Message sur barre internet

Bonjour,

http://ww11.genproc.com/tutorial_genproc/forum.html

Merci de votre aide voici donc les rapports:

-----------\\ ToolBar S&D 1.2.8 XP/Vista

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz )
BIOS : Default System BIOS
USER : Utilisateur ( Administrator )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total:465 Go (Free:15 Go)
D:\ (CD or DVD) - UDF - Total:3 Go (Free:0 Go)
E:\ (USB)
F:\ (USB)
G:\ (USB)
H:\ (USB) - FAT32 - Total:76186 Mo (Free:5 Go)
I:\ (CD or DVD)
K:\ (Local Disk) - FAT32 - Total:465 Go (Free:12 Go)

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [2] ( 19/06/2009|20:30 )

[ UAC => 1 ]

-----------\\ SUPPRESSION

Supprime! - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
Supprime! - C:\Program Files\DAEMON Tools Toolbar\Resources
Supprime! - C:\Program Files\DAEMON Tools Toolbar\uninst.exe
Supprime! - C:\Program Files\DAEMON Tools Toolbar\_DTLite.xml
Supprime! - C:\Program Files\DAEMON Tools Toolbar

-----------\\ Recherche de Fichiers / Dossiers ...

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\Windows\\system32\\blank.htm"
"Search Page"="https://www.google.com/?gws_rd=ssl"
"Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"
"Search Bar"="http://www.google.com/toolbar/ie8/sidebar.html"
"Default_Search_URL"="http://www.google.com/toolbar/ie8/sidebar.html"
"Url"="https://www.msn.com/fr-fr/actualite/"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="https://www.msn.com/fr-fr/"
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"

--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\Users\UTILIS~1\AppData\Roaming\Microsoft\Windows\Recent\AVS Video Converter 6.2.3.314 + Crack.lnk
C:\Users\UTILIS~1\Desktop\AVS Video Converter 6.2.3.314 + Crack
C:\Users\UTILIS~1\Desktop\AVS Video Converter 6.2.3.314 + Crack.rar
C:\Users\UTILIS~1\Desktop\AVS Video Converter 6.2.3.314 + Crack\AVS Video Converter.txt
C:\Users\UTILIS~1\Desktop\AVS Video Converter 6.2.3.314 + Crack\AVSVideoConverter.exe
C:\Users\UTILIS~1\Desktop\AVS Video Converter 6.2.3.314 + Crack\Crack
C:\Users\UTILIS~1\Desktop\link torrent\Link favoris\Wawa-Mania - [RS] Sony Vegas 7.0 + Keygen.url
C:\Users\UTILIS~1\Desktop\link torrent\Link favoris\[RS] Sony Vegas Pro 8.0a. Crack‚, Test‚ & en Fran‡ais! ¯ Movizdb.com (Films,E-book,Logiciel,livre) avec [RS][MU][FREE][FF][MF].url
C:\Users\UTILIS~1\Desktop\SOLIDWORK\sw2k9sp0.0_cracks
C:\Users\UTILIS~1\Desktop\SOLIDWORK\sw2k9sp0.0_cracks\COSMOS
C:\Users\UTILIS~1\Desktop\SOLIDWORK\sw2k9sp0.0_cracks\PhotoView 360
C:\Users\UTILIS~1\Desktop\SOLIDWORK\sw2k9sp0.0_cracks\Win32
C:\Users\UTILIS~1\Desktop\SOLIDWORK\sw2k9sp0.0_cracks\Win64
C:\Users\UTILIS~1\Desktop\SOLIDWORK\sw2k9sp0.0_cracks\COSMOS\license.dat
C:\Users\UTILIS~1\Desktop\SOLIDWORK\sw2k9sp0.0_cracks\PhotoView 360\nexus3.dll
C:\Users\UTILIS~1\Desktop\SOLIDWORK\sw2k9sp0.0_cracks\PhotoView 360\readme!.txt
C:\Users\UTILIS~1\Desktop\SOLIDWORK\sw2k9sp0.0_cracks\Win32\readme!.txt
C:\Users\UTILIS~1\Desktop\SOLIDWORK\sw2k9sp0.0_cracks\Win32\sw2k9sp0.0_x32_crk.exe
C:\Users\UTILIS~1\Desktop\SOLIDWORK\sw2k9sp0.0_cracks\Win64\readme!.txt
C:\Users\UTILIS~1\Desktop\SOLIDWORK\sw2k9sp0.0_cracks\Win64\sw2k9sp0.0_x64_crk.exe
C:\Users\UTILIS~1\Desktop\svg musik\-= TRANCE =-\-= ARTISTES =-\Perplex - Anti Shock - 2007\08-vibe_tribe_-_wise_cracks_perplex_remix-mycel.mp3
C:\Users\UTILIS~1\Desktop\svg musik\-= TRANCE =-\-= ARTISTES =-\Perplex - Electrodelic- 2CD - 2007\110-vibe_tribe_-_wise_cracks_perplex_remix-mycel.mp3
C:\Users\UTILIS~1\Desktop\svg musik\Musiques2\ABBA\12 The Visitors (Crackin' Up).mp3
C:\Users\UTILIS~1\Favorites\Aircrack-ng, aireplay-ng, airodump-ng, Tutorial crack cle wep.url
C:\Users\UTILIS~1\Favorites\MX Vs ATV Unleashed PC (Incl Reloaded Crack) [www Accessroms Com] Torrent.url
C:\Users\UTILIS~1\Favorites\Wawa-Mania - microsoft office 2007 + crack +keygen.url
C:\Users\UTILIS~1\Favorites\Wawa-Mania - [RS] Sony Vegas 7.0 + Keygen.url

[ UAC => 1 ]

1 - "C:\ToolBar SD\TB_1.txt" - 19/06/2009|20:31 - Option : [2]

-----------\\ Fin du rapport a 20:31:15,91

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:34:18, on 19/06/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18248)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\conime.exe
C:\Windows\System32\WScript.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\cmd.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = // ;) anna I Liebe YOU ==> MILK@3|_!!!
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Adblock Pro - {F385C231-605B-4d8f-ACA9-DBFF765BBE17} - C:\Program Files\Adblock Pro\AdblockPro.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\Skytel.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: &Block This Image (ABP) - C:\Program Files\Adblock Pro\blockimg.html
O8 - Extra context menu item: &Bloquer cette image (ABP) - C:\Program Files\Adblock Pro\blockimg.html
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O9 - Extra button: Adblock Pro Preferences - {E7FD3540-AB30-40f1-91E7-101F733C1FD5} - C:\Program Files\Adblock Pro\AdblockPro.dll
O9 - Extra 'Tools' menuitem: Adblock Pro Preferences - {E7FD3540-AB30-40f1-91E7-101F733C1FD5} - C:\Program Files\Adblock Pro\AdblockPro.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O13 - Gopher Prefix:
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Service Google Update (gupdate1c9a505bc1234f6) (gupdate1c9a505bc1234f6) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

nouveau genproc;

Rapport GenProc 2.591 [5] - 19/06/2009 à 22:39:02
@ Windows Vista Service Pack 1 - Mode normal

GenProc n'a détecté aucune infection caractéristique et suggère de suivre la procédure suivante :

Poste un rapport NanoScan https://www.micro-astuce.com/securite/NanoScan-Panda.php

----------------------------------------------------------------------
Sites officiels GenProc : www.alt-shift-return.org et www.genproc.com
----------------------------------------------------------------------

~~ Fin à 22:40:20 ~~
Pourtant l'incription y est toujours je suis en train de faire un scan en ligne apparement j'aurais 3 trojans....

Voila j'ai fais le scan en ligne:
C:\Users\Utilisateur\Desktop\svg musik\03 Track 3.wma WMA/TrojanDownloader.Wimad.D cheval de troie nettoyé par suppression - mis en quarantaine
C:\Users\Utilisateur\Desktop\svg musik\massacre swollen members.mp3 WMA/TrojanDownloader.GetCodec.C cheval de troie nettoyé par suppression - mis en quarantaine
C:\Users\Utilisateur\Desktop\svg musik\zombie cramberies.mp3 WMA/TrojanDownloader.GetCodec.C cheval de troie nettoyé par suppression - mis en quarantaine
C:\Users\Utilisateur\Desktop\svg musik\The Offspring - Rise and Fall Rage and Grace [2008]\06-the_offspring-takes_me_nowhere.mp3 une variante de WMA/TrojanDownloader.GetCodec.gen cheval de troie nettoyé - mis en quarantaine
C:\Users\Utilisateur\Documents\LimeWire\Incomplete\T-246278-Flip Her Babies Sheep.wma une variante de WMA/TrojanDownloader.GetCodec.gen cheval de troie nettoyé - mis en quarantaine
C:\Users\Utilisateur\Documents\LimeWire\Saved\archive lights.mp3 une variante de WMA/TrojanDownloader.GetCodec.gen cheval de troie nettoyé - mis en quarantaine
C:\Users\Utilisateur\Documents\LimeWire\Saved\dub intro.mpg une variante de WMA/TrojanDownloader.GetCodec.gen cheval de troie nettoyé - mis en quarantaine
K:\winrun.vbs une variante probable de Win32/Agent cheval de troie nettoyé par suppression - mis en quarantaine
K:\svg plantage\Music\The Offspring - Rise and Fall Rage and Grace [2008]\06-the_offspring-takes_me_nowhere.mp3 une variante de WMA/TrojanDownloader.GetCodec.gen cheval de troie nettoyé - mis en quarantaine
K:\svg musik\03 Track 3.wma WMA/TrojanDownloader.Wimad.D cheval de troie nettoyé par suppression - mis en quarantaine
K:\svg musik\massacre swollen members.mp3 WMA/TrojanDownloader.GetCodec.C cheval de troie nettoyé par suppression - mis en quarantaine
K:\svg musik\zombie cramberies.mp3 WMA/TrojanDownloader.GetCodec.C cheval de troie nettoyé par suppression - mis en quarantaine
K:\svg musik\The Offspring - Rise and Fall Rage and Grace [2008]\06-the_offspring-takes_me_nowhere.mp3 une variante de WMA/TrojanDownloader.GetCodec.gen cheval de troie nettoyé - mis en quarantaine

Voila maintenant que dois-je faire , s'il vous plait aidez moi!
Merci d'avance

Quel utilitaire dois-je télécharger pour supprimer ce virus ?!
Il commence sérieusement a me tapper sur le systéme!

[*] Télécharge combofix (sUBs) http://download.bleepingcomputer.com/sUBs/ComboFix.exe sur ton Bureau
[*] Double clique combofix.exe et suis les instructions.
[*] Installe la console de récupération si proposé et continue.
[*] Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

ComboFix 09-06-18.02 - Utilisateur 20/06/2009 0:09.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.3071.2116 [GMT 2:00]
Lancé depuis: c:\users\Utilisateur\Documents\Downloads\Programs\ComboFix.exe
SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

K:\Autorun.inf
K:\desktop.ini

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-05-19 au 2009-06-19 ))))))))))))))))))))))))))))))))))))
.

2009-06-19 22:11 . 2009-06-19 22:11 -------- d-----w- c:\users\Utilisateur\AppData\Local\temp
2009-06-19 20:17 . 2009-06-19 20:17 -------- d-----w- c:\program files\ESET
2009-06-19 18:35 . 2009-06-19 18:35 -------- d-----w- C:\UAC
2009-06-19 18:34 . 2009-06-19 18:34 -------- d-----w- c:\program files\Trend Micro
2009-06-19 18:19 . 2009-06-19 18:31 -------- d-----w- C:\ToolBar SD
2009-06-19 18:14 . 2009-06-19 18:28 -------- d-----w- C:\GenProc
2009-06-13 22:59 . 2009-06-13 22:59 -------- d-----w- c:\program files\AVS4YOU
2009-06-13 03:15 . 2009-04-30 12:37 293376 ----a-w- c:\windows\system32\psisdecd.dll
2009-06-13 03:15 . 2009-04-30 12:37 428544 ----a-w- c:\windows\system32\EncDec.dll
2009-06-10 10:19 . 2009-04-23 12:42 636928 ----a-w- c:\windows\system32\localspl.dll
2009-06-10 10:19 . 2009-04-21 11:55 2033152 ----a-w- c:\windows\system32\win32k.sys
2009-06-01 20:00 . 2009-06-01 20:00 -------- d-----w- c:\users\Utilisateur\AppData\Local\TouchStoneSoftware
2009-06-01 20:00 . 2009-06-01 20:00 -------- d-----w- c:\program files\TouchStoneSoftware
2009-05-29 19:07 . 2009-06-01 19:57 -------- d-----w- c:\program files\NTFS Undelete
2009-05-29 12:09 . 2009-05-29 12:09 212848 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\RPAPI.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-19 22:12 . 2009-02-19 18:45 -------- d-----w- c:\users\Utilisateur\AppData\Roaming\DMCache
2009-06-19 20:13 . 2009-05-12 18:37 -------- d-----w- c:\programdata\Yahoo! Companion
2009-06-19 20:12 . 2009-02-16 18:19 -------- d-----w- c:\program files\Steam
2009-06-19 20:08 . 2009-03-15 00:26 -------- d-----w- c:\programdata\Google Updater
2009-06-19 18:43 . 2008-01-21 08:40 669328 ----a-w- c:\windows\system32\perfh00C.dat
2009-06-19 18:43 . 2008-01-21 08:40 123350 ----a-w- c:\windows\system32\perfc00C.dat
2009-06-19 17:26 . 2009-02-16 23:57 -------- d-----w- c:\users\Utilisateur\AppData\Roaming\uTorrent
2009-06-18 22:20 . 2009-02-18 22:03 -------- d-----w- c:\users\Utilisateur\AppData\Roaming\dvdcss
2009-06-18 17:12 . 2009-02-16 18:47 -------- d-----w- c:\program files\Common Files\Steam
2009-06-13 22:59 . 2009-05-09 13:49 -------- d-----w- c:\program files\Common Files\AVSMedia
2009-06-11 15:45 . 2009-02-17 00:39 -------- d-----w- c:\users\Utilisateur\AppData\Roaming\LimeWire
2009-06-01 19:56 . 2009-02-16 12:28 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-29 12:09 . 2009-05-29 12:09 212848 ----a-w- c:\programdata\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll
2009-05-23 19:16 . 2009-03-15 00:26 -------- d-----w- c:\program files\Google
2009-05-14 16:50 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-05-12 18:37 . 2009-05-12 18:37 -------- d-----w- c:\program files\CCleaner
2009-05-12 18:37 . 2009-05-12 18:37 -------- d-----w- c:\program files\Yahoo!
2009-05-12 18:37 . 2009-05-12 18:37 -------- d-----w- c:\users\Utilisateur\AppData\Roaming\Yahoo!
2009-05-09 13:50 . 2009-05-09 13:50 -------- d-----w- c:\users\Utilisateur\AppData\Roaming\AVS4YOU
2009-05-09 13:50 . 2009-05-09 13:50 -------- d-----w- c:\programdata\AVS4YOU
2009-05-09 11:26 . 2009-05-09 11:26 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-05-02 15:00 . 2009-02-17 00:38 -------- d-----w- c:\program files\Java
2009-05-01 18:30 . 2009-05-01 18:30 3366912 ----a-w- c:\windows\system32\GPhotos.scr
2009-04-30 18:54 . 2009-04-30 18:54 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2009-04-30 02:35 . 2009-04-28 14:24 -------- d-----w- c:\program files\MX Simulator
2009-04-27 19:22 . 2009-04-27 19:21 -------- d-----w- c:\program files\Adblock Pro
2009-04-27 14:55 . 2009-04-27 14:55 -------- d-----w- c:\program files\Windows Live
2009-04-24 16:05 . 2009-06-10 10:20 827904 ----a-w- c:\windows\system32\wininet.dll
2009-04-24 16:02 . 2009-06-10 10:20 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-04-24 13:44 . 2009-06-10 10:20 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2009-04-23 12:43 . 2009-06-10 10:20 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-12 15:45 . 2009-04-12 15:45 98304 ----a-w- c:\windows\system32\CmdLineExt.dll
2009-04-12 13:32 . 2009-04-12 13:32 16224 ----a-w- c:\windows\system32\drivers\hamachi.sys
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"Steam"="c:\program files\Steam\Steam.exe" [2009-06-10 1217784]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2002-04-11 1458448]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-02-19 2745776]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-15 39408]
"WindowsWelcomeCenter"="oobefldr.dll" - c:\windows\System32\oobefldr.dll [2008-01-21 2153472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2008-10-02 6335008]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13580832]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 92704]
"SystrayORAHSS"="c:\program files\Orange\Systray\SystrayApp.exe" [2007-09-25 94208]
"ORAHSSSessionManager"="c:\program files\Orange\SessionManager\SessionManager.exe" [2007-09-25 102400]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-05-29 518488]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer1"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{60568AD3-FB74-4DDF-8ADC-06053E8BA1F5}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{F4412B0F-814F-4967-939E-E526F1A88B11}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"TCP Query User{B896E532-8A1C-4955-95F7-7DB309CBB55D}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{D5BD196C-CD64-4442-AF92-90F0CB066AC5}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire
"TCP Query User{9EBF3AED-8E90-45D0-9777-1ADCA089BADD}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:µTorrent
"UDP Query User{F8FD447E-C7B8-4C90-805C-C5B81C76DFA6}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:µTorrent
"TCP Query User{AA3FFD61-3516-46E3-8086-15F27BDB0200}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{E7A8EC1E-C7A7-4269-89AE-3FC15F01D7BB}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire
"TCP Query User{824F575D-42E5-4622-A109-F85FE142F30F}c:\\program files\\java\\jre6\\bin\\javaw.exe"= UDP:c:\program files\java\jre6\bin\javaw.exe:Java(TM) Platform SE binary
"UDP Query User{421313C6-437D-4BE6-AC11-EA518483D577}c:\\program files\\java\\jre6\\bin\\javaw.exe"= TCP:c:\program files\java\jre6\bin\javaw.exe:Java(TM) Platform SE binary
"TCP Query User{6394AD71-3CBB-4466-BD2B-2DBDCF8DFE79}c:\\program files\\java\\jre6\\bin\\java.exe"= UDP:c:\program files\java\jre6\bin\java.exe:Java(TM) Platform SE binary
"UDP Query User{129D626F-2452-4B4D-ADB9-6C425FBCAAEF}c:\\program files\\java\\jre6\\bin\\java.exe"= TCP:c:\program files\java\jre6\bin\java.exe:Java(TM) Platform SE binary
"TCP Query User{991F6DA8-FCB1-43BC-821B-E8F80A100AD0}c:\\program files\\thq\\mx vs atv unleashed\\mxvsatv.exe"= UDP:c:\program files\thq\mx vs atv unleashed\mxvsatv.exe:MXvsATV
"UDP Query User{8C24C77F-8188-45B2-84A3-7EBD740E2764}c:\\program files\\thq\\mx vs atv unleashed\\mxvsatv.exe"= TCP:c:\program files\thq\mx vs atv unleashed\mxvsatv.exe:MXvsATV

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\Orange\\Connectivity\\ConnectivityManager.exe"= c:\program files\Orange\Connectivity\ConnectivityManager.exe:*:enabled:CSS

R0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys [24/04/2009 14:12 64160]
R3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista;c:\windows\System32\drivers\netr28u.sys [21/09/2007 10:38 554496]
R3 Ph3xIB32;Philips 713x Inbox PCI TV Card;c:\windows\System32\drivers\Ph3xIB32.sys [03/04/2007 11:43 1131136]
S2 gupdate1c9a505bc1234f6;Service Google Update (gupdate1c9a505bc1234f6);c:\program files\Google\Update\GoogleUpdate.exe [15/03/2009 02:33 133104]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [19/01/2009 16:35 1005904]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [16/02/2009 13:59 26224]
S3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:\windows\System32\drivers\PCAMp50.sys [16/02/2009 20:01 28224]
.
Contenu du dossier 'Tâches planifiées'

2009-06-19 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-19 12:09]

2009-06-19 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-15 01:09]

2009-06-19 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-15 00:33]
.
.
------- Examen supplémentaire -------
.
uDefault_Search_URL = hxxp://www.google.com/ie
mWindow Title =
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Block This Image (ABP) - c:\program files\Adblock Pro\blockimg.html
IE: &Bloquer cette image (ABP) - c:\program files\Adblock Pro\blockimg.html
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Télécharger avec IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Télécharger le contenu de video FLV avec IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Télécharger tous les liens avec IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: {{E7FD3540-AB30-40f1-91E7-101F733C1FD5} - {7685B225-8229-4321-BA13-A24485B0A760} - c:\program files\Adblock Pro\AdblockPro.dll
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-20 00:11
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1842791622-277908511-2833712957-1000_Classes\CLSID\{6fa03b81-7e4b-49e1-bc12-c0f83e9ed8b0}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:00000071
"Therad"=dword:00000009
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,98,07,ff,fc,5d,
df,1c,2f,3b,8a,0a,32,11,89,01,b5,38,ea,60,74,3f,86,28,b1,30,1f,fb,07,be,97,\

[HKEY_USERS\S-1-5-21-1842791622-277908511-2833712957-1000_Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):84,d9,ae,0e,93,55,81,a2,8a,2c,6a,8f,3a,4f,02,e1,de,42,bf,99,a0,
b4,86,64,27,dc,92,8b,ae,a3,91,0b,7c,75,26,ca,76,b0,1d,d7,00,00,00,00,00,00,\
.
Heure de fin: 2009-06-19 0:13
ComboFix-quarantined-files.txt 2009-06-19 22:13

Avant-CF: 8 016 179 200 octets libres
Après-CF: 7 929 012 224 octets libres

175 --- E O F --- 2009-06-18 17:16

Merci de m'aider Narco!4
Je précise que la phrase n'apparait plus , mais le virus etait'il toujorus la ?

poste un rapport Kaspersky https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr ("Exécutez l'analyse en ligne"). Sélectionne "disque local C:\"
Aide : http://support.kaspersky.fr/admin/u2Files/Image/webscanner/FinalWS.gif

Je ne peut pas analyser tout mon disque C il me demande un fichier précis ...
Comment faire pour qu'il accepte d'analyser mon disque en entier ?

clique sur cliquez ici!