Cheval de troie impossible a supprimer

Medmed -  
Bonjour,Bonjour, je ne sais pas si c'est le bon forum mais je n'ai rien trouver d'autre

Voila mon probleme :

J'ai un virus cheval de troie du nom de Generique.PUP et je ne sais pas comment le supprimer mon enti virus n'arrive pas a le supprimer et ce programme lance des petit cheval de troie que mon anti virus arrive a supprimer ou a mettre en quarantaines est ce qu'on peux m'aider a supprimer ce virus ? surtout que mon anti virus est payant et que si il expire trop tot je risque de foutre en l'air mon ordi avec ce satané virus :s merci d'avance pour vos reponse j'éspaire avoir était assez clair !

JE SUIS SOUS WINDOWS VISTA !
Configuration: Windows Vista
Safari 525.19

23 réponses

Résumé de la discussion

Le fil relate une infection par un cheval de Troie nommé Generique.PUP sur Windows Vista, dont l’antivirus ne parvient pas à supprimer durablement le malware et qui réactive des mini-chevaux de Troie. Le diagnostic repose sur un rapport HijackThis et une liste étendue d’entrées système, montrant des barres d’outil, des services et des tâches susceptibles d’alimenter l’infection. D’autres éléments visibles dans le fil indiquent des programmes potentiellement douteux ou inutiles, comme des barres d’outils, des utilitaires Acer et des applications provenant d’éditeurs divers. En cas de continuation, le fil met en évidence la nécessité de méthodes de nettoyage approfondies (désinfection hors ligne, désinstallation des éléments suspects) et la prudence vis-à-vis des licences antivirus expirantes.

Bobot (l’IA à votre service)
  1. Mehdi-k81
    Ta plein de bonne version d'essai
    Kaspersky
    Norton 2009
    Window live One care
    c'est gratuit ca tien pas longtemps mais essaye de les téléchargés et Fait une analyse complète
    Voila , jsui pas plus calé que sa ^^
    0
    1. thepunkk
      quel est ton antivirus, si c'est avast je peux peut-etre t'aider!
      0
      1. Medmed
        j'ai McAfee SecurityCenter et j'ai fait trois analyse complete :s en plus il est payant mon anti virus il doit etre performant normalement !
        0
        1. Utilisateur anonyme
          Bonsoir Medmed

          Télécharge Random's System Information Tool (RSIT) de random/random et enregistre l'exécutable sur ton Bureau.

          -> http://images.malwareremoval.com/random/RSIT.exe

          ! Déconnecte toi et ferme toutes tes applications en cours !

          Double-clique sur " RSIT.exe " pour le lancer .

          -> Une première fenêtre s'ouvre avec en titre : " Disclaimer of warranty " .

          * Devant l'option "List files/folders created ..." , tu choisis : 2 months

          * clique ensuite sur " Continue " pour lancer l'analyse ...

          -> laisse faire le scan et ne touche pas au PC ...

          Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront (probablement avec le bloc-note).

          Poste le contenu de " log.txt " (c'est celui qui apparait à l'écran), ainsi que de " info.txt " (que tu verras dans la barre des tâches), pour analyse et attends la suite ...

          Important : poste un rapport, puis l'autre dans la réponse suivante
          Si tu essaies de poster les deux en même temps, cela risque d'être trop long pour le forum

          ( Note : les rapports seront en outre sauvegardés dans ce dossier -> C:\rsit )

          Merci
          0
      2. Medmed
        oui ensuite ?
        0
        1. Utilisateur anonyme
          Re

          Fait ce qui t'est demandé au post 4;merci
          0
      4. Medmed
        Logfile of random's system information tool 1.06 (written by random/random)
        Run by Mehdi at 2009-06-05 23:32:34
        Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
        System drive C: has 43 GB (29%) free of 148 GB
        Total RAM: 3066 MB (29% free)

        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 23:32:45, on 05/06/2009
        Platform: Windows Vista SP1 (WinNT 6.00.1905)
        MSIE: Internet Explorer v7.00 (7.00.6001.18226)
        Boot mode: Normal

        Running processes:
        C:\Windows\system32\Dwm.exe
        C:\Windows\Explorer.EXE
        C:\Windows\system32\taskeng.exe
        C:\Program Files\Windows Defender\MSASCui.exe
        C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
        C:\Windows\RtHDVCpl.exe
        C:\Program Files\McAfee.com\Agent\mcagent.exe
        C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
        C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
        C:\Program Files\Launch Manager\QtZgAcer.EXE
        C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
        C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
        C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
        C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
        C:\Program Files\Windows Media Player\wmpnscfg.exe
        C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
        C:\Program Files\On Demand Distribution\OD2 Music Manager\OD2MediaBar_VistaFileManager.exe
        C:\Program Files\Kiwee Toolbar\2.8.167\kwtbaim.exe
        C:\Program Files\Java\jre6\bin\jusched.exe
        C:\Windows\WindowsMobile\wmdcBase.exe
        C:\Program Files\iTunes\iTunesHelper.exe
        C:\Windows\System32\regsvr32.exe
        C:\Program Files\Crack Installer\groupmanager.exe
        C:\Program Files\Windows Live\Messenger\msnmsgr.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\Windows\ehome\ehtray.exe
        C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
        C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
        C:\Program Files\Internet Explorer\IEUser.exe
        C:\Windows\ehome\ehmsas.exe
        C:\Program Files\Acer\Acer VCM\AcerVCM.exe
        C:\Program Files\Hercules\WiFi Station pour Livebox\WiFiLB.exe
        C:\Users\Mehdi\AppData\Local\Temp\RtkBtMnt.exe
        C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe
        C:\Windows\system32\wbem\unsecapp.exe
        C:\Program Files\Windows Live\Toolbar\wltuser.exe
        C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
        C:\Program Files\Acer\Acer VCM\acp2HID.exe
        C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
        C:\Program Files\Windows Live\Contacts\wlcomm.exe
        C:\Program Files\Acer\Empowering Technology\NotificationCenter\Framework.NotificationCenter.exe
        C:\Windows\system32\taskeng.exe
        C:\PROGRA~1\Acer\ACERBI~1\PdtWzd.exe
        C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe
        c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe
        C:\Program Files\Google\Chrome\Application\chrome.exe
        C:\Program Files\Google\Chrome\Application\chrome.exe
        C:\Program Files\Google\Chrome\Application\chrome.exe
        C:\Program Files\Google\Chrome\Application\chrome.exe
        C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe
        c:\PROGRA~1\java\jre6\bin\jp2launcher.exe
        C:\Program Files\Java\jre6\bin\java.exe
        C:\Program Files\LimeWire\LimeWire.exe
        C:\Program Files\Google\Chrome\Application\chrome.exe
        C:\Program Files\Google\Chrome\Application\chrome.exe
        C:\Windows\system32\SearchFilterHost.exe
        C:\Users\Mehdi\Documents\Downloads\RSIT.exe
        C:\Users\Mehdi\Documents\Downloads\RSIT.exe
        C:\Program Files\trend micro\Mehdi.exe

        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=040c&s=2&o=vp32&d=0908&m=aspire_6930g
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://coramail.net/r5.php
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
        R3 - URLSearchHook: AGSearchHook Class - {0BC6E3FA-78EF-4886-842C-5A1258C4455A} - C:\Program Files\AGI\common\agcutils.dll
        O1 - Hosts: ::1 localhost
        O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
        O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
        O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dll
        O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
        O2 - BHO: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar\2.8.167\KiweeIEToolbar.dll
        O2 - BHO: TBSB05288 - {6714ADBD-C6C1-42A8-BD84-9C9339059421} - C:\Program Files\IEToolbar\ECO Bar\ecobar.dll
        O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
        O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
        O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll
        O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
        O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
        O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
        O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
        O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
        O2 - BHO: blueskyadagency browser enhancer - {D14D50D3-D990-C5DF-ED9A-AD1F344F60E4} - C:\Windows\system32\vtbgnivpqzwfpuw.dll
        O2 - BHO: TBSB09835 - {D97FC677-694D-4A75-AC89-A5B85C2BCFED} - (no file)
        O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
        O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
        O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
        O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
        O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
        O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll
        O3 - Toolbar: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar\2.8.167\KiweeIEToolbar.dll
        O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
        O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
        O3 - Toolbar: ECO Bar - {10000000-1000-1000-1000-100000000000} - C:\Program Files\IEToolbar\ECO Bar\ecobar.dll
        O3 - Toolbar: Bullseye Tool Bar - {6226BA26-C017-4007-928C-DE9715C6FA67} - C:\Program Files\IEToolbar\Bullseye Tool Bar\lw.dll
        O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
        O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
        O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
        O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
        O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
        O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
        O4 - HKLM\..\Run: [eAudio] "C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe"
        O4 - HKLM\..\Run: [BkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"
        O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
        O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
        O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
        O4 - HKLM\..\Run: [ZPdtWzdVitaKey MC3000] "C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe" show
        O4 - HKLM\..\Run: [ArcadeDeluxeAgent] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe"
        O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe"
        O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe"
        O4 - HKLM\..\Run: [WarReg_PopUp] C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe
        O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
        O4 - HKLM\..\Run: [MediaBarFileManager] C:\Program Files\On Demand Distribution\OD2 Music Manager\OD2MediaBar_VistaFileManager.exe
        O4 - HKLM\..\Run: [KiweeHook] "C:\Program Files\Kiwee Toolbar\2.8.167\kwtbaim.exe"
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
        O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdcBase.exe
        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
        O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
        O4 - HKLM\..\Run: [kggeczqlqm] C:\Windows\System32\regsvr32.exe /s "C:\Windows\system32\vtbgnivpqzwfpuw.dll"
        O4 - HKLM\..\Run: [GroupManager] C:\Program Files\Crack Installer\groupmanager.exe
        O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
        O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
        O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
        O4 - HKCU\..\Run: [CurseClient] C:\Program Files\Curse\CurseClient.exe -silent
        O4 - HKCU\..\Run: [VeohPlugin] "C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe"
        O4 - HKCU\..\Run: [Speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
        O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
        O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
        O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
        O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
        O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
        O4 - Startup: runit_32.lnk = C:\Program Files\runit\runit_32.exe
        O4 - Global Startup: Acer VCM.lnk = ?
        O4 - Global Startup: WiFi Station pour Livebox.lnk = C:\Program Files\Hercules\WiFi Station pour Livebox\WiFiLB.exe
        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
        O9 - Extra button: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
        O9 - Extra 'Tools' menuitem: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
        O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
        O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
        O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
        O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
        O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
        O13 - Gopher Prefix:
        O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
        O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
        O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
        O20 - Winlogon Notify: AWinNotifyVitaKey MC3000 - C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll
        O20 - Winlogon Notify: spba - C:\Program Files\Common Files\SPBA\homefus2.dll
        O23 - Service: AG Windows Service (AGWinService) - Unknown owner - C:\Program Files\AGI\common\win32\PythonService.exe
        O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
        O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
        O23 - Service: CLHNService - Unknown owner - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
        O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
        O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
        O23 - Service: Google Desktop Manager 5.7.808.7150 (GoogleDesktopManager-080708-050100) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
        O23 - Service: Service Google Update (gupdate1c9c66f42f6f480) (gupdate1c9c66f42f6f480) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
        O23 - Service: iGroupTec Service (IGBASVC) - Unknown owner - C:\Program Files\Acer\Acer Bio Protection\BASVC.exe
        O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
        O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
        O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
        O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
        O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
        O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
        O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
        O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
        O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
        O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
        O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
        O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
        O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
        O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
        O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
        O23 - Service: Loki Drivers Auto Removal (pr2agqwc) (pr2agqwc) - Cyanide - C:\Windows\system32\pr2agqwc.exe
        O23 - Service: Raw Socket Service (RS_Service) - Acer Incorporated - C:\Program Files\Acer\Acer VCM\RS_Service.exe
        O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
        0
        1. Utilisateur anonyme
          Re

          => Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection):
          http://www.commentcamarche.net/faq/sujet 8343 vista desactiver l uac
          * Va dans démarrer puis panneau de configuration
          * Double Clique sur l'icône "Comptes d'utilisateurs"
          * Clique ensuite sur désactiver et valide.

          Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.
          https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

          Lors du scan coupe ta connection internet.

          * Lance l'installation du programme en exécutant le fichier téléchargé.
          * Double-clique maintenant sur le raccourci de Toolbar-S&D.
          * Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
          * Choisis maintenant l'option 1. Patiente jusqu'à la fin de la recherche.
          * Poste le rapport généré. (C:\TB.txt)
          0
      6. Medmed
        voila mais il y a que le fichier log qui est afficher en bloc not il n'y a pas de info.txt :s
        0
        1. Medmed
          -----------\\ ToolBar S&D 1.2.8 XP/Vista

          Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
          X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU T5800 @ 2.00GHz )
          BIOS : ZK2 v0.3120 3A20
          USER : Mehdi ( Administrator )
          BOOT : Normal boot
          C:\ (Local Disk) - NTFS - Total:144 Go (Free:41 Go)
          D:\ (Local Disk) - NTFS - Total:140 Go (Free:22 Go)
          F:\ (CD or DVD)

          "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
          Option : [1] ( 05/06/2009|23:50 )

          [ UAC => 1 ]

          -----------\\ Recherche de Fichiers / Dossiers ...

          C:\ProgramData\Kiwee Toolbar
          C:\ProgramData\Kiwee Toolbar\config
          C:\ProgramData\Kiwee Toolbar\images
          C:\ProgramData\Kiwee Toolbar\config\content_a.xml
          C:\ProgramData\Kiwee Toolbar\config\content_ie.xml
          C:\ProgramData\Kiwee Toolbar\config\content_m.xml
          C:\ProgramData\Kiwee Toolbar\config\content_y.xml
          C:\ProgramData\Kiwee Toolbar\config\logger.xml
          C:\ProgramData\Kiwee Toolbar\config\toolbarIE.xml
          C:\ProgramData\Kiwee Toolbar\config\toolbarIM_a.xml
          C:\ProgramData\Kiwee Toolbar\config\toolbarIM_m.xml
          C:\ProgramData\Kiwee Toolbar\config\toolbarIM_y.xml
          C:\ProgramData\Kiwee Toolbar\images\allow.bmp
          C:\ProgramData\Kiwee Toolbar\images\block.bmp
          C:\ProgramData\Kiwee Toolbar\images\dontsend.bmp
          C:\ProgramData\Kiwee Toolbar\images\im_toolbardropdownmenu.bmp
          C:\ProgramData\Kiwee Toolbar\images\im_toolbarsHelprolloverbase.bmp
          C:\ProgramData\Kiwee Toolbar\images\im_toolbarsm1rolloverbase.bmp
          C:\ProgramData\Kiwee Toolbar\images\im_toolbarsm1rolloverbase_bg.bmp
          C:\ProgramData\Kiwee Toolbar\images\im_toolbarsm1rolloverbase_dp.bmp
          C:\ProgramData\Kiwee Toolbar\images\im_toolbarsm2rolloverbase.bmp
          C:\ProgramData\Kiwee Toolbar\images\im_toolbarstextrollover.bmp
          C:\ProgramData\Kiwee Toolbar\images\kiwee_iconX16.ico
          C:\ProgramData\Kiwee Toolbar\images\kiwee_iconX48.ico
          C:\ProgramData\Kiwee Toolbar\images\send.bmp
          C:\ProgramData\Kiwee Toolbar\images\toolbar_eg.bmp
          C:\ProgramData\Kiwee Toolbar\images\toolbar_emoticons.bmp
          C:\ProgramData\Kiwee Toolbar\images\toolbar_eyeglass.bmp
          C:\ProgramData\Kiwee Toolbar\images\toolbar_gear.bmp
          C:\ProgramData\Kiwee Toolbar\images\toolbar_images.bmp
          C:\ProgramData\Kiwee Toolbar\images\toolbar_kiwee.bmp
          C:\ProgramData\Kiwee Toolbar\images\toolbar_msnlogo.bmp
          C:\ProgramData\Kiwee Toolbar\images\toolbar_news.bmp
          C:\ProgramData\Kiwee Toolbar\images\toolbar_text.bmp
          C:\ProgramData\Kiwee Toolbar\images\toolbar_videos.bmp
          C:\ProgramData\Kiwee Toolbar\images\toolbar_webshots.bmp
          C:\ProgramData\Kiwee Toolbar\images\toolbar_winks.bmp
          C:\ProgramData\Kiwee Toolbar\images\X.bmp
          C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Kiwee Toolbar
          C:\Program Files\Kiwee Toolbar
          C:\Program Files\Kiwee Toolbar\2.8.167
          C:\Program Files\Kiwee Toolbar\2.8.167\AGTBCore.dll
          C:\Program Files\Kiwee Toolbar\2.8.167\AolIMToolbar.dll
          C:\Program Files\Kiwee Toolbar\2.8.167\firefox
          C:\Program Files\Kiwee Toolbar\2.8.167\FlashCOM.dll
          C:\Program Files\Kiwee Toolbar\2.8.167\KiweeCommonCtrls.dll
          C:\Program Files\Kiwee Toolbar\2.8.167\KiweeContentHost.dll
          C:\Program Files\Kiwee Toolbar\2.8.167\KiweeIEToolbar.dll
          C:\Program Files\Kiwee Toolbar\2.8.167\KiweeIMToolbar.dll
          C:\Program Files\Kiwee Toolbar\2.8.167\KiweeTBCore.dll
          C:\Program Files\Kiwee Toolbar\2.8.167\KiweeTBCore.tlb
          C:\Program Files\Kiwee Toolbar\2.8.167\kiweetoolbar.zip
          C:\Program Files\Kiwee Toolbar\2.8.167\kwtbaim.exe
          C:\Program Files\Kiwee Toolbar\2.8.167\mfc80u.dll
          C:\Program Files\Kiwee Toolbar\2.8.167\Microsoft.VC80.CRT.manifest
          C:\Program Files\Kiwee Toolbar\2.8.167\Microsoft.VC80.MFC.manifest
          C:\Program Files\Kiwee Toolbar\2.8.167\msimg32.dll
          C:\Program Files\Kiwee Toolbar\2.8.167\MsnIMToolbar.dll
          C:\Program Files\Kiwee Toolbar\2.8.167\msvcp80.dll
          C:\Program Files\Kiwee Toolbar\2.8.167\msvcr80.dll
          C:\Program Files\Kiwee Toolbar\2.8.167\RemoteLib.dll
          C:\Program Files\Kiwee Toolbar\2.8.167\Riched20.dll
          C:\Program Files\Kiwee Toolbar\2.8.167\firefox\chrome
          C:\Program Files\Kiwee Toolbar\2.8.167\firefox\chrome.manifest
          C:\Program Files\Kiwee Toolbar\2.8.167\firefox\components
          C:\Program Files\Kiwee Toolbar\2.8.167\firefox\defaults
          C:\Program Files\Kiwee Toolbar\2.8.167\firefox\firefox.xpi
          C:\Program Files\Kiwee Toolbar\2.8.167\firefox\install.rdf
          C:\Program Files\Kiwee Toolbar\2.8.167\firefox\META-INF
          C:\Program Files\Kiwee Toolbar\2.8.167\firefox\chrome\kiweetoolbar.jar
          C:\Program Files\Kiwee Toolbar\2.8.167\firefox\components\AGCore.js
          C:\Program Files\Kiwee Toolbar\2.8.167\firefox\components\AGCore.xpt
          C:\Program Files\Kiwee Toolbar\2.8.167\firefox\components\KiweeSearchHistory.js
          C:\Program Files\Kiwee Toolbar\2.8.167\firefox\components\SearchProtection.js
          C:\Program Files\Kiwee Toolbar\2.8.167\firefox\components\SearchProtection.xpt
          C:\Program Files\Kiwee Toolbar\2.8.167\firefox\defaults\preferences
          C:\Program Files\Kiwee Toolbar\2.8.167\firefox\defaults\preferences\defaults.js
          C:\Program Files\Kiwee Toolbar\2.8.167\firefox\META-INF\manifest.mf
          C:\Program Files\Kiwee Toolbar\2.8.167\firefox\META-INF\zigbert.rsa
          C:\Program Files\Kiwee Toolbar\2.8.167\firefox\META-INF\zigbert.sf

          -----------\\ [..\Internet Explorer\Main]

          [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
          "Start Page"="http://coramail.net/r5.php"
          "Local Page"="C:\\Windows\\system32\\blank.htm"
          "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
          "Default_Page_URL"="http://homepage.acer.com/rdr.aspx?b=ACAW&l=040c&s=2&o=vp32&d=0908&m=aspire_6930g"
          "Url"="https://www.msn.com/fr-fr/actualite/"

          [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
          "Start Page"="https://fr.yahoo.com/"
          "Default_Page_URL"="https://fr.yahoo.com/"
          "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
          "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"

          --------------------\\ Recherche d'autres infections

          --------------------\\ Cracks & Keygens ..

          C:\Users\Mehdi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Crack Installer
          C:\Users\Mehdi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Crack Installer\ .lnk
          C:\Users\Mehdi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Crack Installer\Uninstall Crack Installer.lnk
          C:\Users\Mehdi\Incomplete\EZIH7CDIJ25N7KEZRJZVQ3H7Y7GQ76OO\The Sims 2 Complete Collection (.iso)\Crack & Patches.zip

          [ UAC => 1 ]

          1 - "C:\ToolBar SD\TB_1.txt" - 05/06/2009|23:51 - Option : [1]

          -----------\\ Fin du rapport a 23:51:45,95
          0
          1. Utilisateur anonyme
            Re

            Relance ToolBar SD et passe à l'option 2
            Poste moi le rapport stp merci.

            Ensuite repostes un RSIT
            Merci
            0
        2. Medmed
          -----------\\ ToolBar S&D 1.2.8 XP/Vista

          Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
          X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU T5800 @ 2.00GHz )
          BIOS : ZK2 v0.3120 3A20
          USER : Mehdi ( Administrator )
          BOOT : Normal boot
          C:\ (Local Disk) - NTFS - Total:144 Go (Free:41 Go)
          D:\ (Local Disk) - NTFS - Total:140 Go (Free:22 Go)
          F:\ (CD or DVD)

          "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
          Option : [2] ( 05/06/2009|23:59 )

          [ UAC => 1 ]

          -----------\\ SUPPRESSION

          Supprime! - C:\ProgramData\Kiwee Toolbar\config
          Supprime! - C:\ProgramData\Kiwee Toolbar\images
          Supprime! - C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Kiwee Toolbar
          Echec ! - C:\Program Files\Kiwee Toolbar\2.8.167
          Echec ! - C:\Program Files\Kiwee Toolbar\2.8.167\AGTBCore.dll
          Echec ! - C:\Program Files\Kiwee Toolbar\2.8.167\KiweeCommonCtrls.dll
          Echec ! - C:\Program Files\Kiwee Toolbar\2.8.167\KiweeContentHost.dll
          Echec ! - C:\Program Files\Kiwee Toolbar\2.8.167\KiweeTBCore.dll
          Echec ! - C:\Program Files\Kiwee Toolbar\2.8.167\MsnIMToolbar.dll
          Supprime! - C:\ProgramData\Kiwee Toolbar
          Echec ! - C:\Program Files\Kiwee Toolbar

          -----------\\ DEUXIEME PASSAGE

          Echec ! - C:\Program Files\Kiwee Toolbar\2.8.167
          Echec ! - C:\Program Files\Kiwee Toolbar\2.8.167\AGTBCore.dll
          Echec ! - C:\Program Files\Kiwee Toolbar\2.8.167\KiweeCommonCtrls.dll
          Echec ! - C:\Program Files\Kiwee Toolbar\2.8.167\KiweeContentHost.dll
          Echec ! - C:\Program Files\Kiwee Toolbar\2.8.167\KiweeTBCore.dll
          Echec ! - C:\Program Files\Kiwee Toolbar\2.8.167\MsnIMToolbar.dll
          Echec ! - C:\Program Files\Kiwee Toolbar

          -----------\\ Recherche de Fichiers / Dossiers ...

          C:\Program Files\Kiwee Toolbar
          C:\Program Files\Kiwee Toolbar\2.8.167
          C:\Program Files\Kiwee Toolbar\2.8.167\AGTBCore.dll
          C:\Program Files\Kiwee Toolbar\2.8.167\KiweeCommonCtrls.dll
          C:\Program Files\Kiwee Toolbar\2.8.167\KiweeContentHost.dll
          C:\Program Files\Kiwee Toolbar\2.8.167\KiweeTBCore.dll
          C:\Program Files\Kiwee Toolbar\2.8.167\MsnIMToolbar.dll

          -----------\\ [..\Internet Explorer\Main]

          [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
          "Start Page"="http://coramail.net/r5.php"
          "Local Page"="C:\\Windows\\system32\\blank.htm"
          "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
          "Default_Page_URL"="http://homepage.acer.com/rdr.aspx?b=ACAW&l=040c&s=2&o=vp32&d=0908&m=aspire_6930g"
          "Url"="https://www.msn.com/fr-fr/actualite/"

          [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
          "Start Page"="https://www.msn.com/fr-fr/"
          "Default_Page_URL"="https://fr.yahoo.com/"
          "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
          "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"

          --------------------\\ Recherche d'autres infections

          --------------------\\ Cracks & Keygens ..

          C:\Users\Mehdi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Crack Installer
          C:\Users\Mehdi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Crack Installer\ .lnk
          C:\Users\Mehdi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Crack Installer\Uninstall Crack Installer.lnk
          C:\Users\Mehdi\Incomplete\EZIH7CDIJ25N7KEZRJZVQ3H7Y7GQ76OO\The Sims 2 Complete Collection (.iso)\Crack & Patches.zip

          [ UAC => 1 ]

          1 - "C:\ToolBar SD\TB_1.txt" - 05/06/2009|23:51 - Option : [1]
          2 - "C:\ToolBar SD\TB_2.txt" - 06/06/2009| 0:01 - Option : [2]

          -----------\\ Fin du rapport a 0:01:46,33
          0
          1. Utilisateur anonyme
            Re

            Ferme ta connexion à internet(ton navigateur IE ou Firefox) et relance ToolbarSD option 2
            et poste moi le rapport merci

            0
        3. Medmed
          Logfile of random's system information tool 1.06 (written by random/random)
          Run by Mehdi at 2009-06-06 00:05:05
          Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
          System drive C: has 43 GB (29%) free of 148 GB
          Total RAM: 3066 MB (33% free)

          Logfile of Trend Micro HijackThis v2.0.2
          Scan saved at 00:05:08, on 06/06/2009
          Platform: Windows Vista SP1 (WinNT 6.00.1905)
          MSIE: Internet Explorer v7.00 (7.00.6001.18226)
          Boot mode: Normal

          Running processes:
          C:\Windows\system32\Dwm.exe
          C:\Windows\Explorer.EXE
          C:\Windows\system32\taskeng.exe
          C:\Program Files\Windows Defender\MSASCui.exe
          C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
          C:\Windows\RtHDVCpl.exe
          C:\Program Files\McAfee.com\Agent\mcagent.exe
          C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
          C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
          C:\Program Files\Launch Manager\QtZgAcer.EXE
          C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
          C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
          C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
          C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
          C:\Program Files\Windows Media Player\wmpnscfg.exe
          C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
          C:\Program Files\On Demand Distribution\OD2 Music Manager\OD2MediaBar_VistaFileManager.exe
          C:\Program Files\Java\jre6\bin\jusched.exe
          C:\Windows\WindowsMobile\wmdcBase.exe
          C:\Program Files\iTunes\iTunesHelper.exe
          C:\Program Files\Crack Installer\groupmanager.exe
          C:\Program Files\Windows Live\Messenger\msnmsgr.exe
          C:\Windows\ehome\ehtray.exe
          C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
          C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
          C:\Program Files\Internet Explorer\IEUser.exe
          C:\Windows\ehome\ehmsas.exe
          C:\Program Files\Acer\Acer VCM\AcerVCM.exe
          C:\Program Files\Hercules\WiFi Station pour Livebox\WiFiLB.exe
          C:\Users\Mehdi\AppData\Local\Temp\RtkBtMnt.exe
          C:\Windows\system32\wbem\unsecapp.exe
          C:\Program Files\Windows Live\Toolbar\wltuser.exe
          C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
          C:\Program Files\Acer\Acer VCM\acp2HID.exe
          C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
          C:\Program Files\Windows Live\Contacts\wlcomm.exe
          C:\Program Files\Acer\Empowering Technology\NotificationCenter\Framework.NotificationCenter.exe
          C:\Windows\system32\taskeng.exe
          C:\PROGRA~1\Acer\ACERBI~1\PdtWzd.exe
          C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe
          c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe
          C:\Program Files\Google\Chrome\Application\chrome.exe
          C:\Program Files\Google\Chrome\Application\chrome.exe
          C:\Program Files\Google\Chrome\Application\chrome.exe
          C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe
          c:\PROGRA~1\java\jre6\bin\jp2launcher.exe
          C:\Program Files\Java\jre6\bin\java.exe
          C:\Program Files\LimeWire\LimeWire.exe
          C:\Program Files\Google\Chrome\Application\chrome.exe
          C:\Program Files\Google\Chrome\Application\chrome.exe
          C:\Program Files\Google\Chrome\Application\chrome.exe
          C:\Program Files\Google\Chrome\Application\chrome.exe
          C:\Windows\system32\conime.exe
          C:\Windows\system32\NOTEPAD.EXE
          C:\Windows\system32\SearchFilterHost.exe
          C:\Users\Mehdi\Documents\Downloads\RSIT (1).exe
          C:\Program Files\trend micro\Mehdi.exe

          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=040c&s=2&o=vp32&d=0908&m=aspire_6930g
          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://coramail.net/r5.php
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
          R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
          R3 - URLSearchHook: AGSearchHook Class - {0BC6E3FA-78EF-4886-842C-5A1258C4455A} - C:\Program Files\AGI\common\agcutils.dll
          O1 - Hosts: ::1 localhost
          O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
          O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
          O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dll
          O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
          O2 - BHO: TBSB05288 - {6714ADBD-C6C1-42A8-BD84-9C9339059421} - C:\Program Files\IEToolbar\ECO Bar\ecobar.dll
          O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
          O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
          O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll
          O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
          O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
          O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
          O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
          O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
          O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
          O2 - BHO: blueskyadagency browser enhancer - {D14D50D3-D990-C5DF-ED9A-AD1F344F60E4} - C:\Windows\system32\vtbgnivpqzwfpuw.dll
          O2 - BHO: TBSB09835 - {D97FC677-694D-4A75-AC89-A5B85C2BCFED} - (no file)
          O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
          O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
          O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
          O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
          O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
          O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll
          O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
          O3 - Toolbar: ECO Bar - {10000000-1000-1000-1000-100000000000} - C:\Program Files\IEToolbar\ECO Bar\ecobar.dll
          O3 - Toolbar: Bullseye Tool Bar - {6226BA26-C017-4007-928C-DE9715C6FA67} - C:\Program Files\IEToolbar\Bullseye Tool Bar\lw.dll
          O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
          O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
          O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
          O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
          O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
          O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
          O4 - HKLM\..\Run: [eAudio] "C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe"
          O4 - HKLM\..\Run: [BkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"
          O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
          O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
          O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
          O4 - HKLM\..\Run: [ZPdtWzdVitaKey MC3000] "C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe" show
          O4 - HKLM\..\Run: [ArcadeDeluxeAgent] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe"
          O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe"
          O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe"
          O4 - HKLM\..\Run: [WarReg_PopUp] C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe
          O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
          O4 - HKLM\..\Run: [MediaBarFileManager] C:\Program Files\On Demand Distribution\OD2 Music Manager\OD2MediaBar_VistaFileManager.exe
          O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
          O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdcBase.exe
          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
          O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
          O4 - HKLM\..\Run: [kggeczqlqm] C:\Windows\System32\regsvr32.exe /s "C:\Windows\system32\vtbgnivpqzwfpuw.dll"
          O4 - HKLM\..\Run: [GroupManager] C:\Program Files\Crack Installer\groupmanager.exe
          O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
          O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
          O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
          O4 - HKCU\..\Run: [CurseClient] C:\Program Files\Curse\CurseClient.exe -silent
          O4 - HKCU\..\Run: [VeohPlugin] "C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe"
          O4 - HKCU\..\Run: [Speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
          O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
          O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
          O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
          O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
          O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
          O4 - Startup: runit_32.lnk = C:\Program Files\runit\runit_32.exe
          O4 - Global Startup: Acer VCM.lnk = ?
          O4 - Global Startup: WiFi Station pour Livebox.lnk = C:\Program Files\Hercules\WiFi Station pour Livebox\WiFiLB.exe
          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
          O9 - Extra button: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
          O9 - Extra 'Tools' menuitem: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
          O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
          O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
          O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
          O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
          O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
          O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
          O13 - Gopher Prefix:
          O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
          O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
          O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
          O20 - Winlogon Notify: AWinNotifyVitaKey MC3000 - C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll
          O20 - Winlogon Notify: spba - C:\Program Files\Common Files\SPBA\homefus2.dll
          O23 - Service: AG Windows Service (AGWinService) - Unknown owner - C:\Program Files\AGI\common\win32\PythonService.exe
          O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
          O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
          O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
          O23 - Service: CLHNService - Unknown owner - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
          O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
          O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
          O23 - Service: Google Desktop Manager 5.7.808.7150 (GoogleDesktopManager-080708-050100) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
          O23 - Service: Service Google Update (gupdate1c9c66f42f6f480) (gupdate1c9c66f42f6f480) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
          O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
          O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
          O23 - Service: iGroupTec Service (IGBASVC) - Unknown owner - C:\Program Files\Acer\Acer Bio Protection\BASVC.exe
          O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
          O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
          O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
          O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
          O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
          O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
          O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
          O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
          O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
          O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
          O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
          O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
          O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
          O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
          O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
          O23 - Service: Loki Drivers Auto Removal (pr2agqwc) (pr2agqwc) - Cyanide - C:\Windows\system32\pr2agqwc.exe
          O23 - Service: Raw Socket Service (RS_Service) - Acer Incorporated - C:\Program Files\Acer\Acer VCM\RS_Service.exe
          O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
          0
          1. Medmed
            voila SANS LA CONEXION INTERNET

            -----------\\ ToolBar S&D 1.2.8 XP/Vista

            -----------\\ [..\Internet Explorer\Main]

            [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
            "Start Page"="http://coramail.net/r5.php"
            "Local Page"="C:\\Windows\\system32\\blank.htm"
            "Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
            "Default_Page_URL"="http://homepage.acer.com/rdr.aspx?b=ACAW&l=040c&s=2&o=vp32&d=0908&m=aspire_6930g"
            "Url"="http://go.microsoft.com/fwlink/?LinkId=75720"

            [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
            "Start Page"="http://www.msn.com/"
            "Default_Page_URL"="http://fr.yahoo.com"
            "Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
            "Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"

            --------------------\\ Recherche d'autres infections

            Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
            X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU T5800 @ 2.00GHz )
            BIOS : ZK2 v0.3120 3A20
            USER : Mehdi ( Administrator )
            BOOT : Normal boot
            C:\ (Local Disk) - NTFS - Total:144 Go (Free:41 Go)
            D:\ (Local Disk) - NTFS - Total:140 Go (Free:22 Go)
            F:\ (CD or DVD)

            "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
            Option : [2] ( 06/06/2009| 0:10 )

            [ UAC => 1 ]
            --------------------\\ Cracks & Keygens ..

            C:\Users\Mehdi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Crack Installer
            C:\Users\Mehdi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Crack Installer\ .lnk
            C:\Users\Mehdi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Crack Installer\Uninstall Crack Installer.lnk
            C:\Users\Mehdi\Incomplete\EZIH7CDIJ25N7KEZRJZVQ3H7Y7GQ76OO\The Sims 2 Complete Collection (.iso)\Crack & Patches.zip

            [ UAC => 1 ]

            1 - "C:\ToolBar SD\TB_1.txt" - 05/06/2009|23:51 - Option : [1]
            2 - "C:\ToolBar SD\TB_2.txt" - 06/06/2009| 0:01 - Option : [2]
            3 - "C:\ToolBar SD\TB_3.txt" - 06/06/2009| 0:10 - Option : [2]

            -----------\\ Fin du rapport a 0:10:49,72

            -----------\\ SUPPRESSION

            Echec ! - C:\Program Files\Kiwee Toolbar\2.8.167
            Echec ! - C:\Program Files\Kiwee Toolbar\2.8.167\AGTBCore.dll
            Echec ! - C:\Program Files\Kiwee Toolbar\2.8.167\KiweeCommonCtrls.dll
            Echec ! - C:\Program Files\Kiwee Toolbar\2.8.167\KiweeContentHost.dll
            Echec ! - C:\Program Files\Kiwee Toolbar\2.8.167\KiweeTBCore.dll
            Echec ! - C:\Program Files\Kiwee Toolbar\2.8.167\MsnIMToolbar.dll
            Echec ! - C:\Program Files\Kiwee Toolbar

            -----------\\ DEUXIEME PASSAGE

            Echec ! - C:\Program Files\Kiwee Toolbar\2.8.167
            Echec ! - C:\Program Files\Kiwee Toolbar\2.8.167\AGTBCore.dll
            Echec ! - C:\Program Files\Kiwee Toolbar\2.8.167\KiweeCommonCtrls.dll
            Echec ! - C:\Program Files\Kiwee Toolbar\2.8.167\KiweeContentHost.dll
            Echec ! - C:\Program Files\Kiwee Toolbar\2.8.167\KiweeTBCore.dll
            Echec ! - C:\Program Files\Kiwee Toolbar\2.8.167\MsnIMToolbar.dll
            Echec ! - C:\Program Files\Kiwee Toolbar

            -----------\\ Recherche de Fichiers / Dossiers ...

            C:\Program Files\Kiwee Toolbar
            C:\Program Files\Kiwee Toolbar\2.8.167
            C:\Program Files\Kiwee Toolbar\2.8.167\AGTBCore.dll
            C:\Program Files\Kiwee Toolbar\2.8.167\KiweeCommonCtrls.dll
            C:\Program Files\Kiwee Toolbar\2.8.167\KiweeContentHost.dll
            C:\Program Files\Kiwee Toolbar\2.8.167\KiweeTBCore.dll
            C:\Program Files\Kiwee Toolbar\2.8.167\MsnIMToolbar.dll

            -----------\\ [..\Internet Explorer\Main]

            [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
            "Start Page"="http://coramail.net/r5.php"
            "Local Page"="C:\\Windows\\system32\\blank.htm"
            "Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
            "Default_Page_URL"="http://homepage.acer.com/rdr.aspx?b=ACAW&l=040c&s=2&o=vp32&d=0908&m=aspire_6930g"
            "Url"="http://go.microsoft.com/fwlink/?LinkId=75720"

            [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
            "Start Page"="http://www.msn.com/"
            "Default_Page_URL"="http://fr.yahoo.com"
            "Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
            "Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"

            --------------------\\ Recherche d'autres infections

            --------------------\\ Cracks & Keygens ..

            C:\Users\Mehdi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Crack Installer
            C:\Users\Mehdi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Crack Installer\ .lnk
            C:\Users\Mehdi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Crack Installer\Uninstall Crack Installer.lnk
            C:\Users\Mehdi\Incomplete\EZIH7CDIJ25N7KEZRJZVQ3H7Y7GQ76OO\The Sims 2 Complete Collection (.iso)\Crack & Patches.zip

            [ UAC => 1 ]

            1 - "C:\ToolBar SD\TB_1.txt" - 05/06/2009|23:51 - Option : [1]
            2 - "C:\ToolBar SD\TB_2.txt" - 06/06/2009| 0:01 - Option : [2]
            3 - "C:\ToolBar SD\TB_3.txt" - 06/06/2009| 0:10 - Option : [2]
            4 - "C:\ToolBar SD\TB_4.txt" - 06/06/2009| 0:11 - Option : [2]

            -----------\\ Fin du rapport a 0:11:26,58
            0
            1. Utilisateur anonyme
              Bonjour

              Télécharges OTMoveIt3 (de Old_Timer) sur ton Bureau.

              http://download.bleepingcomputer.com/oldtimer/OTMoveIt3.exe

              ! Déconnectes toi et fermes toute tes applications en cours !

              Double cliques sur "OTMoveIt3.exe" pour ouvrir le programme.
              Puis copies ce qui se trouve en gras ci-dessous:


              :Processes
              explorer.exe

              :Services

              :Reg
              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks]
              "{0BC6E3FA-78EF-4886-842C-5A1258C4455A}"=-
              [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6714ADBD-C6C1-42A8-BD84-9C9339059421}]
              [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6714ADBD-C6C1-42A8-BD84-9C9339059421}]
              [-HKEY_CLASSES_ROOT\CLSID\{10000000-1000-1000-1000-100000000000}]
              [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{10000000-1000-1000-1000-100000000000}]
              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
              "{10000000-1000-1000-1000-100000000000}"=-
              [-HKEY_CLASSES_ROOT\CLSID\{6226BA26-C017-4007-928C-DE9715C6FA67}]
              [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6226BA26-C017-4007-928C-DE9715C6FA67}]
              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
              "{6226BA26-C017-4007-928C-DE9715C6FA67}"=-

              :files
              c:\program files\agi
              c:\program files\ietoolbar
              c:\program files\runit\runit_32.exe

              :Commands
              [purity]
              [emptytemp]
              [start explorer]
              [Reboot]

              et colles le dans le cadre de gauche de OTMoveIt3 :
              Paste Instructions for Items to be Moved.
              (ne touche à rien d'autre !)

              -> cliques sur MoveIt! pour lancer la suppression.
              -> laisses travailler l'outil ...

              (Note : ton bureau va disparaître puis réapparaître, c'est normal.)

              -> Une fois finis, un petite fenêtre s'ouvre : cliques sur " Yes " .

              Ton PC va redémarrer de lui même ...

              -->Postes le contenu du rapport qui se trouve dans le dossier "C:\_OTMoveIt\MovedFiles"
              0
          2. Medmed
            ========== PROCESSES ==========
            Process explorer.exe killed successfully.
            ========== SERVICES/DRIVERS ==========
            ========== REGISTRY ==========
            Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{0BC6E3FA-78EF-4886-842C-5A1258C4455A} not found.
            Unable to delete registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0BC6E3FA-78EF-4886-842C-5A1258C4455A}\ .
            Unable to delete registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6714ADBD-C6C1-42A8-BD84-9C9339059421}\\ .
            Unable to delete registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6714ADBD-C6C1-42A8-BD84-9C9339059421}\\ .
            Unable to delete registry key HKEY_CLASSES_ROOT\CLSID\{10000000-1000-1000-1000-100000000000}\\ .
            Unable to delete registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{10000000-1000-1000-1000-100000000000}\\ .
            Unable to delete registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{10000000-1000-1000-1000-100000000000} .
            Unable to delete registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{10000000-1000-1000-1000-100000000000}\ .
            Unable to delete registry key HKEY_CLASSES_ROOT\CLSID\{6226BA26-C017-4007-928C-DE9715C6FA67}\\ .
            Unable to delete registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6226BA26-C017-4007-928C-DE9715C6FA67}\\ .
            Unable to delete registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{6226BA26-C017-4007-928C-DE9715C6FA67} .
            Unable to delete registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6226BA26-C017-4007-928C-DE9715C6FA67}\ .
            ========== FILES ==========
            Folder move failed. c:\program files\AGI\tmp scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\Python25\Lib\xml\sax scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\Python25\Lib\xml\parsers scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\Python25\Lib\xml\etree scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\Python25\Lib\xml\dom scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\Python25\Lib\xml scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\Python25\Lib\logging scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\Python25\Lib\hotshot scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\Python25\Lib\encodings scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\Python25\Lib\email\mime scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\Python25\Lib\email scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\Python25\Lib\ctypes scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\Python25\Lib\compiler scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\Python25\Lib scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\Python25\DLLs scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\Python25 scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common\win32comext\shell scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common\win32comext\axcontrol scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common\win32comext\authorization scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common\win32comext\adsi scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common\win32comext scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common\win32com\server scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common\win32com\client scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common\win32com scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common\win32\scripts scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common\win32\lib scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common\win32 scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common\pyagcore\search\provider scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common\pyagcore\search\algorithm scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common\pyagcore\search scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common\pyagcore\protection scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common\pyagcore\process scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common\pyagcore\lilw scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common\pyagcore\install\installers scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common\pyagcore\install\dependency scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common\pyagcore\install scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common\pyagcore\config scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common\pyagcore scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common\dateutil\zoneinfo scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common\dateutil scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common\comtypes\tools scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common\comtypes\server scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common\comtypes\gen scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common\comtypes\client scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common\comtypes scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI\common scheduled to be moved on reboot.
            Folder move failed. c:\program files\AGI scheduled to be moved on reboot.
            Folder move failed. c:\program files\IEToolbar\ECO Bar scheduled to be moved on reboot.
            Folder move failed. c:\program files\IEToolbar\Bullseye Tool Bar scheduled to be moved on reboot.
            Folder move failed. c:\program files\IEToolbar scheduled to be moved on reboot.
            File move failed. c:\program files\runit\runit_32.exe scheduled to be moved on reboot.
            ========== COMMANDS ==========
            File delete failed. C:\Users\Mehdi\AppData\Local\Temp\hsperfdata_Mehdi\4452 scheduled to be deleted on reboot.
            File delete failed. C:\Users\Mehdi\AppData\Local\Temp\RtkBtMnt.exe scheduled to be deleted on reboot.
            File delete failed. C:\Users\Mehdi\AppData\Local\Temp\~DFADB2.tmp scheduled to be deleted on reboot.
            File delete failed. C:\Users\Mehdi\AppData\Local\Temp\~DFDD95.tmp scheduled to be deleted on reboot.
            User's Temp folder emptied.
            User's Internet Explorer cache folder emptied.
            Windows Temp folder emptied.
            FireFox cache emptied.
            Temp folders emptied.
            Explorer started successfully

            OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 06062009_085844
            0
            1. Utilisateur anonyme
              Re

              Ton PC a t-il redémarré?
              Reposte un hijackthis stp merci
              0
          3. Medmed
            Oui mon pc a redemarrer que ce que un hijackthis ? tu veux que je recommence la manipulation ?
            0
            1. Utilisateur anonyme
              Re

              Non poste l'hijackthis merci
              0
          4. Medmed
            Mais qu'e ce que c'est ? hijackthis ? :s je peux pas te posterquelques choses que je connais pas :s désoler je suis pas super calé en informatique :(
            0
            1. Utilisateur anonyme
              Re

              Autant pour moi c'est un RSIT ;-)
              0
          5. Medmed
            Logfile of random's system information tool 1.06 (written by random/random)
            Run by Mehdi at 2009-06-06 09:41:17
            Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
            System drive C: has 44 GB (30%) free of 148 GB
            Total RAM: 3066 MB (51% free)

            Logfile of Trend Micro HijackThis v2.0.2
            Scan saved at 09:41:31, on 06/06/2009
            Platform: Windows Vista SP1 (WinNT 6.00.1905)
            MSIE: Internet Explorer v7.00 (7.00.6001.18226)
            Boot mode: Normal

            Running processes:
            c:\PROGRA~1\mcafee.com\agent\mcagent.exe
            C:\Windows\system32\Dwm.exe
            C:\Windows\Explorer.EXE
            C:\Windows\system32\taskeng.exe
            C:\Program Files\Windows Defender\MSASCui.exe
            C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
            C:\Windows\RtHDVCpl.exe
            C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
            C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
            C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
            C:\Program Files\Launch Manager\QtZgAcer.EXE
            C:\Users\Mehdi\AppData\Local\Temp\RtkBtMnt.exe
            C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
            C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe
            C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
            C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
            C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
            C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
            C:\Program Files\On Demand Distribution\OD2 Music Manager\OD2MediaBar_VistaFileManager.exe
            C:\Program Files\Java\jre6\bin\jusched.exe
            C:\Windows\WindowsMobile\wmdcBase.exe
            C:\Program Files\iTunes\iTunesHelper.exe
            C:\Windows\System32\regsvr32.exe
            C:\Program Files\Crack Installer\groupmanager.exe
            C:\Program Files\Windows Live\Messenger\msnmsgr.exe
            C:\Program Files\Windows Media Player\wmpnscfg.exe
            C:\Windows\ehome\ehtray.exe
            C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
            C:\Windows\system32\wbem\unsecapp.exe
            C:\Program Files\Internet Explorer\iexplore.exe
            C:\Program Files\Internet Explorer\IEUser.exe
            C:\Program Files\Acer\Acer VCM\AcerVCM.exe
            C:\Program Files\Hercules\WiFi Station pour Livebox\WiFiLB.exe
            C:\Program Files\Hamachi\hamachi.exe
            C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
            C:\Windows\ehome\ehmsas.exe
            C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe
            C:\Program Files\Windows Live\Toolbar\wltuser.exe
            C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
            C:\Program Files\Acer\Acer VCM\acp2HID.exe
            C:\Program Files\LimeWire\LimeWire.exe
            C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
            C:\Program Files\Google\Chrome\Application\chrome.exe
            C:\Program Files\Google\Chrome\Application\chrome.exe
            C:\Program Files\Google\Chrome\Application\chrome.exe
            C:\Program Files\Google\Chrome\Application\chrome.exe
            C:\Program Files\Google\Chrome\Application\chrome.exe
            C:\PROGRA~1\Java\jre6\bin\jp2launcher.exe
            C:\Program Files\Java\jre6\bin\java.exe
            C:\Windows\system32\SearchFilterHost.exe
            C:\Program Files\Google\Chrome\Application\chrome.exe
            C:\Users\Mehdi\Documents\Downloads\RSIT (2).exe
            C:\Program Files\trend micro\Mehdi.exe

            R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=040c&s=2&o=vp32&d=0908&m=aspire_6930g
            R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://coramail.net/r5.php
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
            R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
            R3 - URLSearchHook: AGSearchHook Class - {0BC6E3FA-78EF-4886-842C-5A1258C4455A} - C:\Program Files\AGI\common\agcutils.dll
            O1 - Hosts: ::1 localhost
            O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
            O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
            O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dll
            O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
            O2 - BHO: TBSB05288 - {6714ADBD-C6C1-42A8-BD84-9C9339059421} - C:\Program Files\IEToolbar\ECO Bar\ecobar.dll
            O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
            O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
            O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll
            O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
            O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
            O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
            O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
            O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
            O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
            O2 - BHO: blueskyadagency browser enhancer - {D14D50D3-D990-C5DF-ED9A-AD1F344F60E4} - C:\Windows\system32\vtbgnivpqzwfpuw.dll
            O2 - BHO: TBSB09835 - {D97FC677-694D-4A75-AC89-A5B85C2BCFED} - (no file)
            O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
            O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
            O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
            O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
            O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
            O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll
            O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
            O3 - Toolbar: ECO Bar - {10000000-1000-1000-1000-100000000000} - C:\Program Files\IEToolbar\ECO Bar\ecobar.dll
            O3 - Toolbar: Bullseye Tool Bar - {6226BA26-C017-4007-928C-DE9715C6FA67} - C:\Program Files\IEToolbar\Bullseye Tool Bar\lw.dll
            O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
            O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
            O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
            O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
            O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
            O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
            O4 - HKLM\..\Run: [eAudio] "C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe"
            O4 - HKLM\..\Run: [BkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"
            O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
            O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
            O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
            O4 - HKLM\..\Run: [ZPdtWzdVitaKey MC3000] "C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe" show
            O4 - HKLM\..\Run: [ArcadeDeluxeAgent] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe"
            O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe"
            O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe"
            O4 - HKLM\..\Run: [WarReg_PopUp] C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe
            O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
            O4 - HKLM\..\Run: [MediaBarFileManager] C:\Program Files\On Demand Distribution\OD2 Music Manager\OD2MediaBar_VistaFileManager.exe
            O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
            O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdcBase.exe
            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
            O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
            O4 - HKLM\..\Run: [kggeczqlqm] C:\Windows\System32\regsvr32.exe /s "C:\Windows\system32\vtbgnivpqzwfpuw.dll"
            O4 - HKLM\..\Run: [GroupManager] C:\Program Files\Crack Installer\groupmanager.exe
            O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
            O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
            O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
            O4 - HKCU\..\Run: [CurseClient] C:\Program Files\Curse\CurseClient.exe -silent
            O4 - HKCU\..\Run: [VeohPlugin] "C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe"
            O4 - HKCU\..\Run: [Speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
            O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
            O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
            O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
            O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
            O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
            O4 - Startup: runit_32.lnk = C:\Program Files\runit\runit_32.exe
            O4 - Global Startup: Acer VCM.lnk = ?
            O4 - Global Startup: WiFi Station pour Livebox.lnk = C:\Program Files\Hercules\WiFi Station pour Livebox\WiFiLB.exe
            O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
            O9 - Extra button: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
            O9 - Extra 'Tools' menuitem: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
            O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
            O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
            O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
            O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
            O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
            O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
            O13 - Gopher Prefix:
            O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
            O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
            O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
            O20 - Winlogon Notify: AWinNotifyVitaKey MC3000 - C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll
            O20 - Winlogon Notify: spba - C:\Program Files\Common Files\SPBA\homefus2.dll
            O23 - Service: AG Windows Service (AGWinService) - Unknown owner - C:\Program Files\AGI\common\win32\PythonService.exe
            O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
            O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
            O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
            O23 - Service: CLHNService - Unknown owner - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
            O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
            O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
            O23 - Service: Google Desktop Manager 5.7.808.7150 (GoogleDesktopManager-080708-050100) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
            O23 - Service: Service Google Update (gupdate1c9c66f42f6f480) (gupdate1c9c66f42f6f480) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
            O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
            O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
            O23 - Service: iGroupTec Service (IGBASVC) - Unknown owner - C:\Program Files\Acer\Acer Bio Protection\BASVC.exe
            O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
            O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
            O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
            O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
            O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
            O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
            O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
            O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
            O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
            O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
            O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
            O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
            O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
            O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
            O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
            O23 - Service: Loki Drivers Auto Removal (pr2agqwc) (pr2agqwc) - Cyanide - C:\Windows\system32\pr2agqwc.exe
            O23 - Service: Raw Socket Service (RS_Service) - Acer Incorporated - C:\Program Files\Acer\Acer VCM\RS_Service.exe
            O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
            0
            1. Utilisateur anonyme
              Re

              1)Télécharge Malwarebytes anti malware ici
              http://www.malwarebytes.org/mbam.php

              * Installe le (choisis bien "français" ; ne modifie pas les paramètres d'installe ) et mets le à jour .

              (NB : S'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharge le ici : https://www.malekal.com/tutorial-aboutbuster/

              * Potasse le tuto pour te familiariser avec le prg :

              https://forum.pcastuces.com/sujet.asp?f=31&s=3

              (cela dis, il est très simple d’utilisation).

              relance malwarebytes en suivant scrupuleusement ces consignes :

              ! Déconnecte toi et ferme toutes applications en cours !

              * Lance Malwarebyte's .

              Fais un examen dit "Complet" .

              --> Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
              --> à la fin tu cliques sur "résultat" .
              --> Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .

              Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !

              Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)

              2)Fait un scan complet avec ton antivirus
              et poste moi le rapport à l'issu

              @+
              0
          6. Medmed
            erf je doit l'acheter forcement ? :s
            0
            1. Utilisateur anonyme
              Re

              Non ,tu as un onglet "Download free version" ;tu cliques dessus.

              @+
              0
              2. Medmed
                Heu depuis que j'ai fait les manipulation que tu ma dit j'ai plus msn un message d'erreur apparait en spam toutes les 10 seconde

                A Kiwee Heads Up: There was an error with Yahoo Messenger and your Kiwee Toolbar needs to go bye-bye for now.

                Would you like to send this error message in order to help us improve the toolbar?

                comment je fait ? c'est trés genant :s
                0
                1. Utilisateur anonyme
                  Re

                  As tu fait malwaresbytes?
                  0
              • 1
              • 2

              Discussions similaires

              Supprimer l'historique de commandes et d'achats sur Amazon
              Matthew5

              25 réponses