Jlpjlp, help !

bonsoir,
voilà le rapport malware:

Malwarebytes' Anti-Malware 1.39
Version de la base de données: 2526
Windows 5.1.2600 Service Pack 3

29/07/2009 19:10:49
mbam-log-2009-07-29 (19-10-40).txt

Type de recherche: Examen complet (A:\|C:\|D:\|E:\|F:\|)
Eléments examinés: 205516
Temps écoulé: 39 minute(s), 32 second(s)

Processus mémoire infecté(s): 2
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 31
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 5
Dossier(s) infecté(s): 5
Fichier(s) infecté(s): 36

Processus mémoire infecté(s):
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\EoRezo\SoftwareUpdate\SoftwareUpdateHP.exe (Adware.EoRezo) -> No action taken.
C:\Documents and Settings\Delphine HASSAN\Local Settings\Temp\winrbdte.exe (Trojan.Downloader) -> No action taken.

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\adstechnology.adstechnology (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{831cbac2-8283-4653-9d81-feb9f3f6e47c} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{831cbac4-8283-4653-9d81-feb9f3f6e47c} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{831cbac3-8283-4653-9d81-feb9f3f6e47c} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\adstechnology.adstechnology.1 (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\fis.amo (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\fis.amo.1 (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\fis.momo (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\fis.momo.1 (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{703bdf83-2c12-4d20-8bb0-106ddab01b59} (Rogue.Errorsafe) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{e0767047-9d25-4a3a-b905-852cda087e86} (Rogue.Errorsafe) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{e7296f98-6668-419c-ae1d-04ed641e7c3e} (Rogue.Errorsafe) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{5015bf9d-173c-474b-9af3-77d4d23a4135} (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{85e0b171-04fa-11d1-b7da-00a0c90348a7} (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{92c3f342-45da-4511-853a-b3836aaff5f5} (Adware.SmartShopper) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{831cbac0-8283-4653-9d81-feb9f3f6e47c} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5ed7d3de-6dbe-4516-8712-01b1b64b7057} (Adware.SmartShopper) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{09f1adac-76d8-4d0f-99a5-5c907dadb988} (Rogue.Multiple) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntiVirus) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86a44ef7-78fc-4e18-a564-b18f806f7f56} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\VAV (Rogue.VistaAntiVirus2008) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\UpMedia (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\engine.backup (Rogue.AntiSpyKit) -> No action taken.
HKEY_CLASSES_ROOT\engine.log (Rogue.AntiSpyKit) -> No action taken.
HKEY_CLASSES_ROOT\activationmanager.activationmanager (Trojan.MultiDefender) -> No action taken.
HKEY_CLASSES_ROOT\activationmanager.activationmanager.1 (Trojan.MultiDefender) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\ActivationManager (Trojan.MultiDefender) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\ConnectionServices (Adware.BHO) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\winantispyware 2006 scanner (Rogue.WinAntiSpyware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo (Rogue.Eorezo) -> No action taken.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\softwarehelper (Adware.EoRezo) -> No action taken.

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Dossier(s) infecté(s):
C:\Program Files\ActivationManager (Trojan.MultiDefender) -> No action taken.
C:\Program Files\PCHealthCenter (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\system32\UpMedia (Adware.SmartShopper) -> No action taken.
C:\Program Files\ADSTechnology (Trojan.BHO) -> No action taken.
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\ADSTechnology (Trojan.BHO) -> No action taken.

Fichier(s) infecté(s):
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\EoRezo\SoftwareUpdate\SoftwareUpdateHP.exe (Adware.EoRezo) -> No action taken.
C:\Documents and Settings\Delphine HASSAN\Local Settings\Temp\winrbdte.exe (Trojan.Downloader) -> No action taken.
C:\Program Files\ADSTechnology\ADSTechnology.dll (Trojan.BHO) -> No action taken.
C:\WINDOWS\system32\UpMedia\SearchTool.dll (Adware.SmartShopper) -> No action taken.
c:\WINDOWS\1-fe5e180d56ed9c233080898276c260cc.exe (Adware.SmartShopper) -> No action taken.
c:\WINDOWS\MirarDownloader_876260.exe (Adware.Mirar) -> No action taken.
c:\documents and settings\mahamed hassan.nom-37933e4e8aa\application data\EoRezo\softwareupdate\SoftwareUpdate.exe (Adware.EoRezo) -> No action taken.
c:\system volume information\_restore{7ee724d3-063e-46d0-87fd-70c0ea2c71ba}\RP1032\A0217355.exe (Adware.EoRezo) -> No action taken.
c:\system volume information\_restore{7ee724d3-063e-46d0-87fd-70c0ea2c71ba}\RP1034\A0218491.exe (Adware.EoRezo) -> No action taken.
c:\system volume information\_restore{7ee724d3-063e-46d0-87fd-70c0ea2c71ba}\RP1034\A0218518.exe (Adware.EoRezo) -> No action taken.
c:\system volume information\_restore{7ee724d3-063e-46d0-87fd-70c0ea2c71ba}\RP1035\A0218579.exe (Adware.EoRezo) -> No action taken.
c:\system volume information\_restore{7ee724d3-063e-46d0-87fd-70c0ea2c71ba}\RP1035\A0218619.exe (Adware.EoRezo) -> No action taken.
c:\system volume information\_restore{7ee724d3-063e-46d0-87fd-70c0ea2c71ba}\RP1036\A0219717.exe (Adware.EoRezo) -> No action taken.
c:\system volume information\_restore{7ee724d3-063e-46d0-87fd-70c0ea2c71ba}\RP1036\A0219728.exe (Adware.EoRezo) -> No action taken.
c:\system volume information\_restore{7ee724d3-063e-46d0-87fd-70c0ea2c71ba}\RP1036\A0220186.exe (Adware.EoRezo) -> No action taken.
c:\system volume information\_restore{7ee724d3-063e-46d0-87fd-70c0ea2c71ba}\RP1036\A0220248.exe (Adware.EoRezo) -> No action taken.
c:\system volume information\_restore{7ee724d3-063e-46d0-87fd-70c0ea2c71ba}\RP1037\A0220288.exe (Adware.EoRezo) -> No action taken.
c:\system volume information\_restore{7ee724d3-063e-46d0-87fd-70c0ea2c71ba}\RP1037\A0220367.exe (Adware.EoRezo) -> No action taken.
c:\program files\activationmanager\Uninstall.exe (Trojan.MultiDefender) -> No action taken.
c:\program files\pchealthcenter\0.exe (Trojan.FakeAlert) -> No action taken.
c:\program files\pchealthcenter\5.exe (Trojan.FakeAlert) -> No action taken.
c:\program files\pchealthcenter\0.gif (Trojan.FakeAlert) -> No action taken.
c:\program files\pchealthcenter\1.gif (Trojan.FakeAlert) -> No action taken.
c:\program files\pchealthcenter\2.gif (Trojan.FakeAlert) -> No action taken.
c:\program files\pchealthcenter\3.gif (Trojan.FakeAlert) -> No action taken.
c:\program files\pchealthcenter\sc.html (Trojan.FakeAlert) -> No action taken.
c:\program files\pchealthcenter\1.ico (Trojan.FakeAlert) -> No action taken.
c:\program files\pchealthcenter\2.ico (Trojan.FakeAlert) -> No action taken.
c:\program files\pchealthcenter\2.exe (Trojan.FakeAlert) -> No action taken.
c:\program files\adstechnology\ADSTechnology.exe (Trojan.BHO) -> No action taken.
c:\program files\adstechnology\Uninstall.exe (Trojan.BHO) -> No action taken.
c:\documents and settings\all users\menu démarrer\programmes\adstechnology\ADSTechnology.lnk (Trojan.BHO) -> No action taken.
c:\documents and settings\all users\menu démarrer\programmes\adstechnology\Uninstall.lnk (Trojan.BHO) -> No action taken.
C:\WINDOWS\hosts (Trojan.Agent) -> No action taken.
c:\winzip90sr1freval.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\user32.dat (Trojan.Downloader) -> No action taken.



je dois virer tous ces fichiers (en les supprimant ?)

merci

je continue les autres manip

Logfile of random's system information tool 1.06 (written by random/random)
Run by Delphine HASSAN at 2009-07-29 19:48:00

voila le dernier rapport


Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 2 GB (5%) free of 45 GB
Total RAM: 511 MB (31% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:48:05, on 29/07/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Asus\Asus ChkMail\ChkMail.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\CASIO\Photo Loader\Plauto.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\DOCUME~1\DELPHI~1\LOCALS~1\Temp\abrp.exe
C:\DOCUME~1\DELPHI~1\LOCALS~1\Temp\winonnym.exe
C:\DOCUME~1\DELPHI~1\LOCALS~1\Temp\cjobut.exe
C:\Program Files\Spyware Doctor\update.exe
C:\Documents and Settings\Delphine HASSAN\Bureau\RSIT.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\trend micro\Delphine HASSAN.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*https://fr.search.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = fr.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr9/*https://fr.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*https://fr.search.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr9/*https://fr.search.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://y.lo.st
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer optimisé pour MSN
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Barre d'outils - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: EoBho Class - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: Yahoo! Barre d'outils - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SoftwareHelper] C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: ASUS ChkMail.lnk = C:\Program Files\Asus\Asus ChkMail\ChkMail.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: Supervision de Photo Loader.lnk = C:\Program Files\CASIO\Photo Loader\Plauto.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.free.fr/freebox/index.html
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

hello,
quand tu dis :

désactive ton parefeu, ton antivirus, la garde de ton antispyware



il faut savoir que je n'ai pas d'antivirus, l'antis^yware déblqoue régulièrement (spyware doctor ne fonctionne pas en ce moment, ça lui prend parfois) et le pare feu, chépas !!!



donc je vais faire ce que tu me dis mais san ceet hrase.

je n'ai pas ausis supprimer tous lmes fichiers acr je ne les ai pas trouvé comme dit plus haut


a +

voila


ComboFix 09-07-29.01 - Delphine HASSAN 29/07/2009 21:22.1.1 - FAT32x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.352.1036.18.511.202 [GMT 2:00]
Running from: c:\documents and settings\Delphine HASSAN\Bureau\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\ActivationManager
c:\program files\ActivationManager\Uninstall.exe
c:\program files\ADSTechnology
c:\program files\ADSTechnology\ADSTechnology.dll
c:\program files\ADSTechnology\ADSTechnology.exe
c:\program files\ADSTechnology\Uninstall.exe
c:\program files\PCHealthCenter
c:\program files\PCHealthCenter\0.exe
c:\program files\PCHealthCenter\0.gif
c:\program files\PCHealthCenter\1.gif
c:\program files\PCHealthCenter\1.ico
c:\program files\PCHealthCenter\2.exe
c:\program files\PCHealthCenter\2.gif
c:\program files\PCHealthCenter\2.ico
c:\program files\PCHealthCenter\3.gif
c:\program files\PCHealthCenter\5.exe
c:\program files\PCHealthCenter\sc.html
c:\windows\hosts
c:\windows\Installer\2b250f.msi
c:\windows\Installer\2e704e.msp
c:\windows\Installer\2e704f.msp
c:\windows\Installer\6aa893.msi
c:\windows\Installer\7f1467.msi
c:\windows\Installer\9be624.msi
c:\windows\Installer\dbdcd.msi
c:\windows\pi.exe
c:\windows\system32\UpMedia
c:\windows\system32\UpMedia\SearchTool.dll
c:\windows\system32\user32.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_BOONTY_GAMES
-------\Service_Boonty Games


((((((((((((((((((((((((( Files Created from 2009-06-28 to 2009-07-29 )))))))))))))))))))))))))))))))
.

2009-07-29 17:15 . 2009-07-29 17:15 -------- d-----w- C:\UsbFix
2009-07-29 16:26 . 2009-07-29 16:26 -------- d-----w- c:\docume~1\DELPHI~1\APPLIC~1\Malwarebytes
2009-07-29 16:26 . 2009-07-13 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-29 16:26 . 2009-07-29 16:26 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-29 16:26 . 2009-07-29 16:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-07-29 16:26 . 2009-07-13 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-29 16:24 . 2009-07-29 16:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-07-29 16:24 . 2009-07-29 16:24 -------- d-----w- c:\program files\CCleaner
2009-07-28 20:54 . 2009-07-28 20:54 -------- d-----w- c:\documents and settings\Delphine HASSAN\Local Settings\Application Data\Adobe
2009-07-26 14:48 . 2004-02-02 08:37 11914 ----a-w- c:\windows\system32\drivers\wg3n.sys
2009-07-26 14:48 . 2004-02-02 08:51 55891 ----a-w- c:\windows\system32\drivers\Teefer.sys
2009-07-26 14:48 . 2004-02-02 08:53 18518 ----a-w- c:\windows\system32\drivers\wpsdrvnt.sys
2009-07-26 14:47 . 2004-02-02 10:06 83096 ----a-w- c:\windows\system32\SSSensor.dll
2009-07-26 14:47 . 2009-07-26 14:47 -------- d-----w- c:\program files\Sygate
2009-07-26 14:47 . 2009-07-26 14:47 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard
2009-07-26 11:28 . 2009-07-26 11:28 -------- d-----w- c:\documents and settings\Delphine HASSAN\Local Settings\Application Data\Microsoft
2009-07-26 10:10 . 2009-07-26 10:10 -------- d-----w- c:\windows\system32\XPSViewer
2009-07-26 10:10 . 2009-07-26 10:10 -------- d-----w- c:\program files\MSBuild
2009-07-26 10:10 . 2009-07-26 10:10 -------- d-----w- c:\program files\Reference Assemblies
2009-07-26 10:09 . 2008-07-06 12:06 89088 ------w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-07-26 10:09 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-07-26 10:09 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-07-26 10:09 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-07-26 10:09 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\dllcache\xpssvcs.dll
2009-07-26 10:09 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-07-26 10:09 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-07-25 21:07 . 2009-07-25 21:07 -------- d-----w- c:\program files\trend micro
2009-07-25 21:07 . 2009-07-25 21:07 -------- d-----w- C:\rsit
2009-07-23 20:42 . 2009-07-23 20:42 -------- d-----w- C:\FindyKill
2009-07-23 19:57 . 2008-12-11 06:38 159600 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-07-23 19:57 . 2009-04-03 09:18 130936 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2009-07-23 19:57 . 2008-12-18 10:16 73840 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-07-23 19:57 . 2008-12-10 09:36 64392 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2009-07-23 19:57 . 2009-07-23 19:57 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2009-07-23 19:57 . 2009-07-23 19:57 -------- d-----w- c:\program files\Spyware Doctor
2009-07-23 19:57 . 2009-07-23 19:57 -------- d-----w- c:\docume~1\DELPHI~1\APPLIC~1\PC Tools
2009-07-23 19:15 . 2009-07-23 19:15 -------- d-----w- c:\docume~1\DELPHI~1\APPLIC~1\GlarySoft
2009-07-23 19:10 . 2009-07-23 19:10 -------- d-----w- c:\program files\AskBarDis
2009-07-22 21:24 . 2009-07-22 21:24 -------- d-----w- c:\program files\Enigma Software Group
2009-07-22 17:00 . 2009-07-22 17:00 20480 ----a-w- c:\documents and settings\mahamed hassan.NOM-37933E4E8AA\Application Data\EoRezo\SoftwareUpdate\Software\itsTV\3.0.1.3\itstv.exe
2009-07-21 21:06 . 2009-07-21 21:06 -------- d-----w- c:\documents and settings\mahamed hassan.NOM-37933E4E8AA\Local Settings\Application Data\Mozilla
2009-07-21 17:41 . 2009-07-21 17:41 604416 ----a-w- c:\windows\system32\TUProgSt.exe
2009-07-17 21:22 . 2009-07-17 21:22 20480 ----a-w- c:\documents and settings\mahamed hassan.NOM-37933E4E8AA\Application Data\EoRezo\SoftwareUpdate\Software\itsTV\3.0.1.2\itstv.exe
2009-07-02 20:46 . 2009-07-02 20:46 20480 ----a-w- c:\documents and settings\mahamed hassan.NOM-37933E4E8AA\Application Data\EoRezo\SoftwareUpdate\Software\itsTV\3.0.1.1\itstv.exe
2009-07-01 14:25 . 2009-07-01 14:25 -------- d-----w- c:\docume~1\DELPHI~1\APPLIC~1\TuneUp Software

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-29 19:31 . 2008-07-29 16:39 12 ----a-w- c:\windows\bthservsdp.dat
2009-07-26 10:17 . 2004-09-20 15:49 86444 ----a-w- c:\windows\system32\perfc00C.dat
2009-07-26 10:17 . 2004-09-20 15:49 510304 ----a-w- c:\windows\system32\perfh00C.dat
2009-06-27 12:07 . 2009-06-27 12:07 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software
2009-06-27 12:07 . 2009-06-27 12:07 -------- d-sh--w- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-06-26 05:09 . 2009-06-26 05:09 -------- d-----w- c:\docume~1\DELPHI~1\APPLIC~1\PCToolsFirewallPlus
2009-06-26 05:09 . 2009-06-26 05:09 -------- d--h--r- c:\docume~1\DELPHI~1\APPLIC~1\yahoo!
2009-06-25 19:37 . 2009-06-25 19:37 -------- d-----w- c:\documents and settings\mahamed hassan.NOM-37933E4E8AA\Application Data\PCToolsFirewallPlus
2009-06-25 19:28 . 2009-06-25 19:28 -------- d-----w- c:\program files\Fichiers communs\PC Tools
2009-06-25 18:17 . 2009-06-25 18:17 262144 ----a-w- C:\ntuser.dat
2009-06-23 01:42 . 2009-06-23 01:42 385984 ----a-w- c:\documents and settings\mahamed hassan.NOM-37933E4E8AA\Application Data\EoRezo\install.exe
2009-06-23 01:42 . 2009-06-23 01:42 698903 ----a-w- c:\documents and settings\mahamed hassan.NOM-37933E4E8AA\Application Data\EoRezo\SoftwareUpdate\unins000.exe
2009-06-23 01:42 . 2009-06-23 01:42 -------- d-----w- c:\documents and settings\mahamed hassan.NOM-37933E4E8AA\Application Data\EoRezo
2009-06-18 08:19 . 2009-06-18 08:19 -------- d-----w- c:\program files\Incomplete
2009-06-16 14:40 . 2004-09-20 15:48 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:40 . 2004-09-20 15:48 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-03 21:02 . 2009-06-03 21:02 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-06-03 19:10 . 2004-09-20 15:48 1297408 ----a-w- c:\windows\system32\quartz.dll
2009-05-07 15:33 . 2004-09-20 15:48 348672 ----a-w- c:\windows\system32\localspl.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-07-17 15:20 279944 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-07-17 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-07-17 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"PcSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2005-04-20 917504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2008-04-14 143872]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 222616]
"SoftwareHelper"="c:\documents and settings\mahamed hassan.NOM-37933E4E8AA\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe" [2008-12-09 441952]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2009-07-24 1173384]
"SmcService"="c:\progra~1\Sygate\SPF\smc.exe" [2004-02-24 2446488]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 105328]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 723880]
"ALUAlert"="c:\program files\Symantec\LiveUpdate\ALUNotify.exe" [2002-08-19 435816]
"Symantec NetDriver Warning"="c:\progra~1\SYMNET~1\SNDWarn.exe" [2004-10-29 500856]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
ASUS ChkMail.lnk - c:\program files\Asus\Asus ChkMail\ChkMail.exe [2005-4-25 106496]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-6 106496]
hp psc 1000 series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [2003-4-6 225280]
Supervision de Photo Loader.lnk - c:\program files\CASIO\Photo Loader\Plauto.exe [2005-8-1 294912]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"wave1"=SMNT40.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Free.fr\\connect.exe"=
"c:\\Program Files\\Nokia\\Nokia PC Suite 6\\PcSync2.exe"=
"c:\\Program Files\\Fichiers communs\\Real\\Update_OB\\realsched.exe"=
"c:\\Program Files\\Symantec\\LiveUpdate\\NDETECT.EXE"=
"c:\\Program Files\\Symantec\\LiveUpdate\\AUpdate.exe"=
"c:\\Program Files\\Ahead\\Nero StartSmart\\NeroStartSmart.exe"=
"c:\\Program Files\\Microsoft Office\\Office\\OSA9.EXE"=
"c:\\Documents and Settings\\mahamed hassan.NOM-37933E4E8AA\\Application Data\\eoRezo\\SoftwareUpdate\\SoftwareUpdateHP.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpohmr08.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\jusched.exe"=
"c:\\Program Files\\CASIO\\Photo Loader\\Plauto.exe"=
"c:\\Program Files\\Asus\\Asus ChkMail\\ChkMail.exe"=

[HKLM\~\Services\\SERVIC~1.EXE"=]
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpotdd01.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpoevm08.exe"=
"c:\\PROGRA~1\\YAHOO!\\Companion\\Installs\\cpn\\ytbb.exe"=
"c:\\PROGRA~1\\FICHIE~1\\INSTAL~1\\engine\\6\\INTEL3~1\\iKernel.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Spyware Doctor\\pctsTray.exe"=
"c:\\DOCUME~1\\DELPHI~1\\LOCALS~1\\Temp\\cexj.exe"=
"c:\\DOCUME~1\\DELPHI~1\\LOCALS~1\\Temp\\winpusr.exe"=
"c:\\DOCUME~1\\DELPHI~1\\LOCALS~1\\Temp\\wincvuhb.exe"=
"c:\\DOCUME~1\\DELPHI~1\\LOCALS~1\\Temp\\winatss.exe"=
"c:\\DOCUME~1\\DELPHI~1\\LOCALS~1\\Temp\\winbfjcl.exe"=

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [23/07/2009 21:57 130936]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [21/02/2009 12:11 55152]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [23/07/2009 21:57 348752]
R3 abp470n5;abp470n5;\??\c:\windows\system32\drivers\ejejne.sys --> c:\windows\system32\drivers\ejejne.sys [?]
R3 fbxusb;FreeBox USB Network Adapter;c:\windows\system32\drivers\fbxusb.sys [31/12/2003 11:35 18848]
S3 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [06/02/2009 18:08 607088]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [29/07/2009 18:26 38160]

--- Other Services/Drivers In Memory ---

*Deregistered* - mchInjDrv
.
Contents of the 'Scheduled Tasks' folder

2009-06-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2009-05-09 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 1200 series854FF0989A4AA23B58D69D1FF20212903A329E7F122828695.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-05 22:52]

2009-07-29 c:\windows\Tasks\GlaryInitialize.job
- d:\glary utilities\initialize.exe [2009-07-23 14:55]

2009-07-29 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2008-05-24 14:07]
.
- - - - ORPHANS REMOVED - - - -

Toolbar-SITEguard - (no file)
WebBrowser-{C64ADC18-F6BB-4EB5-AC20-46AC76944398} - (no file)
WebBrowser-{A8F9752D-E2B8-4E7A-86B5-499F4330E2FE} - (no file)


.
------- Supplementary Scan -------
.
uStart Page = fr.yahoo.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://fr.yahoo.com
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = <local>
uSearchURL,(Default) = hxxp://fr.rd.yahoo.com/customize/ie/defaults/su/msgr9/*https://fr.search.yahoo.com/
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-29 21:34
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3252)
c:\program files\Spyware Doctor\pctgmhk.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 6\PCSCM.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\SYSTEM32\ATI2EVXX.EXE
c:\program files\GOOGLE\COMMON\GOOGLE UPDATER\GOOGLEUPDATERSERVICE.EXE
c:\program files\JAVA\JRE6\BIN\JQS.EXE
c:\program files\SPYWARE DOCTOR\PCTSSVC.EXE
c:\program files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
c:\progra~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
c:\progra~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\SYSTEM32\NOTEPAD.EXE
c:\docume~1\DELPHI~1\LOCALS~1\Temp\winpusr.exe
c:\docume~1\DELPHI~1\LOCALS~1\Temp\winatss.exe
.
**************************************************************************
.
Completion time: 2009-07-29 21:39 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-29 19:39

Pre-Run: 2 320 367 616 octets libres
Post-Run: 2 552 496 128 octets libres

Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4
280 --- E O F --- 2009-07-27 16:07





je fais le reste

hello,

quelle épopée !!!!!!!!!!!!!

j'ai lancé AD REMOVER hier soir à 21H40 : fenetre violette qui me dit d'attendre etc. Tjs pareil à minuit, là je vais me coucheR; à 6h ce matin, tjs pareil. J'ai odnc quitter le prog et redémarrer mon ordi. donc AD r n'a pas pu travailler je pense , voila le rapport :

======= RAPPORT D'AD-REMOVER 1.1.4.5_O | UNIQUEMENT XP/VISTA/SEVEN =======
.
Mit à jour par C_XX le 24/06/2009 à 7:10 PM
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 21:48:06, 29/07/2009 | Mode Normal | Option: CLEAN
Exécuté de: C:\Program Files\Ad-remover\
Système d'exploitation: Microsoft® Windows XP™ Service Pack 3 v5.1.2600
Nom du PC: NOM-37933E4E8AA | Utilisateur actuel: Delphine HASSAN
.
Administrateur: Administrateur
Administrateur: Delphine HASSAN
N'est pas administrateur: HelpAssistant *Desactive*
N'est pas administrateur: Invité *Desactive*
Administrateur: mahamed hassan
N'est pas administrateur: SUPPORT_388945a0 *Desactive*








quand je l'avais lancé, je n'avais pas fait en tant qu'administrateur je pense, je recomencerai ce soir.
Mais il faut savoir que j'ai 2 ssessions sur mon ordi et que j'aurai speut etre dû les supprimer.
Bon alors si tu as des explications pour uqe je sois administrateur je prends.




je vais faireun usb fix comme ask

les 2 personnes qui ont une session sur l'ordi ont des droits d'aministrateur, donc je ne pense que cla me pose pb. Mais qu'entends tu par lic droit et ouvrir le prog en tant qu'administrateur et laisser parametre par défaut: on ne me prpsoe pas ce choix.
ou alors est ce au téléchargement que cela doit mêtre proposé ?

merci

ET voila


.
======= RAPPORT D'AD-REMOVER 1.1.4.5_O | UNIQUEMENT XP/VISTA/SEVEN =======
.
Mit à jour par C_XX le 24/06/2009 à 7:10 PM
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 19:05:59, 30/07/2009 | Mode Normal | Option: CLEAN
Exécuté de: C:\Program Files\Ad-remover\
Système d'exploitation: Microsoft® Windows XP™ Service Pack 3 v5.1.2600
Nom du PC: NOM-37933E4E8AA | Utilisateur actuel: Delphine HASSAN
.
Administrateur: Administrateur
Administrateur: Delphine HASSAN
N'est pas administrateur: HelpAssistant *Desactive*
N'est pas administrateur: Invité *Desactive*
Administrateur: mahamed hassan
N'est pas administrateur: SUPPORT_388945a0 *Desactive*
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.
.
HKCR\CLSID\{201f27d4-3704-41d6-89c1-aa35e39143ed}
HKCR\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKCR\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179}
HKCR\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
HKCU\Software\EoRezo
HKCU\Software\ItsLabel
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKLM\Software\EoRezo
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdate_is1
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Softwarehelper
HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{3041d03e-fd4b-44e0-b742-2d9b88305f98}
HKCR\CLSID\{0702a2b6-13aa-4090-9e01-bcdc85dd933f}
HKCR\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}
HKCR\CLSID\{b0de3308-5d5a-470d-81b9-634fc078393b}
.
C:\DOCUME~1\DELPHI~1\APPLIC~1\EoRezo\host.cyp
C:\DOCUME~1\DELPHI~1\APPLIC~1\EoRezo\cmhost.cyp
C:\DOCUME~1\DELPHI~1\APPLIC~1\EoRezo\user.cyp
C:\DOCUME~1\DELPHI~1\APPLIC~1\EoRezo\cache
C:\DOCUME~1\DELPHI~1\APPLIC~1\EoRezo\db
C:\DOCUME~1\DELPHI~1\APPLIC~1\EoRezo\ConfMedia.cyp
C:\DOCUME~1\DELPHI~1\APPLIC~1\EoRezo\eoDesktop
C:\DOCUME~1\DELPHI~1\APPLIC~1\EoRezo\eoStats
C:\DOCUME~1\DELPHI~1\APPLIC~1\EoRezo\db\cat.cyp
C:\DOCUME~1\DELPHI~1\APPLIC~1\EoRezo\eoDesktop\userConfig.xml
C:\DOCUME~1\DELPHI~1\APPLIC~1\EoRezo\eoDesktop\config.xml
C:\DOCUME~1\DELPHI~1\APPLIC~1\EoRezo\eoDesktop\eoDesktop.html
C:\DOCUME~1\DELPHI~1\APPLIC~1\EoRezo\eoStats\eoStats.txt
C:\DOCUME~1\DELPHI~1\APPLIC~1\EoRezo
C:\DOCUME~1\DELPHI~1\APPLIC~1\ItsLabel\ItsTV
C:\DOCUME~1\DELPHI~1\APPLIC~1\ItsLabel\ItsTV\itsTV.xml
C:\DOCUME~1\DELPHI~1\APPLIC~1\ItsLabel
C:\DOCUME~1\DELPHI~1\APPLIC~1\Mozilla\Firefox\Profiles\gwxmb99b.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\chrome.manifest
C:\DOCUME~1\DELPHI~1\APPLIC~1\Mozilla\Firefox\Profiles\gwxmb99b.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\chrome.manifest.dev
C:\DOCUME~1\DELPHI~1\APPLIC~1\Mozilla\Firefox\Profiles\gwxmb99b.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\install.rdf
C:\DOCUME~1\DELPHI~1\APPLIC~1\Mozilla\Firefox\Profiles\gwxmb99b.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\install.rdf.bak
C:\DOCUME~1\DELPHI~1\APPLIC~1\Mozilla\Firefox\Profiles\gwxmb99b.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\chrome
C:\DOCUME~1\DELPHI~1\APPLIC~1\Mozilla\Firefox\Profiles\gwxmb99b.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults
C:\DOCUME~1\DELPHI~1\APPLIC~1\Mozilla\Firefox\Profiles\gwxmb99b.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\META-INF
C:\DOCUME~1\DELPHI~1\APPLIC~1\Mozilla\Firefox\Profiles\gwxmb99b.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\chrome\ajtoolbar.jar
C:\DOCUME~1\DELPHI~1\APPLIC~1\Mozilla\Firefox\Profiles\gwxmb99b.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults\preferences
C:\DOCUME~1\DELPHI~1\APPLIC~1\Mozilla\Firefox\Profiles\gwxmb99b.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults\preferences\ask.gif
C:\DOCUME~1\DELPHI~1\APPLIC~1\Mozilla\Firefox\Profiles\gwxmb99b.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults\preferences\ask.src
C:\DOCUME~1\DELPHI~1\APPLIC~1\Mozilla\Firefox\Profiles\gwxmb99b.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults\preferences\snipit.js
C:\DOCUME~1\DELPHI~1\APPLIC~1\Mozilla\Firefox\Profiles\gwxmb99b.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults\preferences\config.dat.bak
C:\DOCUME~1\DELPHI~1\APPLIC~1\Mozilla\Firefox\Profiles\gwxmb99b.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults\preferences\config.dat
C:\DOCUME~1\DELPHI~1\APPLIC~1\Mozilla\Firefox\Profiles\gwxmb99b.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\META-INF\manifest.mf
C:\DOCUME~1\DELPHI~1\APPLIC~1\Mozilla\Firefox\Profiles\gwxmb99b.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\META-INF\zigbert.rsa
C:\DOCUME~1\DELPHI~1\APPLIC~1\Mozilla\Firefox\Profiles\gwxmb99b.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\META-INF\zigbert.sf
C:\DOCUME~1\DELPHI~1\APPLIC~1\Mozilla\Firefox\Profiles\gwxmb99b.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
C:\Program Files\AskBarDis\unins000.dat
C:\Program Files\AskBarDis\unins000.exe
C:\Program Files\AskBarDis\bar
C:\Program Files\AskBarDis\PopSwatter
C:\Program Files\AskBarDis\bar\Settings
C:\Program Files\AskBarDis\bar\bin
C:\Program Files\AskBarDis\bar\Cache
C:\Program Files\AskBarDis\bar\History
C:\Program Files\AskBarDis\bar\Settings\config.dat.bak
C:\Program Files\AskBarDis\bar\Settings\config.dat
C:\Program Files\AskBarDis\bar\Settings\prevcfg.htm
C:\Program Files\AskBarDis\bar\bin\askBar.dll
C:\Program Files\AskBarDis\bar\bin\askPopStp.dll
C:\Program Files\AskBarDis\bar\bin\psvince.dll
C:\Program Files\AskBarDis\bar\Cache\files.ini
C:\Program Files\AskBarDis\bar\Cache\003F262C
C:\Program Files\AskBarDis\bar\Cache\003F3120
C:\Program Files\AskBarDis\bar\Cache\003F3668.bin
C:\Program Files\AskBarDis\bar\Cache\003F3B42.bin
C:\Program Files\AskBarDis\bar\Cache\003F3D87.bin
C:\Program Files\AskBarDis\bar\Cache\003F3FF4.bin
C:\Program Files\AskBarDis\bar\Cache\003F421B.bin
C:\Program Files\AskBarDis\bar\Cache\003F449C.bin
C:\Program Files\AskBarDis\bar\History\search
C:\Program Files\AskBarDis\PopSwatter\History
C:\Program Files\AskBarDis\PopSwatter\History\notallow
C:\Program Files\AskBarDis\PopSwatter\History\allowed
C:\Program Files\AskBarDis
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\SoftwareUpdate
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\host.cyp
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\cmhost.cyp
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\ConfMedia.cyp
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\eoDesktop
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\install.exe
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\eoStats
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\user.cyp
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\SoftwareUpdate\unins000.dat
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\SoftwareUpdate\unins000.exe
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\SoftwareUpdate\SoftwareUpdate.exe
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\SoftwareUpdate\SoftwareUpdateHP.exe
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\SoftwareUpdate\user_profil.cyp
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\SoftwareUpdate\Software
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\SoftwareUpdate\help_config.cyp
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\SoftwareUpdate\Download
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\SoftwareUpdate\user_config.cyp
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\SoftwareUpdate\Software\itsTV
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\SoftwareUpdate\Software\itsTV\3.0.1.0
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\SoftwareUpdate\Software\itsTV\3.0.1.1
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\SoftwareUpdate\Software\itsTV\3.0.1.2
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\SoftwareUpdate\Software\itsTV\3.0.1.3
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\SoftwareUpdate\Software\itsTV\3.0.1.4
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\SoftwareUpdate\Software\itsTV\3.0.1.1\itstv.exe
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\SoftwareUpdate\Software\itsTV\3.0.1.2\itstv.exe
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\SoftwareUpdate\Software\itsTV\3.0.1.3\itstv.exe
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\SoftwareUpdate\Software\itsTV\3.0.1.4\itstv.exe
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\eoDesktop\eoDesktop.html
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\eoDesktop\userConfig.xml
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\eoDesktop\config.xml
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo\eoStats\eoStats.txt
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Application Data\Eorezo
C:\WINDOWS\Prefetch\SOFTWAREUPDATEHP.EXE-36BDE899.pf
C:\DOCUME~1\DELPHI~1\Cookies\delphine_hassan@eorezo[1].txt
C:\DOCUME~1\DELPHI~1\Cookies\delphine_hassan@eorezo[3].txt
C:\DOCUME~1\DELPHI~1\Cookies\delphine_hassan@ads.eorezo[2].txt
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Cookies\mahamed_hassan@eorezo[2].txt
C:\Documents and Settings\mahamed hassan.NOM-37933E4E8AA\Cookies\mahamed_hassan@ads.eorezo[2].txt

(!) -- Fichiers temporaires supprimés.

.
============== Scan additionnel ==============
.

* Mozilla FireFox Version [Impossible d'obtenir la version] *

Nom du profil: gwxmb99b.default (Delphine HASSAN)
.
(Prefs.js) user_pref("browser.search.defaultenginename", "Yahoo");
(Prefs.js) user_pref("browser.search.selectedEngine", "Yahoo");
(Prefs.js) user_pref("browser.search.defaulturl", "hxxp://fr.search.yahoo.com/search?fr=ffsp1&p=");
(Prefs.js) user_pref("browser.startup.homepage", "hxxp://fr.yahoo.com");
(Prefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.9.1.1");
(Invalidprefs.js) user_pref("browser.search.defaultenginename", "Google");
(Invalidprefs.js) user_pref("browser.search.selectedEngine", "lo.st");
(Invalidprefs.js) user_pref("browser.search.defaulturl", "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=");
(Invalidprefs.js) user_pref("browser.startup.homepage", "hxxp://lo.st");
(Invalidprefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.8.0.3");
.
.

* Internet Explorer Version 7.0.5730.11 *

[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/

[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

Tabs: res://ieframe.dll/tabswelcome.htm

============== Suspect (Cracks, Serials ... ) ==============

.
.
===================================
.
12636 Octet(s) - C:\Ad-Report-CLEAN.log
.
3 Fichier(s) - C:\DOCUME~1\DELPHI~1\LOCALS~1\Temp
1 Fichier(s) - C:\WINDOWS\Temp
.
36 Fichier(s) - C:\Program Files\Ad-remover\BACKUP
43 Fichier(s) - C:\Program Files\Ad-remover\QUARANTINE
.
Fin à: 19:24:48 | 30/07/2009
.
============== E.O.F ==============
.

lorsuqe je vais sous malwarebyte/onglet quarantaine, il n'y a rien ! c'est passé ou ? fautq ue je refasse un scan ?


bon je vais deja faire ad R en sup tout

par contre j'ai trouvé sous c/prog files/ ad remover/ un fichier quarantaine avec plein de fichier (à moi) : je les supprime à partir de ce fichier ?

VOILA LE RAPPORT

.
======= RAPPORT D'AD-REMOVER 1.1.4.5_O | UNIQUEMENT XP/VISTA/SEVEN =======
.
Mit à jour par C_XX le 24/06/2009 à 7:10 PM
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 19:21:02, 31/07/2009 | Mode Normal | Option: CLEAN
Exécuté de: C:\Program Files\Ad-remover\
Système d'exploitation: Microsoft® Windows XP™ Service Pack 3 v5.1.2600
Nom du PC: NOM-37933E4E8AA | Utilisateur actuel: Delphine HASSAN
.
Administrateur: Administrateur
Administrateur: Delphine HASSAN
N'est pas administrateur: HelpAssistant *Desactive*
N'est pas administrateur: Invité *Desactive*
Administrateur: mahamed hassan
N'est pas administrateur: SUPPORT_388945a0 *Desactive*
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.
.
.

(!) -- Fichiers temporaires supprimés.

.
============== Scan additionnel ==============
.

* Mozilla FireFox Version [Impossible d'obtenir la version] *

Nom du profil: gwxmb99b.default (Delphine HASSAN)
.
(Prefs.js) user_pref("browser.search.defaultenginename", "Yahoo");
(Prefs.js) user_pref("browser.search.selectedEngine", "Yahoo");
(Prefs.js) user_pref("browser.search.defaulturl", "hxxp://fr.search.yahoo.com/search?fr=ffsp1&p=");
(Prefs.js) user_pref("browser.startup.homepage", "hxxp://fr.yahoo.com");
(Prefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.9.1.1");
(Invalidprefs.js) user_pref("browser.search.defaultenginename", "Google");
(Invalidprefs.js) user_pref("browser.search.selectedEngine", "lo.st");
(Invalidprefs.js) user_pref("browser.search.defaulturl", "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=");
(Invalidprefs.js) user_pref("browser.startup.homepage", "hxxp://lo.st");
(Invalidprefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.8.0.3");
.
.

* Internet Explorer Version 7.0.5730.11 *

[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/

[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

Tabs: res://ieframe.dll/tabswelcome.htm

============== Suspect (Cracks, Serials ... ) ==============

.
.
===================================
.
2916 Octet(s) - C:\Ad-Report-CLEAN.log
.
6 Fichier(s) - C:\DOCUME~1\DELPHI~1\LOCALS~1\Temp
1 Fichier(s) - C:\WINDOWS\Temp
.
56 Fichier(s) - C:\Program Files\Ad-remover\BACKUP
43 Fichier(s) - C:\Program Files\Ad-remover\QUARANTINE
.
Fin à: 19:39:51 | 31/07/2009
.
============== E.O.F ==============
.






mais tu n'as pas répondu a ma question :
1) POUR TOUT SUPPRIMER LES FICHIERS DETECTES PAR AD REMOVER, JE FAIS QUOI ?????????????

Sous c/program files/ ad remover, ya un fichier quarantaine, ad remover : je sélectione tout et je fais "supprimer" ? c'est ça ?




2) de plus , sous malwarebytes, je n'ai rien ds l'onglet quarantaire ! j fais quoi ?

merci beaucoup

Voila le rapport, j'avais ava,nt supprimer lfichoiers qui étaient sous ad remover/prog files



Malwarebytes' Anti-Malware 1.39
Version de la base de données: 2526
Windows 5.1.2600 Service Pack 3

31/07/2009 21:31:39
mbam-log-2009-07-31 (21-31-39).txt

Type de recherche: Examen rapide
Eléments examinés: 90953
Temps écoulé: 3 minute(s), 49 second(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 6
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 5
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 6

Processus mémoire infecté(s):
C:\Documents and Settings\Delphine HASSAN\Local Settings\temp\winerfrfc.exe (Trojan.Downloader) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{703bdf83-2c12-4d20-8bb0-106ddab01b59} (Rogue.Errorsafe) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e0767047-9d25-4a3a-b905-852cda087e86} (Rogue.Errorsafe) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e7296f98-6668-419c-ae1d-04ed641e7c3e} (Rogue.Errorsafe) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\VAV (Rogue.VistaAntiVirus2008) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\engine.backup (Rogue.AntiSpyKit) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\engine.log (Rogue.AntiSpyKit) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\ADSTechnology (Trojan.BHO) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Documents and Settings\Delphine HASSAN\Local Settings\temp\winerfrfc.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\WINDOWS\1-fe5e180d56ed9c233080898276c260cc.exe (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\WINDOWS\MirarDownloader_876260.exe (Adware.Mirar) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\adstechnology\ADSTechnology.lnk (Trojan.BHO) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\adstechnology\Uninstall.lnk (Trojan.BHO) -> Quarantined and deleted successfully.
c:\winzip90sr1freval.exe (Trojan.Agent) -> Quarantined and deleted successfully.


je fai srsit et je reviens !