Pas possible eteindre et redemarrer le pc

VEVEB -  
sherred Messages postés 8605 Statut Membre -
Bonjour,

Je n'arrive plus a étéindre mon PC pour pouvoir le redémarrer. Avant cela j'avais un message de bitdefender comme quoi il aviat bloque un virus root .. et je ne pouvais plus ouvrir aucun programme. comment puis je le rédemarrer ou le désinfecter en créant un cd a partir d'un autre Pc ??? Le mien est inaccessible .il ya t-il une solution. Merci d'avance
Configuration: window vista
Internet Explorer 7.0

15 réponses

  1. sherred Messages postés 8605 Statut Membre 351
     
    a tu essaye de demarrer sans echec ?
    0
  2. sherred Messages postés 8605 Statut Membre 351
     
    Pour démarrer en mode sans échec

    >>1--demarre ou redémarre l’ordinateur. L'affichage affichent la progression du BIOS,

    >>2--A la fin du chargement du BIOS, tapotte sur la touche F8 de ton clavier. jusqu'à ce que le menu des options avancées de Windows apparaisse. Si tu appuie sur la touche F8 trop tôt, il est possible que certains ordinateurs affichent le message "erreur clavier". Dans ce cas redémarre l'ordinateur et essaye de nouveau.

    >>4--En utilisant les flèches de ton clavier, sélectionne « Mode sans échec » dans le menu puis appuie sur Entrée.
    0
    1. veveb
       
      Merci pour ta réponse j'ai réussi à le démarrer en mode sans echec .
      En fait j'ai un rootkit.agent comment puisje le supprimer car bitdefender ne marche plus mi mon parefeu et je ne peux peux plus démarrer mon pc en mode normal.
      0
  3. sherred Messages postés 8605 Statut Membre 351
     
    Salut,
    tu peu soit charger sur une clés usb "si elle est pris en compte" soit demarrage sans echec avec réseau

    et
    Télécharges AD-Remover ( de Cyrildu17 / C_XX ) sur ton bureau :

    http://sd-1.archive-host.com/membres/up/16506160323759868/AD-R.exe
    /!\ Déconnectes toi et fermes toutes applications en cours

    ● Double clique sur le programme d'installation , et installe le dans son emplacement par défaut. ( C:\Program files )
    ● Double clique sur l'icône Ad-remover située sur ton bureau
    ● Au menu principal choisi l'option "A"
    ● Postes le rapport qui apparait à la fin . copie ce rapport la ou tu peu le retrouver

    ( le rapport est sauvegardé aussi sous C:\Ad-report(date).log )
    --------------------------------------------------------------------------------------
    Télécharge random's system information tool (RSIT) http://images.malwareremoval.com/random/RSIT.exe par random/random et sauvegarde-le sur le Bureau.
    Double-clique sur RSIT.exe Clic Continue à l'écran Disclaimer.
    Si l'outil HIjackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.
    Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste en pièce jointe log.txt qui sera affiché ..ainsi que de info.txt qui sera réduit dans la Barre des Tâches.
    -------------------------------------------------------------------------------------
    enfin
    Télécharge SmitfraudFix : http://siri.urz.free.fr/Fix/SmitfraudFix.exe
    http://siri.urz.free.fr/Fix/SmitfraudFix.php
    - Enregistre-le sur le bureau

    - Double-clique sur SmitfraudFix.exe et choisis l'option 1 puis Entrée

    - Un rapport sera généré, poste-le dans ta prochaine réponse stp.
    0
    1. VEVEB
       
      RAPPORT

      ------- LOGFILE OF AD-REMOVER 1.1.1.5 | ONLY XP/VISTA -------

      Updated by C_XX on 25/02/2009 at 20:30

      Start at: 7:10:22 | 03/03/2009 | Boot mode: Safe Boot
      Option: SCAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
      Operating System: Microsoft® Windows Vista™ Home Premium Service Pack 1 (version 6.0.6001)
      Computer Name: VRO66
      Current User: Utilisateur - Administrator
      Drive(s):
      - C:\ (File System: NTFS)
      - D:\ (File System: NTFS)
      - E:\ (File System: CDFS)
      System Drive: C:\
      Windows Directory: C:\Windows\
      System Directory: C:\Windows\System32\

      --- Running Processes: 30
      --- User Account Control is DISABLE

      +-----------------| Boonty/Boonty Games Elements Found:

      Service: Boonty Games
      .
      HKLM\Software\Boonty
      HKLM\System\ControlSet001\Services\Boonty Games
      HKLM\System\ControlSet002\Services\Boonty Games
      HKLM\System\CurrentControlSet\Services\Boonty Games
      HKLM\System\ControlSet003\Services\Boonty Games
      .
      C:\Boonty
      C:\Program Files\Common Files\BOONTY Shared
      C:\ProgramData\BOONTY
      \BOONTY

      +-----------------| Eorezo Elements Found:

      .

      +-----------------| Infected Poker Softwares Elements Found:

      .
      C:\ProgramData\Microsoft\Windows\Startm~1\Programs\Everest Poker

      +-----------------| FunWebProducts/MyWay/MyWebSearch Elements Found:

      .
      .

      +-----------------| It's TV Elements Found:

      .

      +-----------------| Sweetim Elements Found:

      HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
      HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
      HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{36D6A89E-C39F-4EE8-9181-C13E9BC739A5}
      HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{3A38DCA2-E8EC-4B98-A35F-A0496AB54873}
      HKCU\Software\Microsoft\Internet Explorer\InternetRegistry\Registry\User\S-1-5-21-1775314581-1887464410-931703825-1000\Software\Sweetim
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\351716A953E21214898904032EAE2E81
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A189D17A469616C4688D23E192996267
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
      .
      C:\Windows\Installer\467c693.msi
      C:\Windows\Installer\467c699.msi
      C:\Windows\Installer\{36D6A89E-C39F-4EE8-9181-C13E9BC739A5}
      C:\Windows\Installer\{3A38DCA2-E8EC-4B98-A35F-A0496AB54873}
      C:\ProgramData\SweetIM
      C:\Users\Utilisateur\Appdata\LocalLow\SweetIM

      +-----------------| Other Adwares Found:

      .
      HKCR\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
      HKLM\Software\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
      .
      C:\Program Files\Conduit

      +-----------------| Added Scan:

      ---- Internet Explorer Version 7.0.6001.18000 ----

      +-[HKEY_CURRENT_USER\..\Internet Explorer\Main]

      Search bar: hxxp://g.msn.fr/0SEFRFR/SAOS02
      Search Page: hxxp://home.microsoft.com/access/allinone.asp
      Start page: hxxp://www.google.fr/

      +-[HKEY_USERS\S-1-5-21-1775314581-1887464410-931703825-1000\..\Internet Explorer\Main]

      Search bar: hxxp://g.msn.fr/0SEFRFR/SAOS02
      Search Page: hxxp://home.microsoft.com/access/allinone.asp
      Start page: hxxp://www.google.fr/

      +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

      Default_Page_URL: hxxp://www.asus.com
      Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
      Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
      Start page: hxxp://go.microsoft.com/fwlink/?LinkId=69157

      +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

      Tabs: hxxp://ieframe.dll/tabswelcome.htm

      +---------------------------------------------------------------------------+

      [~8429 Bytes] - C:\Ad-Report-Scan-03.03.2009.log

      - C:\Program Files\Ad-remover\TOOLS\BACKUP
      - C:\Program Files\Ad-remover\TOOLS\QUARANTINE

      End at: 7:11:40 | 03/03/2009
      .
      +-----------------| E.O.F - 118 Lines
      .
      0
  4. VEVEB
     
    SUITE DES RAPPORTS (merci d'avance);
    Voici la suite de mes rapport je n'ai pas je ne peux pas les envoyer en piece jointe
    Logfile of random's system information tool 1.05 (written by random/random)
    Run by Utilisateur at 2009-03-03 08:27:21
    Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
    System drive C: has 59 GB (50%) free of 119 GB
    Total RAM: 3070 MB (84% free)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 08:27:35, on 03/03/2009
    Platform: Windows Vista SP1 (WinNT 6.00.1905)
    MSIE: Internet Explorer v7.00 (7.00.6001.18000)
    Boot mode: Safe mode with network support

    Running processes:
    C:\Windows\Explorer.EXE
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Users\Utilisateur\Videos\Downloads\RSIT.exe
    C:\Users\Utilisateur\Desktop\Utilisateur.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fhome.microsoft.com%2fintl%2fbr%2faccess%2fallinone.asp%3f
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.asus.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: peer2Peer-FR2 Toolbar - {9f23e207-7e05-4ee2-a90e-50cf3ae9b03f} - C:\Program Files\peer2Peer-FR2\tbpeer.dll
    O1 - Hosts: ::1 localhost
    O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: peer2Peer-FR2 Toolbar - {9f23e207-7e05-4ee2-a90e-50cf3ae9b03f} - C:\Program Files\peer2Peer-FR2\tbpeer.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: ASUS Security Protect Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ItIEAddIn.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: peer2Peer-FR2 Toolbar - {9f23e207-7e05-4ee2-a90e-50cf3ae9b03f} - C:\Program Files\peer2Peer-FR2\tbpeer.dll
    O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [RtHDVCpl] "C:\Windows\RtHDVCpl.exe"
    O4 - HKLM\..\Run: [Skytel] "C:\Windows\Skytel.exe"
    O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe"
    O4 - HKLM\..\Run: [SMSERIAL] "C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe"
    O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
    O4 - HKLM\..\Run: [ATKMEDIA] "C:\Program Files\ASUS\ATK Media\DMEDIA.EXE"
    O4 - HKLM\..\Run: [ASUS Camera ScreenSaver] "C:\Windows\ASScrProlog.exe"
    O4 - HKLM\..\Run: [ASUS Screen Saver Protector] "C:\Windows\ASScrPro.exe"
    O4 - HKLM\..\Run: [CognizanceTS] "C:\Windows\system32\rundll32.exe" C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll,RegisterModule
    O4 - HKLM\..\Run: [NeroFilterCheck] "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe"
    O4 - HKLM\..\Run: [ooquickpdfv7] "C:\Windows\system32\oopmagentts.exe"
    O4 - HKLM\..\Run: [PrinTray] "C:\Windows\system32\spool\DRIVERS\W32X86\3\printray.exe"
    O4 - HKLM\..\Run: [NvSvc] "C:\Windows\system32\RUNDLL32.EXE" C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] "C:\Windows\system32\RUNDLL32.EXE" C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] "C:\Windows\system32\RUNDLL32.EXE" C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
    O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
    O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA6051] command.com /c del "C:\Program Files\Everest Poker\casino.exe"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC2464] cmd.exe /c del "C:\Program Files\Everest Poker\casino.exe"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA6820] command.com /c del "C:\Program Files\Everest Poker\gvcrt.dll"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC2641] cmd.exe /c del "C:\Program Files\Everest Poker\gvcrt.dll"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA6566] command.com /c del "C:\Program Files\Everest Poker\gvmain.exe"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC2673] cmd.exe /c del "C:\Program Files\Everest Poker\gvmain.exe"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA7743] command.com /c del "C:\Program Files\Everest Poker\data\shared\shared\bitmaps\btn_scroll.gvt"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC4339] cmd.exe /c del "C:\Program Files\Everest Poker\data\shared\shared\bitmaps\btn_scroll.gvt"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA8176] command.com /c del "C:\Program Files\Everest Poker\data\shared\shared\bitmaps\chips.art"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC1400] cmd.exe /c del "C:\Program Files\Everest Poker\data\shared\shared\bitmaps\chips.art"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA2027] command.com /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\button.ogg"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC6541] cmd.exe /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\button.ogg"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA3548] command.com /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\carddeal.ogg"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC8489] cmd.exe /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\carddeal.ogg"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA8159] command.com /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\cardflip.ogg"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC3282] cmd.exe /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\cardflip.ogg"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA9563] command.com /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\chipclick.ogg"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC8773] cmd.exe /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\chipclick.ogg"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA2873] command.com /c del "C:\Program Files\Everest Poker\data\startup\shared\icons\ep.ico"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC6673] cmd.exe /c del "C:\Program Files\Everest Poker\data\startup\shared\icons\ep.ico"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA7729] command.com /c del "C:\Program Files\Everest Poker\data\startup\shared\sounds\alert.ogg"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC9733] cmd.exe /c del "C:\Program Files\Everest Poker\data\startup\shared\sounds\alert.ogg"
    O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
    O4 - HKCU\..\Run: [Sidebar] "C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [LightScribe Control Panel] "C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" -hidden
    O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe"
    O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe"
    O4 - HKCU\..\Run: [WMPNSCFG] "C:\Program Files\Windows Media Player\WMPNSCFG.exe"
    O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\RunOnce: [SpybotDeletingB3849] command.com /c del "C:\Program Files\Everest Poker\casino.exe"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD6024] cmd.exe /c del "C:\Program Files\Everest Poker\casino.exe"
    O4 - HKCU\..\RunOnce: [SpybotDeletingB3846] command.com /c del "C:\Program Files\Everest Poker\gvcrt.dll"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD2620] cmd.exe /c del "C:\Program Files\Everest Poker\gvcrt.dll"
    O4 - HKCU\..\RunOnce: [SpybotDeletingB545] command.com /c del "C:\Program Files\Everest Poker\gvmain.exe"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD8868] cmd.exe /c del "C:\Program Files\Everest Poker\gvmain.exe"
    O4 - HKCU\..\RunOnce: [SpybotDeletingB1845] command.com /c del "C:\Program Files\Everest Poker\data\shared\shared\bitmaps\btn_scroll.gvt"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD3508] cmd.exe /c del "C:\Program Files\Everest Poker\data\shared\shared\bitmaps\btn_scroll.gvt"
    O4 - HKCU\..\RunOnce: [SpybotDeletingB6286] command.com /c del "C:\Program Files\Everest Poker\data\shared\shared\bitmaps\chips.art"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD3039] cmd.exe /c del "C:\Program Files\Everest Poker\data\shared\shared\bitmaps\chips.art"
    O4 - HKCU\..\RunOnce: [SpybotDeletingB7018] command.com /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\button.ogg"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD9068] cmd.exe /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\button.ogg"
    O4 - HKCU\..\RunOnce: [SpybotDeletingB9555] command.com /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\carddeal.ogg"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD5600] cmd.exe /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\carddeal.ogg"
    O4 - HKCU\..\RunOnce: [SpybotDeletingB1732] command.com /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\cardflip.ogg"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD8108] cmd.exe /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\cardflip.ogg"
    O4 - HKCU\..\RunOnce: [SpybotDeletingB1423] command.com /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\chipclick.ogg"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD4159] cmd.exe /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\chipclick.ogg"
    O4 - HKCU\..\RunOnce: [SpybotDeletingB5467] command.com /c del "C:\Program Files\Everest Poker\data\startup\shared\icons\ep.ico"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD8073] cmd.exe /c del "C:\Program Files\Everest Poker\data\startup\shared\icons\ep.ico"
    O4 - HKCU\..\RunOnce: [SpybotDeletingB6422] command.com /c del "C:\Program Files\Everest Poker\data\startup\shared\sounds\alert.ogg"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD1861] cmd.exe /c del "C:\Program Files\Everest Poker\data\startup\shared\sounds\alert.ogg"
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
    O4 - Startup: Outil de notification Live Search.lnk = C:\Users\Utilisateur\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
    O4 - Global Startup: OFFICE One Startup v7.lnk = ?
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O13 - Gopher Prefix:
    O15 - ESC Trusted Zone: http://*.update.microsoft.com
    O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{57DD59A3-C787-4BF3-AF29-42E04FE7E64D}: NameServer = 192.168.30.1
    O20 - AppInit_DLLs: APSHook.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. https://www.bitdefender.fr/ - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
    O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
    O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
    O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
    O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
    0
  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. VEVEB
     
    SUITE ET FIN DES RAPPORTS;

    Pouvez -me donnez une solution pour faire repartir mon pc car il ne démarre qu'en mode sans echec et je ne sais plus que faire.

    ASmitFraudFix v2.398

    Rapport fait à 8:34:52,36, 03/03/2009
    Executé à partir de C:\Users\Utilisateur\Desktop\SmitfraudFix
    OS: Microsoft Windows [version 6.0.6001] - Windows_NT
    Le type du système de fichiers est NTFS
    Fix executé en mode sans echec

    »»»»»»»»»»»»»»»»»»»»»»»» Process

    C:\Windows\system32\csrss.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\winlogon.exe
    C:\Windows\system32\services.exe
    C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\cmd.exe
    C:\Windows\system32\wbem\wmiprvse.exe

    »»»»»»»»»»»»»»»»»»»»»»»» hosts

    »»»»»»»»»»»»»»»»»»»»»»»» C:\

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Utilisateur

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\UTILIS~1\AppData\Local\Temp

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Utilisateur\Application Data

    »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\UTILIS~1\FAVORI~1

    »»»»»»»»»»»»»»»»»»»»»»»» Bureau

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

    C:\Program Files\Google\googletoolbar1.dll PRESENT !

    »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

    »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

    »»»»»»»»»»»»»»»»»»»»»»»» o4Patch
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    o4Patch
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    IEDFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    Agent.OMZ.Fix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» VACFix
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    VACFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    404Fix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"="APSHook.dll"
    "LoadAppInit_DLLs"=dword:00000001

    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "Userinit"="C:\\Windows\\system32\\userinit.exe,"

    »»»»»»»»»»»»»»»»»»»»»»»» RK

    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    Description: Intel(R) Wireless WiFi Link 4965AGN
    DNS Server Search Order: 192.168.1.1

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{299663C6-FCF6-4B5F-B78A-F41D0A223ED4}: DhcpNameServer=192.168.1.1

    »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

    »»»»»»»»»»»»»»»»»»»»»»»» Fin
    0
  7. sherred Messages postés 8605 Statut Membre 351
     
    Déconnectes toi et fermes toutes applications en cours !

    * Relances "Ad-remover" : au menu principal choisi l'option "B" . clean
    puis
    option A supprimer tout

    --> le programme va travailler ...

    * Postes le rapport qui apparait à la fin + un nouvel Hijackthis pour analyse ...

    ( le rapport est sauvegardé aussi sous C:\Ad-report.log )

    /!\ Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tapes explorer.exe et valides) /!\
    -----------------------------------------------------
    ensuite
    redemarre Smitfraud " et fait l'option nettoyage "2"
    Réponds O aux deux questions suivantes: si il les pose
    Voulez-vous nettoyer le registre ?
    Corriger le fichier infecté ?
    Un rapport.txt sera généré et tu le sauve sous ton bureau pour le retrouver plus tard
    et tu redemarre le pc

    et tu me dit si il y a du mieux
    0
  8. VEVEB
     
    ------- LOGFILE OF AD-REMOVER 1.1.1.5 | ONLY XP/VISTA -------

    Updated by C_XX on 25/02/2009 at 20:30

    *** LIMITED TO ***

    Boonty/BoontyGames
    Eorezo
    Infected Poker Softwares
    FunWebProduct/MyWay/MyWebSearch
    It's TV
    Sweetim
    Other Adwares

    ******************

    Start at: 9:14:10 | 03/03/2009 | Boot mode: Safe Boot
    Option: CLEAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
    Operating System: Microsoft® Windows Vista™ Home Premium Service Pack 1 (version 6.0.6001)
    Computer Name: VRO66
    Current User: Utilisateur - Administrator
    Drive(s):
    - C:\ (File System: NTFS)
    - D:\ (File System: NTFS)
    - E:\ (File System: CDFS)
    System Drive: C:\
    Windows Directory: C:\Windows\
    System Directory: C:\Windows\System32\

    --- Running Processes: 30
    --- User Account Control is DISABLE

    (!) ---- IE start pages/Tabs reset

    +--------------------| Boonty/Boonty Games Elements Deleted :

    Service: "Boonty Games"
    .
    HKLM\Software\Boonty
    HKLM\System\ControlSet001\Services\Boonty Games
    HKLM\System\ControlSet002\Services\Boonty Games
    .
    C:\Boonty
    C:\ProgramData\BOONTY
    C:\Program Files\Common Files\BOONTY Shared

    +-----------------| Eorezo Elements Deleted :

    .

    +-----------------| Infected Poker Softwares Elements Deleted :

    .
    C:\ProgramData\Microsoft\Windows\Startm~1\Programs\Everest Poker

    +-----------------| FunWebProducts/MyWay/MyWebSearch Elements Deleted :

    .
    .

    +-----------------| It's TV Elements Deleted :

    .

    +-----------------| Sweetim Elements Deleted :

    HKCU\Software\Microsoft\Internet Explorer\Internetregistry\Registry\User\S-1-5-21-1775314581-1887464410-931703825-1000\Software\Sweetim
    HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
    HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
    HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{36D6A89E-C39F-4EE8-9181-C13E9BC739A5}
    HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{3A38DCA2-E8EC-4B98-A35F-A0496AB54873}
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\351716A953E21214898904032EAE2E81
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A189D17A469616C4688D23E192996267
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
    HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
    .
    C:\Windows\Installer\467c693.msi
    C:\Windows\Installer\467c699.msi
    C:\Windows\Installer\{36D6A89E-C39F-4EE8-9181-C13E9BC739A5}
    C:\Windows\Installer\{3A38DCA2-E8EC-4B98-A35F-A0496AB54873}
    C:\ProgramData\SweetIM
    C:\Users\Utilisateur\Appdata\LocalLow\SweetIM

    +-----------------| Other Adwares Deleted:

    .
    HKCR\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
    .
    C:\Program Files\Conduit

    (!) ---- Temp files deleted.
    (!) ---- Recycle bin emptied in all drives.

    +-----------------| Added Scan :

    ---- Internet Explorer Version 7.0.6001.18000 ----

    +-[HKEY_CURRENT_USER\..\Internet Explorer\Main]

    Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
    Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
    Search Page: hxxp://home.microsoft.com/access/allinone.asp
    Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

    +-[HKEY_USERS\S-1-5-21-1775314581-1887464410-931703825-1000\..\Internet Explorer\Main]

    Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
    Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
    Search Page: hxxp://home.microsoft.com/access/allinone.asp
    Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

    +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

    Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
    Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    Search bar: hxxp://search.msn.com/spbasic.htm
    Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    Start page: hxxp://fr.msn.com/

    +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

    Tabs: hxxp://ieframe.dll/tabswelcome.htm

    +---------------------------------------------------------------------------+

    [~9090 Bytes] - C:\Ad-Report-Clean-03.03.2009.log
    [~8651 Bytes] - C:\Ad-Report-Scan-03.03.2009.log

    - C:\Program Files\Ad-remover\TOOLS\BACKUP
    - C:\Program Files\Ad-remover\TOOLS\QUARANTINE

    End at: 9:16:55 | 03/03/2009
    .
    +-----------------| E.O.F - 131 Lines
    .
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 09:21:33, on 03/03/2009
    Platform: Windows Vista SP1 (WinNT 6.00.1905)
    MSIE: Internet Explorer v7.00 (7.00.6001.18000)
    Boot mode: Safe mode with network support

    Running processes:
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\Taskmgr.exe
    C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
    C:\Windows\explorer.exe
    C:\Windows\system32\notepad.exe
    C:\Windows\helppane.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Users\Utilisateur\Desktop\Utilisateur.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fhome.microsoft.com%2fintl%2fbr%2faccess%2fallinone.asp%3f
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.bing.com/spresults.aspx
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: peer2Peer-FR2 Toolbar - {9f23e207-7e05-4ee2-a90e-50cf3ae9b03f} - C:\Program Files\peer2Peer-FR2\tbpeer.dll
    O1 - Hosts: ::1 localhost
    O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: peer2Peer-FR2 Toolbar - {9f23e207-7e05-4ee2-a90e-50cf3ae9b03f} - C:\Program Files\peer2Peer-FR2\tbpeer.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: ASUS Security Protect Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ItIEAddIn.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: peer2Peer-FR2 Toolbar - {9f23e207-7e05-4ee2-a90e-50cf3ae9b03f} - C:\Program Files\peer2Peer-FR2\tbpeer.dll
    O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [RtHDVCpl] "C:\Windows\RtHDVCpl.exe"
    O4 - HKLM\..\Run: [Skytel] "C:\Windows\Skytel.exe"
    O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe"
    O4 - HKLM\..\Run: [SMSERIAL] "C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe"
    O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
    O4 - HKLM\..\Run: [ATKMEDIA] "C:\Program Files\ASUS\ATK Media\DMEDIA.EXE"
    O4 - HKLM\..\Run: [ASUS Camera ScreenSaver] "C:\Windows\ASScrProlog.exe"
    O4 - HKLM\..\Run: [ASUS Screen Saver Protector] "C:\Windows\ASScrPro.exe"
    O4 - HKLM\..\Run: [CognizanceTS] "C:\Windows\system32\rundll32.exe" C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll,RegisterModule
    O4 - HKLM\..\Run: [NeroFilterCheck] "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe"
    O4 - HKLM\..\Run: [ooquickpdfv7] "C:\Windows\system32\oopmagentts.exe"
    O4 - HKLM\..\Run: [PrinTray] "C:\Windows\system32\spool\DRIVERS\W32X86\3\printray.exe"
    O4 - HKLM\..\Run: [NvSvc] "C:\Windows\system32\RUNDLL32.EXE" C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] "C:\Windows\system32\RUNDLL32.EXE" C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] "C:\Windows\system32\RUNDLL32.EXE" C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
    O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
    O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA6051] command.com /c del "C:\Program Files\Everest Poker\casino.exe"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC2464] cmd.exe /c del "C:\Program Files\Everest Poker\casino.exe"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA6820] command.com /c del "C:\Program Files\Everest Poker\gvcrt.dll"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC2641] cmd.exe /c del "C:\Program Files\Everest Poker\gvcrt.dll"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA6566] command.com /c del "C:\Program Files\Everest Poker\gvmain.exe"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC2673] cmd.exe /c del "C:\Program Files\Everest Poker\gvmain.exe"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA7743] command.com /c del "C:\Program Files\Everest Poker\data\shared\shared\bitmaps\btn_scroll.gvt"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC4339] cmd.exe /c del "C:\Program Files\Everest Poker\data\shared\shared\bitmaps\btn_scroll.gvt"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA8176] command.com /c del "C:\Program Files\Everest Poker\data\shared\shared\bitmaps\chips.art"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC1400] cmd.exe /c del "C:\Program Files\Everest Poker\data\shared\shared\bitmaps\chips.art"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA2027] command.com /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\button.ogg"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC6541] cmd.exe /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\button.ogg"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA3548] command.com /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\carddeal.ogg"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC8489] cmd.exe /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\carddeal.ogg"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA8159] command.com /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\cardflip.ogg"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC3282] cmd.exe /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\cardflip.ogg"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA9563] command.com /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\chipclick.ogg"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC8773] cmd.exe /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\chipclick.ogg"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA2873] command.com /c del "C:\Program Files\Everest Poker\data\startup\shared\icons\ep.ico"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC6673] cmd.exe /c del "C:\Program Files\Everest Poker\data\startup\shared\icons\ep.ico"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA7729] command.com /c del "C:\Program Files\Everest Poker\data\startup\shared\sounds\alert.ogg"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC9733] cmd.exe /c del "C:\Program Files\Everest Poker\data\startup\shared\sounds\alert.ogg"
    O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
    O4 - HKCU\..\Run: [Sidebar] "C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [LightScribe Control Panel] "C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" -hidden
    O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe"
    O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe"
    O4 - HKCU\..\Run: [WMPNSCFG] "C:\Program Files\Windows Media Player\WMPNSCFG.exe"
    O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\RunOnce: [SpybotDeletingB3849] command.com /c del "C:\Program Files\Everest Poker\casino.exe"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD6024] cmd.exe /c del "C:\Program Files\Everest Poker\casino.exe"
    O4 - HKCU\..\RunOnce: [SpybotDeletingB3846] command.com /c del "C:\Program Files\Everest Poker\gvcrt.dll"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD2620] cmd.exe /c del "C:\Program Files\Everest Poker\gvcrt.dll"
    O4 - HKCU\..\RunOnce: [SpybotDeletingB545] command.com /c del "C:\Program Files\Everest Poker\gvmain.exe"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD8868] cmd.exe /c del "C:\Program Files\Everest Poker\gvmain.exe"
    O4 - HKCU\..\RunOnce: [SpybotDeletingB1845] command.com /c del "C:\Program Files\Everest Poker\data\shared\shared\bitmaps\btn_scroll.gvt"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD3508] cmd.exe /c del "C:\Program Files\Everest Poker\data\shared\shared\bitmaps\btn_scroll.gvt"
    O4 - HKCU\..\RunOnce: [SpybotDeletingB6286] command.com /c del "C:\Program Files\Everest Poker\data\shared\shared\bitmaps\chips.art"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD3039] cmd.exe /c del "C:\Program Files\Everest Poker\data\shared\shared\bitmaps\chips.art"
    O4 - HKCU\..\RunOnce: [SpybotDeletingB7018] command.com /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\button.ogg"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD9068] cmd.exe /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\button.ogg"
    O4 - HKCU\..\RunOnce: [SpybotDeletingB9555] command.com /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\carddeal.ogg"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD5600] cmd.exe /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\carddeal.ogg"
    O4 - HKCU\..\RunOnce: [SpybotDeletingB1732] command.com /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\cardflip.ogg"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD8108] cmd.exe /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\cardflip.ogg"
    O4 - HKCU\..\RunOnce: [SpybotDeletingB1423] command.com /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\chipclick.ogg"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD4159] cmd.exe /c del "C:\Program Files\Everest Poker\data\shared\shared\sounds\chipclick.ogg"
    O4 - HKCU\..\RunOnce: [SpybotDeletingB5467] command.com /c del "C:\Program Files\Everest Poker\data\startup\shared\icons\ep.ico"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD8073] cmd.exe /c del "C:\Program Files\Everest Poker\data\startup\shared\icons\ep.ico"
    O4 - HKCU\..\RunOnce: [SpybotDeletingB6422] command.com /c del "C:\Program Files\Everest Poker\data\startup\shared\sounds\alert.ogg"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD1861] cmd.exe /c del "C:\Program Files\Everest Poker\data\startup\shared\sounds\alert.ogg"
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
    O4 - Startup: Outil de notification Live Search.lnk = C:\Users\Utilisateur\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
    O4 - Global Startup: OFFICE One Startup v7.lnk = ?
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O13 - Gopher Prefix:
    O15 - ESC Trusted Zone: http://*.update.microsoft.com
    O17 - HKLM\System\CCS\Services\Tcpip\..\{57DD59A3-C787-4BF3-AF29-42E04FE7E64D}: NameServer = 192.168.30.1
    O20 - AppInit_DLLs: APSHook.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. https://www.bitdefender.fr/ - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
    O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
    O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
    O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
    O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
    0
  9. sherred Messages postés 8605 Statut Membre 351
     
    tu a refait smitfraud comme je te l'ai demander ?
    0
  10. VEVEB
     
    oui ci joint le rapport mais je ne peux toujours pas demarrer mon pc normalement uniquement en mode sans échec. Que puis-je faire???

    SmitFraudFix v2.398

    Rapport fait à 9:31:37,86, 03/03/2009
    Executé à partir de C:\Users\Utilisateur\Desktop\SmitfraudFix
    OS: Microsoft Windows [version 6.0.6001] - Windows_NT
    Le type du système de fichiers est NTFS
    Fix executé en mode sans echec

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

    »»»»»»»»»»»»»»»»»»»»»»»» hosts

    127.0.0.1 localhost
    ::1 localhost

    »»»»»»»»»»»»»»»»»»»»»»»» VACFix

    VACFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

    S!Ri's WS2Fix: LSP not Found.

    »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

    GenericRenosFix by S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

    C:\Program Files\Google\googletoolbar1.dll supprimé

    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix

    IEDFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix

    Agent.OMZ.Fix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» 404Fix

    404Fix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» RK

    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    Description: Intel(R) Wireless WiFi Link 4965AG
    DNS Server Search Order: 192.168.1.1

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{299663C6-FCF6-4B5F-B78A-F41D0A223ED4}: DhcpNameServer=192.168.1.1

    »»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires

    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

    »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

    Nettoyage terminé.

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» Fin

    Merci encore
    0
  11. sherred Messages postés 8605 Statut Membre 351
     
    tu a surement des fichier systeme hs
    si tu a le cd xp suit cette procedure

    si non je cherche une autre solution
    LA REPARATION DE XP AVEC LE CD

    il faut utilisé le cd en boot
    attention un cd de XP Pro sur une installation de XP familial ne fonctionnera pas et inversement

    1er
    Le bios

    1.Pour que tu puisse démarrer avec le cd, il faut « l'écrire »dans le BIOS
    entre dans le BIOS au démarrage de ton PC en tapotant sur la touche suppr de ton clavier (cela peut changer suivant votre machine, mais c’est toujours indiqué sur l’écran au démarrage)
    2.Une fois dans le bios tu cherche « first boot device » et tu met le cdrom en 1er
    (pour t'aider ->regarde en bas de l'écran tu doit avoir les touches et leurs correspondances)

    3. Met ton cd de Windows xp ou vista dans le lecteur.

    4. Sauvegarde les changements.

    5. Redémarre.

    2eme
    LA REPARATION

    1.Une fois redémarré Appuie sur une touche pour lancer le cd-rom.

    2.Tu laisse faire le chargement des pilotes

    3.ensuite tu aura plusieurs options si tu fait R « ce qui parait logique » tu auras la console de
    récupération,ce n'est pas le but rechercher...ici donc tu doit appuyer sur ENTREE et non sur R c'est comme si tu faisait une nouvelle installation

    4. Clique sur F8 pour continuer

    5. là tu sélectionne le système d'exploitation« si tu en a plusieurs » et tu appuie sur R

    6.attention il te faut la clé de ton xp « fait gaffe si ton clavier numérique est verrouillé appuie sur la touche Verr/Num »
    7.bien..tu n'a plus qu'à attendre une ½ heure
    0
  12. VEVEB
     
    J'ai window vista et je n'arrive pas ouvrir le bios. J'ai un DVD recovery dvd asustek et et utility . Je suppose que c'est celui dont j'ai besoin. Et un autre avec les drivers. J'ai aussi un fichier image kav rescue 2008 effectué le en décembre puis je l'utiliser pour restaurer et comment (je ne l'ai pas graver il est sur le pc)?
    0
  13. VEVEB
     
    ESt ce qu'il faut que je fasse une sauvegarde de tout mes fichiers phots films classeur exel ect ..avant de lancer le dvd recovery? Pour lancer le lancer le bios il faut que je fasse echap.
    Une fois lancé il me propose plusieurs solutions
    une partition ou les 2 hd puis une autre ... je ne comprends pas trop et j'ai peur de faire une betise de tout effacer .Peux-tu m'aider encore un peu ? QUe dois-je choisir 1-2ou 3
    Merci
    0
  14. veveb
     
    EN fait j'ai fait une restauration systeme et jel 'ai démarre normalement mais il rame.Ce matin j'ai une erreur et j'ai eu du mal a le faire repartir. on va voir. Merci pour ta patience.
    0
  15. sherred Messages postés 8605 Statut Membre 351
     
    si tu a fait un restauration il y a de forte chance qu tu a recuperer des saloperies
    télécharge hijackthis http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe
    -> enregistre la cible sous .... "le bureau" renomme hijackthis.exe en par exemple HJT.exe

    -> Fais un double-clic sur "HJT.exe" afin de lancer l'installation

    -> Clique sur Install ensuite sur "I Accept"

    -> Clique sur" Do a scan system and save log file"

    -> Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse

    0