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2004/04/30 11:01:00 | 000,000,053 | -HS- | M] () - D:\Autorun.inf -- [ NTFS ]
O33 - MountPoints2\{025726f1-9f1d-11dc-a6c2-001b77a67dac}\Shell - "" = AutoRun
O33 - MountPoints2\{4d324d67-1aa2-11e0-ab8b-001b77a67dac}\Shell - "" = AutoRun
O33 - MountPoints2\{5f9e2c53-621d-11de-a935-001b77a67dac}\Shell\AutoRun\command - "" = G:\Delivery.exe
O33 - MountPoints2\{c20a465d-0f61-11e0-ab8a-001b77a67dac}\Shell - "" = AutoRun
O33 - MountPoints2\{c20a465d-0f61-11e0-ab8a-001b77a67dac}\Shell\AutoRun\command - "" = G:\ReadMe.exe => Infection USB (USB.Troj)
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

:Files
C:\WINDOWS\System32\chg.exe
C:\Documents and Settings\All Users\Application Data\YnnAflICEeXU.exe
C:\Program Files\Fast Browser Search
C:\Program Files\DevNet\Toolbar
C:\Documents and Settings\christian\Menu Démarrer\Programmes\Windows Recovery
C:\Documents and Settings\All Users\Application Data\YnnAflICEeXU.exe
C:\Documents and Settings\All Users\Application Data\~18538292
C:\Documents and Settings\christian\Bureau\Windows Recovery.lnk
C:\Documents and Settings\All Users\Application Data\18538292
C:\Documents and Settings\christian\Local Settings\Application Data\soagbnjv_nav.dat
C:\Documents and Settings\christian\Local Settings\Application Data\soagbnjv.dat

:Commands
[emptytemp]
[EMPTYFLASH]

Cette fois ci tu ne clique pas sur "Runscan", mais sur "RunFix"

Laisse OTL travailler et une fois le rapport générer sauvegarde le sur ta clef USB pour me le poster dans ta prochaine réponse.

Ensuite éjecte le CD et redémarre ton PC normalement, il devrait mieux se comporter.

puis...

• télécharge Malwarebytes.
• Téléchargement et tuto de Danakil à lire avant le scan.
• Choisie "exécuter un examen rapide" et à la fin du scan , coche tous les éléments trouvés,et clique sur supprimer la sélection.
• Poste moi le rapport stp.

Curagiu

[Skynet]

malheureusement pas de changement
tjrs pas de programmes et plus d'icone sur le bureau apart la poubelle et outlook
imposible de telecharger malwarbytes "NSIS error"error launching installer
le dernier rapport

Code: Tout sélectionner

========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0626A63-410B-45E2-99A1-3F2475B2D695}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F0626A63-410B-45E2-99A1-3F2475B2D695}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}\ deleted successfully.
C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{1BB22D38-A411-4B13-A746-C2A4F4EC7344} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\ deleted successfully.
File C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{3EA8D036-C9E7-4721-BCDF-C13D00C4CC39} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3EA8D036-C9E7-4721-BCDF-C13D00C4CC39}\ deleted successfully.
C:\Program Files\DevNet\Toolbar\DevNet.dll moved successfully.
Registry value HKEY_USERS\christian_ON_C\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{1BB22D38-A411-4B13-A746-C2A4F4EC7344} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\ not found.
File C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll not found.
Registry value HKEY_USERS\christian_ON_C\Software\Microsoft\Windows\CurrentVersion\Run\\YnnAflICEeXU deleted successfully.
C:\Documents and Settings\All Users\Application Data\YnnAflICEeXU.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableTaskMgr deleted successfully.
Registry value HKEY_USERS\christian_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableTaskMgr deleted successfully.
C:\AUTOEXEC.BAT moved successfully.
D:\Autorun.inf moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{025726f1-9f1d-11dc-a6c2-001b77a67dac}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{025726f1-9f1d-11dc-a6c2-001b77a67dac}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4d324d67-1aa2-11e0-ab8b-001b77a67dac}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4d324d67-1aa2-11e0-ab8b-001b77a67dac}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5f9e2c53-621d-11de-a935-001b77a67dac}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5f9e2c53-621d-11de-a935-001b77a67dac}\ not found.
File G:\Delivery.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c20a465d-0f61-11e0-ab8a-001b77a67dac}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c20a465d-0f61-11e0-ab8a-001b77a67dac}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c20a465d-0f61-11e0-ab8a-001b77a67dac}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c20a465d-0f61-11e0-ab8a-001b77a67dac}\ not found.
File G:\ReadMe.exe => Infection USB (USB.Troj) not found.
C:\WINDOWS\003119_.tmp deleted successfully.
C:\WINDOWS\msdownld.tmp folder deleted successfully.
C:\WINDOWS\SET29.tmp deleted successfully.
C:\WINDOWS\SET3.tmp deleted successfully.
C:\WINDOWS\SET4.tmp deleted successfully.
C:\WINDOWS\SET8.tmp deleted successfully.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
========== FILES ==========
C:\WINDOWS\System32\chg.exe moved successfully.
File\Folder C:\Documents and Settings\All Users\Application Data\YnnAflICEeXU.exe not found.
C:\Program Files\Fast Browser Search\IE folder moved successfully.
C:\Program Files\Fast Browser Search folder moved successfully.
C:\Program Files\DevNet\Toolbar folder moved successfully.
C:\Documents and Settings\christian\Menu Démarrer\Programmes\Windows Recovery folder moved successfully.
File\Folder C:\Documents and Settings\All Users\Application Data\YnnAflICEeXU.exe not found.
C:\Documents and Settings\All Users\Application Data\~18538292 moved successfully.
C:\Documents and Settings\christian\Bureau\Windows Recovery.lnk moved successfully.
C:\Documents and Settings\All Users\Application Data\18538292 moved successfully.
C:\Documents and Settings\christian\Local Settings\Application Data\soagbnjv_nav.dat moved successfully.
C:\Documents and Settings\christian\Local Settings\Application Data\soagbnjv.dat moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: christian
->Temp folder emptied: 83414383 bytes
->Temporary Internet Files folder emptied: 31388755 bytes
->Java cache emptied: 12661764 bytes
->Flash cache emptied: 105717 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 84 bytes
 
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33237 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 9339848 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 91232840 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
 
Total Files Cleaned = 218.00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: christian
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
Total Flash Files Cleaned = 0.00 mb
 
 
OTLPE by OldTimer - Version 3.1.46.0 log created on 04252011_230730

[jeanmimigab]

re,

Le malware à rendu touts tes fichiers/dossiers cachés...

Pour les faire apparaitre j'essais de te programmer QQ chose

[christian ajaccio]

merci beaucoup
nettement mieux

[jeanmimigab]

re,

essais cela stp...

enfonce simultanément les deux touches" Windows+R", cela va ouvrir une fenêtre >> tape cmd et valide en cliquant sur OK

une fenêtre noire s'ouvre...tape le texte en rouge en respectant bien les espaces >> attrib -h c:\* /s /d et valide avec la touche "entrée"

une liste de commande va défiler, laisse tout cela se finir tranquillement, clic-droit sur ton bureau et choisis "actualiser" et dit moi si les dossiers/fichiers réapparaissent

[christian ajaccio]

Nickel tout est revenu à la normale , si tu passe part Ajaccio n'oublie de m'avertir.
Rapport de Malwarebytes
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Version de la base de données: 6443

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

26/04/2011 08:16:57
mbam-log-2011-04-26 (08-16-57).txt

Type d'examen: Examen complet (C:\|D:\|E:\|)
Elément(s) analysé(s): 250856
Temps écoulé: 2 heure(s), 59 minute(s), 53 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 5
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 4

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallPaper (PUM.Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
c:\system volume information\_restore{73393c42-ce22-4935-9158-a4e4b2269f50}\RP829\A0060305.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\_OTL\movedfiles\04252011_230730\c_documents and settings\all users\application data\ynnafliceexu.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\_OTL\movedfiles\04252011_230730\c_program files\fast browser search\IE\searchguardplus.exe (PUP.Fbsearch) -> Not selected for removal.
c:\_OTL\movedfiles\04252011_230730\c_program files\fast browser search\IE\update.exe (PUP.Fbsearch) -> Not selected for removal.

j'ai eu alerte a 4H cette nuit avec le meme FakeAlert!grb a cet emplacement C:\_OTL\MovedFiles\04252011_230730\C_Documents and Settings\All Users\Application Data\18538292 supprimé par Macafee doit-je m'inquieter?

[jeanmimigab]

coucou,

C'est cool que ça soit revenue, je ne te cache pas que c'est la première fois que je vois ça (pourtant j'en ai vu des bizarreries)

si tu passe part Ajaccio n'oublie de m'avertir.

Si tu as des figatelli et une bonne vielle cheminée, pas de problème....

doit-je m'inquieter?

il était temps qu'il se réveille Mc Affee

pas d'inquiétude, ce sont des bestioles qui sont dans la quarantaine d'OTL
C:\_OTL\MovedFiles\04252011_230730\C_Documents and Settings\All Users\Application Data\18538292

Par sécurité, laisse ce PC éteint jusqu'a ce que l'on reprenne la désinfection, ont est pas à l'abris d'un dropper qui trainerai encore.....

je suis à la bourre pour le boulot...

Je regarde tout cela en rentrant ce soir

@++

[jeanmimigab]

coucou,

avant d'aller plus loin, rend toi sur virus total, clique sur parcourir pour choisir ce fichier en rouge >> "C:\PhysicalMBR.bin" et clique sur "analyser" .
une fois l'analyse finis, poste le lien de la page contenant le rapport stp...
@++

[christian ajaccio]

Salut Jeanmi
le fichier PhysicalMBR n'existe pas sur mon pc
j'ai fait rechercher sur tout les disques avec fichiers systeme et caché
Rien