Bonjour, j'ai besoin de l'aide d'un expert pour venir à bout d'un PC infecté que j'ai nettoyé mais dont il reste encore des traces, merci
Les problèmes à l'origine sont:
- Barre de pub intempestives (Casino, fausses alertes de sécurité)
- Fond d'écran de Windows envahi de pubs
Actuellement, il m'est toujours impossible de modifier le fond d'écran, le choix est bloqué (grisé) est-ce causé par l'infection?
L'utilisateur avait Securitoo que j'ai désinstallé (à propos,je trouve beaucoup d'ordinateurs infectés avec soit Securitoo ou Avast), je dois lui proposer une nouvelle solution de sécurité, pour l'instant j'ai installé Spysweeper with antivirus.
voici les rapports des logiciels que j'ai utilisé au départ pour nettoyer et ceux de la nouvelle procédure:
Scan avec Kapersky antivirus (mode sans échec)
----
Scanned: 420704
Detected: 66
Untreated: 0
Start time: 10/03/2008 13:11:59
Duration: 04:54:43
Finish time: 10/03/2008 18:06:42
Detected
--------
Status Object
------ ------
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.cma File: c:\windows\system32\vturp.dll
deleted: Trojan program Trojan.NSIS.StartPage.c File: c:\program files\winvi\update.exe//stream//Script
deleted: adware not-a-virus:AdWare.Win32.NaviPromo.ao File: C:\Documents and Settings\HP_Administrateur\Mes documents\martial.mahe56\webmediaplayer_setup.exe//PE_Patch.PECompact//PecBundle//PECompact//data0000.bin//stream//data0006
quarantined: virus Heur.Trojan.Generic (modification) File: C:\Documents and Settings\HP_Administrateur\Mes documents\Mes téléchargements AnumanLive\architecture_3d_1.0.exe//file001
quarantined: virus Heur.Trojan.Generic (modification) File: C:\Documents and Settings\HP_Administrateur\Mes documents\Mes téléchargements AnumanLive\architecture_3d_1.5.exe//file002
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\Z5KDRWUM\calc[1]
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\aeegleaf.dll
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\aguwcecm.dll
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\akyqrrel.dll
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\atwkkxgr.dll
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\bdxgavow.dll
deleted: Trojan program Trojan.Win32.BHO.rd File: C:\WINDOWS\system32\BIGENJHC.0LL
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\cimcgfok.dll
deleted: Trojan program Trojan-Downloader.Win32.ConHook.hl File: C:\WINDOWS\system32\CRUUMDXL.0LL//PE_Patch.UPX//UPX
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\dtturyaw.dll
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.aku File: C:\WINDOWS\system32\epdbsjnm.dll//PE_Patch.UPX//UPX
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\fmeyhsub.dll
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\fnogcalx.dll
deleted: Trojan program Trojan-Downloader.Win32.ConHook.hl File: C:\WINDOWS\system32\GELTSTTM.0LL//PE_Patch.UPX//UPX
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\gnfwmvvd.dll
deleted: Trojan program Trojan-Downloader.Win32.ConHook.hl File: C:\WINDOWS\system32\HFALENGL.0LL//PE_Patch.UPX//UPX
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\idsdsmjd.dll
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\igcgglqp.dll
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\jsbbohyi.dll
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\lauyqvdf.dll
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\lhxyqxvk.dll
deleted: Trojan program Trojan-Downloader.Win32.ConHook.hl File: C:\WINDOWS\system32\MGMQORMI.0LL//PE_Patch.UPX//UPX
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\mujldoxy.dll
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\mybkwmyi.dll
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\nexqpwfh.dll
deleted: Trojan program Trojan-Downloader.Win32.ConHook.hl File: C:\WINDOWS\system32\NPAPJFOU.0LL//PE_Patch.UPX//UPX
deleted: Trojan program Trojan.Win32.BHO.rg File: C:\WINDOWS\system32\OFJLUXLA.0LL
deleted: Trojan program Trojan-Downloader.Win32.ConHook.hl File: C:\WINDOWS\system32\PTIUVOCQ.0LL//PE_Patch.UPX//UPX
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.aku File: C:\WINDOWS\system32\qbjosqwc.dll//PE_Patch.UPX//UPX
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\qiuaiefq.dll
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\qjoviyyk.dll
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\qlhebmiv.dll
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\qpqtcjob.dll
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\qtnbnigo.dll
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\safcfjua.dll
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\siafyrqt.dll
deleted: Trojan program Trojan.Win32.BHO.re File: C:\WINDOWS\system32\SPIOLTJO.0LL
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\sqnomsap.dll
deleted: Trojan program Trojan-Downloader.Win32.ConHook.hl File: C:\WINDOWS\system32\SSIMKKDL.0LL//PE_Patch.UPX//UPX
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\talgkkpr.dll
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\tllblsoy.dll
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\ucmmtapb.dll
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\udfhjhjk.dll
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\vbomqwyb.dll
deleted: Trojan program Trojan-Downloader.Win32.ConHook.hl File: C:\WINDOWS\system32\WDOTQNTB.0LL//PE_Patch.UPX//UPX
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\ybidppqq.dll
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\ybrcfpyd.dll
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\yergjadx.dll
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\yhguqgkx.dll
deleted: adware not-a-virus:AdWare.Win32.Virtumonde.gen File: C:\WINDOWS\system32\yrmyertv.dll
deleted: Trojan program Trojan-Downloader.Win32.ConHook.hl File: C:\WINDOWS\system32\YYNEVQWW.0LL//PE_Patch.UPX//UPX
deleted: Trojan program Trojan-Downloader.Win32.ConHook.hl File: C:\WINDOWS\system32\__c002ED11.dat//PE_Patch.UPX//UPX
deleted: Trojan program Trojan-Downloader.Win32.ConHook.hl File: C:\WINDOWS\system32\__c0084100.dat//PE_Patch.UPX//UPX
deleted: Trojan program Trojan-Downloader.Win32.ConHook.hl File: C:\WINDOWS\system32\__c008BF32.dat//PE_Patch.UPX//UPX
deleted: Trojan program Trojan-Downloader.Win32.ConHook.hl File: C:\WINDOWS\system32\__c009570E.dat//PE_Patch.UPX//UPX
deleted: Trojan program Trojan-Downloader.Win32.ConHook.hl File: C:\WINDOWS\system32\__c00AA100.dat//PE_Patch.UPX//UPX
deleted: Trojan program Trojan-Downloader.Win32.ConHook.hl File: C:\WINDOWS\system32\__c00BC179.dat//PE_Patch.UPX//UPX
deleted: Trojan program Trojan-Downloader.Win32.ConHook.hl File: C:\WINDOWS\system32\__c00C28E0.dat//PE_Patch.UPX//UPX
deleted: Trojan program Trojan-Downloader.Win32.ConHook.hl File: C:\WINDOWS\system32\__c00C36AE.dat//PE_Patch.UPX//UPX
deleted: adware not-a-virus:AdWare.Win32.NaviPromo.ao File: C:\WINDOWS\Temp\NSIS_Install_WMP.exe//stream//data0006
deleted: adware not-a-virus:AdWare.Win32.NaviPromo.ao File: C:\WINDOWS\Temp\NSIS_Install_WMP.exe//stream
--------------------------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse (mode sans échec)
---------------------------------------------------------
+ Créé à: 21:34:57 10/03/2008
+ Résultat de l'analyse:
C:\Program Files\Common Files\Companion Wizard\WapCHK.dll -> Adware.Companion : Nettoyé et sauvegardé (mise en quarantaine).
C:\Program Files\Common Files\Companion Wizard\WapCHK{4E2ABCDD-1721-4356-8AB7-9BAA11E3CF17}.dll -> Adware.Companion : Nettoyé et sauvegardé (mise en quarantaine).
C:\Program Files\Common Files\Companion Wizard\WapCHK{67A576BD-81A4-45C2-BBB5-ADC2FB2FED6F}.dll -> Adware.Companion : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP221\A0060631.dll -> Dialer.CDUpdater.a : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP221\A0060632.dll -> Dialer.CDUpdater.p : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP234\A0084972.dll -> Not-A-Virus.Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP234\A0084984.dll -> Not-A-Virus.Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP162\A0036246.exe -> Not-A-Virus.Downloader.Win32.WinFixer.au : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\HP_Administrateur\Application Data\installer_fr[1].exe -> Not-A-Virus.Downloader.Win32.WinFixer.cu : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\HP_Administrateur\Application Data\winantiviruspro2007freeinstall_fr[1].exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP197\A0046012.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP199\A0052800.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP201\A0053875.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Nettoyé et sauvegardé (mise en quarantaine).
Fin du rapport
-------------------------------------------------------------------------------------------------------------------------------------------
Nettoyage disque avec Ccleaner (registre inclu): ok
------------------------------------------------------------------------------------------------------------------------------------------
Navilog:
Search Navipromo version 3.4.2 commencé le 11/03/2008 à 8:44:40,85
Outil exécuté depuis C:\Program Files\navilog1
Mise à jour le 27.01.2008 à 17h00 par IL-MAFIOSO
Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 6.0.2900.2180
Système de fichiers : NTFS
Executé en mode normal
*** Recherche Programmes installés ***
*** Recherche dossiers dans C:\WINDOWS ***
*** Recherche dossiers dans C:\Program Files ***
*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\APPLIC~1 ***
*** Recherche dossiers dans "C:\Documents and Settings\HP_Administrateur\application data" ***
*** Recherche dossiers dans "C:\Documents and Settings\HP_Administrateur\local settings\application data" ***
*** Recherche dossiers dans "C:\Documents and Settings\HP_Administrateur\MESDOC~1\MENUDM~1" ***
*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\MENUD?~1\PROGRA~1 ***
*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net
Aucun Fichier trouvé
*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!
* Recherche dans C:\WINDOWS\system32 *
Fichiers trouvés :
rnuinr.exe trouvé !
rnuinr.dat trouvé !
rnuinr_nav.dat trouvé !
rnuinr_navps.dat trouvé !
* Recherche dans "C:\Documents and Settings\HP_Administrateur\local settings\application data" *
*** Recherche fichiers ***
C:\WINDOWS\pack.epk trouvé !
*** Recherche clés spécifiques dans le Registre ***
HKEY_CURRENT_USER\Software\Lanconfig trouvé !
*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)
1)Recherche nouveaux fichiers Instant Access :
2)Recherche Heuristique :
* Dans C:\WINDOWS\system32 :
rnuinr.dat trouvé !
rnuinr_nav.dat trouvé !
* Dans "C:\Documents and Settings\HP_Administrateur\local settings\application data" :
3)Recherche Certificats :
Certificat Egroup trouvé !
4)Recherche fichiers connus :
C:\WINDOWS\system32\prutv.ini2 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\uwaydbfb.ini2 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\cdeeg.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\prutv.bak1 trouvé ! infection Vundo possible non traitée par cet outil !
C:\WINDOWS\system32\prutv.bak2 trouvé ! infection Vundo possible non traitée par cet outil !
*** Analyse terminée le 11/03/2008 à 8:47:03,42 ***
---------------------------------------------------------------------------------------------------------------------------------------
Navilog. Désinfection automatique (en mode sans échec)
-----------------------------------------------------------------------------------------------------------------------------------------
BTFix 1.086 (par bibi26) - 11/03/2008 13:11:39 - Nettoyage - Mode sans échec
Lancé depuis C:\Documents and Settings\HP_Administrateur\Bureau\BTFix\BTFix.exe
---> Fichiers/dossiers supprimés (Première passe)
- Fichiers temporaires effacés
- C:\Documents and Settings\All Users\Application Data\SeekmoSA\
- C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Seekmo\
---> Nettoyage terminé
BTFix 1.086 (par bibi26) - 11/03/2008 13:12:30 - Analyse
Lancé depuis C:\Documents and Settings\HP_Administrateur\Bureau\BTFix\BTFix.exe
---> Fichiers/Dossiers trouvés
---> Analyse terminée
-----------------------------------------------------------------------------------------------------------------------------------------
Nettoyage avec CLEAN:
11/03/2008 a 13:13:02,57
*** Recherche des fichiers dans C:
*** Recherche des fichiers dans C:\WINDOWS\
*** Recherche des fichiers dans C:\WINDOWS\system32
C:\WINDOWS\system32\mcrh.tmp FOUND
*** Recherche des fichiers dans C:\Program Files
"C:\Program Files\DivX\Google\Firefox\ffinstaller.exe" FOUND
"C:\Program Files\SystemDoctor 2006 Free\" FOUND
"C:\Program Files\Viewpoint\" FOUND
"C:\Program Files\Windows\" FOUND
*** Fin du rapport !
-----------------------------------------------------------------------------------------------------------------------------------------
VUNDO FIX, éléments trouvés et supprimés:
C:\WINDOWS\system32\cdeeg.bak1
C:\WINDOWS\system32\cdeeg.ini
C:\WINDOWS\system32\geedc.dll
--------------------------------------------------------------------------------------------------------------------------
Spysweeper:
19:06: Processus de suppression lancé. Durée 00:00:04
19:06: Mise en quarantaine de toutes les traces : virtumonde
19:06: Mise en quarantaine de toutes les traces : mediapipe
19:06: Processus de suppression lancé.
19:06: Traces trouvées : 5
19:06: Analyse des fichiers terminée, temps passé : 02:30:12
19:06: Analyse annulée
19:05: Avertissement: SweepDirectories: Cannot find directory "j:". This directory was not added to the list of paths to be scanned.
19:05: Avertissement: SweepDirectories: Cannot find directory "i:". This directory was not added to the list of paths to be scanned.
19:05: Avertissement: SweepDirectories: Cannot find directory "h:". This directory was not added to the list of paths to be scanned.
19:05: Avertissement: SweepDirectories: Cannot find directory "g:". This directory was not added to the list of paths to be scanned.
19:05: Avertissement: SweepDirectories: Cannot find directory "f:". This directory was not added to the list of paths to be scanned.
19:05: Avertissement: SweepDirectories: Cannot find directory "e:". This directory was not added to the list of paths to be scanned.
18:08: Avertissement: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\networkservice\application data\webroot\spy sweeper\temp\ssmsae7ed9f7-754d-4ce2-b3fd-3f145636504a.tmp]
18:08: Avertissement: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\networkservice\application data\webroot\spy sweeper\temp\ssmsc5e8dee2-5589-4fd0-b4cf-b5f4df9bcbcd.tmp]
18:08: Avertissement: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\networkservice\application data\webroot\spy sweeper\temp\ssmsb54f1ebf-d221-4f1a-9f87-7923d2508ed2.tmp]
18:08: Avertissement: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\networkservice\application data\webroot\spy sweeper\temp\ssms19db198b-938d-4030-8980-de65f9b9d41b.tmp]
18:08: Avertissement: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\networkservice\application data\webroot\spy sweeper\temp\ssms5909fadd-0310-43e6-ae7c-609045c1c655.tmp]
18:08: Avertissement: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\networkservice\application data\webroot\spy sweeper\temp\ssms24b2d440-3522-4ba8-a10b-c594fd64c219.tmp]
18:08: Avertissement: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\networkservice\application data\webroot\spy sweeper\temp\ssmsc1d7115e-291c-497c-bbdf-d18bc5fce76b.tmp]
18:08: Avertissement: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\networkservice\application data\webroot\spy sweeper\temp\ssms5345d1f9-afba-4db1-8600-e51f95d8af11.tmp]
18:08: Avertissement: Failed to open file "c:\documents and settings\networkservice\application data\webroot\spy sweeper\temp\ssmsae7ed9f7-754d-4ce2-b3fd-3f145636504a.tmp". Opération réussie
18:08: Avertissement: Failed to open file "c:\documents and settings\networkservice\application data\webroot\spy sweeper\temp\ssmsc5e8dee2-5589-4fd0-b4cf-b5f4df9bcbcd.tmp". Opération réussie
18:08: Avertissement: Failed to open file "c:\documents and settings\networkservice\application data\webroot\spy sweeper\temp\ssmsb54f1ebf-d221-4f1a-9f87-7923d2508ed2.tmp". Opération réussie
18:08: Avertissement: Failed to open file "c:\documents and settings\networkservice\application data\webroot\spy sweeper\temp\ssms19db198b-938d-4030-8980-de65f9b9d41b.tmp". Opération réussie
18:08: Avertissement: Failed to open file "c:\documents and settings\networkservice\application data\webroot\spy sweeper\temp\ssms5909fadd-0310-43e6-ae7c-609045c1c655.tmp". Opération réussie
18:08: Avertissement: Failed to open file "c:\documents and settings\networkservice\application data\webroot\spy sweeper\temp\ssms24b2d440-3522-4ba8-a10b-c594fd64c219.tmp". Opération réussie
18:08: Avertissement: Failed to open file "c:\documents and settings\networkservice\application data\webroot\spy sweeper\temp\ssmsc1d7115e-291c-497c-bbdf-d18bc5fce76b.tmp". Opération réussie
18:08: Avertissement: Failed to open file "c:\documents and settings\networkservice\application data\webroot\spy sweeper\temp\ssms5345d1f9-afba-4db1-8600-e51f95d8af11.tmp". Opération réussie
18:02: Avertissement: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\hp_administrateur\ntuser.dat]
18:01: Avertissement: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\networkservice\ntuser.dat]
18:01: Avertissement: AntiVirus engine for IFO returned [Access Denied] on [c:\windows\system32\config\software]
18:01: Avertissement: AntiVirus engine for IFO returned [Access Denied] on [c:\windows\system32\config\system]
17:59: Avertissement: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\networkservice\application data\webroot\spy sweeper\temp\ssms02a03017-a473-466f-b80c-62ce3b4be587.tmp]
17:56: Avertissement: AntiVirus engine for IFO returned [Access Denied] on [c:\windows\system32\config\default]
17:53: Avertissement: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\networkservice\application data\webroot\spy sweeper\temp\ssms89c14628-4818-48ea-bf77-a34822b4a090.tmp]
17:51: Avertissement: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\networkservice\application data\webroot\spy sweeper\temp\ssms822f8728-e126-47f8-8f5f-8eff7fe440b2.tmp]
17:46: Avertissement: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\networkservice\application data\webroot\spy sweeper\temp\ssms418fc7a3-5fb9-469a-b4d6-291f4d5fde33.tmp]
17:43: Avertissement: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\networkservice\application data\webroot\spy sweeper\temp\ssms006876f9-90b8-47da-8cf7-575e34e94eb0.tmp]
17:38: Avertissement: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\windows\system32\config\security]
17:38: Avertissement: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\networkservice\application data\webroot\spy sweeper\temp\ssms42e39fb3-4b3f-4d56-84dc-88833f800541.tmp]
17:36: Avertissement: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\networkservice\application data\webroot\spy sweeper\temp\ssms40fdc1cc-e5e7-4bd7-9292-95974aaeac8e.tmp]
17:35: Avertissement: AntiVirus engine for IFO returned [Access Denied] on [c:\pagefile.sys]
17:32: Avertissement: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\networkservice\application data\webroot\spy sweeper\temp\ssmsc960853f-30fe-43ef-ad30-9aa29c3c0594.tmp]
17:31: Avertissement: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\networkservice\application data\webroot\spy sweeper\temp\ssmsfd6bd821-71d9-4cc2-bc9d-3b49be948b86.tmp]
17:07: Avertissement: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\windows\system32\config\software.log]
16:48: Avertissement: AntiVirus engine for IFO returned [Error Code DFFBFDF0] on [c:\windows\system32\config\default.log]
16:44: Avertissement: AntiVirus engine for IFO returned [Access Denied] on [c:\documents and settings\networkservice\application data\webroot\spy sweeper\temp\ssms3ab57dcd-e00f-4382-a65f-15f96aa07710.tmp]
16:36: Démarrage de l’analyse des fichiers
16:36: Analyse des cookies terminée, temps passé : 00:00:00
16:36: Démarrage de l’analyse des cookies
16:36: Analyse du Registre terminée, temps passé 
02:11
16:35: HKU\S-1-5-21-2203390189-18601340-728463498-1007\software\microsoft\rdfa\ (ID = 2128564)
16:35: HKU\S-1-5-21-2203390189-18601340-728463498-1007\software\microsoft\aldd\ (ID = 2091397)
16:35: HKLM\software\microsoft\aoprndtws\ (ID = 2128500)
16:35: Trouvé Adware: virtumonde
16:35: HKLM\software\classes\appid\downloadmanager.exe\ (ID = 866963)
16:35: HKCR\appid\downloadmanager.exe\ (ID = 866684)
16:35: Trouvé Adware: mediapipe
16:35: Analyse de la mémoire terminée, temps passé : 00:00:00
16:35: Démarrage de l’analyse du Registre
16:33: Démarrage de l’analyse de la mémoire
16:33: Analyse lancée avec la version des définitions 1105
16:33: Spy Sweeper 5.5.7.103 démarrée
16:33: | Début de session, mardi 11 mars 2008 |
***************
16:31: Version du programme : 5.5.7.103 - Utilise les définitions de logiciels espions 1105
16:31: Informatif: Loaded AntiVirus Engine: 2.71.3; SDK Version: 4.27E; Virus Definitions: 11/03/2008 03:40:30 (GMT)
16:30: Spy Sweeper 5.5.7.103 démarrée
16:30: | Début de session, mardi 11 mars 2008 |
***************
Opération : Injection de code
Cible : C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
Source : C:\WINDOWS\system32\csrss.exe
16:26: Détection d’une falsification
16:26: ApplicationMinimized - EXIT
16:26: ApplicationMinimized - ENTER
16:25: Vos définitions sont à jour.
16:25: Les définitions de virus ont été mises à jour.
16:25: Informatif: Loaded AntiVirus Engine: 2.71.3; SDK Version: 4.27E; Virus Definitions: 11/03/2008 03:40:30 (GMT)
16:24: Les définitions de logiciels espions ont été mises à jour.
Anti-enregistreur de frappe: Désactivé
16:14: Informatif: ShieldEmail: Start monitoring port 25 for mail activities
Pièces jointes de message électronique: Activé
16:14: Informatif: ShieldEmail: Start monitoring port 110 for mail activities
Protection anti-aide de navigation: Activé
Protection Sécurité IE: Activé
Protection Exécution Alternate Data Stream (ADS): Activé
Protection au démarrage: Activé
Sites publicitaires connus: Désactivé
Protection du fichier d'hôtes: Activé
Protection communication Internet: Activé
Protection anti-ActiveX.: Activé
Protection Service Windows Messenger: Activé
Protection des Favoris IE: Activé
Protection du système de fichiers: Activé
Protection anti-exécution: Activé
Protections des services système: Activé
Protection anti-détournement d’IE: Activé
Protection anti-cookies de suivi IE: Désactivé
16:14: État des Protections
16:14: État de la vérification des licences (0) : Terminé !
16:14: Définitions de logiciels espions : 992
16:13: Spy Sweeper 5.5.7.103 démarrée
16:13: Spy Sweeper 5.5.7.103 démarrée
16:13: | Début de session, mardi 11 mars 2008 |
***************
-----------------------------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------------------------------------
Deckard's System Scanner v20071014.68
Run by HP_Administrateur on 2008-03-12 10:10:07
Computer is in Normal Mode.
--------------------------------------------------------------------------------
-- System Restore --------------------------------------------------------------
Successfully created a Deckard's System Scanner Restore Point.
-- Last 5 Restore Point(s) --
8: 2008-03-12 09:10:12 UTC - RP8 - Deckard's System Scanner Restore Point
7: 2008-03-12 08:54:29 UTC - RP7 - Software Distribution Service 3.0
6: 2008-03-12 08:50:48 UTC - RP6 - Revo Uninstaller's restore point - AVG Anti-Spyware 7.5
5: 2008-03-12 08:49:21 UTC - RP5 - Revo Uninstaller's restore point - dbar
4: 2008-03-11 14:14:12 UTC - RP4 - Supprimé eBay Toolbar
-- First Restore Point --
1: 2008-03-11 11:16:29 UTC - RP1 - Point de vérification système
Backed up registry hives.
Performed disk cleanup.
-- HijackThis (run as HP_Administrateur.exe) -----------------------------------
Unable to find log (file not found); running clone.
-- HijackThis Clone ------------------------------------------------------------
Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-03-12 10:12:03
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16608)
Boot mode: Normal
Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Orange HSS\Orange Desktop Search\OrangeDesktopSearch.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Hercules\WiFi Station\WiFiStation.exe
C:\WINDOWS\arservice.exe
C:\WINDOWS\ehome\ehrecvr.exe
C:\WINDOWS\ehome\ehSched.exe
C:\WINDOWS\system32\FTRTSVC.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehmsas.exe
C:\hp\KBD\kbd.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system\hpsysdrv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\HP_Administrateur\Bureau\dss.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\HP_Administrateur\Bureau\hijackthis\HP_Administrateur.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: {fbd1cc70-38ab-9f4b-5d34-5593ec4afbb6} - {6bbfa4ce-3955-43d5-b4f9-ba8307cc1dbf} - C:\WINDOWS\system32\bfjifyrj.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar2.dll
O3 - Toolbar: (no name) - - (no file)
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [ftutil2] "rundll32.exe" ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [50533cb2] "rundll32.exe" "C:\WINDOWS\system32\bfbdyawu.dll",b
O4 - HKLM\..\Run: [BM53600f2e] Rundll32.exe "C:\WINDOWS\system32\rkupllek.dll",s
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [WebSUpdater] "C:\Program Files\winvi\wupda.exe" /background
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Orange Desktop Search] "C:\Program Files\Orange HSS\Orange Desktop Search\OrangeDesktopSearch.exe" /tray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - Global Startup: Event Reminder.lnk = C:\Documents and Settings\HP_Administrateur\Mes documents\PrintMaster\PMremind.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: WiFi Station.lnk = ?
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O10 - Unknown file in Winsock LSP: C:\WINDOWS\system32\nwprovau.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/p [...] wflash.cab
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Fichiers communs\Microsoft Shared\Information Retrieval\msitss.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Fichiers communs\Skype\Skype4COM.dll
O20 - Winlogon Notify: qomjgdb - C:\WINDOWS\system32\qomjgdb.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\ati2evxx.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\system32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Moteur Webroot Spy Sweeper (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
--
End of file - 9134 bytes
-- HijackThis Fixed Entries (C:\DOCUME~1\HP_ADM~1\Bureau\HIJACK~1\backups\) ----
backup-20080311-152452-781 O23 - Service: setup_7.0.0.180_10.03.2008_13-20 - Unknown owner - C:\Documents and Settings\All Users\Bureau\Kaspersky Lab Tool\setup_7.0.0.180_10.03.2008_13-20.exe" -r (file missing)
backup-20080311-153855-107 O4 - HKLM\..\Run: [AVP] "C:\Documents and Settings\All Users\Bureau\Kaspersky Lab Tool\setup_7.0.0.180_10.03.2008_13-20.exe"
backup-20080312-100119-517 O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/671 [...] taller.exe
backup-20080312-100119-724 O4 - HKLM\..\Run: [dbar_starter] C:\Documents and Settings\HP_Administrateur\Application Data\Deskbar_{749DB41C-0DC4-4b05-BC2F-4F193DAF5F47}\starter.exe
-- File Associations -----------------------------------------------------------
All associations okay.
-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------
R2 Haspnt - c:\windows\system32\drivers\haspnt.sys <Not Verified; Aladdin Knowledge Systems; Windows NT HASP Kernel Device Driver>
S3 catchme - c:\docume~1\hp_adm~1\locals~1\temp\catchme.sys (file missing)
S3 PCAMPR5 (PCAMPR5 NDIS Protocol Driver) - c:\windows\system32\pcampr5.sys (file missing)
S3 PCANDIS5 (PCANDIS5 NDIS Protocol Driver) - c:\windows\system32\pcandis5.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
S3 Profos - c:\program files\fichiers communs\bitdefender\bitdefender threat scanner\profos.sys (file missing)
S3 RT2500USB (Hercules Wireless USB Dongle Driver) - c:\windows\system32\drivers\rt73.sys <Not Verified; Ralink Technology, Corp.; Ralink 802.11 Wireless Adapters>
S3 SIS163u (SiS 163 usb Wireless LAN Adapter Driver) - c:\windows\system32\drivers\sis163u.sys <Not Verified; SiS Corporation; NDIS NIC Driver>
-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------
R2 FTRTSVC (France Telecom Routing Table Service) - c:\windows\system32\ftrtsvc.exe <Not Verified; France Telecom; FTRTSVC NT Service>
-- Device Manager: Disabled ----------------------------------------------------
No disabled devices found.
-- Scheduled Tasks -------------------------------------------------------------
2008-03-10 11:56:00 482 --a------ C:\WINDOWS\Tasks\Connexion facile à Internet.job
-- Files created between 2008-02-12 and 2008-03-12 -----------------------------
2008-03-12 09:03:35 354 ---hs---- C:\WINDOWS\system32\uwaydbfb.ini2
2008-03-11 16:28:42 0 d-------- C:\Documents and Settings\NetworkService\Application Data\Webroot
2008-03-11 16:10:38 0 d-------- C:\Documents and Settings\LocalService\Application Data\Webroot
2008-03-11 16:10:23 0 d-------- C:\Program Files\Webroot
2008-03-11 16:10:23 0 d-------- C:\Documents and Settings\HP_Administrateur\Application Data\Webroot
2008-03-11 16:10:23 0 d-------- C:\Documents and Settings\All Users\Application Data\Webroot
2008-03-11 15:26:57 0 dr-h----- C:\Documents and Settings\HP_Administrateur\Recent
2008-03-11 13:35:51 0 d-------- C:\VundoFix Backups
2008-03-11 08:43:55 0 d-------- C:\Program Files\Navilog1
2008-03-10 13:33:13 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-03-10 13:05:48 93760 --a------ C:\WINDOWS\system32\bfjifyrj.dll
2008-03-10 13:03:25 87616 --a------ C:\WINDOWS\system32\bfbdyawu.dll
2008-03-10 13:03:19 89152 --a------ C:\WINDOWS\system32\rkupllek.dll
2008-03-10 12:59:22 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-10 12:56:46 593952 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-03-10 12:19:12 0 d-------- C:\Documents and Settings\LocalService\Menu Démarrer
2008-03-10 12:10:00 0 d-------- C:\Program Files\BitDefender
2008-03-10 12:01:56 93760 --a------ C:\WINDOWS\system32\fftmymux.dll
2008-03-10 12:01:49 89152 --a------ C:\WINDOWS\system32\twhfyksw.dll
2008-03-10 11:03:18 237568 -ra------ C:\WINDOWS\system32\SiSWPars.dll <Not Verified; Silicon Integrated Systems Corporation; SiSWPars Dynamic Link Library>
2008-03-10 11:03:18 155648 -ra------ C:\WINDOWS\system32\SiSWInst.dll <Not Verified; Silicon Integrated Systems Corporation; SiSWInst Dynamic Link Library>
2008-03-10 11:03:18 49152 -ra------ C:\WINDOWS\system32\SiSWBase.dll <Not Verified; Silicon Integrated Systems Corporation; SiSWBase Dynamic Link Library>
2008-03-10 11:03:17 167424 -ra------ C:\WINDOWS\system32\drivers\sis163u.sys <Not Verified; SiS Corporation; NDIS NIC Driver>
2008-03-10 10:05:31 0 d-------- C:\Documents and Settings\HP_Administrateur\Menu Démarrer
2008-03-10 10:00:23 0 d-------- C:\WINDOWS\CSC
2008-03-10 09:52:38 0 d-------- C:\WINDOWS\pss
2008-03-02 19:42:36 0 d-------- C:\Program Files\Fichiers communs\BitDefender
2008-03-02 06:23:48 0 d-------- C:\Program Files\winvi
2008-02-27 17:50:52 141312 --a------ C:\WINDOWS\system32\MSCmCFR.dll <Not Verified; Microsoft Corporation; COMCTL>
2008-02-27 17:50:52 32768 --a------ C:\WINDOWS\system32\CmDlgFR.dll <Not Verified; Microsoft Corporation; CMDIALOG>
2008-02-27 17:50:51 119568 --a------ C:\WINDOWS\system32\Vb6fr.dll <Not Verified; Microsoft Corporation; Environnement Visual Basic>
2008-02-27 17:50:51 148480 --a------ C:\WINDOWS\system32\TLBINF32.dll <Not Verified; Microsoft Corporation; Object Navigator, Visual Basic>
2008-02-27 17:50:51 118784 --a------ C:\WINDOWS\system32\msstdfmt.dll <Not Verified; Microsoft Corporation; MSSTDFMT Object Library>
2008-02-24 12:07:53 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-24 07:52:53 0 d-------- C:\Program Files\LiveCAD
2008-02-24 07:36:20 0 d-------- C:\Documents and Settings\HP_Administrateur\Application Data\Anuman Interactive
2008-02-17 07:01:16 0 d-------- C:\Program Files\IKEA HomePlanner
-- Find3M Report ---------------------------------------------------------------
2008-03-12 09:58:37 0 d-------- C:\Documents and Settings\HP_Administrateur\Application Data\Skype
2008-03-11 15:14:14 0 d-------- C:\Program Files\eBay
2008-03-11 08:43:31 0 d-------- C:\Documents and Settings\HP_Administrateur\Application Data\WholeSecurity
2008-03-10 13:06:55 163788 -----n--- C:\WINDOWS\system32\prutv.ini2
2008-03-10 13:03:17 161877 -----n--- C:\WINDOWS\system32\prutv.bak2
2008-03-10 12:03:42 0 d-------- C:\Program Files\Wanadoo
2008-03-10 11:58:57 0 d-------- C:\Program Files\Fichiers communs\AOL
2008-03-10 11:58:56 0 d-------- C:\Program Files\AntivirusFirewall
2008-03-10 11:56:49 446566 --a------ C:\WINDOWS\system32\perfh00C.dat
2008-03-10 11:56:49 64484 --a------ C:\WINDOWS\system32\perfc00C.dat
2008-03-10 11:54:04 0 d-------- C:\Program Files\Fichiers communs
2008-03-10 11:51:46 0 d-------- C:\Documents and Settings\HP_Administrateur\Application Data\AOL
2008-02-24 09:30:39 0 d-------- C:\Program Files\Common Files
2008-02-24 09:29:17 0 d-------- C:\Program Files\Mindscape
2008-02-24 09:29:15 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-02-21 05:21:00 0 d-------- C:\Documents and Settings\HP_Administrateur\Application Data\Adobe
2008-02-20 06:19:19 266373 -----n--- C:\WINDOWS\system32\prutv.bak1
2008-02-17 09:06:29 0 d-------- C:\Program Files\Fichiers communs\Adobe
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6bbfa4ce-3955-43d5-b4f9-ba8307cc1dbf}]
10/03/2008 13:05 93760 --a------ C:\WINDOWS\system32\bfjifyrj.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [14/05/2007 23:22]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [26/10/2006 15:13]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [12/07/2007 03:00]
"RTHDCPL"="RTHDCPL.EXE" [22/07/2006 00:56 C:\WINDOWS\RTHDCPL.EXE]
"Reminder"="C:\Windows\Creator\Remind_XP.exe" [14/12/2004 01:23]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [22/07/2005 21:14]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [04/03/2007 12:52]
"PCDrProfiler"="" []
"HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [15/02/2006 21:34]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [19/02/2006 02:41]
"ftutil2"="rundll32.exe" [10/08/2004 12:00 C:\WINDOWS\system32\rundll32.exe]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [05/08/2005 19:34]
"DMAScheduler"="c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe" [13/04/2006 08:05]
"cmonitor"="" []
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" [03/08/2005 01:15 C:\WINDOWS\arpwrmsg.exe]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [11/01/2008 22:16]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe" []
"50533cb2"="rundll32.exe" [10/08/2004 12:00 C:\WINDOWS\system32\rundll32.exe]
"BM53600f2e"="C:\WINDOWS\system32\rkupllek.dll" [10/03/2008 13:03]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [01/10/2007 16:40]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WebSUpdater"="C:\Program Files\winvi\wupda.exe" [28/02/2008 00:55]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [28/06/2007 11:24]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [13/09/2007 12:31]
"Orange Desktop Search"="C:\Program Files\Orange HSS\Orange Desktop Search\OrangeDesktopSearch.exe" [17/01/2007 15:10]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [10/08/2004 12:00]
C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Event Reminder.lnk - C:\Documents and Settings\HP_Administrateur\Mes documents\PrintMaster\PMremind.exe [02/03/2007 19:04:56]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [19/02/2006 04:21:22]
WiFi Station.lnk - C:\Program Files\Hercules\WiFi Station\WifiStation.exe [06/03/2007 09:49:30]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableLockWorkstation"=0 (0x0)
"DisableTaskMgr"=0 (0x0)
"DisableChangePassword"=0 (0x0)
"DisableRegistryTools"=0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLogoff"=0 (0x0)
"NoClose"=0 (0x0)
"ForceActiveDesktopOn"=1
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\qomjgdb]
qomjgdb.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 nwprovau
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOKIT]
C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON]
C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH]
C:\PROGRA~1\Wanadoo\Watch.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"XCOMM"=2 (0x2)
"VSSERV"=2 (0x2)
"LIVESRV"=2 (0x2)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
AutoRun\command- D:\setupSNK.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3ee7f78d-ee8d-11dc-a586-0040f4f4bb8a}]
AutoRun\command- J:\.\PSMenu\psmenu.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{88b0f0ed-ef5c-11dc-be59-001921461e2d}]
AutoRun\command- J:\start.exe
FramaKey\command- J:\start.exe
-- Hosts -----------------------------------------------------------------------
127.0.0.1 007guard.com
127.0.0.1 www.007guard.com
127.0.0.1 008i.com
127.0.0.1 008k.com
127.0.0.1 www.008k.com
127.0.0.1 00hq.com
127.0.0.1 www.00hq.com
127.0.0.1 010402.com
127.0.0.1 032439.com
127.0.0.1 www.032439.com
7495 more entries in hosts file.
-- End of Deckard's System Scanner: finished at 2008-03-12 10:12:53 ------------
-----------------------------------------------------------------------------------------------------------
Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------
-- System Information ----------------------------------------------------------
Microsoft Windows XP Professionnel (build 2600) SP 2.0
Architecture: X86; Language: French
CPU 0: Intel(R) Pentium(R) D CPU 2.80GHz
CPU 1: Intel(R) Pentium(R) D CPU 2.80GHz
Percentage of Memory in Use: 47%
Physical Memory (total/avail): 959.36 MiB / 500.35 MiB
Pagefile Memory (total/avail): 2313.93 MiB / 1914.43 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1922.36 MiB
C: is Fixed (NTFS) - 365.87 GiB total, 352.88 GiB free.
D: is Fixed (FAT32) - 6.72 GiB total, 0.73 GiB free.
E: is CDROM (No Media)
F: is Removable (No Media)
G: is Removable (No Media)
H: is Removable (No Media)
I: is Removable (No Media)
\\.\PHYSICALDRIVE0 - SAMSUNG HD400LJ - 372.61 GiB - 2 partitions
\PARTITION0 (bootable) - Système de fichiers installable - 365.87 GiB - C:
\PARTITION1 - Unknown - 6.73 GiB - D:
\\.\PHYSICALDRIVE2 - Generic USB CF Reader USB Device
\\.\PHYSICALDRIVE4 - Generic USB MS Reader USB Device
\\.\PHYSICALDRIVE1 - Generic USB SD Reader USB Device
\\.\PHYSICALDRIVE3 - Generic USB SM Reader USB Device
-- Security Center -------------------------------------------------------------
AUOptions is scheduled to auto-install.
Windows Internal Firewall is enabled.
FW: Norton Internet Worm Protection v2006 (Symantec) [COLOR=RED]Disabled[/COLOR]
AV: Spy Sweeper with AntiVirus v5.5.7.103 (Webroot Software, Inc.) [COLOR=RED]Disabled[/COLOR]
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLacsd.exe:*:Enabled:AOL"
"C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL"
"C:\\Program Files\\AOL 9.0\\waol.exe"="C:\\Program Files\\AOL 9.0\\waol.exe:*:Enabled:AOL 9.0"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
"C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL"
"C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLacsd.exe:*:Enabled:AOL"
"C:\\Program Files\\AOL 9.0\\waol.exe"="C:\\Program Files\\AOL 9.0\\waol.exe:*:Enabled:AOL 9.0"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
-- Environment Variables -------------------------------------------------------
ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\HP_Administrateur\Application Data
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Fichiers communs
COMPUTERNAME=MARTIAL
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\HP_Administrateur
LOGONSERVER=\\MARTIAL
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;c:\Python22;C:\Program Files\ATI Technologies\ATI Control Panel;;C:\PROGRA~1\FICHIE~1\MUVEET~1\030625;C:\PROGRA~1\FICHIE~1\MUVEET~1\030625
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 7, GenuineIntel
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=0407
ProgramFiles=C:\Program Files
PROMPT=$P$G
SESSIONNAME=Console
SonicCentral=c:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp
TMP=C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp
USERDOMAIN=MARTIAL
USERNAME=HP_Administrateur
USERPROFILE=C:\Documents and Settings\HP_Administrateur
windir=C:\WINDOWS
-- User Profiles ---------------------------------------------------------------
HP_Administrateur [I](admin)[/I]
Administrateur [I](admin)[/I]
-- Add/Remove Programs ---------------------------------------------------------
--> C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
--> C:\WINDOWS\IsUn040c.exe -fC:\WINDOWS\orun32.isu
--> c:\WINDOWS\system32\\MSIEXEC.EXE /x {075473F5-846A-448B-BCB3-104AA1760205}
--> c:\WINDOWS\system32\\MSIEXEC.EXE /x {AB708C9B-97C8-4AC9-899B-DBF226AC9382}
--> c:\WINDOWS\system32\\MSIEXEC.EXE /x {B12665F4-4E93-4AB4-B7FC-37053B524629}
--> c:\WINDOWS\system32\\MSIEXEC.EXE /x {F80239D8-7811-4D5E-B033-0D0BBFE32920}
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8.1.2 - Français --> MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81200000003}
Adobe® Photoshop® Album Edition Découverte 3.0 --> MsiExec.exe /I{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}
Amélioration de nos services --> C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe /M{23012310-3E05-46A5-88A9-C6CBCABCAC79} /l1036
ATI Display Driver --> rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class
ISPLAY -clean
Cartes de Visite --> RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{888DF9D4-876E-11D7-B60C-00C04F4351FF}\setup.exe" -l0x40c
Connexion Facile à Internet --> C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe /M{8105684D-8CA6-440D-8F58-7E5FD67A499D} /l1036
Correctif n° 2 pour Windows XP Édition Media Center 2005 -->
Correctif pour Windows XP (KB888795) -->
Correctif pour Windows XP (KB891593) -->
Correctif pour Windows XP (KB899337) -->
Correctif pour Windows XP (KB899510) -->
Correctif pour Windows XP (KB902841) -->
Correctif Windows XP - KB895961 -->
DivX Codec --> C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Content Uploader --> C:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
DivX Player --> C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player --> C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Ecran de veille AOL Photos --> C:\Program Files\Fichiers communs\AOL\Screensaver\uninst_ygpss.exe
eMusic - 50 Free MP3 offer --> "C:\Program Files\Winamp\eMusic\Uninst-eMusic-promotion.exe"
Enhanced Multimedia Keyboard Solution --> C:\HP\KBD\Install.exe /u
Gestionnaire Internet --> C:\PROGRA~1\Wanadoo\uninstall.exe
Google Earth --> MsiExec.exe /I{407B9B5C-DAC5-4F44-A756-B57CAB4E6A8B}
Google Toolbar for Internet Explorer --> regsvr32 /u /s "c:\program files\google\googletoolbar2.dll"
HijackThis 1.99.1 --> C:\Documents and Settings\HP_Administrateur\Bureau\hijackthis\HijackThis.exe /uninstall
HP Boot Optimizer --> MsiExec.exe /X{1341D838-719C-4A05-B50F-49420CA1B4BB}
HP Customer Participation Program 7.0 --> C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat
HP DigitalMedia Archive --> MsiExec.exe /X{F80239D8-7811-4D5E-B033-0D0BBFE32920}
HP Document Viewer 7.0 --> C:\Program Files\HP\Digital Imaging\DocumentViewer\hpzscr01.exe -datfile hpqbud04.dat
HP DVD Play 2.1 --> RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{45D707E9-F3C4-11D9-A373-0050BAE317E1}\Setup.exe" -uninstall
HP Imaging Device Functions 7.0 --> C:\Program Files\HP\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat
HP Photosmart for Media Center PC --> c:\Program Files\HP\Digital Imaging\bin\mcpc\setupmcl.exe /u
HP Photosmart Premier Software 6.5 --> C:\Program Files\HP\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat
HP Photosmart, Officejet and Deskjet 7.0.A --> C:\Program Files\HP\Digital Imaging\{BDBE2F3E-42DB-4d4a-8CB1-19BA765DBC6C}\setup\hpzscr01.exe -datfile hposcr11.dat
HP Software Update --> MsiExec.exe /X{BB85ED9C-AFC9-43BD-B8DC-258C3C7DF72E}
HP Solution Center 7.0 --> C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
J2SE Runtime Environment 5.0 Update 6 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150060}
Java(TM) 6 Update 2 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
Java(TM) SE Runtime Environment 6 Update 1 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
L'Architecte 3D --> RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C3B6ACB3-3D65-45F5-B629-FDF258170859}\setup.exe" -l0x40c -removeonly
Learn2 Player (Uninstall Only) --> C:\Program Files\Learn2.com\StRunner\stuninst.exe
Microsoft Away Mode -->
Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Works --> MsiExec.exe /I{A059DE09-1B49-4450-B340-7AE097EC3F04}
Mozilla Firefox (2.0.0.12) --> C:\Documents and Settings\HP_Administrateur\Bureau\Firefox\firefox\uninstall\helper.exe
MSN --> C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARP
muvee autoProducer 5.0 --> RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB4740B3-2530-452D-A825-F7AB246CA7DF}\setup.exe" -l0x40c
muvee autoProducer unPlugged 2.0 --> RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5FDD0538-C67A-4F67-B3F8-09D1AAF04D99}\setup.exe" -l0x40c
Navigateur Orange --> C:\PROGRA~1\Wanadoo\Shell.exe inst\uninst_FTBrowser.shl
Navilog1 3.4.2 --> "C:\Program Files\Navilog1\unins000.exe"
OCR Software by I.R.I.S 7.0 --> C:\Program Files\HP\Digital Imaging\OCR\hpzscr01.exe -datfile hpqbud11.dat
Orange --> C:\Program Files\Orange\GLOBAL\Mnu\uninst.exe /G:{80CA15EA-C0A5-7CAF-B9E9-B8B2A87EFE11}
Orange Desktop Search --> C:\Program Files\Orange HSS\Orange Desktop Search\uninst.exe
Orange Les offres Internet --> C:\Program Files\Orange\GLOBAL\Sung\uninst.exe /G:{90CA15EA-C0A5-7CAF-B9E9-B8B2A87EFE11}
Otto --> "C:\Program Files\FrenchOtto\uninstallotto.exe"
Panneau de contrôle ATI --> RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}\setup.exe"
PC-Doctor 5 pour Windows --> C:\Program Files\PC-Doctor 5 for Windows\uninst.exe
PrintMaster --> RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8DD144C1-5EAD-4D55-80A1-ACAF893A4FFE}\setup.exe" anything
Python 2.2 pywin32 extensions (build 203) --> "C:\Python22\Removepywin32.exe" -u "C:\Python22\pywin32-wininst.log"
Python 2.2.3 --> C:\Python22\UNWISE.EXE C:\Python22\INSTALL.LOG
Quick-Label --> C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\8\INTEL3~1\IDriver.exe /M{CD1BB614-48BB-4E35-9CB3-DDD09A8A0C41}
QuickTime --> C:\WINDOWS\unvise32qt.exe C:\WINDOWS\system32\QuickTime\Uninstall.log
RealPlayer --> C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Realtek High Definition Audio Driver --> RtlUpd.exe -r -m
Services Internet --> C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe /M{5CFD7508-7774-48FE-8280-7A3C0AE71755} /l1036
Shockwave --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\INSTALL.LOG
Skype™ 3.5 --> MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
Sonic Express Labeler --> MsiExec.exe /X{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
Sonic MyDVD Plus --> MsiExec.exe /X{21657574-BD54-48A2-9450-EB03B2C7FC29}
Sonic RecordNow Audio --> MsiExec.exe /X{AB708C9B-97C8-4AC9-899B-DBF226AC9382}
Sonic RecordNow Copy --> MsiExec.exe /X{B12665F4-4E93-4AB4-B7FC-37053B524629}
Sonic RecordNow Data --> MsiExec.exe /X{075473F5-846A-448B-BCB3-104AA1760205}
Sonic Update Manager --> MsiExec.exe /X{30465B6C-B53F-49A1-9EBA-A3F187AD502E}
Spy Sweeper --> "C:\Program Files\Webroot\Spy Sweeper\unins000.exe"
Virtools 3D Life Player --> C:\Program Files\Virtools\3D Life Player\WebplayerConfig.exe -u
WiFi Station --> C:\Program Files\InstallShield Installation Information\{DECE22F4-EEDD-4615-BC56-2F4827FAD64B}\Setup.exe -runfromtemp -l0x040c -removeonly
Winamp (remove only) --> "C:\Program Files\Wi
Message édité par olivier_l92 le 14-03-2008 à 12:40:28
![[:laripette]](/images/perso/laripette.gif "[:laripette]")
![[:mr_jo]](/images/perso/mr_jo.gif "[:mr_jo]")
