Aidez moi a enlevé mes virus et trojans svp

Question

Bonjour,
Mon pc a été infécté par des trojan j'ai donc fait des analyses avec a-squared et spybot j'ai effacé tous les trojans et g nettoyé mon pc  avec c-cleaner. Pourtant mon pc rame a fond dans windows et sur internet aussi. J'ai telecharger hijack this (trend micro) et smitfraudFix  et je voudrais savoir si vous pouviez m'analyser les rapports?? 

Config:

Windows vista
Internet explorer 8
Mozilla firefox

MERCI BCP

plopus · Answer

bonjour

telecharge hijackthis sur ton bureau  https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/29061.html

execute le en administrateuir sous vista choisit do a scan and save the log  et poste le rapport

Guizo · Answer

Salut merci pour ton aide. Voila le rapport hijack this.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:02:23, on 29/05/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\msdtc.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\TODDSrv.exe
C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\System32\hkcmd.exe
C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
C:\Program Files\CardDetector\HUAWEI160\CardDetector.exe
C:\Program Files\a-squared Anti-Malware\a2guard.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\USB Disk Win98 Driver\Res.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Windows\System32undll32.exe
C:\Program Files\Synaptics\SynTP\SynToshiba.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\OrangeHSS\Launcher\Launcher.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\OrangeHSS\systray\systrayapp.exe
C:\Program Files\OrangeHSS\Deskboard\deskboard.exe
C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRAM FILES\A-SQUARED ANTI-MALWARE\a2HiJackFree.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Users\start\Desktop\HiJackThis\HijackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer fourni par Yahoo!
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Gossiper Toolbar - {0a452a47-c5a8-4854-a237-4b9b06b376f0} - C:\Program Files\Gossiper	bGoss.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: BHO Barre de Confiance - {988B07F5-7392-455A-8A1F-64935CB8B6ED} - C:\Program Files\BarreConfCMCIC\TAPBar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Barre de confiance - {55BDF3B0-C0A8-481A-B8A6-01CD2BE0F3FD} - C:\Program Files\BarreConfCMCIC\TAPBar.dll
O3 - Toolbar: Gossiper Toolbar - {0a452a47-c5a8-4854-a237-4b9b06b376f0} - C:\Program Files\Gossiper	bGoss.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe hwSetUP
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe
O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information	opi.exe -startup
O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [Desktop SMS] C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe /auto
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [PLFSet] rundll32.exe C:\Windows\PLFSet.dll,PLFDefSetting
O4 - HKLM\..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [CardDetectorHUAWEI160] C:\Program Files\CardDetector\HUAWEI160\CardDetector.exe
O4 - HKLM\..\Run: [BEWINTERNET-FR-DMGP-V2SessionManager] "C:\Program Files\Orange\IEWInternet\SessionManager\SessionManager.exe"
O4 - HKLM\..\Run: [a-squared] "C:\PROGRAM FILES\A-SQUARED ANTI-MALWARE\a2guard.exe" /d=60
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USB Disk Win98 Driver\Res.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\RunServices: [] Winreg.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD	oscdspd.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: eBay - {C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://www.webtip.ch/cgi-bin/toshiba/tracker_url.pl?FR (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix: 
O15 - Trusted Zone: http://*.mappy.com
O15 - Trusted Zone: http://*.orange.fr
O15 - Trusted Zone: http://rw.search.ke.voila.fr
O15 - Trusted Zone: http://orange.weborama.fr
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} - http://activex.camfrogweb.com/advanced/2.0.2.20/cfweb_activex.camfrogweb.com-advanced-2.0.2.20_instmodule.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F43DE135-7EC4-4234-ADF1-B307F837E77E}: NameServer = 192.168.1.1
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Service Google Update (gupdate1c9bb79361eb80b) (gupdate1c9bb79361eb80b) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Unknown owner - C:\Program Files\Norton Internet Security\isPwdSvc.exe (file missing)
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

plopus · Answer

Tu as une toolbar infectieuse + une autre infection

Fait ceci :

#  Télécharge ToolbarSD (de Team IDN) sur ton Bureau

https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

# Lance l'installation du programme en exécutant le fichier téléchargé.

#clique droit et execute en administrateur sous vista maintenant sur le raccourci de Toolbar-S&D.

# Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.

# Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.

# Poste le rapport généré. (C:\TB.txt)

Guizo · Answer

Salut voila le rapport toolbarSD

   -----------\  ToolBar S&D 1.2.8   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6001 ) Service Pack 1
   X86-based PC ( Multiprocessor Free : Genuine Intel(R) CPU           T2080  @ 1.73GHz )
   BIOS : Ver 1.00PARTTBL0
   USER : start ( Not Administrator ! )
   BOOT : Normal boot
   Antivirus : Norton Internet Security 2007 (Not Activated)
   Firewall  : Norton Internet Security 2007 (Not Activated)
   C:\ (Local Disk) - NTFS - Total:147 Go (Free:18 Go)
   D:\ (USB)
   E:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
   Option : [1] ( 29/05/2009|21:45 )

   [ UAC => 0 ]

   -----------\  Recherche de Fichiers / Dossiers ...

   C:\Program Files\Gossiper
   C:\Program Files\Gossiper\GossiperToolbarHelper.exe
   C:\Program Files\Gossiper\INSTALL.LOG
   C:\Program Files\Gossiper	bGoss.dll
   C:\Program Files\Gossiper	oolbar.cfg
   C:\Program Files\Gossiper\UNWISE.EXE
   C:\ProgramData\Kiwee Toolbar
   C:\ProgramData\Kiwee Toolbar\config
   C:\ProgramData\Kiwee Toolbar\images
   C:\ProgramData\Kiwee Toolbar\config\content_a.xml
   C:\ProgramData\Kiwee Toolbar\config\content_ie.xml
   C:\ProgramData\Kiwee Toolbar\config\content_m.xml
   C:\ProgramData\Kiwee Toolbar\config\content_y.xml
   C:\ProgramData\Kiwee Toolbar\config\logger.xml
   C:\ProgramData\Kiwee Toolbar\config	oolbarIE.xml
   C:\ProgramData\Kiwee Toolbar\config	oolbarIM_a.xml
   C:\ProgramData\Kiwee Toolbar\config	oolbarIM_m.xml
   C:\ProgramData\Kiwee Toolbar\config	oolbarIM_y.xml
   C:\ProgramData\Kiwee Toolbar\images\allow.bmp
   C:\ProgramData\Kiwee Toolbar\images\block.bmp
   C:\ProgramData\Kiwee Toolbar\images\dontsend.bmp
   C:\ProgramData\Kiwee Toolbar\images\im_toolbardropdownmenu.bmp
   C:\ProgramData\Kiwee Toolbar\images\im_toolbarsHelprolloverbase.bmp
   C:\ProgramData\Kiwee Toolbar\images\im_toolbarsm1rolloverbase.bmp
   C:\ProgramData\Kiwee Toolbar\images\im_toolbarsm1rolloverbase_bg.bmp
   C:\ProgramData\Kiwee Toolbar\images\im_toolbarsm1rolloverbase_dp.bmp
   C:\ProgramData\Kiwee Toolbar\images\im_toolbarsm2rolloverbase.bmp
   C:\ProgramData\Kiwee Toolbar\images\im_toolbarstextrollover.bmp
   C:\ProgramData\Kiwee Toolbar\images\send.bmp
   C:\ProgramData\Kiwee Toolbar\images	oolbar_eg.bmp
   C:\ProgramData\Kiwee Toolbar\images	oolbar_emoticons.bmp
   C:\ProgramData\Kiwee Toolbar\images	oolbar_eyeglass.bmp
   C:\ProgramData\Kiwee Toolbar\images	oolbar_gear.bmp
   C:\ProgramData\Kiwee Toolbar\images	oolbar_images.bmp
   C:\ProgramData\Kiwee Toolbar\images	oolbar_kiwee.bmp
   C:\ProgramData\Kiwee Toolbar\images	oolbar_msnlogo.bmp
   C:\ProgramData\Kiwee Toolbar\images	oolbar_news.bmp
   C:\ProgramData\Kiwee Toolbar\images	oolbar_text.bmp
   C:\ProgramData\Kiwee Toolbar\images	oolbar_videos.bmp
   C:\ProgramData\Kiwee Toolbar\images	oolbar_webshots.bmp
   C:\ProgramData\Kiwee Toolbar\images	oolbar_winks.bmp
   C:\ProgramData\Kiwee Toolbar\images\X.bmp
   C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Kiwee Toolbar
   C:\Program Files\Kiwee Toolbar
   C:\Program Files\Kiwee Toolbar\2.8.167
   C:\Program Files\Kiwee Toolbar\2.8.167\firefox
   C:\Program Files\Kiwee Toolbar\2.8.167\kiweetoolbar.zip
   C:\Program Files\Kiwee Toolbar\2.8.167\firefox\chrome
   C:\Program Files\Kiwee Toolbar\2.8.167\firefox\components
   C:\Program Files\Kiwee Toolbar\2.8.167\firefox\firefox.xpi
   C:\Program Files\Kiwee Toolbar\2.8.167\firefox\install.rdf
   C:\Program Files\Kiwee Toolbar\2.8.167\firefox\META-INF
   C:\Program Files\Kiwee Toolbar\2.8.167\firefox\chrome\kiweetoolbar.jar
   C:\Program Files\Kiwee Toolbar\2.8.167\firefox\components\AGCore.xpt
   C:\Program Files\Kiwee Toolbar\2.8.167\firefox\components\SearchProtection.xpt
   C:\Program Files\Kiwee Toolbar\2.8.167\firefox\META-INF\manifest.mf
   C:\Program Files\Kiwee Toolbar\2.8.167\firefox\META-INF\zigbert.rsa
   C:\Program Files\Kiwee Toolbar\2.8.167\firefox\META-INF\zigbert.sf

   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\windows\system32\blank.htm"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Start Page"="https://www.orange.fr/portail"
   "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Url"="https://www.msn.com/fr-fr/actualite/"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home"
   "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
   "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Local Page"="C:\windows\system32\blank.htm"


   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\01 - Lloyd - Girls All Around THe World - DJ Felon Remix.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\02 - Shwayze - Corona And Lime.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\03 - Too hort - Blow The Whistle.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\04 - Missy Elliott - Ching A Ling.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\05 - Michael Jackson ft Fergie - Billie Jean 2008 - Kanye West Remix.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\06 - Diddy - Through The Pain.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\07 - Kanye West - Stronger.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\08 - Nelly - Bay Bay Bay.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\09 - E-40 ft Akon - Wake It Up.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\10 - Timbaland ft. Nelly Furtado- Give It To Me.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\11 - ONeal McKnight ft. Jermaine Dupri - Check Your Coat - Jearmaine Remix.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\12 - Madonna ft. Justin Timberlake  Timbo - 4 Minutes To Save The World.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\13 - Craig David - Hot Stuff.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\14 - Lil Mama ft T-Pain - Shawty Get Loose.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\15 - The Federation - I Wear My Stunna Glasses At Nite.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\16 - Timbaland - The Way I Are.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\17 - Ludacris - What A Fool Believes - Benny Black  Doobie Brothers Remix.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\18 - Nelly Furtado - Say It Right.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\19 - Estelle ft Kanye West - American Boy.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\20 - Three 6 Mafia - Lollipop.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\Distributed by Mininova.txt
   C:\Users\start\Documents\T‚l‚chargement termin‚\Acronis Disk Director 10 FR build 2161 (Partition suite) # Keygen inclus - par Ju#.7z
   C:\Users\start\Documents\T‚l‚chargement termin‚\Keygen Microsoft office FR 2007
   C:\Users\start\Documents\T‚l‚chargement termin‚\Keygen Microsoft office FR 2007.zip
   C:\Users\start\Documents\T‚l‚chargement termin‚\Keygen Microsoft office FR 2007\A lire.doc
   C:\Users\start\Documents\T‚l‚chargement termin‚\Keygen Microsoft office FR 2007\key.txt
   C:\Users\start\Documents\T‚l‚chargement termin‚\Office 2007 Professional Plus SP2 FR\OFF12PPSP1FR\_Extras\Classic Menu for Office 2007 v4.00\keygen.exe
   C:\Users\start\Music\Documents\NI - Traktor Pro 1.0.1\crack


   [ UAC => 1 ]


   1 - "C:\ToolBar SD\TB_1.txt" - 29/05/2009|21:48 - Option : [1]

   -----------\  Fin du rapport a 21:48:11,29

plopus · Answer

attention au crack !!!

C:\Users\start\Documents\T‚l‚chargement termin‚\Keygen Microsoft office FR 2007
C:\Users\start\Documents\T‚l‚chargement termin‚\Keygen Microsoft office FR 2007.zip
C:\Users\start\Documents\T‚l‚chargement termin‚\Keygen Microsoft office FR 2007\A lire.doc
C:\Users\start\Documents\T‚l‚chargement termin‚\Keygen Microsoft office FR 2007\key.txt
C:\Users\start\Documents\T‚l‚chargement termin‚\Office 2007 Professional Plus SP2 FR\OFF12PPSP1FR\_Extras\Classic Menu for Office 2007 v4.00\keygen.exe
C:\Users\start\Music\Documents\NI - Traktor Pro 1.0.1\crack 

surtout qu'il existe a la place de microsoft office, open office qui est la meme chose mais gratuit


    *  Relance Toolbar-S&D en liquant droit et execute en administrateur sur le raccourci.

    * Tape sur "2" puis valide en appuyant sur "Entrée".

      /!\ Ne ferme pas la fenêtre lors de la suppression /!\

    * Un rapport sera généré, poste son contenu ici.


* NOTE : Si ton Bureau ne réapparait pas, appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches.
Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter..."
Tape explorer puis valide.

puis fait un scan en ligne ici et poste le rapport   http://www.bitdefender.fr/scan_fr/scan8/ie.html


puis

    *  Télécharge Malwarebytes
http://www.commentcamarche.net/telecharger/telecharger 34055379 malwarebytes anti malware

    * Fais la mise à jour du logiciel (elle se fait normalement à l'installation)
    * Lance une analyse complète en cliquant sur "Exécuter un examen complet"
    * Sélectionnes les disques que tu veux analyser et cliques sur "Lancer l'examen"
    * L'analyse peut durer un bon moment.....
    * Une fois l'analyse terminée, cliques sur "OK" puis sur "Afficher les résultats"
    * Vérifies que tout est bien coché et cliques sur "Supprimer la sélection" => et ensuite sur "OK"
    * Un rapport va s'ouvrir dans le bloc note... Fais un copié/collé du rapport dans ta prochaine réponse sur le forum


* Il se pourrait que certains fichiers devront être supprimés au redémarrage du PC... Faites le en cliquant sur "oui" à la question posée

Guizo · Answer

Salut et encore merci pour ton aide. Voila le rapport toolbar sd apres suppression:

   -----------\  ToolBar S&D 1.2.8   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6001 ) Service Pack 1
   X86-based PC ( Multiprocessor Free : Genuine Intel(R) CPU           T2080  @ 1.73GHz )
   BIOS : Ver 1.00PARTTBL0
   USER : start ( Not Administrator ! )
   BOOT : Normal boot
   Antivirus : Norton Internet Security 2007 (Not Activated)
   Firewall  : Norton Internet Security 2007 (Not Activated)
   C:\ (Local Disk) - NTFS - Total:147 Go (Free:12 Go)
   D:\ (USB)
   E:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
   Option : [2] ( 30/05/2009|13:32 )

   [ UAC => 1 ]

   -----------\ SUPPRESSION

   Supprime! - C:\Program Files\Gossiper\GossiperToolbarHelper.exe
   Supprime! - C:\Program Files\Gossiper\INSTALL.LOG
   Supprime! - C:\Program Files\Gossiper	bGoss.dll
   Supprime! - C:\Program Files\Gossiper	oolbar.cfg
   Supprime! - C:\Program Files\Gossiper\UNWISE.EXE
   Supprime! - C:\ProgramData\Kiwee Toolbar\config
   Supprime! - C:\ProgramData\Kiwee Toolbar\images
   Supprime! - C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Kiwee Toolbar
   Supprime! - C:\Program Files\Kiwee Toolbar\2.8.167
   Supprime! - C:\Program Files\Gossiper
   Supprime! - C:\ProgramData\Kiwee Toolbar
   Supprime! - C:\Program Files\Kiwee Toolbar

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\windows\system32\blank.htm"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Start Page"="https://www.orange.fr/portail"
   "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Url"="https://www.msn.com/fr-fr/actualite/"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="https://www.msn.com/fr-fr/"
   "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
   "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Local Page"="C:\windows\system32\blank.htm"


   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\01 - Lloyd - Girls All Around THe World - DJ Felon Remix.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\02 - Shwayze - Corona And Lime.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\03 - Too hort - Blow The Whistle.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\04 - Missy Elliott - Ching A Ling.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\05 - Michael Jackson ft Fergie - Billie Jean 2008 - Kanye West Remix.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\06 - Diddy - Through The Pain.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\07 - Kanye West - Stronger.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\08 - Nelly - Bay Bay Bay.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\09 - E-40 ft Akon - Wake It Up.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\10 - Timbaland ft. Nelly Furtado- Give It To Me.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\11 - ONeal McKnight ft. Jermaine Dupri - Check Your Coat - Jearmaine Remix.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\12 - Madonna ft. Justin Timberlake  Timbo - 4 Minutes To Save The World.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\13 - Craig David - Hot Stuff.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\14 - Lil Mama ft T-Pain - Shawty Get Loose.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\15 - The Federation - I Wear My Stunna Glasses At Nite.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\16 - Timbaland - The Way I Are.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\17 - Ludacris - What A Fool Believes - Benny Black  Doobie Brothers Remix.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\18 - Nelly Furtado - Say It Right.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\19 - Estelle ft Kanye West - American Boy.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\20 - Three 6 Mafia - Lollipop.mp3
   C:\Users\start\Desktop\Musique\Hip-Hop USA\DJ JP - Get Your Party Crackin ft. Timbaland Lil Wayne Kanye West Akon Nelly Furtado\Distributed by Mininova.txt
   C:\Users\start\Documents\T‚l‚chargement termin‚\Acronis Disk Director 10 FR build 2161 (Partition suite) # Keygen inclus - par Ju#.7z
   C:\Users\start\Documents\T‚l‚chargement termin‚\Keygen Microsoft office FR 2007
   C:\Users\start\Documents\T‚l‚chargement termin‚\Keygen Microsoft office FR 2007.zip
   C:\Users\start\Documents\T‚l‚chargement termin‚\Keygen Microsoft office FR 2007\A lire.doc
   C:\Users\start\Documents\T‚l‚chargement termin‚\Keygen Microsoft office FR 2007\key.txt
   C:\Users\start\Documents\T‚l‚chargement termin‚\Office 2007 Professional Plus SP2 FR\OFF12PPSP1FR\_Extras\Classic Menu for Office 2007 v4.00\keygen.exe
   C:\Users\start\Music\Documents\NI - Traktor Pro 1.0.1\crack


   [ UAC => 1 ]


   1 - "C:\ToolBar SD\TB_1.txt" - 29/05/2009|21:48 - Option : [1]
   2 - "C:\ToolBar SD\TB_2.txt" - 30/05/2009|13:41 - Option : [2]

   -----------\  Fin du rapport a 13:41:22,01

plopus · Answer

ok passe a malwarebyte et poste le rapport

Guizo · Answer

Salut voila le rapport malwarebytes:

Malwarebytes' Anti-Malware 1.37
Version de la base de données: 2196
Windows 6.0.6001 Service Pack 1

30/05/2009 17:50:44
mbam-log-2009-05-30 (17-50-44).txt

Type de recherche: Examen complet (C:\|D:\|E:\|)
Eléments examinés: 249725
Temps écoulé: 2 hour(s), 26 minute(s), 39 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Miracle (Rogue.FixTool) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\desktop sms (Worm.P2P) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
c:\Users\start\PerfectOptimizer.exe (Rogue.PerfectOptimizer) -> Quarantined and deleted successfully.
c:\Windows\Tasks\PerfectOptimzier_OneClick.job (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.

plopus · Answer

ok fait attention avec les logiciels de securité ou d'optimisation qui ne sont pas connu fait des recherches avant de les telecharger.

est ce toi qui as installé ce programme ?  PerfectOptimizer, 


fait ceci :

• Télécharge Random's System Information Tool (RSIT) de Random/Random, et enregistre le sur ton Bureau.
http://images.malwareremoval.com/random/RSIT.exe

• clique droit et execute en administrateur sur RSIT.exe pour lancer l'outil.
• Clique sur "Continue" à l'écran Disclaimer.
• Si l'outil HijackThis n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu s'il te le demande) et tu devras accepter la licence.
• Une fois le scan terminé, deux rapports vont apparaître : poste les dans deux messages séparés stp

Guizo · Answer

Salut oui c'est moi qui est installé perfect optimiser. J'ai fait l'analyse RSIT voila le rapport par contre j'en ai eu qu'un et pas deux:

Logfile of random's system information tool 1.06 (written by random/random)
Run by start at 2009-05-30 18:25:53
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 1
System drive C: has 12 GB (8%) free of 151 GB
Total RAM: 1013 MB (17% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:26:27, on 30/05/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Windows\Explorer.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\msdtc.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\TODDSrv.exe
C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
C:\Windows\system32\UI0Detect.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\System32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynToshiba.exe
C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
C:\Program Files\CardDetector\HUAWEI160\CardDetector.exe
C:\Program Files\a-squared Anti-Malware\a2guard.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\USB Disk Win98 Driver\Res.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Windows\System32undll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\OrangeHSS\Launcher\Launcher.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files\OrangeHSS\systray\systrayapp.exe
C:\Program Files\OrangeHSS\Deskboard\deskboard.exe
C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe
C:\Users\start\Desktop\RSIT.exe
c:\program files\windows defender\MpCmdRun.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Users\start\Desktop\RSIT.exe
C:\Program Files	rend micro\start.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer fourni par Yahoo!
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: BHO Barre de Confiance - {988B07F5-7392-455A-8A1F-64935CB8B6ED} - C:\Program Files\BarreConfCMCIC\TAPBar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Barre de confiance - {55BDF3B0-C0A8-481A-B8A6-01CD2BE0F3FD} - C:\Program Files\BarreConfCMCIC\TAPBar.dll
O3 - Toolbar: (no name) - {0a452a47-c5a8-4854-a237-4b9b06b376f0} - (no file)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe hwSetUP
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe
O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information	opi.exe -startup
O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [PLFSet] rundll32.exe C:\Windows\PLFSet.dll,PLFDefSetting
O4 - HKLM\..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [CardDetectorHUAWEI160] C:\Program Files\CardDetector\HUAWEI160\CardDetector.exe
O4 - HKLM\..\Run: [BEWINTERNET-FR-DMGP-V2SessionManager] "C:\Program Files\Orange\IEWInternet\SessionManager\SessionManager.exe"
O4 - HKLM\..\Run: [a-squared] "C:\PROGRAM FILES\A-SQUARED ANTI-MALWARE\a2guard.exe" /d=60
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USB Disk Win98 Driver\Res.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\RunServices: [] Winreg.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD	oscdspd.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: eBay - {C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://www.webtip.ch/cgi-bin/toshiba/tracker_url.pl?FR (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O13 - Gopher Prefix: 
O15 - Trusted Zone: http://*.mappy.com
O15 - Trusted Zone: http://*.orange.fr
O15 - Trusted Zone: http://rw.search.ke.voila.fr
O15 - Trusted Zone: http://orange.weborama.fr
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} - http://activex.camfrogweb.com/advanced/2.0.2.20/cfweb_activex.camfrogweb.com-advanced-2.0.2.20_instmodule.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F43DE135-7EC4-4234-ADF1-B307F837E77E}: NameServer = 192.168.1.1
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Service Google Update (gupdate1c9bb79361eb80b) (gupdate1c9bb79361eb80b) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Unknown owner - C:\Program Files\Norton Internet Security\isPwdSvc.exe (file missing)
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

plopus · Answer

juste au passage avant la suite Perfetc optimiser est un rogue, c'est un faux logiciel qui est en réalité un virus donc ne t'etonne pas de + le retrouver normalement il a ete supprimé  :) , si tu trouve encore des traces de ce logiciel supprime les.



 bon il te reste des cochonnerie :

Fait un scan en ligne ici et poste le rapport en entier :    http://www.bitdefender.fr/scan_fr/scan8/ie.html



au passage il te reste des traces de NOrton desinstalle le completement avec sa :

http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20050414110429924

ensuite tu as beaucoup d'antispyware pour pas grand chose et en plus il ont tous des des resident ACTIVé ton PC doit ramer a fond !!!

desactive le TEA timer de spybot (d'ailleur j'aurai te le dire avant) et si tu le remet a la fin de la desinfection accepte TOUTES les modif de registre.

arrete aussi le resident de  a-squared Anti-Malware.  tu doit garder 1 guard en temps réel pour ton antivirus et une pour ton antispyware la tu as 4 guard en temps réel qui te fond ramé le PC, qui doivent entré en conflit etc...en plus tu es moins protege.

Un conseil desinstalle a-squared Anti-Malware completement et arrete le tea timer de spybot en allant dans les options de spybot et decoche utilisé le resident

Guizo · Answer

Salut j'ai viré a-squared et ad-aware et g arrété le resident de spybot. Par contre c'es quoi le tea-timer de spybot? J'ai pas trouvé. Sinon j'arrive pas a desinstallé norton meme en suivant ton lien et en plus je n'ai pas le cd de norton. Et une derniere chose je voulais savoir si spybot est un spyware ou un antivirus? La je vais faire l'analyse bit defender et je te poste le rapport. Merci

plopus · Answer

en fait le tea timer de spybot c'est le resident donc apparamment tu m'as desactivé .

sa doit deja moins ramer, tu feras ceci pour eliminer les traces de desinstallation c'est un nettoyeur :

telecharge et installe CCleaner DECOCHE L'installation de la yahoo toolbar puis va dans /option/avancé et decoche la premiere case puis va dans onglet registre et fichier temporaire et lance plusieurs nettoyage jusqu'a trouver 0erreur et ne fait pas de sauvegarde des elements.

en attente du scan en ligne

Guizo · Answer

J'ai reussi a viré norton. Voila le rapport bitdefender:

BitDefender Online Scanner - Rapport virus en temps réel
  
  
 
Généré à: Sat, May 30, 2009 - 22:55:28
 

--------------------------------------------------------------------------------

 
  
  
 
Info d'analyse
  
  
 
Fichiers scannés
 140211
 
Infectés Fichiers
 0
 
  
  
 
 
  
  
 
Virus Détectés
  
  
 
Aucun virus trouvé.
 
 
  
  
 
 
  
  
 
 

--------------------------------------------------------------------------------
  
  
 
Ce sommaire du processus d'analyse sera utilisé par les laboratoires Antivirus BitDefender pour créer des statistiques agréguées sur l'activité des virus dans le monde.

g!rly · Answer

_______*#####*
____*##########*
__*##############
__################
_##################_________**####*
__##################_____*##########
__##################___*#############
___#################*_###############*
____#################################*
______###############################
_______#############################* __________
________*##########################__________
__________########################
___________*####################*
____________*##################
_____________*###############
_______________#############
________________##########
________________*#######*
_________________######
__________________####
__________________###
___________________#

plopus · Answer

salut g!rly tu vas bien ?  :)


guizo :

telecharge sur ton BUREAU combofix  http://download.bleepingcomputer.com/sUBs/ComboFix.exe

DESACTIVE ton antivirus et TOUtes tes defence et deconnecte toi d'internet

lance le suit les indication et ne touche a rien durant le scan meme pas a la souris sous risque de faire bug le PC et poste le rapport a la fin

g!rly · Answer

love ya`

                             |
                         .   |
                             |
               \    *        |     *    .  /
                 \        *  |  .        /
              .    \     ___---___     /    .  
                     \.--         --./     
          ~-_    *  ./               \.   *   _-~
             ~-_   /    ^         ^    \   _-~     *
        *       ~-/    ___       ___    \-~        
          .      |    (_O_)     (_O_)    |      .
              * |                         | *     
     -----------|                         |-----------
       .        |    <               >    |        .    
             *   |    \             /    | *
                _-\    `.         .'    /-_    *
          .  _-~ . \     `-.___.-'     /   ~-_     
          _-~       `\               /'*      ~-_  
         ~           /`--___   ___--'\           ~
                *  /        ---     .  \   
                 /     *     |           \   
               /             |   *         \ 
                          .  |        .
                             |

plopus · Answer

et ben dit ya une page entiere rempli g!rly  :) tu es en forme ce matin

en plus j'ai vu que tu fait un combat avec chiquitine de celui qui aura le meilleur poste en dessin, chiquitine en a vraiment des pas mal  ;)

g!rly · Answer

set vs horus .)

Guizo · Answer

Salut et encore merci de continuer de m'aider. J'ai encore beaucoup de saloperies ou pas? J'ai passé comboFix voila le rapport:

ComboFix 09-05-30.03 - start 31/05/2009  7:38.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium   6.0.6001.1.1252.33.1036.18.1013.408 [GMT 2:00]
Lancé depuis: c:\users\start\Desktop\ComboFix.exe
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Outdated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\start\AppData\Roaming\.#
c:\windows\system32\404Fix.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\Ijl11.dll
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe

.
(((((((((((((((((((((((((((((   Fichiers créés du 2009-04-28 au 2009-05-31  ))))))))))))))))))))))))))))))))))))
.

2009-05-30 18:11 . 2009-05-30 18:11	--------	d-----w	c:\programdata\NortonInstaller
2009-05-30 16:23 . 2009-05-30 16:26	--------	d-----w	c:\program files\trend micro
2009-05-30 16:23 . 2009-05-30 16:24	--------	d-----w	C:\rsit
2009-05-30 13:23 . 2009-05-31 05:33	--------	d-----w	c:\users\start\AppData\Roaming\uTorrent
2009-05-30 13:18 . 2009-05-30 13:18	--------	d-----w	c:\users\start\AppData\Roaming\Malwarebytes
2009-05-30 13:17 . 2009-05-26 11:20	40160	----a-w	c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-30 13:17 . 2009-05-30 13:18	--------	d-----w	c:\program files\Malwarebytes' Anti-Malware
2009-05-30 13:17 . 2009-05-30 13:17	--------	d-----w	c:\programdata\Malwarebytes
2009-05-30 13:17 . 2009-05-26 11:19	19096	----a-w	c:\windows\system32\drivers\mbam.sys
2009-05-30 12:01 . 2009-05-30 19:54	--------	d-----w	c:\windows\BDOSCAN8
2009-05-29 19:44 . 2009-05-30 11:41	--------	d-----w	C:\ToolBar SD
2009-05-29 15:35 . 2009-05-29 15:36	--------	d-----w	c:\users\start\AppData\Roaming\dvdcss
2009-05-29 15:34 . 2009-05-29 15:39	--------	d-----w	c:\users\start\AppData\Roaming\vlc
2009-05-29 15:29 . 2009-05-29 15:29	--------	d-----w	c:\program files\VideoLAN
2009-05-28 13:13 . 2009-05-28 13:13	--------	d-----w	c:\users\start\AppData\Roaming\Printer Info Cache
2009-05-28 13:13 . 2009-05-28 13:13	--------	d-----w	c:\users\start\AppData\Roaming\Image Zone Express
2009-05-26 16:58 . 2009-05-26 16:58	552	----a-w	c:\users\start\AppData\Local\d3d8caps.dat
2009-05-20 02:34 . 2009-05-20 02:34	--------	d-----w	c:\users\start\Jeux de Nes
2009-05-19 12:12 . 2009-05-19 12:12	--------	d-----w	c:\programdata\WEBREG
2009-05-19 12:11 . 2009-05-25 15:19	--------	d-----w	c:\users\start\AppData\Roaming\HP
2009-05-19 12:10 . 2009-05-19 12:10	--------	d-----w	c:\programdata\HPSSUPPLY
2009-05-19 12:05 . 2009-05-19 12:05	--------	d-----w	c:\program files\Hewlett-Packard
2009-05-19 12:05 . 2009-05-19 12:05	--------	d-----w	c:\program files\Common Files\Hewlett-Packard
2009-05-19 12:05 . 2009-05-19 12:10	--------	d-----w	c:\program files\Common Files\HP
2009-05-19 12:00 . 2009-05-19 12:10	--------	d-----w	c:\program files\HP
2009-05-19 11:57 . 2009-05-19 12:13	164400	----a-w	c:\windows\hpoins19.dat
2009-05-19 11:57 . 2009-05-19 12:42	--------	d-----w	c:\programdata\HP
2009-05-19 11:56 . 2006-11-20 21:36	258048	----a-w	c:\windows\system32\hpzids01.dll
2009-05-19 11:56 . 2006-12-16 06:19	675840	----a-w	c:\windows\system32\hpowiav1.dll
2009-05-19 11:56 . 2006-12-16 06:19	303104	----a-w	c:\windows\system32\hpovst01.dll
2009-05-19 11:56 . 2006-12-16 06:19	573440	----a-w	c:\windows\system32\hpotscl1.dll
2009-05-19 11:56 . 2007-03-13 19:55	26952	----a-w	c:\windows\hpomdl19.dat
2009-05-17 21:15 . 2009-05-22 15:05	35	----a-w	c:\users\start\AppData\Roaming\SetValue.bat
2009-05-15 11:12 . 2009-05-30 18:01	--------	d-----w	c:\program files\a-squared Anti-Malware
2009-05-15 07:17 . 2009-05-30 17:45	--------	d-----w	c:\programdata\Lavasoft
2009-05-15 07:17 . 2009-05-30 17:45	--------	d-----w	c:\program files\Lavasoft
2009-05-15 07:04 . 2009-05-30 17:33	--------	d-----w	c:\programdata\Spybot - Search & Destroy
2009-05-15 07:04 . 2009-05-15 14:43	--------	d-----w	c:\program files\Spybot - Search & Destroy
2009-05-13 21:01 . 2009-05-13 21:01	--------	d-----w	c:\programdata\eMule
2009-05-13 21:01 . 2009-05-13 21:42	--------	d-----w	c:\users\start\AppData\Local\eMule
2009-05-13 17:35 . 2009-05-13 17:35	--------	d-----w	c:\program files\Microsoft.NET
2009-05-13 17:32 . 2009-05-13 17:32	--------	d-----w	c:\program files\Microsoft Visual Studio 8
2009-05-13 17:26 . 2009-05-13 17:26	--------	d--h--r	C:\MSOCache
2009-05-12 21:10 . 2009-01-21 13:25	137384	----a-w	c:\windows\system32\drivers\cbfs32.sys
2009-05-12 21:09 . 2009-05-12 21:10	--------	d-----w	c:\program files\mes données
2009-05-12 16:35 . 2009-05-30 17:49	--------	d-----w	c:\program files\Webcamfirst
2009-05-12 15:36 . 2009-05-12 15:36	--------	d-----w	c:\windows\SUYIN NB Cam
2009-05-12 15:35 . 2007-04-24 09:49	45056	----a-w	c:\windows\PLFSet.dll
2009-05-12 15:35 . 2007-04-02 16:40	172032	----a-w	c:\windows\system32\rsnp2uvc.dll
2009-05-12 15:35 . 2007-02-07 16:35	1729152	----a-w	c:\windows\system32\drivers\snp2uvc.sys
2009-05-12 15:35 . 2006-12-28 09:21	27904	----a-w	c:\windows\system32\drivers\sncduvc.sys
2009-05-12 15:35 . 2006-11-07 13:17	286720	----a-w	c:\windows\system32\vsnp2uvc.dll
2009-05-12 15:35 . 2009-05-12 15:35	--------	d-----w	c:\program files\Common Files\snp2uvc
2009-05-12 15:35 . 2005-11-23 11:55	53248	----a-w	c:\windows\system32\csnp2uvc.dll
2009-05-12 05:17 . 2007-12-11 18:22	65536	----a-w	c:\windows\system32\Autodial2000.dll
2009-05-12 05:17 . 2009-05-12 05:31	--------	d-----w	c:\program files\OrangeHSS
2009-05-11 15:38 . 2009-05-11 15:39	--------	d-----w	c:\users\start\AppData\Roaming\agi
2009-05-11 15:37 . 2009-05-11 15:37	--------	d-----w	c:\program files\AGI
2009-05-11 04:43 . 2009-05-11 04:43	--------	d-----w	c:\program files\psx emulation cheater
2009-05-11 02:14 . 2009-05-11 23:47	--------	d-----w	c:\windows\Recent
2009-05-11 02:14 . 2009-05-11 23:47	--------	d-----w	c:\windows\APPLOG
2009-05-10 23:50 . 2009-05-10 23:50	26	----a-w	c:\windows\winstart.bat
2009-05-10 23:50 . 2009-05-10 23:50	141	----a-w	c:\windows\tmpcpyis.bat
2009-05-10 23:50 . 2009-05-10 23:50	122	----a-w	c:\windows\tmpdelis.bat
2009-05-10 23:43 . 1998-07-30 10:51	305152	----a-w	c:\windows\IsUninst.exe
2009-05-05 13:19 . 2009-05-15 06:09	90	----a-w	c:\users\start\AppData\Local\kcyss.bat
2009-05-03 18:35 . 2009-05-03 18:35	--------	d-----w	c:\users\start\AppData\Roaming\fltk.org
2009-05-03 01:53 . 2009-05-03 01:53	--------	d-----w	c:\windows\system32\Adobe
2009-05-03 01:51 . 2009-05-24 11:18	153024	---ha-w	c:\windows\system32\mlfcache.dat
2009-05-03 01:33 . 2009-05-03 17:12	--------	d-----w	c:\users\start\Jeux console

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-30 19:50 . 2008-01-24 19:28	--------	d-----w	c:\program files\Yahoo!
2009-05-30 18:14 . 2007-03-08 10:40	--------	d-----w	c:\program files\Common Files\Symantec Shared
2009-05-26 18:02 . 2006-11-02 15:48	672322	----a-w	c:\windows\system32\perfh00C.dat
2009-05-26 18:02 . 2006-11-02 15:48	124434	----a-w	c:\windows\system32\perfc00C.dat
2009-05-26 00:06 . 2008-02-19 14:18	--------	d-----w	c:\program files\uTorrent
2009-05-25 15:58 . 2009-03-28 06:47	1	----a-w	c:\users\start\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-05-25 15:47 . 2008-02-07 15:53	--------	d-----w	c:\programdata\Microsoft Help
2009-05-22 15:05 . 2009-05-17 21:15	691	----a-w	c:\users\start\AppData\Roaming\GetValue.vbs
2009-05-18 13:19 . 2007-03-08 09:52	--------	d--h--w	c:\program files\InstallShield Installation Information
2009-05-18 12:53 . 2009-04-01 23:50	--------	d-----w	c:\program files\iPod
2009-05-18 12:52 . 2009-03-28 05:58	--------	d-----w	c:\program files\OpenOffice.org 3
2009-05-18 12:41 . 2009-04-02 03:11	--------	d-----w	c:\program files\uTorrent SpeedUp Pro
2009-05-18 12:39 . 2009-05-18 12:39	0	----a-w	C:\XES37F8.tmp
2009-05-18 12:39 . 2009-05-18 12:39	0	----a-w	C:\XES786.tmp
2009-05-15 06:04 . 2009-04-17 01:01	--------	d-----w	c:\program files\uTorrent Acceleration Tool
2009-05-15 06:04 . 2009-03-27 01:28	--------	d-----w	c:\users\start\AppData\Roaming\OnlineStorage
2009-05-13 22:08 . 2009-03-02 15:45	116120	----a-w	c:\windows\system32\GDIPFONTCACHEV1.DAT
2009-05-13 17:36 . 2006-11-02 12:37	--------	d-----w	c:\program files\MSBuild
2009-05-13 01:01 . 2006-11-02 11:18	--------	d-----w	c:\program files\Windows Mail
2009-05-12 21:10 . 2009-05-12 21:09	--------	d-----w	c:\program files\mes données
2009-05-12 15:41 . 2008-01-22 17:01	--------	d-----w	c:\program files\Camera Assistant Software for Toshiba
2009-05-11 23:47 . 2009-03-24 13:19	--------	d-----w	c:\users\start\AppData\Roaming\Audacity
2009-05-11 23:47 . 2009-02-04 01:20	--------	d-----w	c:\program files\Messenger Plus! Live
2009-05-05 12:37 . 2009-03-28 02:54	88	----a-w	c:\users\start\AppData\Local\muqog.bat
2009-05-04 15:15 . 2009-03-30 19:49	--------	d-----w	c:\program files\Google
2009-05-03 15:52 . 2009-03-30 17:54	--------	d-----w	c:\program files\CA Yahoo! Anti-Spy
2009-04-28 09:19 . 2009-04-28 09:19	--------	d-----w	c:\users\Wizgo.PC-DE-GUILLAUME\AppData\Roaming\OnlineStorage
2009-04-22 12:00 . 2009-04-22 11:59	--------	d-----w	c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-22 12:00 . 2009-04-01 23:50	--------	d-----w	c:\program files\iTunes
2009-04-22 11:55 . 2009-04-22 11:55	75048	----a-w	c:\programdata\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
2009-04-22 11:48 . 2008-06-18 21:45	--------	d-----w	c:\program files\Common Files\Adobe
2009-04-13 08:24 . 2009-04-13 08:24	--------	d-----w	c:\users\Wizgo.PC-DE-GUILLAUME\AppData\Roaming\Yahoo!
2009-04-13 08:23 . 2009-04-13 08:21	--------	d-----w	c:\users\Wizgo.PC-DE-GUILLAUME\AppData\Roaming\uTorrent
2009-04-13 08:18 . 2009-04-13 08:18	--------	d-----w	c:\users\Wizgo.PC-DE-GUILLAUME\AppData\Roaming\DivX
2009-04-13 08:17 . 2009-04-13 08:17	114568	----a-w	c:\users\Wizgo.PC-DE-GUILLAUME\AppData\Local\GDIPFONTCACHEV1.DAT
2009-04-13 00:23 . 2009-04-13 00:23	--------	d-----w	c:\program files\Zone Labs
2009-04-13 00:19 . 2009-04-13 00:19	--------	d-----w	c:\programdata\CheckPoint
2009-04-12 23:01 . 2009-04-12 23:01	--------	d-----w	c:\program files\Common Files\Scanner
2009-04-12 14:18 . 2008-01-24 19:28	--------	d-----w	c:\program files\DivX
2009-04-12 14:16 . 2009-03-26 16:26	--------	d-----w	c:\program files\Common Files\DivX Shared
2009-04-05 20:17 . 2009-04-01 23:43	--------	d-----w	c:\program files\QuickTime
2009-04-05 11:39 . 2009-04-05 11:34	--------	d-----w	c:\users\start\AppData\Roaming\CamfrogWEB
2009-04-03 19:06 . 2009-04-02 06:30	--------	d-----w	c:\program files\Common Files\AVSMedia
2009-04-03 17:49 . 2009-04-01 23:45	--------	d-----w	c:\program files\Safari
2009-04-03 17:47 . 2009-04-03 17:47	--------	d-----w	c:\program files\Bonjour
2009-04-02 06:31 . 2009-04-02 06:31	--------	d-----w	c:\programdata\AVS4YOU
2009-04-02 06:31 . 2009-04-02 06:31	--------	d-----w	c:\users\start\AppData\Roaming\AVS4YOU
2009-04-02 05:13 . 2009-04-01 23:44	--------	d-----w	c:\program files\Bonjour(9)
2009-04-02 04:47 . 2008-01-22 16:49	8224	----a-w	c:\users\start\AppData\Local\GDIPFONTCACHEV1.DAT
2009-04-02 00:38 . 2008-03-21 21:54	--------	d-----w	c:\users\start\AppData\Roaming\Apple Computer
2009-04-01 23:51 . 2009-04-01 23:50	--------	d-----w	c:\programdata\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-04-01 23:50 . 2008-03-21 21:47	--------	d-----w	c:\program files\Common Files\Apple
2009-04-01 18:38 . 2009-03-30 19:34	--------	d-----w	c:\program files\CDBurnerXP
2009-04-01 18:36 . 2009-02-26 01:13	--------	d-----w	c:\program files\CCleaner
2009-04-01 18:36 . 2008-01-22 16:40	--------	d-----w	c:\program files\Synaptics
2009-04-01 18:28 . 2009-03-30 19:09	--------	d-----w	c:\users\start\AppData\Roaming\uTorrent(111)
2009-04-01 18:10 . 2009-03-31 13:33	--------	d-----w	c:\users\Wizgo\AppData\Roaming\uTorrent
2009-03-31 13:17 . 2009-03-31 13:17	114568	----a-w	c:\users\Wizgo\AppData\Local\GDIPFONTCACHEV1.DAT
2009-03-28 08:07 . 2009-03-28 08:07	410984	----a-w	c:\windows\system32\deploytk.dll
2009-03-19 14:32 . 2009-04-22 12:00	23400	----a-w	c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-19 14:32 . 2009-03-19 14:32	23400	----a-w	c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys
2009-03-17 03:38 . 2009-04-15 00:35	13824	----a-w	c:\windows\system32\apilogen.dll
2009-03-17 03:38 . 2009-04-15 00:35	24064	----a-w	c:\windows\system32\amxread.dll
2009-03-08 11:34 . 2009-03-28 07:38	914944	----a-w	c:\windows\system32\wininet.dll
2009-03-08 11:34 . 2009-03-28 07:38	43008	----a-w	c:\windows\system32\licmgr10.dll
2009-03-08 11:33 . 2009-03-28 07:38	18944	----a-w	c:\windows\system32\corpol.dll
2009-03-08 11:33 . 2009-03-28 07:38	109056	----a-w	c:\windows\system32\iesysprep.dll
2009-03-08 11:33 . 2009-03-28 07:38	109568	----a-w	c:\windows\system32\PDMSetup.exe
2009-03-08 11:33 . 2009-03-28 07:38	107520	----a-w	c:\windows\system32\RegisterIEPKEYs.exe
2009-03-08 11:33 . 2009-03-28 07:38	107008	----a-w	c:\windows\system32\SetIEInstalledDate.exe
2009-03-08 11:33 . 2009-03-28 07:38	103936	----a-w	c:\windows\system32\SetDepNx.exe
2009-03-08 11:33 . 2009-03-28 07:38	132608	----a-w	c:\windows\system32\ieUnatt.exe
2009-03-08 11:33 . 2009-03-28 07:38	420352	----a-w	c:\windows\system32\vbscript.dll
2009-03-08 11:32 . 2009-03-28 07:38	72704	----a-w	c:\windows\system32\admparse.dll
2009-03-08 11:32 . 2009-03-28 07:38	71680	----a-w	c:\windows\system32\iesetup.dll
2009-03-08 11:32 . 2009-03-28 07:38	66560	----a-w	c:\windows\system32\wextract.exe
2009-03-08 11:32 . 2009-03-28 07:38	169472	----a-w	c:\windows\system32\iexpress.exe
2009-03-08 11:31 . 2009-03-28 07:38	34816	----a-w	c:\windows\system32\imgutil.dll
2009-03-08 11:31 . 2009-03-28 07:38	48128	----a-w	c:\windows\system32\mshtmler.dll
2009-03-08 11:31 . 2009-03-28 07:38	45568	----a-w	c:\windows\system32\mshta.exe
2009-03-08 11:22 . 2009-03-28 07:38	156160	----a-w	c:\windows\system32\msls31.dll
2009-03-03 04:46 . 2009-04-15 00:36	3599328	----a-w	c:\windows\system32\ntkrnlpa.exe
2009-03-03 04:46 . 2009-04-15 00:36	3547632	----a-w	c:\windows\system32\ntoskrnl.exe
2009-03-03 04:39 . 2009-04-15 00:36	183296	----a-w	c:\windows\system32\sdohlp.dll
2009-03-03 04:39 . 2009-04-15 00:36	551424	----a-w	c:\windows\system32\rpcss.dll
2009-03-03 04:39 . 2009-04-15 00:36	26112	----a-w	c:\windows\system32\printfilterpipelineprxy.dll
2009-03-03 04:37 . 2009-04-15 00:36	98304	----a-w	c:\windows\system32\iasrecst.dll
2009-03-03 04:37 . 2009-04-15 00:36	44032	----a-w	c:\windows\system32\iasdatastore.dll
2009-03-03 04:37 . 2009-04-15 00:36	54784	----a-w	c:\windows\system32\iasads.dll
2009-03-03 03:04 . 2009-04-15 00:36	666624	----a-w	c:\windows\system32\printfilterpipelinesvc.exe
2009-03-03 02:38 . 2009-04-15 00:36	17408	----a-w	c:\windows\system32\iashost.exe
2002-03-11 09:06 . 2002-03-11 09:06	1822520	----a-w	c:\program files\instmsiw.exe
2002-03-11 08:45 . 2002-03-11 08:45	1708856	----a-w	c:\program files\instmsia.exe
2009-02-24 19:34 . 2009-02-24 19:34	1044480	----a-w	c:\program files\mozilla firefox\plugins\libdivx.dll
2009-02-24 19:34 . 2009-02-24 19:34	200704	----a-w	c:\program files\mozilla firefox\plugins\ssldivx.dll
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OSDOverLayIcon]
@="{8129812F-4AF8-4A47-85A5-D995B505880C}"
[HKEY_CLASSES_ROOT\CLSID\{8129812F-4AF8-4A47-85A5-D995B505880C}]
2009-04-16 14:32	53248	----a-w	c:\program files\mes données\OSDExtension.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2006-11-13 413696]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-05-04 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"HWSetup"="c:\program files\TOSHIBA\Utilities\HWSetup.exe" [2006-11-01 413696]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2006-12-19 411768]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2007-02-06 509496]
"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2006-12-07 55416]
"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2007-01-17 534648]
"Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaRegistration.exe" [2007-02-19 571024]
"topi"="c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-03-02 577536]
"SVPWUTIL"="c:\program files\TOSHIBA\Utilities\SVPWUTIL.exe" [2006-11-01 438272]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-02-02 835584]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-28 148888]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-01-13 90191]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-01-13 81920]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-01-13 7766016]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-11-28 81920]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-11-28 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-11-28 106496]
"PLFSet"="c:\windows\PLFSet.dll" [2007-04-24 45056]
"KeNotify"="c:\program files\TOSHIBA\Utilities\KeNotify.exe" [2006-11-06 34352]
"ORAHSSSessionManager"="c:\program files\OrangeHSS\SessionManager\SessionManager.exe" [2007-12-12 107248]
"CardDetectorHUAWEI160"="c:\program files\CardDetector\HUAWEI160\CardDetector.exe" [2008-09-25 274432]
"BEWINTERNET-FR-DMGP-V2SessionManager"="c:\program files\Orange\IEWInternet\SessionManager\SessionManager.exe" [2008-09-25 131824]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"USB Storage Toolbox"="c:\program files\USB Disk Win98 Driver\Res.EXE" [2005-09-14 65536]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"NDSTray.exe"="NDSTray.exe" [BU]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-01-18 4349952]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"FilterAdministratorToken"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
"AntiVirusDisableNotify"="0x00000000"
"UpdatesDisableNotify"="0x00000000"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
"DefaultOutboundAction"= 0 (0x0)
"DefaultInboundAction"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{8B50BA2A-8C4C-4FE4-9CF8-01EE69C14190}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{4F2B5B6D-0ABC-4035-A669-4F72DE374CFD}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"TCP Query User{9F2DDA66-953B-42F4-9C96-9AB7F4F31777}c:\program files\windows live\messenger\msnmsgr.exe"= UDP:c:\program files\windows live\messenger\msnmsgr.exe:Windows Live Messenger
"UDP Query User{F8026AC2-11B4-4BF2-A592-32EF8EC4C47F}c:\program files\windows live\messenger\msnmsgr.exe"= TCP:c:\program files\windows live\messenger\msnmsgr.exe:Windows Live Messenger
"TCP Query User{67FE2105-383F-4114-BADC-46817EBA0DAC}c:\windows\system32\winreg.exe"= UDP:c:\windows\system32\winreg.exe:Winreg
"UDP Query User{D80521F8-DD82-4DF3-A511-CFDE012FD8A4}c:\windows\system32\winreg.exe"= TCP:c:\windows\system32\winreg.exe:Winreg
"{B68DDBB7-5854-462B-B402-C5F3ACDBC88C}"= UDP:c:\program files\Mozilla Firefox\firefox.exe:Mozilla Firefox
"{9EFFB496-7C2F-4032-8710-BB85A8EF08EA}"= TCP:c:\program files\Mozilla Firefox\firefox.exe:Mozilla Firefox
"{82DC71F7-B5C2-45A1-B0E0-234DF3BA87CD}"= UDP:c:\program files\K-Lite Codec Pack\Filters\ac3config.exe:AC3Filter
"{EBDAD518-3227-42F9-A122-50C2768D80BF}"= TCP:c:\program files\K-Lite Codec Pack\Filters\ac3config.exe:AC3Filter
"{262DEBA5-5EC6-45C9-BCB0-361F421BBF50}"= Disabled:TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"TCP Query User{A319C412-4E62-45FB-8E2A-336F43C75A7F}c:\program files\windows live\messenger\msnmsgr.exe"= UDP:c:\program files\windows live\messenger\msnmsgr.exe:Windows Live Messenger
"UDP Query User{27455208-5C43-4CD0-93E1-AD1F14055FD0}c:\program files\windows live\messenger\msnmsgr.exe"= TCP:c:\program files\windows live\messenger\msnmsgr.exe:Windows Live Messenger
"{914558EC-E758-4782-A150-46ED41DE140F}"= Disabled:TCP:55000:192.168.1.10:eMule
"TCP Query User{AD667AEE-B323-4F01-B0E7-48ACDABEC428}c:\program files\emule\emule.exe"= Disabled:UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{0FF5DF6B-FEEB-41A4-9404-79DB26C2B876}c:\program files\emule\emule.exe"= Disabled:TCP:c:\program files\emule\emule.exe:eMule
"{2C3F7019-7AEE-4308-A1DA-0B55F698A6DC}"= Disabled:UDP:c:\program files\uTorrent Acceleration Tool\uTorrent Acceleration Tool.exe:uTorrent Acceleration Tool
"{45E6ECE0-4271-45F1-B094-71F76F808742}"= Disabled:TCP:c:\program files\uTorrent Acceleration Tool\uTorrent Acceleration Tool.exe:uTorrent Acceleration Tool
"TCP Query User{F43452C4-0663-481C-B01F-FEFC907ED84A}c:\program files\utorrent\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:µTorrent
"UDP Query User{9B68FA2C-070D-4D44-8B0E-70D05B54CECF}c:\program files\utorrent\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:µTorrent
"{DA5F344F-D127-4A00-BE5B-C3A100B876DD}"= UDP:c:\program files\Mozilla Firefox\firefox.exe:Mozilla Firefox
"{0E6ACF05-6898-4EB1-8E68-0A5FA45FC6A0}"= TCP:c:\program files\Mozilla Firefox\firefox.exe:Mozilla Firefox
"{4B08FBF3-1E8A-4B45-A181-1DB8AB8C1493}"= UDP:c:\users\start\AppData\Local\Temp\7zSAA62.tmp\SymNRT.exe:Norton Removal Tool
"{E5F59BC3-6818-439B-ABA6-4975CA016D7C}"= TCP:c:\users\start\AppData\Local\Temp\7zSAA62.tmp\SymNRT.exe:Norton Removal Tool

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
"DefaultOutboundAction"= 0 (0x0)
"DefaultInboundAction"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
"DefaultOutboundAction"= 0 (0x0)
"DefaultInboundAction"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\Program Files\Orange\IEWInternet\Connectivity\ConnectivityManager.exe"= c:\program files\Orange\IEWInternet\Connectivity\ConnectivityManager.exe:*:enabled:CSS
"c:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe"= c:\program files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS

R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [12/01/2009 20:28 114768]
R1 CbFs;CbFs;c:\windows\System32\drivers\cbfs32.sys [12/05/2009 23:10 137384]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [12/01/2009 20:28 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [12/01/2009 20:27 51792]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [15/05/2009 09:04 1153368]
S2 gupdate1c9bb79361eb80b;Service Google Update (gupdate1c9bb79361eb80b);c:\program files\Google\Update\GoogleUpdate.exe [12/04/2009 16:16 133104]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\System32\FsUsbExDisk.Sys [29/12/2008 15:27 36512]
S3 HDJMidi;Hercules DJ Console MIDI;c:\windows\System32\drivers\HDJMidi.sys [23/02/2008 05:27 41984]
S3 hwusbfake;Huawei DataCard USB Fake;c:\windows\System32\drivers\ewusbfake.sys [24/03/2009 21:44 100224]
S3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:\windows\System32\drivers\PCAMp50.sys [24/03/2009 21:50 28224]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,LaunchINFSectionEx c:\program files\Internet Explorer\clrtour.inf,DefaultInstall.ResetTour,,12
.
Contenu du dossier 'Tâches planifiées'

2009-05-31 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-12 14:15]

2009-05-31 c:\windows\Tasks\User_Feed_Synchronization-{3037FDC8-E66C-4A01-909D-DA431392C1D2}.job
- c:\windows\system32\msfeedssync.exe [2009-03-28 11:31]
.
- - - - ORPHELINS SUPPRIMES - - - -

SafeBoot-procexp90.Sys


.
------- Examen supplémentaire -------
.
uStart Page = hxxp://orange.fr/
mWindow Title = 
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://www.webtip.ch/cgi-bin/toshiba/tracker_url.pl?FR
TCP: {F43DE135-7EC4-4234-ADF1-B307F837E77E} = 192.168.1.1
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} - hxxp://activex.camfrogweb.com/advanced/2.0.2.20/cfweb_activex.camfrogweb.com-advanced-2.0.2.20_instmodule.exe
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
FF - ProfilePath - c:\users\start\AppData\Roaming\Mozilla\Firefox\Profiles\oxesnv3c.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.orange.fr
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MIMWA2&q=
FF - plugin: c:\program files\Google\Update\1.2.145.5\npGoogleOneClick8.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
FF - plugin: c:\programdata\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll

---- PARAMETRES FIREFOX ----
FF - user.js: network.proxy.type - 0
FF - user.js: browser.shell.checkDefaultBrowser - false
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-31 07:42
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-3943368547-3807070264-3836599413-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{D7E3E596-7CB6-9CBF-B075-059EB737B9AC}*]
"bbdgcbaepnokgoaokiffgafpccenoknkoojj"=hex:61,61,00,00
"abdgcbaepnokgoaokiafjghdeibmbocacn"=hex:61,61,00,00

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\[u]0/u000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\[u]0/u001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\[u]0/u002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\[u]0/u004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Heure de fin: 2009-05-31  7:44
ComboFix-quarantined-files.txt  2009-05-31 05:44

Avant-CF: 28 837 388 288 octets libres
Après-CF: 28 988 780 544 octets libres

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
388	--- E O F ---	2009-05-29 16:02

g!rly · Answer

__________888888888888888888888888
________8888:::8888888888888888888888888
_______8888::::::8888888888888888888888888888
______88:::::::::888:::8888888888888888888888888
_____88888888::::8:::::::::::888888888888888888888
____888 8::888888::::::::::::::::::888888888888888888
____88:::::88888888:::::m::::::::::888888888888888888
____888888888888888888::M:::::::::::8888888888888888
____88888888888888888888::::::::::::M888888888888888
____8888888888888888888888:::::::::M8888888888888888
____ 8888888888888888888888:::::::M888888888888888888
____8888888888888888::88888::::::M88888888888888888888
___88888888888888888:::88888:::::M888888888888888888888
__ 88888888888888888:::88888::::M;o*M*o;::8888888888888
__88888888888888888:::8888:::::M:::::::::::::8888888888888
_ 88888888888888888::::88::::::M:;:::::::::::::888888888888
_8888888888888888888:::8::::::Maaa:::::::::::M888888888888
_88_ 8888888888::88::::8::::M:::::::::::::::::::8888888888888
88_88888888888:::8:::::::::M::::::::::;:::::::::88:888888888­88
8_8888888888888:::::::::::M::"a@@@aa"::::::8w888888888888
_88888888888:888::::::::::M:::::"aaa"::::::::::M8i8888888888888
8888888888::::88:::::::::M88:::::::::::::::::M88z88888888888888
8888888888:::::8:::::::::M88888::::::::::MM888!88888888888888
888888888:::::8:::::::::M8888888MAmmmAMVMM888*88888888
888888 M:::::::::::::::M888888888:::::::MM88888888888888
8888_ M::::::::::::::M88888888888::::::MM888888888888888
888 _M:::::::::::::M8888888888888M:::::mM888888888888888
_888_M::::::::::::M8888:888888888888::::m::Mm88888 888888
_ 88_M::::::::::::8888:88888888888888888::::::Mm8_ 88888
_ 88_M::::::::::8888M::88888::888888888888:::::::Mm88888
_ 8 _MM::::::::8888M:::8888:::::888888888888::::::::Mm8
___ 8M:::::::8888M:::::888:::::::88:::8888888::::::::Mm
___88MM:::::8888M:::::::88::::::::8:::::888888:::M:::::M
__ 8888M:::::888MM::::::::8:::::::::::M::::8888::::M::::M
__88888M:::::88:M::::::::::8:::::::::::M:::8888::::::M::M
_ 88 888MM:::888:M::::::::::::::::::::::M:8888:::::::::::::M:
_ 8 88888M:::88::M:::::::::::::::::::::::MM:88::::::::::::::::M
__ 88888M:::88::M::::::::::::*88*::::::::M:88::::::::::::::::::M
__888888M:::88::M:::::::::88@@88::::::M::88:::::::::::::::::::M
__888888MM::88::MM::::::88@@88::::::M:::8:::::::::::::::::::::*8
__88888 M:::8:MM::::::::::::*88*::::::::M::::::::::::::::::::::88@@
__ 8888 _M::::::MM:::::::::::::::::::::::MM:::::::::::::::::::::::88@@
___888_ M:::::::MM:::::::::::::::::::::MM:M:::::::::::::::::::::::::*8
___888__M::::::MMM:::::::::::::::::::MM:::MM:::::::::::::::::::::::M
___88 __M::::::::MMMM:::::::::::MMMM:::::MM::::::::::::::::::::MM
____88__M::::::::::MMMMMMMMMMMM:::::::::MMM:::::::::::::MMM
____ 88__M::::::::::::::MMMMMMM:::::::::::::::::MMMMMMMMMM
_____88 _8M:::::::::::::::::::::::::::::::::::::::::::::::MMMMMM
_____8 _88M:::::::::::::::::::::::::::::M::::::M::::::::::::::MM
_______ 888M::::::::::::::::::::::::::MM::::::MM:::::::::MM
_______88888M:::::::::::::::::::::MMM:::::::mM::::::MM
_______888888M:::::::::::::::::MMM:::::::::MMM:::::M
______ 8888888M:::::::::::::::MMM:::::::::::MM:::::M
______88 88888M::::::::::::MMM::::::::::::::M::::::M
______8_88888M:::::::::::MM:::::::::::::::M:::::::M:
_______ 88888:M::::::::::M::::::::::::::::M:::::::MM
_______888888M:::::::::M::::::::::::::::::::::::::M:M
_______888888M:::::::M:::::::::@::::::::::::::::M::M
_______88888M:::::::::::::::::@@:::::::::::::::::M::M
______ 88888M:::::::::::::::::@@@::::::::::::::::M:::M
______88888M::::::::::::::::::@@::::::::::::::::::M::::M
_____ 88888M:::::::m::::::::::@:::::::::Mm:::::::M:::::M
_____8888M::::::::M:::::::::::::::::::::::MM:::::::M:::::::M
____ 8888M::::::::M::::::::::::::::::::::MMM::::::::M:::::::M
____888_M:::::::Mm::::::::::::::::::::MMM:::::::::M:::::::::M
___8888_MM:::::Mm:::::::::::::::::::MMMM:::::::::m:::m::::M
__ 888__M:::::::M::::::::::::::::::::MMM::::::::::::M::::mm:::M
_8888__MM:::::::::::::::::::::::::::MM:::::::::::::mM:::MM::::M:
______ M::::::::::::::::::::::::::::::M::::::::::::::mM:::MM:::Mm
______MM::::::::m::::::::::::::::::::::::::::::::::::M::::MM:::MM
_____ M:::::::::::M::::::::::::::::::::::::::::::::::::::M:::M:::MM
_____MM::::::::::M::::::::::::::::M:::::::::::::::::::::M::M:::MM
_____M:::::::::::::M88::::::::::::M:::::::::::::::::::::MM:::MMM
_____M::::::::::::::8888888888M::::::::::::::::::::::MM::::MM
____ M::::::::::::::::88888888M::::::::::::::::::::::::M:::::MM
____ M:::::::::::::::::888888M:::::::::::::::::::::::::M:::::MM
_____M:::::::::::::::::88888M:::::::::::::::::::::::::M::::MM
_____M:::::::::::::::::::88M::::::::::::::::::::::::::::M::MM
_____M:::::::::::::::::::::M::::::::::::::::::::::::::::MMM
_____MM::::::::::::::::::M::::::::::::::::::::::::::::::MMM
______M::::::::::::::::::M::::::::::::::::::::::::::::::MMM
______MM::::::::::::::::M::::::::::::::::::::::::::::::MMM
______ M::::::::::::::::M::::::::::::::::::::::::::::::MMM
_______MM:::::::::::::M:::::::::::::::::::::::::::::MMM
_______M::::::::::::::M:::::::::::::::::::::::::::::MMM
_______ MM::::::::::::M::::::::::::::::::::::::::::MMM
________M:::::::::::M:::::::::::::::::::::::::::::MMM
________MM:::::::::M::::::::::::::::::::::::::::MMM
________ M:::::::::M:::::::::::::::::::::::::::MMM
_________MM:::::::M::::::::::::::::::::::::::MMM
_________ MM::::::M::::::::::::::::::::::::MMM
_________ MM:::::M:::::::::::::::::::::::MMM
__________MM::::M:::::::::::::::::::::MMM
__________MM:::M:::::::::::::::::::::MMM
__________ MM::M::::::::::::::::::::MMM
__________ MM:M:::::::::::::::::::MMM
___________MMM::::::::::::::::::MMM
___________MM::::::::::::::::::MMM
__________ M::::::::::::::::::::MMM
__________MM:::::::::::::::::::MMM
__________MM:::::::::::::::::::MMM
__________MM::::::::M::::::::::MMM:
__________mMM:::::MM::::::::MMMM
__________ MMM:::::::::::::::MMM:M
___________mMM::::::M:::::::MM::M
___________MM:::::MMMM::::::M::M
___________ MM:::::MMM:::::::M::M
___________ mM:::::MM::::::::M:::M
____________MM::::MM:::::::::::MM
____________MM::::MM:::::::::::::M:
____________MM:::::M:::::::::::::::M
____________MMM:::::::::::::::::::::M:
____________ MMM:::::::::::::::::::::M:
____________ MMM:::::::::::::::::::::M:
_____________MMM:::::::::::::::::::::M:
_____________MMM::::::::::::::::::::Mm
_____________ MM:::::::::::::::::::::MM
_____________ MMM:::::::::::::::::::MM
_____________ MMM:::::::::::::::::::MM
_____________ MMM::::::::::::::::::MM
_____________ MMM::::::::::::::::::MM
______________MM:::::::::::::::::MMM
______________MMM::::::::::::::::MM
______________MMM:::::::::::::::MM
______________MMM::::::::::::::MM
______________ MM::::::::::::::MM
______________ MM:::::::::::::MM
______________ MM:::::::::::::MM
______________ MMM:::::::::::MM
______________ MMM::::::::::MM
_______________MM:::::::::::MM
_______________MMM:::::::::MM
_______________MMM:::::::::MM
_______________ MM:::::::::MM
_______________ MMM:::::::MM
_______________ MMM:::::::MM
________________MM::::::::MM
________________MM::::::::MM
________________ MM:::::::MM
________________ MM::::::MM:
________________ MM::::::M:M
________________ MM::::::M:M
________________ :M::::::::::M:
________________M:M::::::::::M
_______________ M:::M:::::::::M
_______________M::::M:::::::::M
______________ M:::::M::::::::::M
______________M::::::MM:::::::::M
______________M:::::::M:::::::::::M
______________M;:;::::M:::::::::::M
______________M:m:;:::M:::::::::::M
______________MM:m:m::M::::::::;:M
______________ MM:m::MM::::::::;:;M
_______________MM::MMM:::::::;:m:M
_______________MMMM MM:::::m:m:M
___________________MM:::::::m:MM
___________________ MM::::::MM
____________________MM::MM

Guizo · Answer

Salut voila le rapport malwarebytes:

Malwarebytes' Anti-Malware 1.37
Version de la base de données: 2196
Windows 6.0.6001 Service Pack 1

30/05/2009 17:50:44
mbam-log-2009-05-30 (17-50-44).txt

Type de recherche: Examen complet (C:\|D:\|E:\|)
Eléments examinés: 249725
Temps écoulé: 2 hour(s), 26 minute(s), 39 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Miracle (Rogue.FixTool) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\desktop sms (Worm.P2P) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
c:\Users\start\PerfectOptimizer.exe (Rogue.PerfectOptimizer) -> Quarantined and deleted successfully.
c:\Windows\Tasks\PerfectOptimzier_OneClick.job (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.

Guizo · Answer

Salut plopus je vient de tomber sur la 2ème partie du rapport RSIT donc je te le poste:  
apres je vais refaire un hijack this pourrai tu me dire si je suis toujours infécté. Merci

info.txt logfile of random's system information tool 1.06 2009-05-30 18:24:00

======Uninstall list======

-->"C:\Program Files\InstallShield Installation Information\{A644254B-92F6-4970-8635-AB0775371E72}\setup.exe" --u:{A644254B-92F6-4970-8635-AB0775371E72}
-->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE
-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{622E6F16-0904-49B6-BBE1-4CC836314CCF}\setup.exe" -l0x40c 
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{697AFC77-F318-4CD4-BF16-F50F4C1072DA}\setup.exe" -l0x40c 
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0015-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0019-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {14809F99-C601-4D4A-9391-F1E8FAA964C5}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {A0516415-ED61-419A-981D-93596DA74165}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {D66D5A44-E480-4BA4-B4F2-C554F6B30EBB}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0044-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {B165D3C2-40AE-4D39-86F7-E5C87C4264C0}
32 Bit HP CIO Components Installer-->MsiExec.exe /I{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}
Acer Crystal Eye webcam-->C:\Program Files\InstallShield Installation Information\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}\setup.exe -runfromtemp -l0x040c -removeonly -u
Ad-Aware-->"C:\ProgramData\{83C91755-2546-441D-AC40-9A6B4B860800}\Ad-AwareAE.exe" REMOVE=TRUE MODIFY=FALSE
Ad-Aware-->C:\ProgramData\{83C91755-2546-441D-AC40-9A6B4B860800}\Ad-AwareAE.exe
Adobe AIR-->MsiExec.exe /I{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}
Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flash Player 9 ActiveX-->C:\Windows\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
Adobe Media Player-->msiexec /qb /x {1EBB57D4-63FF-87CC-A0F0-D73982CF6008}
Adobe Media Player-->MsiExec.exe /I{1EBB57D4-63FF-87CC-A0F0-D73982CF6008}
Adobe Reader 8.1.4-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81300000003}
Adobe Shockwave Player 11.5-->"C:\Windows\system32\Adobe\Shockwave 11\uninstaller.exe"
AppCore-->MsiExec.exe /I{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}
Apple Mobile Device Support-->MsiExec.exe /I{AFA20D47-69C3-4030-8DF8-D37466E70F13}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
ASAPI-->MsiExec.exe /X{8A7E941F-2BB4-47D0-B732-8AE5F3513B68}
Ask.com Search Assistant 1.0.1-->C:\Program Files\Ask Search Assistant\uninst.exe
a-squared Anti-Malware 4.5-->"C:\Program Files\a-squared Anti-Malware\unins000.exe"
Assistant de connexion Windows Live-->MsiExec.exe /I{D3116CC7-24DC-4CA3-9CE1-23FED836E9F2}
Atheros Driver Installation Program-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{28006915-2739-4EBE-B5E8-49B25D32EB33}\Setup.exe" -l0x40c  -removeonly
Audacity 1.3.5 (Unicode)-->"C:\Program Files\Audacity 1.3 Beta (Unicode)\unins000.exe"
AV-->MsiExec.exe /I{F4DB525F-A986-4249-B98B-42A8066251CA}
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
Barre de confiance CM-CIC-->"C:\Program Files\BarreConfCMCIC\Setup.exe" -u
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
CA Yahoo! Anti-Spy (remove only)-->"C:\Program Files\CA Yahoo! Anti-Spy\uninstall.exe"
Camera Assistant Software for Toshiba-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{37C866E4-AA67-4725-9E95-A39968DD7960}\setup.exe" -l0x40c 
Card Detector for Huawei E160-->C:\Program Files\CardDetector\HUAWEI160\CardDetectorSetup.exe -u
ccCommon-->MsiExec.exe /I{3CCAD2EF-CFF2-4637-82AA-AABF370282D3}
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Codeur Windows Media Série 9-->msiexec.exe /I {E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
Codeur Windows Media Série 9-->MsiExec.exe /I{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
Désinstallation de Internet Everywhere-->C:\Program Files\Orange\IEWInternet\installation\core\Installgui.exe -u
Desktop SMS-->MsiExec.exe /I{5980B928-1C95-4B3E-957B-B02D8147FF9E}
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Plus DirectShow Filters-->C:\Program Files\DivX\DivXDSFiltersUninstall.exe /DSFILTERS
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
DVD MovieFactory for TOSHIBA-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F214EAA4-A069-4BAF-9DA4-4DB8BEEDE485}\setup.exe" -l0x40c 
Favorit-->c:\users\start\appdata\local\kcyss.bat
FruityLoops Studio Producer Edition v4.01-->C:\PROGRA~1\FLSTUD~1\UNWISE.EXE C:\PROGRA~1\FLSTUD~1\INSTALL.LOG
Google Chrome-->"C:\Program Files\Google\Chrome\Application\1.0.154.65\Installer\setup.exe" --uninstall --system-level
Google Earth-->MsiExec.exe /I{1E04F83B-2AB9-4301-9EF7-E86307F79C72}
Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_BDA1448D3D255554.exe" /uninstall
Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
HP Customer Participation Program 8.0-->C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat
HP Imaging Device Functions 8.0-->C:\Program Files\HP\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat
HP OCR Software 8.0-->C:\Program Files\HP\Digital Imaging\OCR\hpzscr01.exe -datfile hpqbud11.dat
HP Photosmart Essential-->MsiExec.exe /X{EB21A812-671B-4D08-B974-2A347F0D8F70}
HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B-->C:\Program Files\HP\Digital Imaging\{C916D86C-AB76-49c7-B0E4-A946E0FD9BC2}\setup\hpzscr01.exe -datfile hposcr19.dat -onestop -showdisconnect -forcereboot
HP Solution Center 8.0-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
HP Update-->MsiExec.exe /X{8C6027FD-53DC-446D-BB75-CACD7028A134}
HPSSupply-->MsiExec.exe /X{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}
Intel(R) Graphics Media Accelerator Driver-->C:\Windows\system32\igxpun.exe -uninstall
iTunes-->MsiExec.exe /I{5EFCBB42-36AB-4FF9-B90C-E78C7B9EE7B3}
Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216013FF}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Java(TM) SE Runtime Environment 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160000}
K-Lite Mega Codec Pack 3.7.5-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
LiveUpdate Notice (Symantec Corporation)-->MsiExec.exe /X{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
mes données 1.2.1.9-->C:\Program Files\mes données\uninst.exe
Messenger Plus! Live-->"C:\Program Files\Messenger Plus! Live\Uninstall.exe"
Microsoft .NET Framework 3.5 SP1-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mise à jour Microsoft Office Excel 2007 Help  (KB963678)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {B761869A-B85C-40E2-994C-A1CE78AC8F2C}
Mise à jour Microsoft Office Powerpoint 2007 Help  (KB963669)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {C3DCA38E-005E-41BA-A52A-7C3429F351C3}
Mise à jour Microsoft Office Word 2007 Help  (KB963665)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {81536A04-DBFB-4DB3-978F-0F284590C223}
Mozilla Firefox (3.0.10)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSRedist-->MsiExec.exe /I{B7C61755-DB48-4003-948F-3D34DB8EAF69}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
myphotobook 3.1-->C:\Program Files\myphotobook\uninst.exe
Native Instruments Service Center-->"C:\ProgramData\{442B6EC3-77A0-4817-825F-67F47D7A2E54}\Service Center Setup.exe" REMOVE=TRUE MODIFY=FALSE
Native Instruments Service Center-->C:\ProgramData\{442B6EC3-77A0-4817-825F-67F47D7A2E54}\Service Center Setup.exe
Native Instruments Traktor-->"C:\ProgramData\{3689B77C-90FA-4663-91AB-5AB34383CD81}\Traktor Setup.exe" REMOVE=TRUE MODIFY=FALSE
Native Instruments Traktor-->C:\ProgramData\{3689B77C-90FA-4663-91AB-5AB34383CD81}\Traktor Setup.exe
Norton Confidential Browser Component-->MsiExec.exe /I{4843B611-8FCB-4428-8C23-31D0A5EAE164}
Norton Confidential Web Protection Component-->MsiExec.exe /I{D353CC51-430D-4C6F-9B7E-52003DA1E05A}
Norton Internet Security (Symantec Corporation)-->"C:\Program Files\Common Files\Symantec Shared\SymSetup\{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}_10_1_0_26\{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}.exe" /X
Norton Internet Security-->MsiExec.exe /I{3672B097-EA69-4bfe-B92F-29AE6D9D2B34}
Norton Internet Security-->MsiExec.exe /I{48185814-A224-447A-81DA-71BD20580E1B}
Norton Internet Security-->MsiExec.exe /I{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}
Norton Internet Security-->MsiExec.exe /I{E3EFA461-EB83-4C3B-9C47-2C1D58A01555}
Norton Internet Security-->MsiExec.exe /I{E5EE9939-259F-4DE2-8023-5C49E16A4F43}
Norton Protection Center-->MsiExec.exe /I{9A129ABC-A53A-4209-A21E-D5DEDFB7CCA8}
NVIDIA Drivers-->C:\Windows\system32\NVUNINST.EXE UninstallGUI
OpenOffice.org 3.0-->MsiExec.exe /I{6860B340-530D-46B3-91F8-1AE1F70F7C33}
Orange - Logiciels Internet-->C:\Program Files\OrangeHSS\installation\core\Installgui.exe -u
QuickTime-->MsiExec.exe /I{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}
Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista-->C:\Program Files\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\setup.exe -runfromtemp -l0x040c -removeonly
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m
Réducteur de bruit lect. CD/DVD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}\setup.exe" -l0x40c 
Safari-->MsiExec.exe /I{D90AFDE3-3E67-407A-ACA8-F0BAAD012F08}
Samsung PC Studio 3 USB Driver Installer-->"C:\Program Files\InstallShield Installation Information\{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}\setup.exe" -runfromtemp -l0x040c -removeonly
Samsung PC Studio 3-->"C:\Program Files\InstallShield Installation Information\{C4A4722E-79F9-417C-BD72-8D359A090C97}\setup.exe" -runfromtemp -l0x040c -removeonly
Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
Security Update for Windows Media Encoder (KB954156)-->msiexec.exe /I {E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E} MSIPATCHREMOVE={E836F1B7-43FB-46B0-A0D9-E4D2A5951659} /qb
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
Tag&Rename 3.3.5-->"C:\Program Files\TagRename\unins000.exe"
Texas Instruments PCIxx21/x515/xx12 drivers.-->C:\Program Files\InstallShield Installation Information\{0409969E-BEFB-44D3-90B9-63BE50FBAE5E}\setup.exe -runfromtemp -l0x040c
TOSHIBA Assist-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{12B3A009-A080-4619-9A2A-C6DB151D8D67}\setup.exe" -l0x40c 
TOSHIBA ConfigFree-->C:\Program Files\InstallShield Installation Information\{BDD83DC9-BEE9-4654-A5DA-CC46C250088D}\setup.exe -runfromtemp -l0x040cuninstall -removeonly
TOSHIBA Disc Creator-->MsiExec.exe /X{5DA0E02F-970B-424B-BF41-513A5018E4C0}
TOSHIBA Extended Tiles for Windows Mobility Center-->C:\Program Files\InstallShield Installation Information\{617C36FD-0CBE-4600-84B2-441CEB12FADF}\setup.exe -runfromtemp -l0x040c
TOSHIBA Flash Cards Support Utility-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{620BBA5E-F848-4D56-8BDA-584E44584C5E} 
TOSHIBA Hardware Setup-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{5279374D-87FE-4879-9385-F17278EBB9D3} /l1036 
TOSHIBA Mot de passe responsable-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE} /l1036 
Toshiba Online Product Information-->C:\Program Files\InstallShield Installation Information\{2290A680-4083-410A-ADCC-7092C67FC052}\setup.exe -runfromtemp -l0x040c -removeonly
TOSHIBA SD Memory Utilities-->MsiExec.exe /X{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}
TOSHIBA Software Modem-->Tosmreg -U
TOSHIBA Value Added Package-->C:\Program Files\InstallShield Installation Information\{FEDD27A0-B306-45EF-BF58-B527406B42C8}\setup.exe -runfromtemp -l0x040c
Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for Microsoft Office Outlook 2007 Help (KB957246)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {80E46078-C1C5-4AE8-8744-3EAFC812E118}
Update for Outlook 2007 Junk Email Filter (kb968503)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {5DD98950-4D10-4B79-8BF6-59726705207D}
USB Disk Win98 Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4E79A62F-7A2D-4058-BCE0-94E6B9E2F162}\Setup.exe" 
uTorrent Acceleration Tool-->C:\Program Files\uTorrent Acceleration Tool\uninstall.exe
VC 9.0 Runtime-->MsiExec.exe /I{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}
VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B}
Visual C++ 2008 x86 Runtime - (v9.0.30729)-->MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5D14231E27}
Visual C++ 2008 x86 Runtime - v9.0.30729.01-->C:\Windows\system32\msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D14231E27} /qb+ REBOOTPROMPT=""
WaveLab Demo-->"C:\Program Files\Steinberg\WaveLab Demo\Uninstall.exe" "C:\Program Files\Steinberg\WaveLab Demo\install.log"
Webcamfirst 3.1.8-->"C:\Program Files\Webcamfirst\uninstall.exe"
Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
WinDVD for TOSHIBA-->C:\Program Files\InstallShield Installation Information\{20471B27-D702-4FE8-8DEC-0702CC8C0A85}\setup.exe -runfromtemp -l0x040c
Yahoo! Toolbar-->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE

======Hosts File======

127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com

======Security center information======

AV: Norton Internet Security (disabled) (outdated)
FW: Norton Internet Security (disabled)
AS: Spybot - Search and Destroy (outdated)
AS: Lavasoft Ad-Watch Live!
AS: Windows Defender (outdated)
AS: Norton Internet Security (disabled) (outdated)

======System event log======

Computer Name: PC-de-Guillaume
Event Code: 36
Message: Le service de temps n'a pas été synchronisé avec l'heure du système pendant 86400 secondes, car aucun des fournisseurs de service de temps n'a fourni de marque horaire utilisable. Le service de temps ne mettra pas à jour l'heure du système local avant de pouvoir effectuer une synchronisation avec une source de temps. Si l'heure du système local est configurée de manière à agir en tant que serveur de temps pour les clients, il arrêtera de publier des informations en tant que source de temps aux clients. Le service de temps continuera d'essayer et de synchroniser l'heure avec ses sources de temps. Vérifiez la présence d'autres événements W32time dans le journal des événements du système  pour plus de détails. Exécutez « w32tm /resync » pour forcer une synchronisation d'heure instantanée.
Record Number: 170725
Source Name: Microsoft-Windows-Time-Service
Time Written: 20090530155604.000000-000
Event Type: Avertissement
User: 

Computer Name: PC-de-Guillaume
Event Code: 4001
Message: Le Service d’autoconfiguration WLAN s’est arrêté correctement.

Record Number: 170742
Source Name: Microsoft-Windows-WLAN-AutoConfig
Time Written: 20090530160101.716200-000
Event Type: Avertissement
User: AUTORITE NT\SYSTEM

Computer Name: PC-de-Guillaume
Event Code: 15016
Message: Impossible d’initialiser le package de sécurité Kerberos pour l’authentification côté serveur. Le champ de données contient le numéro de l’erreur.
Record Number: 170756
Source Name: Microsoft-Windows-HttpEvent
Time Written: 20090530160229.465403-000
Event Type: Erreur
User: 

Computer Name: PC-de-Guillaume
Event Code: 7026
Message: Le pilote de démarrage système ou d'amorçage suivant n'a pas pu se charger : 
PxHelp20
Record Number: 170847
Source Name: Service Control Manager
Time Written: 20090530160257.000000-000
Event Type: Erreur
User: 

Computer Name: PC-de-Guillaume
Event Code: 7022
Message: Le service Windows Update est en attente de démarrage.
Record Number: 170876
Source Name: Service Control Manager
Time Written: 20090530160944.000000-000
Event Type: Erreur
User: 

=====Application event log=====

Computer Name: PC-de-Guillaume
Event Code: 1000
Message: Application défaillante ssvagent.exe, version 6.0.130.3, horodatage 0x49b4f3b6, module défaillant msvcrt.dll!strcat_s, version 6.0.6001.18000, horodatage 0x4791a7a6, code d’exception 0xc0000139, décalage d’erreur 0x00009cac, ID du processus 0x13d0, heure de début de l’application 0x01c9e071f6a090b0.
Record Number: 63594
Source Name: Application Error
Time Written: 20090529152734.000000-000
Event Type: Erreur
User: 

Computer Name: PC-de-Guillaume
Event Code: 1530
Message: Windows a détecté que votre fichier de Registre est toujours utilisé par d'autres applications ou services. Le fichier va être déchargé. Les applications ou services qui ont accès à votre Registre risquent de ne pas fonctionner correctement après cela. 

 DÉTAIL - 
 14 user registry handles leaked from \Registry\User\S-1-5-21-3943368547-3807070264-3836599413-1000:
Process 728 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3943368547-3807070264-3836599413-1000
Process 728 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3943368547-3807070264-3836599413-1000
Process 728 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3943368547-3807070264-3836599413-1000
Process 1072 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3943368547-3807070264-3836599413-1000
Process 728 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3943368547-3807070264-3836599413-1000\Software\Microsoft\SystemCertificates\Root
Process 728 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3943368547-3807070264-3836599413-1000\Software\Policies\Microsoft\SystemCertificates
Process 728 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3943368547-3807070264-3836599413-1000\Software\Policies\Microsoft\SystemCertificates
Process 728 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3943368547-3807070264-3836599413-1000\Software\Policies\Microsoft\SystemCertificat

plopus · Answer

bon combofix n'as pas eu l'effet desiré

reposte un nouveau RSIT juste le LOG.TXT

plopus · Answer

peut tu faire un scan COMPLET avec superantispyware supprime tout ce qu'il trouve et poste le rapport

http://www.infos-du-net.com/telecharger/SUPERAntiSpyware,0301-7377.html

plopus · Answer

repasse un coup de CCleaner registre compris

puis redemarre ton PC, dit moi si tout va bien.

puis telecharge hijackthis sur ton bureau  https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/29061.html

lance le choisit do a scan and save the log et poste le rapport

plopus · Answer

relance hijackthis choisit do a scan only et coche les cases a gauche des lignes :

 O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime     
 O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"     
 O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe     
 O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"     
 O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe     
 O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} - http://activex.camfrogweb.com/     
 O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe     


puis clic sur fix checked


retourne sur 2 liens et met bien tous tes produits a jour en DESINSTALLANT les anciennes versions

par le biais de ce site internet il faut installer l'active X puis
clic start scan et le site montre d'une croix rouge les faille de
sécurité pour quelques produits important installé sur le PC comme
java, IE, windows, flashplayer, adobe...les + importantes
https://www.flexera.com/products/operations/software-vulnerability-management.html

-
Soit on peut aussi passer par un logiciel a installer qui scan le PC et
affiche TOUTES les mises a jour des logiciels et produits installé sur
le PC
https://filehippo.com/windows/tuning-utilities/


puis

    *  Télécharge Toolscleaner sur ton Bureau

 http://www.commentcamarche.net/telecharger/telechargement 34055291 toolscleaner

    * Double-clique sur ToolsCleaner2.exe et laisse le travailler
    * Clique sur Recherche et laisse le scan se terminer.
    * Clique sur Suppression pour finaliser.
    * Tu peux, si tu le souhaites, te servir des Options facultatives.
    * Clique sur Quitter, pour que le rapport puisse se créer.
    * Le rapport (TCleaner.txt) se trouve à la racine de votre disque dur (C:\)...colle le dans ta prochaine réponse


puis repasse un coup de CCleaner plusieurs fois jusqu' a trouver 0 erreurs.

ton rapport est propre, si tu n'as + de probleme met ton sujet en résolu

plopus · Answer

aVAST  tu devrais le remplacé par antivir

malwarebyte a garder et fait un scan par mois, garde spybot et desactive windows defender et tu peux garder aussi super antispyware fait des scan regulier, CCleaner utilise le chaque semaine

Guizo · Answer

Une derniere chose ou es-ce-qu'on coche résolu? Merci

plopus · Answer

tu es pas inscrit tu peux pas tan pis

fait encore sa va dans demarrer en bas dans la barre de recherche copie colle ceci

combofix /u et accepte ce qui suit cela desinstallera combofix et sa quarantaine

Aidez moi a enlevé mes virus et trojans svp

30 réponses

Votre réponse

Discussions similaires

Newsletters