Logiciel espion Fermé

Question

Bonjour, j'ai découvet un logiciel espion sur mon PC depuis quelque jours mais apparemment c plus malin que je pensais !! le Génie qui m'a fait cela a utilisé un compte d'administrateur pour cette rasion je n'arrive pas a suprimmer 3 programmes (un message me dit que je ne suis pas l'administrateur!! Hier j'ai refais un scan anti virus "Avira" il m'a affiché 2 avertissements , il n'arrive pas à controler 2 fichiers voilà une copie du rapport : La recherche sur les fichiers sélectionnés commence : Recherche débutant dans 'C:\' C:\hiberfil.sys [AVERTISSEMENT] Impossible d'ouvrir le fichier ! C:\pagefile.sys [AVERTISSEMENT] Impossible d'ouvrir le fichier ! Recherche débutant dans 'D:\' Fin de la recherche : samedi 29 août 2009 20:42 Temps nécessaire: 44:50 Minute(s) La recherche a été effectuée intégralement 21039 Les répertoires ont été contrôlés 347691 Des fichiers ont été contrôlés 0 Des virus ou programmes indésirables ont été trouvés 0 Des fichiers ont été classés comme suspects 0 Des fichiers ont été supprimés 0 Des virus ou programmes indésirables ont été réparés 0 Les fichiers ont été déplacés dans la quarantaine 0 Les fichiers ont été renommés 2 Impossible de contrôler des fichiers 347689 Fichiers non infectés 1732 Les archives ont été contrôlées 2 Avertissements 0 Consignes ***J'ai utilisé aussi le scan du spypot il n'arrive pas à corriger trois fichiers il me dit que je ne suis pas l'administrateur :( voilà les 3 programmes que le scan a détécté dont je n'arrive pas à corriger : 1/MyWay.MyWebSearch Menace: PUPS Description The toolbar gets installed via download from a website. It also has a plugin for Microsoft Outlook, which is run at system startup. Everytime the user looks for a statement with the search function, an obviously unique identification number ("sauid") is sent to a webserver. When uninstalled, some registry entries and files remain on the system. 2/Adviva 3/ FunWebProducts Menace: PUPS Fonctionnalités FunWebProducts is supposed to install funny icons or smileys. Description This trojan does install the described items and a lot of more applications the user did not ask for. It is also detected as trojans by various antivirus scanners because it does not clearly state what it brings along. je veux bien un coup de main des connaisseurs ! Merci

kduc · Answer

Salut,

Télécharge http://sd-1.archive-host.com/membres/up/16506160323759868/AD-R.exe (de Cyrildu17 / C_XX) sur ton Bureau.

Déconnecte-toi du net et ferme toutes applications en cours.

1. Double-clique sur le programme d'installation ; laisse-le 
s’ installer par défaut (C:\Program files).
2. Double-clique sur l'icône AD-Remover située sur ton Bureau.
(Pour Vista : clique droit > "Exécuter en tant qu'administrateur")
3. Au menu principal, choisis l'option L.
L’ outil débute sa recherche … Laisse-le travailler !
Le scan achevé, une fenêtre va s’ afficher.
4. Poste (copie-colle) le rapport qui apparaît à la fin.

(Tu trouveras aussi le rapport sous C:\Ad-report(date).log)
(CTRL+A pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller)

Note : "Process.exe", une composante de l'outil peut être 
détecté par certains antivirus comme une infection ; donc, ne pas en tenir compte : 
il s'agit d'un faux positif.

besthiba · Answer

j'ai fait ceque vous m'avez demandé et voila le rapport : . ======= RAPPORT D'AD-REMOVER 1.1.4.5_Q | UNIQUEMENT XP/VISTA/SEVEN ======= . Mit à jour par C_XX le 26/08/2009 à 6:37 PM Contact: AdRemover.contact@gmail.com Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html . Lancé à: 19:49:02, 30/08/2009 | Mode Normal | Option: SCAN Exécuté de: C:\Program Files\Ad-remover\ Système d'exploitation: Microsoft® Windows Vista™ v6.0.6001 Nom du PC: PC-HIBA | Utilisateur actuel: HIBA . . ============== ÉLÉMENT(S) TROUVÉ(S) ============== . . HKCR\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} HKCR\Typelib\{D518921A-4A03-425E-9873-B9A71756821E} HKCU\Software\AppDataLow\Software\MyWebSearch HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D} HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA} HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA} HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25560540-9571-4D7B-9389-0F166788785A} HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8} HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C} HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9FF05104-B030-46FC-94B8-81276E4E27DF} HKLM\Software\Classes\Typelib\{D518921A-4A03-425E-9873-B9A71756821E} HKLM\Software\Classes\Typelib\{D518921A-4A03-425E-9873-B9A71756821E} HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481} HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45DD-9B68-D6A12C30E5D7} HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907} HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48DD-9B6D-7A13A3E42127} HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40FD-8DAE-FF14757F60C7} HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA} HKLM\Software\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\AskSearchAsst.exe HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Ask.com Search Assistant HKU\S-1-5-21-3066969076-1937047056-318044926-1000\Software\Appdatalow\Software\Fun Web Products HKU\S-1-5-21-3066969076-1937047056-318044926-1000\Software\Appdatalow\Software\MyWebSearch . C:\Users\HIBA\AppData\LocalLow\FunWebProducts C:\Users\HIBA\AppData\LocalLow\MyWebSearch C:\Program Files\Ask Search Assistant C:\Users\HIBA\Desktop\SweetImSetup.exe C:\Program Files\Windows Live\Messenger\Riched20.dll C:\Users\HIBA\AppData\Roaming\MICROS~1\Windows\Cookies\hiba@zwinky[2].txt . ============== Scan additionnel ============== . . . . * Internet Explorer Version 8.0.6001.18372 * . [HKEY_CURRENT_USER\..\Internet Explorer\Main] . Search Page: hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*hxxp://www.yahoo.com Start Page: hxxp://www.tattoodle.com?tid={7D64F8F9-B856-4d90-B933-4268F81386E5}&v=12 Default_Page_URL: hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=040c&s=2&o=vp32&d=1008&m=aspire_5735 Search Bar: hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*hxxp://www.yahoo.com/ext/search/search.html . [HKEY_LOCAL_MACHINE\..\Internet Explorer\Main] . Start Page: hxxp://www.yahoo.com/ Default_Search_URL: hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*hxxp://www.yahoo.com Search Page: hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*hxxp://www.yahoo.com Default_Page_URL: hxxp://www.yahoo.com/ Search Bar: hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*hxxp://www.yahoo.com/ext/search/search.html . [HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS] . Tabs: hxxp://www.fastbrowsersearch.com/new-tab/?v=18&tid={7D64F8F9-B856-4d90-B933-4268F81386E5} . =================================== . 4182 Octet(s) - C:\Ad-Report-SCAN.log . 2104 Fichier(s) - C:\Users\HIBA\AppData\Local\Temp 1768 Fichier(s) - C:\Windows\Temp . 0 Fichier(s) - C:\Program Files\Ad-remover\BACKUP 0 Fichier(s) - C:\Program Files\Ad-remover\QUARANTINE . Fin à: 19:56:21 | 30/08/2009 . ============== E.O.F ============== .

kduc · Answer

..

C' est parfait.

Je vois "Eléments trouvés" mais, ... pas "Neutralisés" !

Tu as bien fais le choix "L" (Lancer le nettoyage) ?

---
Maintenant, télécharge, installe et mets à jour Malwarebytes Anti-Malwares …
http://forum.telecharger.01net.com/microhebdo/6/tuto-securite/tuto-malwaresbytes-anti-malware-352008/messages-1.html puis, lance un scan COMPLET et poste le rapport.

PS : si MalwareByte's a détecté des infections, clique sur Afficher les résultats, 
puis sur Supprimer la sélection.

Ensuite, ...

Fais un scan HijackThis :
http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/hijackthis-version-install-sujet_199100_1.htm ... et poste le rapport.

---
PS : essaie de poster les deux rapports dans la même réponse.

besthiba · Answer

Vous avez raison j'ai fait "S"au lieu de"L"

je viens de faire : voila le rapport et merci infiniment pour votre suivi :)

.
======= RAPPORT D'AD-REMOVER 1.1.4.5_Q | UNIQUEMENT XP/VISTA/SEVEN =======
.
Mit à jour par C_XX le 26/08/2009 à 6:37 PM
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 23:49:56, 30/08/2009 | Mode Normal | Option: CLEAN
Exécuté de: C:\Program Files\Ad-remover\
Système d'exploitation: Microsoft® Windows Vista™   v6.0.6001
Nom du PC: PC-HIBA | Utilisateur actuel: HIBA
.
. 
============== ÉLÉMENT(S) NEUTRALISÉ(S) ============== 
.
.
HKCR\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe}
HKCR\Typelib\{D518921A-4A03-425E-9873-B9A71756821E}
HKCU\Software\AppDataLow\Software\MyWebSearch
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25560540-9571-4D7B-9389-0F166788785A}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9FF05104-B030-46FC-94B8-81276E4E27DF}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45DD-9B68-D6A12C30E5D7}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48DD-9B6D-7A13A3E42127}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40FD-8DAE-FF14757F60C7}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\AskSearchAsst.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Ask.com Search Assistant
HKU\S-1-5-21-3066969076-1937047056-318044926-1000\Software\Appdatalow\Software\Fun Web Products
.
C:\Users\HIBA\AppData\LocalLow\FunWebProducts\Data 
C:\Users\HIBA\AppData\LocalLow\FunWebProducts\Installr 
C:\Users\HIBA\AppData\LocalLow\FunWebProducts\Shared 
C:\Users\HIBA\AppData\LocalLow\FunWebProducts\Data\avatar.dat 
C:\Users\HIBA\AppData\LocalLow\FunWebProducts\Data\outfit.dat 
C:\Users\HIBA\AppData\LocalLow\FunWebProducts\Dataegister.dat 
C:\Users\HIBA\AppData\LocalLow\FunWebProducts\Data\zbucks.dat 
C:\Users\HIBA\AppData\LocalLow\FunWebProducts\Installr\Cache 
C:\Users\HIBA\AppData\LocalLow\FunWebProducts\Installr\Cache\064AD5E5.exe 
C:\Users\HIBA\AppData\LocalLow\FunWebProducts\Installr\Cache\files.ini 
C:\Users\HIBA\AppData\LocalLow\FunWebProducts 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Cache 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\History 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Settings 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\avatar.htm 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\bgfadel.gif 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\bgfader.gif 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\common-x.css 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\common.css 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\cornerbl.gif 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\cornerbr.gif 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\ext_def.gif 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\ext_roll.gif 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\include.js 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\index.htm 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\loader.htm 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\loading.gif 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\logo.gif 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\max_def.gif 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\max_roll.gif 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\min_def.gif 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\min_roll.gif 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON
oflash.htm 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMONes_def.gif 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMONes_roll.gif 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\spacer.gif 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\spacer.swf 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON	opgrad.gif 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\window.ico 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Cache\064B1FEF 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Cache\064B255B 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Cache\064B31D9 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Cache\064B3321.bin 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Cache\064B3449.bin 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Cache\064B35FE.bin 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Cache\064B37E2.bin 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Cache\064B3929.bin 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Cache\0678FD91.bin 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Cache\0678FEAA.bin 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Cache\0678FFC3.bin 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Cache\067900DC.bin 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Cache\files.ini 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\History\search3 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON\ask_logo.gif 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON\autoup.gif 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON\autoup.htm 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON\center.htm 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON\index.htm 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON\mid_dots.gif 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON\mws_logo.gif 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON\protect.htm 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON\shocked.gif 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON\stop.gif 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON\systray.htm 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON\systrayp.htm 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON	p_grad.gif 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON\warn.gif 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Settings\prevcfg2.htm 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Settings\setting2.htm 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Settings\settings.dat 
C:\Users\HIBA\AppData\LocalLow\MyWebSearch 
C:\Program Files\Ask Search Assistant\ask.ico 
C:\Program Files\Ask Search Assistant\AskSearchAsst.ini 
C:\Program Files\Ask Search Assistant\Install.asa.log 
C:\Program Files\Ask Search Assistant\uninst.exe 
C:\Program Files\Ask Search Assistant 
C:\Users\HIBA\Desktop\SweetImSetup.exe 
C:\Program Files\Windows Live\Messengeriched20.dll 
C:\Users\HIBA\AppData\Roaming\MICROS~1\Windows\Cookies\hiba@zwinky[2].txt 

(!) -- Fichiers temporaires supprimés.

.
============== Scan additionnel ==============
.
.
.
.
* Internet Explorer Version 8.0.6001.18372 *
. 
[HKEY_CURRENT_USER\..\Internet Explorer\Main] 
. 
Search Page: hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*hxxp://www.yahoo.com
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Search Bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Default_search_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
. 
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main] 
. 
Start Page: hxxp://fr.msn.com/
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Search Bar: hxxp://search.msn.com/spbasic.htm
. 
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS] 
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
===================================
.
9250 Octet(s) - C:\Ad-Report-CLEAN.log 
4499 Octet(s) - C:\Ad-Report-SCAN.log 
.
2044 Fichier(s) - C:\Users\HIBA\AppData\Local\Temp 
55 Fichier(s) - C:\Windows\Temp 
.
20 Fichier(s) - C:\Program Files\Ad-remover\BACKUP
11 Fichier(s) - C:\Program Files\Ad-remover\QUARANTINE
.
Fin à: 23:57:48 | 30/08/2009
.
============== E.O.F ==============
.

kduc · Answer

...

Je préfère cela ...

Fais la suite et ça devrait être bon.

besthiba · Answer

Je vais finir demain soir, je vais DODO mnt :) j'espère que je vais réussir à nettoyer mon pc 

Merci bcp bcp 

à demain

besthiba · Answer

Bonsoir, 

Voila les deux rapport mon cher expert :) :)

le 1er rapport :
Malwarebytes' Anti-Malware 1.40
Version de la base de données: 2722
Windows 6.0.6001 Service Pack 1

31/08/2009 22:10:21
mbam-log-2009-08-31 (22-10-21).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 227569
Temps écoulé: 1 hour(s), 13 minute(s), 41 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 5

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Program Files\Ad-remover\QUARANTINE\PROGRA~1\WI1F86~1\MESSEN~1iched20.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\JetAudio\jetUpdate.exe (Rogue.MalwareSweeper) -> Quarantined and deleted successfully.
C:\Users\Public\Favorites
etservice.exe (Backdoor.Agent) -> Delete on reboot.
C:\Users\Public\Favorites\NginuL_na.exe (Worm.AutoRun) -> Delete on reboot.
C:\Users\Public\Favorites\plug\001.dll (Backdoor.Agent) -> Delete on reboot.

le 2ème rapport :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:20:09, on 31/08/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18372)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\PLFSetI.exe
C:\Users\HIBA\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Athan\Athan.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Nokia\PC Internet Access\NPCIA.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\PC Connectivity Solution\Transports\NclIrSrv.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*https://fr.yahoo.com/?p=us
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*https://fr.yahoo.com/?p=us
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: SearchHelper Class - {91C18ED5-5E1C-4AE5-A148-A861DE8C8E16} - C:\Program Files\SGPSA\mtwb3sh.dll (file missing)
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Search Assistant - {F0626A63-410B-45E2-99A1-3F2475B2D695} - C:\Program Files\SGPSA\BHO.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [BkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [PLFSetI] C:\Windows\PLFSetI.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [ProductReg] "C:\Program Files\Acer\WR_PopUp\ProductReg.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Athan] C:\Program Files\Athan\Athan.exe
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [NokiaPCInternetAccess] "C:\Program Files\Nokia\PC Internet Access\NPCIA.exe" /b
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Showbalm] "C:\ProgramData\jump program program.j0etxb"
O4 - HKCU\..\Run: [ANTI LITE TITLE DEBUG] "C:\ProgramData\option dupe tool.63g5px8"
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix: 
O16 - DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} (Module de délivrance de certificat MINEFI) - https://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerVistaADP-2.0.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Service Google Update (gupdate1c9d52578b6163a) (gupdate1c9d52578b6163a) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

kduc · Answer

Salut,

Désactive les protections résidentes (Antivirus, etc...).
Tu les réactiveras par la suite.
 
* Télécharger Lop S&D (par Eric71) sur ton bureau : 
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2

* Double-clique dessus pour lancer l'installation
* Puis, double-clique sur le raccourci Lop S&D présent sur le bureau
* Choisis la langue souhaitée, puis choisir l'Option 1.
* Patiente jusqu'à la fin du scan.
* Poster le rapport généré (C:\lopR.txt)

PS : si le Bureau ne réapparait pas, fais Ctrl/Alt/Suppr, onglet "Fichier", 
Nouvelle tâche, tape explorer.exe et valide.

besthiba · Answer

Bonsoir mon cher expert :)

voilà le rapport :


   --------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6001 ) Service Pack 1
   X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) Dual  CPU  T3200  @ 2.00GHz )
   BIOS : Ver 1.00PARTTBL
   USER : HIBA ( Administrator )
   BOOT : Normal boot
   C:\ (Local Disk) - NTFS - Total:69 Go (Free:30 Go)
   D:\ (Local Disk) - NTFS - Total:69 Go (Free:68 Go)
   E:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [1] ( 01/09/2009|21:24 )

   [ UAC => 1 ]
 
   --------------------\  Listing des dossiers dans Local

   [13/03/2009|13:50] C:\Users\HIBA\AppData\Local\Adobe
   [13/01/2009|00:05] C:\Users\HIBA\AppData\Local\Apple
   [13/01/2009|00:32] C:\Users\HIBA\AppData\Local\Apple Computer
   [29/10/2008|22:48] C:\Users\HIBA\AppData\Local\Application Data 
   [31/03/2009|00:06] C:\Users\HIBA\AppData\Local\d3d9caps.dat
   [03/06/2009|11:38] C:\Users\HIBA\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
   [02/03/2009|02:00] C:\Users\HIBA\AppData\Local\GDIPFONTCACHEV1.DAT
   [11/07/2009|06:14] C:\Users\HIBA\AppData\Local\Google
   [29/10/2008|22:48] C:\Users\HIBA\AppData\Local\Historique 
   [01/09/2009|18:02] C:\Users\HIBA\AppData\Local\IconCache.db
   [18/02/2009|22:26] C:\Users\HIBA\AppData\Local\IsolatedStorage
   [27/08/2009|00:54] C:\Users\HIBA\AppData\Local\Microsoft
   [05/11/2008|15:06] C:\Users\HIBA\AppData\Local\Microsoft Help
   [18/02/2009|22:59] C:\Users\HIBA\AppData\Local\MyPhotoFun
   [01/09/2009|21:23] C:\Users\HIBA\AppData\Local\Temp
   [29/10/2008|22:48] C:\Users\HIBA\AppData\Local\Temporary Internet Files 
   [21/12/2008|22:50] C:\Users\HIBA\AppData\Local\VirtualStore
   [28/04/2009|01:55] C:\Users\HIBA\AppData\Local\Yahoo
 
   --------------------\  Tâches planifiées dans C:\Windows	asks

   [01/09/2009 21:19][--a------] C:\Windows	asks\GoogleUpdateTaskMachineUA.job
   [01/09/2009 19:19][--a------] C:\Windows	asks\GoogleUpdateTaskMachineCore.job
   [01/09/2009 19:19][--ah-----] C:\Windows	asks\SA.DAT
   [01/09/2009 18:02][--a------] C:\Windows	asks\SCHEDLGU.TXT

   --------------------\  Listing des dossiers dans C:\ProgramData
   
   [08/05/2008|08:15] C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
   [13/01/2009|00:08] C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
   [02/03/2009|01:54] C:\ProgramData\Adobe
   [13/01/2009|00:04] C:\ProgramData\Apple
   [13/01/2009|00:07] C:\ProgramData\Apple Computer
   [02/11/2006|15:02] C:\ProgramData\Application Data 
   [09/03/2009|12:47] C:\ProgramData\Avira
   [29/10/2008|22:44] C:\ProgramData\Bureau 
   [04/11/2008|23:34] C:\ProgramData\CyberLink
   [02/11/2006|15:02] C:\ProgramData\Desktop 
   [02/11/2006|15:02] C:\ProgramData\Documents 
   [16/10/2008|07:34] C:\ProgramData\eSobi
   [29/10/2008|23:19] C:\ProgramData\ezsidmv.dat
   [29/10/2008|22:44] C:\ProgramData\Favoris 
   [02/11/2006|15:02] C:\ProgramData\Favorites 
   [08/05/2008|08:16] C:\ProgramData\FloodLightGames
   [27/06/2009|10:06] C:\ProgramData\Google
   [24/11/2008|19:30] C:\ProgramData\Hewlett-Packard
   [25/11/2008|08:30] C:\ProgramData\HP
   [10/03/2009|19:54] C:\ProgramData\HP Product Assistant
   [24/11/2008|19:36] C:\ProgramData\HPSSUPPLY
   [29/06/2009|14:21] C:\ProgramData\hpzinstall.log
   [17/12/2008|01:59] C:\ProgramData\Installations
   [07/03/2009|23:57] C:\ProgramData\jump program program.77yvu
   [07/03/2009|23:57] C:\ProgramData\jump program program.j0etxb
   [31/08/2009|20:52] C:\ProgramData\Malwarebytes
   [09/03/2009|12:58] C:\ProgramData\McAfee
   [29/10/2008|22:44] C:\ProgramData\Menu D‚marrer 
   [17/01/2009|22:47] C:\ProgramData\Messenger Plus!
   [03/02/2009|21:15] C:\ProgramData\Microsoft
   [03/02/2009|21:44] C:\ProgramData\Microsoft Help
   [29/10/2008|22:44] C:\ProgramData\ModŠles 
   [18/02/2009|22:58] C:\ProgramData\MyPhotoFun France
   [09/03/2009|12:59] C:\ProgramData\Okay meta anti lite
   [07/03/2009|23:57] C:\ProgramData\option dupe tool.63g5px8
   [23/11/2008|22:05] C:\ProgramData\PC Suite
   [31/10/2008|09:56] C:\ProgramData\SiteAdvisor
   [29/10/2008|23:15] C:\ProgramData\Skype
   [30/08/2009|19:47] C:\ProgramData\Spybot - Search & Destroy
   [02/11/2006|15:02] C:\ProgramData\Start Menu 
   [02/11/2006|15:02] C:\ProgramData\Templates 
   [09/03/2009|13:32] C:\ProgramData	rustface
   [24/11/2008|19:37] C:\ProgramData\WEBREG
   [05/11/2008|00:01] C:\ProgramData\WLInstaller
   [28/04/2009|01:36] C:\ProgramData\Yahoo!
   [19/05/2009|15:44] C:\ProgramData\Yahoo! Companion

   --------------------\  Listing des dossiers dans C:\Program Files

   [29/10/2008|22:49] C:\Program Files\Acer
   [04/11/2008|23:49] C:\Program Files\Acer GameZone
   [16/10/2008|07:35] C:\Program Files\Acer Inc
   [08/05/2008|08:02] C:\Program Files\Acer Incorporated
   [08/05/2008|08:15] C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
   [10/03/2009|13:55] C:\Program Files\Adobe
   [31/08/2009|00:00] C:\Program Files\Ad-remover
   [13/01/2009|00:05] C:\Program Files\Apple Software Update
   [13/04/2009|22:34] C:\Program Files\Athan
   [09/03/2009|12:47] C:\Program Files\Avira
   [08/05/2008|08:25] C:\Program Files\Big Kahuna Reef
   [13/01/2009|00:07] C:\Program Files\Bonjour
   [09/03/2009|13:04] C:\Program Files\Circl Developement
   [09/03/2009|12:58] C:\Program Files\Common Files
   [16/10/2008|07:27] C:\Program Files\Convesoft
   [08/05/2008|08:30] C:\Program Files\Cyberlink
   [23/11/2008|21:55] C:\Program Files\DIFX
   [04/11/2008|23:29] C:\Program Files\eSobi
   [19/07/2009|21:03] C:\Program Files\Fast Browser Search
   [29/10/2008|22:44] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
   [30/10/2008|21:28] C:\Program Files\FreeCall.com
   [28/06/2009|21:45] C:\Program Files\Google
   [24/11/2008|19:33] C:\Program Files\Hewlett-Packard
   [24/11/2008|19:36] C:\Program Files\HP
   [27/12/2008|20:45] C:\Program Files\InstallShield Installation Information
   [30/04/2008|09:21] C:\Program Files\Intel
   [29/01/2009|02:40] C:\Program Files\Internet Explorer
   [13/01/2009|00:07] C:\Program Files\iPod
   [13/01/2009|00:08] C:\Program Files\iTunes
   [31/08/2009|22:10] C:\Program Files\JetAudio
   [16/10/2008|07:30] C:\Program Files\Launch Manager
   [31/10/2008|14:29] C:\Program Files\L'Aventure Multimedia
   [22/05/2009|23:02] C:\Program Files\LingvoSoft
   [31/08/2009|20:52] C:\Program Files\Malwarebytes' Anti-Malware
   [30/04/2008|09:23] C:\Program Files\Marvell
   [23/05/2009|23:51] C:\Program Files\Messenger Plus! Live
   [29/10/2008|23:36] C:\Program Files\Microsoft
   [02/11/2006|14:37] C:\Program Files\Microsoft Games
   [26/08/2009|00:09] C:\Program Files\Microsoft Office
   [29/10/2008|23:17] C:\Program Files\Microsoft SQL Server Compact Edition
   [11/06/2009|09:12] C:\Program Files\Microsoft Works
   [08/05/2008|08:12] C:\Program Files\Microsoft.NET
   [08/05/2008|19:02] C:\Program Files\Movie Maker
   [02/11/2006|14:37] C:\Program Files\MSBuild
   [26/08/2009|00:08] C:\Program Files\MSECache
   [30/10/2008|08:58] C:\Program Files\MSXML 4.0
   [18/02/2009|22:25] C:\Program Files\MyPhotoFun France
   [29/10/2008|22:55] C:\Program Files\Neuf
   [08/05/2008|08:27] C:\Program Files\NewTech Infosystems
   [17/12/2008|02:00] C:\Program Files\Nokia
   [23/11/2008|21:54] C:\Program Files\PC Connectivity Solution
   [13/01/2009|00:06] C:\Program Files\QuickTime
   [08/12/2008|12:19] C:\Program Files\Real
   [16/10/2008|07:28] C:\Program Files\Realtek
   [02/11/2006|14:37] C:\Program Files\Reference Assemblies
   [14/08/2009|07:29] C:\Program Files\SGPSA
   [29/10/2008|23:15] C:\Program Files\Skype
   [30/08/2009|20:59] C:\Program Files\Spybot - Search & Destroy
   [30/04/2008|09:25] C:\Program Files\Synaptics
   [01/06/2009|11:18] C:\Program Files\TeamViewer3
   [31/08/2009|23:19] C:\Program Files\Trend Micro
   [02/11/2006|15:01] C:\Program Files\Uninstall Information
   [08/05/2008|19:02] C:\Program Files\Windows Calendar
   [08/05/2008|19:02] C:\Program Files\Windows Collaboration
   [08/05/2008|19:02] C:\Program Files\Windows Defender
   [08/05/2008|19:02] C:\Program Files\Windows Journal
   [05/11/2008|00:03] C:\Program Files\Windows Live
   [14/08/2009|07:29] C:\Program Files\Windows Mail
   [14/08/2009|07:37] C:\Program Files\Windows Media Player
   [29/10/2008|22:44] C:\Program Files\Windows NT
   [08/05/2008|19:02] C:\Program Files\Windows Photo Gallery
   [08/05/2008|19:02] C:\Program Files\Windows Sidebar
   [28/04/2009|01:36] C:\Program Files\Yahoo!

   --------------------\  Listing des dossiers dans C:\Program Files\Common Files

   [10/03/2009|13:55] C:\Program Files\Common Files\Adobe
   [13/01/2009|00:07] C:\Program Files\Common Files\Apple
   [31/10/2008|00:29] C:\Program Files\Common Files\DESIGNER
   [24/11/2008|19:33] C:\Program Files\Common Files\Hewlett-Packard
   [24/11/2008|19:35] C:\Program Files\Common Files\HP
   [27/12/2008|20:36] C:\Program Files\Common Files\InstallShield
   [08/05/2008|08:27] C:\Program Files\Common Files\LightScribe
   [06/03/2009|10:55] C:\Program Files\Common Files\microsoft shared
   [08/05/2008|08:26] C:\Program Files\Common Files\muvee Technologies
   [23/11/2008|21:55] C:\Program Files\Common Files\Nokia
   [23/11/2008|21:55] C:\Program Files\Common Files\PCSuite
   [08/12/2008|12:20] C:\Program Files\Common Files\Real
   [02/11/2006|13:18] C:\Program Files\Common Files\Services
   [29/10/2008|23:15] C:\Program Files\Common Files\Skype
   [02/11/2006|13:18] C:\Program Files\Common Files\SpeechEngines
   [03/02/2009|21:17] C:\Program Files\Common Files\System
   [29/10/2008|23:32] C:\Program Files\Common Files\Windows Live
   [29/10/2008|23:14] C:\Program Files\Common Files\WindowsLiveInstaller
   [08/12/2008|12:20] C:\Program Files\Common Files\xing shared

   --------------------\  Process

   ( 104 Processes )

   iexplore.exe ~ [PID:6136]
   iexplore.exe ~ [PID:4016]
   iexplore.exe ~ [PID:2988]
   iexplore.exe ~ [PID:4204]

   --------------------\  Recherche avec S_Lop

   C:\ProgramData\jump program program.77yvu
   C:\ProgramData\jump program program.j0etxb
   C:\ProgramData\option dupe tool.63g5px8
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\ProgramData\Okay meta anti lite
   C:\ProgramData\Okay meta anti lite\BOWS DOG.dat
   C:\Users\HIBA\AppData\Local\Temp
stB00E.tmp
   C:\Users\HIBA\AppData\Local\Temp
sx2D28.tmp
   C:\Users\HIBA\AppData\Roaming\MICROS~1\Windows\Cookies\hiba@advertising[2].txt
 
   --------------------\  Verification du Registre

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
   "Showbalm"="\"C:\ProgramData\jump program program.j0etxb\""
   "ANTI LITE TITLE DEBUG"="\"C:\ProgramData\option dupe tool.63g5px8\""

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-09-01 21:24:37
   Windows 6.0.6001 Service Pack 1 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 3
 
   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [F:3111][D:167]-> C:\Users\HIBA\AppData\Local\Temp
   [F:3278][D:1]-> C:\Users\HIBA\AppData\Roaming\MICROS~1\Windows\Cookies
   [F:1563][D:7]-> C:\Users\HIBA\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
   [F:6][D:2]-> C:\$Recycle.Bin

   1 - "C:\Lop SD\LopR_1.txt" - 01/09/2009|21:27 - Option : [1]

   --------------------\  Fin du rapport a 21:27:56
   [ UAC => 1 ]


quoi faire !! est ce que mon cher PC est sauvé ou pas encore :) lol

kduc · Answer

Salut,

Relance Lop S&D

* Choisis l'Option 2 (Suppression)
* Ne ferme pas la fenêtre lors de la suppression !
* Poste le rapport généré (C:\lopR.txt)

PS : si le Bureau ne réapparaît pas, fais Ctrl/Alt/Suppr, onglet "Fichier", 
Nouvelle tâche, tape explorer.exe et valide.

besthiba · Answer

Bonsoir, 

Voilà le rapport :
   
   --------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6001 ) Service Pack 1
   X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) Dual  CPU  T3200  @ 2.00GHz )
   BIOS : Ver 1.00PARTTBL
   USER : HIBA ( Administrator )
   BOOT : Normal boot
   C:\ (Local Disk) - NTFS - Total:69 Go (Free:30 Go)
   D:\ (Local Disk) - NTFS - Total:69 Go (Free:68 Go)
   E:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [2] ( 02/09/2009|21:47 )

   [ UAC => 1 ]


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\ProgramData\Okay meta anti lite\BOWS DOG.dat
   Supprime! - C:\Users\HIBA\AppData\Local\Temp
stB00E.tmp
   Supprime! - C:\Users\HIBA\AppData\Local\Temp
sx2D28.tmp
   Supprime! - C:\Users\HIBA\AppData\Roaming\MICROS~1\Windows\Cookies\hiba@advertising[2].txt
   Supprime! - C:\ProgramData\jump program program.77yvu
   Supprime! - C:\ProgramData\jump program program.j0etxb
   Supprime! - C:\ProgramData\option dupe tool.63g5px8
   Supprime! - C:\ProgramData\Okay meta anti lite
   -
   [ Fichier Hosts ] .. Restaure!
 
   \\\\\\\\\\\\\\\ 

 
   --------------------\  Listing des dossiers dans Local

   [13/03/2009|13:50] C:\Users\HIBA\AppData\Local\Adobe
   [13/01/2009|00:05] C:\Users\HIBA\AppData\Local\Apple
   [13/01/2009|00:32] C:\Users\HIBA\AppData\Local\Apple Computer
   [29/10/2008|22:48] C:\Users\HIBA\AppData\Local\Application Data 
   [31/03/2009|00:06] C:\Users\HIBA\AppData\Local\d3d9caps.dat
   [03/06/2009|11:38] C:\Users\HIBA\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
   [02/03/2009|02:00] C:\Users\HIBA\AppData\Local\GDIPFONTCACHEV1.DAT
   [11/07/2009|06:14] C:\Users\HIBA\AppData\Local\Google
   [29/10/2008|22:48] C:\Users\HIBA\AppData\Local\Historique 
   [02/09/2009|08:32] C:\Users\HIBA\AppData\Local\IconCache.db
   [18/02/2009|22:26] C:\Users\HIBA\AppData\Local\IsolatedStorage
   [27/08/2009|00:54] C:\Users\HIBA\AppData\Local\Microsoft
   [05/11/2008|15:06] C:\Users\HIBA\AppData\Local\Microsoft Help
   [18/02/2009|22:59] C:\Users\HIBA\AppData\Local\MyPhotoFun
   [02/09/2009|21:47] C:\Users\HIBA\AppData\Local\Temp
   [29/10/2008|22:48] C:\Users\HIBA\AppData\Local\Temporary Internet Files 
   [21/12/2008|22:50] C:\Users\HIBA\AppData\Local\VirtualStore
   [28/04/2009|01:55] C:\Users\HIBA\AppData\Local\Yahoo
 
   --------------------\  Tâches planifiées dans C:\Windows	asks

   [02/09/2009 21:19][--a------] C:\Windows	asks\GoogleUpdateTaskMachineUA.job
   [02/09/2009 20:50][--a------] C:\Windows	asks\GoogleUpdateTaskMachineCore.job
   [02/09/2009 20:50][--ah-----] C:\Windows	asks\SA.DAT
   [02/09/2009 08:32][--a------] C:\Windows	asks\SCHEDLGU.TXT

   --------------------\  Listing des dossiers dans C:\ProgramData
   
   [08/05/2008|08:15] C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
   [13/01/2009|00:08] C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
   [02/03/2009|01:54] C:\ProgramData\Adobe
   [13/01/2009|00:04] C:\ProgramData\Apple
   [13/01/2009|00:07] C:\ProgramData\Apple Computer
   [02/11/2006|15:02] C:\ProgramData\Application Data 
   [09/03/2009|12:47] C:\ProgramData\Avira
   [29/10/2008|22:44] C:\ProgramData\Bureau 
   [04/11/2008|23:34] C:\ProgramData\CyberLink
   [02/11/2006|15:02] C:\ProgramData\Desktop 
   [02/11/2006|15:02] C:\ProgramData\Documents 
   [16/10/2008|07:34] C:\ProgramData\eSobi
   [29/10/2008|23:19] C:\ProgramData\ezsidmv.dat
   [29/10/2008|22:44] C:\ProgramData\Favoris 
   [02/11/2006|15:02] C:\ProgramData\Favorites 
   [08/05/2008|08:16] C:\ProgramData\FloodLightGames
   [27/06/2009|10:06] C:\ProgramData\Google
   [24/11/2008|19:30] C:\ProgramData\Hewlett-Packard
   [25/11/2008|08:30] C:\ProgramData\HP
   [10/03/2009|19:54] C:\ProgramData\HP Product Assistant
   [24/11/2008|19:36] C:\ProgramData\HPSSUPPLY
   [29/06/2009|14:21] C:\ProgramData\hpzinstall.log
   [17/12/2008|01:59] C:\ProgramData\Installations
   [31/08/2009|20:52] C:\ProgramData\Malwarebytes
   [09/03/2009|12:58] C:\ProgramData\McAfee
   [29/10/2008|22:44] C:\ProgramData\Menu D‚marrer 
   [17/01/2009|22:47] C:\ProgramData\Messenger Plus!
   [03/02/2009|21:15] C:\ProgramData\Microsoft
   [03/02/2009|21:44] C:\ProgramData\Microsoft Help
   [29/10/2008|22:44] C:\ProgramData\ModŠles 
   [18/02/2009|22:58] C:\ProgramData\MyPhotoFun France
   [23/11/2008|22:05] C:\ProgramData\PC Suite
   [31/10/2008|09:56] C:\ProgramData\SiteAdvisor
   [29/10/2008|23:15] C:\ProgramData\Skype
   [30/08/2009|19:47] C:\ProgramData\Spybot - Search & Destroy
   [02/11/2006|15:02] C:\ProgramData\Start Menu 
   [02/11/2006|15:02] C:\ProgramData\Templates 
   [09/03/2009|13:32] C:\ProgramData	rustface
   [24/11/2008|19:37] C:\ProgramData\WEBREG
   [05/11/2008|00:01] C:\ProgramData\WLInstaller
   [28/04/2009|01:36] C:\ProgramData\Yahoo!
   [19/05/2009|15:44] C:\ProgramData\Yahoo! Companion

   --------------------\  Listing des dossiers dans C:\Program Files

   [29/10/2008|22:49] C:\Program Files\Acer
   [04/11/2008|23:49] C:\Program Files\Acer GameZone
   [16/10/2008|07:35] C:\Program Files\Acer Inc
   [08/05/2008|08:02] C:\Program Files\Acer Incorporated
   [08/05/2008|08:15] C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
   [10/03/2009|13:55] C:\Program Files\Adobe
   [31/08/2009|00:00] C:\Program Files\Ad-remover
   [13/01/2009|00:05] C:\Program Files\Apple Software Update
   [13/04/2009|22:34] C:\Program Files\Athan
   [09/03/2009|12:47] C:\Program Files\Avira
   [08/05/2008|08:25] C:\Program Files\Big Kahuna Reef
   [13/01/2009|00:07] C:\Program Files\Bonjour
   [09/03/2009|13:04] C:\Program Files\Circl Developement
   [09/03/2009|12:58] C:\Program Files\Common Files
   [16/10/2008|07:27] C:\Program Files\Convesoft
   [08/05/2008|08:30] C:\Program Files\Cyberlink
   [23/11/2008|21:55] C:\Program Files\DIFX
   [04/11/2008|23:29] C:\Program Files\eSobi
   [19/07/2009|21:03] C:\Program Files\Fast Browser Search
   [29/10/2008|22:44] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
   [30/10/2008|21:28] C:\Program Files\FreeCall.com
   [28/06/2009|21:45] C:\Program Files\Google
   [24/11/2008|19:33] C:\Program Files\Hewlett-Packard
   [24/11/2008|19:36] C:\Program Files\HP
   [27/12/2008|20:45] C:\Program Files\InstallShield Installation Information
   [30/04/2008|09:21] C:\Program Files\Intel
   [29/01/2009|02:40] C:\Program Files\Internet Explorer
   [13/01/2009|00:07] C:\Program Files\iPod
   [13/01/2009|00:08] C:\Program Files\iTunes
   [31/08/2009|22:10] C:\Program Files\JetAudio
   [16/10/2008|07:30] C:\Program Files\Launch Manager
   [31/10/2008|14:29] C:\Program Files\L'Aventure Multimedia
   [22/05/2009|23:02] C:\Program Files\LingvoSoft
   [31/08/2009|20:52] C:\Program Files\Malwarebytes' Anti-Malware
   [30/04/2008|09:23] C:\Program Files\Marvell
   [23/05/2009|23:51] C:\Program Files\Messenger Plus! Live
   [29/10/2008|23:36] C:\Program Files\Microsoft
   [02/11/2006|14:37] C:\Program Files\Microsoft Games
   [26/08/2009|00:09] C:\Program Files\Microsoft Office
   [29/10/2008|23:17] C:\Program Files\Microsoft SQL Server Compact Edition
   [11/06/2009|09:12] C:\Program Files\Microsoft Works
   [08/05/2008|08:12] C:\Program Files\Microsoft.NET
   [08/05/2008|19:02] C:\Program Files\Movie Maker
   [02/11/2006|14:37] C:\Program Files\MSBuild
   [26/08/2009|00:08] C:\Program Files\MSECache
   [30/10/2008|08:58] C:\Program Files\MSXML 4.0
   [18/02/2009|22:25] C:\Program Files\MyPhotoFun France
   [29/10/2008|22:55] C:\Program Files\Neuf
   [08/05/2008|08:27] C:\Program Files\NewTech Infosystems
   [17/12/2008|02:00] C:\Program Files\Nokia
   [23/11/2008|21:54] C:\Program Files\PC Connectivity Solution
   [13/01/2009|00:06] C:\Program Files\QuickTime
   [08/12/2008|12:19] C:\Program Files\Real
   [16/10/2008|07:28] C:\Program Files\Realtek
   [02/11/2006|14:37] C:\Program Files\Reference Assemblies
   [14/08/2009|07:29] C:\Program Files\SGPSA
   [29/10/2008|23:15] C:\Program Files\Skype
   [30/08/2009|20:59] C:\Program Files\Spybot - Search & Destroy
   [30/04/2008|09:25] C:\Program Files\Synaptics
   [01/06/2009|11:18] C:\Program Files\TeamViewer3
   [31/08/2009|23:19] C:\Program Files\Trend Micro
   [02/11/2006|15:01] C:\Program Files\Uninstall Information
   [08/05/2008|19:02] C:\Program Files\Windows Calendar
   [08/05/2008|19:02] C:\Program Files\Windows Collaboration
   [08/05/2008|19:02] C:\Program Files\Windows Defender
   [08/05/2008|19:02] C:\Program Files\Windows Journal
   [05/11/2008|00:03] C:\Program Files\Windows Live
   [14/08/2009|07:29] C:\Program Files\Windows Mail
   [14/08/2009|07:37] C:\Program Files\Windows Media Player
   [29/10/2008|22:44] C:\Program Files\Windows NT
   [08/05/2008|19:02] C:\Program Files\Windows Photo Gallery
   [08/05/2008|19:02] C:\Program Files\Windows Sidebar
   [28/04/2009|01:36] C:\Program Files\Yahoo!

   --------------------\  Listing des dossiers dans C:\Program Files\Common Files

   [10/03/2009|13:55] C:\Program Files\Common Files\Adobe
   [13/01/2009|00:07] C:\Program Files\Common Files\Apple
   [31/10/2008|00:29] C:\Program Files\Common Files\DESIGNER
   [24/11/2008|19:33] C:\Program Files\Common Files\Hewlett-Packard
   [24/11/2008|19:35] C:\Program Files\Common Files\HP
   [27/12/2008|20:36] C:\Program Files\Common Files\InstallShield
   [08/05/2008|08:27] C:\Program Files\Common Files\LightScribe
   [06/03/2009|10:55] C:\Program Files\Common Files\microsoft shared
   [08/05/2008|08:26] C:\Program Files\Common Files\muvee Technologies
   [23/11/2008|21:55] C:\Program Files\Common Files\Nokia
   [23/11/2008|21:55] C:\Program Files\Common Files\PCSuite
   [08/12/2008|12:20] C:\Program Files\Common Files\Real
   [02/11/2006|13:18] C:\Program Files\Common Files\Services
   [29/10/2008|23:15] C:\Program Files\Common Files\Skype
   [02/11/2006|13:18] C:\Program Files\Common Files\SpeechEngines
   [03/02/2009|21:17] C:\Program Files\Common Files\System
   [29/10/2008|23:32] C:\Program Files\Common Files\Windows Live
   [29/10/2008|23:14] C:\Program Files\Common Files\WindowsLiveInstaller
   [08/12/2008|12:20] C:\Program Files\Common Files\xing shared

   --------------------\  Process

   ( 100 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-09-02 21:47:45
   Windows 6.0.6001 Service Pack 1 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 3
 
   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [F:3116][D:165]-> C:\Users\HIBA\AppData\Local\Temp
   [F:3285][D:1]-> C:\Users\HIBA\AppData\Roaming\MICROS~1\Windows\Cookies
   [F:1543][D:7]-> C:\Users\HIBA\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
   [F:6][D:2]-> C:\$Recycle.Bin

   1 - "C:\Lop SD\LopR_1.txt" - 01/09/2009|21:27 - Option : [1]
   2 - "C:\Lop SD\LopR_2.txt" - 02/09/2009|21:50 - Option : [2]

   --------------------\  Fin du rapport a 21:50:57
   [ UAC => 1 ]

Merci bcp pour votre suivi mon cher expert  :)

kduc · Answer

Salut,

Télécharge Genproc : http://www.genproc.com/GenProc.exe ; 
puis, double-clique sur GenProc.exe et poste le contenu du rapport qui s'ouvre.

besthiba · Answer

voila le rapport :

Rapport GenProc 2.623 [1] - 03/09/2009 à 1:25:40 
@ Windows Vista Service Pack 1 - Mode normal
@ Internet Explorer (8.0.6001.18372) [Navigateur par défaut]

# Etape 1/ Télécharge :
 
- CCleaner https://www.ccleaner.com/ccleaner/download (FileHippo). Ce logiciel va permettre de supprimer tous les fichiers temporaires. Lance-le et clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures". Par la suite, laisse-le avec ses réglages par défaut. Ferme le programme.

- Toolbar-S&D https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2 (Team IDN) sur ton Bureau.


 Redémarre en mode sans échec comme indiqué ici https://www.wekyo.com/demarrer-le-pc-en-mode-sans-echec-windows-7-et-8/  ; Choisis ta session courante *** HIBA *** (pour retrouver le rapport, clique sur le raccourci "Rapport GenProc[1]" sur ton bureau).


# Etape 2/ 

 Lance Toolbar-S&D situé sur le Bureau. Tape sur "2" puis valide en appuyant sur "Entrée". Ne ferme pas la fenêtre lors de la suppression.

# Etape 3/ 

 Lance CCleaner : "Nettoyeur"/"lancer le nettoyage" et c'est tout.

# Etape 4/ 

 Redémarre normalement et poste, dans la même réponse : 

- Le contenu du rapport TB.txt situé dans C:\ ; 
- Un nouveau rapport HijackThis http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/hijackthis-version-install-sujet_199100_1.htm ;
- Un nouveau rapport GenProc ;

 Précise les difficultés que tu as eu (ce que tu n'as pas pu faire...) ainsi que l'évolution de la situation.

~~ Arguments de la procédure ~~


# Détections [1] GenProc 2.623 03/09/2009 à  1:26:12 
Toolbar:le 03/09/2009 à  1:26:43 "C:\Windows\iun6002.exe" 

----------------------------------------------------------------------
Sites officiels GenProc : www.alt-shift-return.org et www.genproc.com
----------------------------------------------------------------------

~~ Fin à  1:27:00 ~~

kduc · Answer

Salut,

Suis les étapes et poste les rapports.

besthiba · Answer

Bonsoir,

désolé pour le retard Cher expert mais j'avais du mal à faire cette étape :(

J’avais vraiment du mal à faire le mode de démarrage sans échec !!
Je l’ai fait quand même, mon bureau était bizarre, j’ai redémarré puis j’ai cliqué sur GenProc qui m’a affiché un apport par la suite :

Le voilà :
Rapport GenProc 2.623 [3] - 05/09/2009 à 0:13:29 
@ Windows Vista Service Pack 1 - Mode normal
@ Internet Explorer (8.0.6001.18372) [Navigateur par défaut]

# Etape 1/ Télécharge :
 
- Toolbar-S&D https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2 (Team IDN) sur ton Bureau.


 Redémarre en mode sans échec comme indiqué ici https://www.wekyo.com/demarrer-le-pc-en-mode-sans-echec-windows-7-et-8/  ; Choisis ta session courante *** HIBA *** (pour retrouver le rapport, clique sur le raccourci "Rapport GenProc[3]" sur ton bureau).


# Etape 2/ 

 Lance Toolbar-S&D situé sur le Bureau. Tape sur "2" puis valide en appuyant sur "Entrée". Ne ferme pas la fenêtre lors de la suppression.

# Etape 3/ 

 Lance CCleaner : "Nettoyeur"/"lancer le nettoyage" et c'est tout.

# Etape 4/ 

 Redémarre normalement et poste, dans la même réponse : 

- Le contenu du rapport TB.txt situé dans C:\ ; 
- Un nouveau rapport HijackThis http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/hijackthis-version-install-sujet_199100_1.htm ;
- Un nouveau rapport GenProc ;

 Précise les difficultés que tu as eu (ce que tu n'as pas pu faire...) ainsi que l'évolution de la situation.

~~ Arguments de la procédure ~~


# Détections [1] GenProc 2.623 03/09/2009 à  1:26:12 
Toolbar:le 03/09/2009 à  1:26:43 "C:\Windows\iun6002.exe" 

# Détections [2] GenProc 2.623 03/09/2009 à  1:28:27 

# Détections [3] GenProc 2.623 05/09/2009 à  0:13:31 
Toolbar:le 05/09/2009 à  0:13:50 "C:\Windows\iun6002.exe" 

----------------------------------------------------------------------
Sites officiels GenProc : www.alt-shift-return.org et www.genproc.com
----------------------------------------------------------------------

~~ Fin à  0:14:03 ~~

Voilà le Rapport toolBar :



   -----------\  ToolBar S&D 1.2.9   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6001 ) Service Pack 1
   X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) Dual  CPU  T3200  @ 2.00GHz )
   BIOS : Ver 1.00PARTTBL
   USER : HIBA ( Administrator )
   BOOT : Normal boot
   C:\ (Local Disk) - NTFS - Total:69 Go (Free:28 Go)
   D:\ (Local Disk) - NTFS - Total:69 Go (Free:68 Go)
   E:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)

   "C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
   Option : [2] ( 05/09/2009| 0:20 )

   [ UAC => 1 ]
   C:\Windows\iun6002.exe

   -----------\ SUPPRESSION

   Supprime! - C:\Windows\iun6002.exe

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\Windows\system32\blank.htm"
   "Search Page"="http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*https://fr.yahoo.com/?p=us"
   "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
   "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
   "Search Bar"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Default_search_url"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Url"="http://www.microsoft.com/athome/community/rss.xml"
   "Url"="http://rss.msn.com/en-us/?feedoutput=rss&ocid=iehrs&unsub=true"
   "Url"="http://www.microsoft.com/atwork/community/rss.xml"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="https://www.msn.com/fr-fr/"
   "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Local Page"="C:\Windows\System32\blank.htm"
   "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
   "Search Bar"="http://www.bing.com/spresults.aspx"


   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [ UAC => 1 ]


   1 - "C:\ToolBar SD\TB_1.txt" - 05/09/2009| 0:21 - Option : [2]

   -----------\  Fin du rapport a  0:21:09,02

besthiba · Answer

J’ai pas réussi à faire ça &#61516;

Le contenu du rapport TB.txt situé dans C:\ ;
Comment faire ??

Voila le rapport du HIjackThis, je l’avais déjà sur mon bureau :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:20:09, on 31/08/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18372)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\PLFSetI.exe
C:\Users\HIBA\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Athan\Athan.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Nokia\PC Internet Access\NPCIA.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\PC Connectivity Solution\Transports\NclIrSrv.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*https://fr.yahoo.com/?p=us
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*https://fr.yahoo.com/?p=us
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: SearchHelper Class - {91C18ED5-5E1C-4AE5-A148-A861DE8C8E16} - C:\Program Files\SGPSA\mtwb3sh.dll (file missing)
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Search Assistant - {F0626A63-410B-45E2-99A1-3F2475B2D695} - C:\Program Files\SGPSA\BHO.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [BkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [PLFSetI] C:\Windows\PLFSetI.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [ProductReg] "C:\Program Files\Acer\WR_PopUp\ProductReg.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Athan] C:\Program Files\Athan\Athan.exe
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [NokiaPCInternetAccess] "C:\Program Files\Nokia\PC Internet Access\NPCIA.exe" /b
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Showbalm] "C:\ProgramData\jump program program.j0etxb"
O4 - HKCU\..\Run: [ANTI LITE TITLE DEBUG] "C:\ProgramData\option dupe tool.63g5px8"
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix: 
O16 - DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} (Module de délivrance de certificat MINEFI) - https://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerVistaADP-2.0.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Service Google Update (gupdate1c9d52578b6163a) (gupdate1c9d52578b6163a) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

kduc · Answer

Salut,

Fait directement cela ...

" # Etape 3/ 
Poste un rapport Nod32 (il faut utiliser Internet Explorer) 
- coche toutes les cases à chaque fois, et lorsque c'est terminé, colle le rapport : 
C:\Program Files\EsetOnlineScanner\log.txt "

Donc ...

Lance un scan Nod32 : https://www.eset.com/ 
(il faut utiliser Internet Explorer)

Coche toutes les cases à chaque fois ; une fois le scan achevé, colle le rapport : 

-> C:\Program Files\EsetOnlineScanner\log.txt <-- le rapport

besthiba · Answer

Bonsoir mon expert :)

ça fait des jours j'essaye de teléchatger cet anti-virus mais ça marche pas arrivant à 44% il arrête de scanner 

Koi faire SVP :( ?

kduc · Answer

Salut,

Clique droit sur ce lien pour installer ComboFix (par sUBs) :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Choisis "Enregistrer sous" (dans IE c'est "Enregistrer la cible/le lien sous..")
et sauvegarde-le (Enregistrer dans) sur le Bureau.

Important : dans "Nom du fichier" enregistre (renomme) "combofix" en combo-fix.exe

Prends connaissance de ce tutoriel : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

Ferme toutes les fenêtres et applications. 
Déconnecte-toi du net et désactive tes protections résidentes :
https://forum.pcastuces.com/default.asp

! IMPORTANT ! ...A ce stade, désactive l' UAC : http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/desactiver-controle-utilisateurs-sujet_198996_1.htm

Sur le bureau, double clique combo-fix.exe.
Tape sur la touche Y (Yes) pour démarrer le scan.
ComboFix redémarrera ton PC.
Lorsque le scan sera complété, un rapport apparaîtra. 
Copie/colle ce rapport dans ta prochaine réponse et nouveau rapport hijackthis.

PS : Le rapport se trouve également ici : C:\Combofix.txt

Ne clique pas dans la fenêtre de Combofix durant l’analyse : cela pourrait provoquer le gel du programme !

besthiba · Answer

Bonjour cher expert, :) :)

Je vous remercie infiniment pour votre aide :) 

voilà le rapport :

ComboFix 09-09-11.01 - HIBA 12/09/2009 11:53.2.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium   6.0.6001.1.1252.33.1036.18.3000.1856 [GMT 2:00]
Lancé depuis: c:\users\HIBA\Desktop\combo-fix.exe.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-3066969076-1937047056-318044926-500
c:\program files\Fast Browser Search
c:\program files\Fast Browser Search\IE\1.bat
c:\program files\Fast Browser Search\IE\about.html
c:\program files\Fast Browser Search\IE\affid.dat
c:\program files\Fast Browser Search\IE\basis.xml
c:\program files\Fast Browser Search\IE\BHO.dll
c:\program files\Fast Browser Search\IE\ClearRecycleBin.exe
c:\program files\Fast Browser Search\IE\error.html
c:\program files\Fast Browser Search\IE\fbsProtection.xml
c:\program files\Fast Browser Search\IE\FbsSearchProvider.xml
c:\program files\Fast Browser Search\IE\FbsSearchProviderIE8.exe
c:\program files\Fast Browser Search\IE\FBStoolbar.dll
c:\program files\Fast Browser Search\IE\icons.bmp
c:\program files\Fast Browser Search\IE\info.txt
c:\program files\Fast Browser Search\IE\local.xml
c:\program files\Fast Browser Search\IE\logobg.bmp
c:\program files\Fast Browser Search\IE\MTWBtoolbar.html
c:\program files\Fast Browser Search\IE\search.bmp
c:\program files\Fast Browser Search\IE\SearchGuardPlus.exe
c:\program files\Fast Browser Search\IE\SearchGuardPlus.ico
c:\program files\Fast Browser Search\IE\SGPU.ico
c:\program files\Fast Browser Search\IE\sgpUpdater.exe
c:\program files\Fast Browser Search\IE\sgpUpdater.xml
c:\program files\Fast Browser Search\IE\SGPUpdaterS.exe
c:\program files\Fast Browser Search\IE	bs_include_script_003175.js
c:\program files\Fast Browser Search\IE	bs_include_script_005064.js
c:\program files\Fast Browser Search\IE	bs_include_script_012817.js
c:\program files\Fast Browser Search\IE\Toolbar Help.htm
c:\program files\Fast Browser Search\IE\uninstall.exe
c:\program files\Fast Browser Search\IE\uninstalSGP.exe
c:\program files\Fast Browser Search\IE\uninstalSGPU.exe
c:\program files\Fast Browser Search\IE\update.exe
c:\program files\Fast Browser Search\IE\version.txt
c:\program files\SGPSA
c:\program files\SGPSA\BHO.dll
c:ecycler\S-1-5-21-6299470188-7406144504-541983239-2526
c:\windows\Installer\178011.msi
c:\windows\Suyin.reg

.
(((((((((((((((((((((((((((((   Fichiers créés du 2009-08-12 au 2009-09-12  ))))))))))))))))))))))))))))))))))))
.

2009-09-12 10:00 . 2009-09-12 10:00	--------	d-----w-	c:\users\Default\AppData\Local	emp
2009-09-09 19:56 . 2009-08-14 17:07	897608	----a-w-	c:\windows\system32\drivers	cpip.sys
2009-09-07 00:33 . 2009-09-07 00:33	--------	d-----w-	c:\program files\ESET
2009-09-03 22:42 . 2009-09-04 22:21	--------	d-----w-	C:\ToolBar SD
2009-09-03 22:37 . 2009-09-03 22:37	--------	d-----w-	c:\program files\CCleaner
2009-09-02 23:25 . 2009-09-04 22:37	--------	d-----w-	C:\GenProc
2009-09-02 18:56 . 2009-08-28 12:39	28672	----a-w-	c:\windows\system32\Apphlpdm.dll
2009-09-02 18:56 . 2009-08-28 10:15	4240384	----a-w-	c:\windows\system32\GameUXLegacyGDFs.dll
2009-09-01 19:23 . 2009-09-02 19:50	--------	d-----w-	C:\Lop SD
2009-08-31 21:19 . 2009-08-31 21:19	--------	d-----w-	c:\program files\Trend Micro
2009-08-31 18:52 . 2009-08-03 11:36	38160	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-31 18:52 . 2009-08-31 18:52	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-08-31 18:52 . 2009-08-31 18:52	--------	d-----w-	c:\programdata\Malwarebytes
2009-08-31 18:52 . 2009-08-03 11:36	19096	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-08-30 19:04 . 2009-06-15 15:21	499712	----a-w-	c:\windows\system32\kerberos.dll
2009-08-30 19:04 . 2009-06-15 15:24	175104	----a-w-	c:\windows\system32\wdigest.dll
2009-08-30 19:04 . 2009-06-15 15:24	270848	----a-w-	c:\windows\system32\schannel.dll
2009-08-30 19:04 . 2009-06-15 15:23	1256448	----a-w-	c:\windows\system32\lsasrv.dll
2009-08-30 19:04 . 2009-06-15 15:22	213504	----a-w-	c:\windows\system32\msv1_0.dll
2009-08-30 19:04 . 2009-06-15 18:20	439896	----a-w-	c:\windows\system32\drivers\ksecdd.sys
2009-08-30 19:04 . 2009-06-15 15:24	72704	----a-w-	c:\windows\system32\secur32.dll
2009-08-30 19:04 . 2009-06-15 12:57	9728	----a-w-	c:\windows\system32\lsass.exe
2009-08-30 17:34 . 2009-08-30 22:00	--------	d-----w-	c:\program files\Ad-remover
2009-08-26 22:05 . 2009-08-30 18:59	--------	d-----w-	c:\program files\Spybot - Search & Destroy
2009-08-26 22:05 . 2009-08-30 17:47	--------	d-----w-	c:\programdata\Spybot - Search & Destroy
2009-08-26 20:54 . 2009-08-26 20:54	--------	d-----w-	c:\users\HIBA\AppData\Roaming\Malwarebytes
2009-08-26 01:01 . 2009-06-22 10:22	2048	----a-w-	c:\windows\system32	zres.dll
2009-08-25 22:08 . 2009-08-25 22:08	--------	d-----w-	c:\program files\MSECache

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-12 09:11 . 2008-10-29 21:16	--------	d-----w-	c:\users\HIBA\AppData\Roaming\Skype
2009-09-12 06:04 . 2008-10-29 21:19	--------	d-----w-	c:\users\HIBA\AppData\Roaming\skypePM
2009-09-10 05:05 . 2006-11-02 11:18	--------	d-----w-	c:\program files\Windows Mail
2009-09-08 21:34 . 2008-05-08 15:56	49472	----a-w-	c:\windows\system32\perfh00C.dat
2009-09-08 21:34 . 2008-05-08 15:56	11720	----a-w-	c:\windows\system32\perfc00C.dat
2009-08-31 20:10 . 2008-12-18 20:14	--------	d-----w-	c:\program files\JetAudio
2009-08-14 16:29 . 2009-09-09 19:55	17920	----a-w-	c:\windows\system32
etevent.dll
2009-08-14 16:29 . 2009-09-09 19:55	104960	----a-w-	c:\windows\system32
etiohlp.dll
2009-08-14 14:16 . 2009-09-09 19:55	9728	----a-w-	c:\windows\system32\TCPSVCS.EXE
2009-08-14 14:16 . 2009-09-09 19:55	17920	----a-w-	c:\windows\system32\ROUTE.EXE
2009-08-14 14:16 . 2009-09-09 19:55	11264	----a-w-	c:\windows\system32\MRINFO.EXE
2009-08-14 14:16 . 2009-09-09 19:55	27136	----a-w-	c:\windows\system32\NETSTAT.EXE
2009-08-14 14:16 . 2009-09-09 19:55	19968	----a-w-	c:\windows\system32\ARP.EXE
2009-08-14 14:16 . 2009-09-09 19:55	8704	----a-w-	c:\windows\system32\HOSTNAME.EXE
2009-08-14 14:16 . 2009-09-09 19:55	10240	----a-w-	c:\windows\system32\finger.exe
2009-07-17 14:35 . 2009-08-13 03:25	71680	----a-w-	c:\windows\system32\atl.dll
2009-07-14 13:00 . 2009-08-13 03:24	313344	----a-w-	c:\windows\system32\wmpdxm.dll
2009-07-14 12:59 . 2009-08-13 03:24	4096	----a-w-	c:\windows\system32\dxmasf.dll
2009-07-14 12:58 . 2009-08-13 03:24	7680	----a-w-	c:\windows\system32\spwmp.dll
2009-07-14 10:59 . 2009-08-13 03:24	8147456	----a-w-	c:\windows\system32\wmploc.DLL
2009-07-11 19:32 . 2009-09-09 19:55	513024	----a-w-	c:\windows\system32\wlansvc.dll
2009-07-11 19:32 . 2009-09-09 19:55	302592	----a-w-	c:\windows\system32\wlansec.dll
2009-07-11 19:32 . 2009-09-09 19:55	293376	----a-w-	c:\windows\system32\wlanmsm.dll
2009-07-11 19:29 . 2009-09-09 19:55	127488	----a-w-	c:\windows\system32\L2SecHC.dll
2009-06-29 12:21 . 2008-11-24 17:22	146288	----a-w-	c:\windows\hpoins18.dat
2009-06-15 15:24 . 2009-07-15 06:04	156672	----a-w-	c:\windows\system32	2embed.dll
2009-06-15 15:20 . 2009-07-15 06:04	72704	----a-w-	c:\windows\system32\fontsub.dll
2009-06-15 15:20 . 2009-07-15 06:04	10240	----a-w-	c:\windows\system32\dciman32.dll
2009-06-15 12:52 . 2009-07-15 06:04	289792	----a-w-	c:\windows\system32\atmfd.dll
2008-10-16 15:00 . 2008-10-16 14:58	8192	--sha-w-	c:\windows\Users\Default\NTUSER.DAT
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-05-14 15:05	121392	----a-w-	c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-26 1232896]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-04-16 1079808]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-28 39408]
"NokiaPCInternetAccess"="c:\program files\Nokia\PC Internet Access\NPCIA.exe" [2008-05-07 536576]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-03-18 4363504]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"WindowsWelcomeCenter"="oobefldr.dll" - c:\windows\System32\oobefldr.dll [2008-01-21 2153472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-25 1049896]
"BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-06 34040]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-07-16 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-07-16 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-07-16 145944]
"PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-09-10 809480]
"eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-05-14 526896]
"ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-06-11 409600]
"ProductReg"="c:\program files\Acer\WR_PopUp\ProductReg.exe" [2008-09-23 6144]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"TkBellExe"="c:\program files\Common Files\Real\Update_OBealsched.exe" [2008-12-08 185872]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-12-08 29744]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"Athan"="c:\program files\Athan\Athan.exe" [2009-01-18 1081344]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-06-13 6183456]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{094339B4-DC9A-4360-BD84-3F092D663E07}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{630EE3C1-2814-48EE-A950-11CD55D32643}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{7B7DEEEB-D07C-4D91-9E38-F857C78E87AD}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe
"{85FDDE5B-8CBC-4798-B06D-8EC8E0C59F70}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe
"{700982FC-837F-4B5A-9A78-2CBD0B8EB989}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe
"{1EC0BE30-C5C4-4D30-8DDA-FDFEE6BEFF0F}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe
"{89DA007C-73BF-4DD5-92F4-A6479FA63BA8}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe
"{54955791-5D79-4470-BEFE-6EECB7BB4EF4}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe
"{E0025EC9-154E-4225-AD81-E6274D2A9539}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{6AA1A1C3-AA85-4BAB-847E-203D58F3E99C}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{4124DF1A-AC30-4A82-8B14-C436E8FBC55C}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{AED1D4E6-9542-4B83-ABBF-6EDB5825987A}"= UDP:c:\program files\FreeCall.com\FreeCall\FreeCall.exe:FreeCall
"{C0672EF7-E98A-4A47-977C-E5A316A873D9}"= TCP:c:\program files\FreeCall.com\FreeCall\FreeCall.exe:FreeCall
"{A189041B-2891-47CE-9C6C-D5055E6D1D4B}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{1AE16A21-4506-4385-B9EB-94DD7F0AC453}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{731A4575-B7A7-45FD-893D-1DA00CD570ED}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{BE573602-3406-4ACA-A520-87CECCE89DAB}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{2FFD9A91-AF6D-4E33-8C3F-55843A2D9682}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{A5EADEFD-CFAE-4F5A-A71A-F24AE978FF39}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{2B43D934-3468-42D2-AF6C-CFD9445E0C62}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger

R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [03/03/2008 13:11 16384]
R2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [08/05/2008 08:30 24576]
R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [06/04/2008 22:42 50424]
S2 gupdate1c9d52578b6163a;Service Google Update (gupdate1c9d52578b6163a);c:\program files\Google\Update\GoogleUpdate.exe [15/05/2009 08:22 133104]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [04/04/2008 03:03 131072]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [21/01/2008 04:23 179712]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [08/12/2008 12:17 29744]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32undll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contenu du dossier 'Tâches planifiées'

2009-09-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-15 06:21]

2009-09-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-15 06:21]
.
.
------- Examen supplémentaire -------
.
mWindow Title = 
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*https://fr.yahoo.com/?p=us
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} - hxxps://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerVistaADP-2.0.cab
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-eRecoveryService - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-12 12:00
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Heure de fin: 2009-09-12 12:02
ComboFix-quarantined-files.txt  2009-09-12 10:02

Avant-CF: 33 194 835 968 octets libres
Après-CF: 33 033 183 232 octets libres

255	--- E O F ---	2009-09-10 19:38

et voila le 2ème rapport

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:03:52, on 12/09/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18372)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Windows\system32\igfxext.exe
C:\Program Files\Athan\Athan.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Nokia\PC Internet Access\NPCIA.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\PC Connectivity Solution\Transports\NclIrSrv.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32
otepad.exe
C:\Windows\system32\conime.exe
C:\Windows\Explorer.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*https://fr.yahoo.com/?p=us
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [BkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [PLFSetI] C:\Windows\PLFSetI.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [ProductReg] "C:\Program Files\Acer\WR_PopUp\ProductReg.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Athan] C:\Program Files\Athan\Athan.exe
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [NokiaPCInternetAccess] "C:\Program Files\Nokia\PC Internet Access\NPCIA.exe" /b
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O16 - DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} (Module de délivrance de certificat MINEFI) - https://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerVistaADP-2.0.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Service Google Update (gupdate1c9d52578b6163a) (gupdate1c9d52578b6163a) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

kduc · Answer

Salut,

Télécharge FindyKill (de Chiquitine29) sur ton bureau : 

http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe 

! Déconnecte-toi et ferme toutes applications en cours ! 

• Double clique sur "FindyKill.exe" pour lancer l'installation et laisse les paramètres d'installation par défaut. 

• Branche tes sources de données externes au PC (clé USB, disque dur externe, etc ...). 

• Clique droit sur le raccourci FindyKill présent sur ton bureau et choisis "éxécuter en tant qu'administrateur" . 

• Au menu principal, choisis l'option F pour français et tape sur [entrée]. 

• Au second menu, choisis l'option 1 (recherche) et tape sur [entrée]. 

Laisse l' outil travailler ... Et, ne touche à rien ! 

-> Poste le rapport qui apparait à la fin du scan. 

(le rapport est concervé sous C:\FindyKill.txt) 
(Ctrl+A pour tout selectionner , Ctrl+C pour copier et Ctrl+V pour coller) 

Aides en images : http://pagesperso-orange.fr/NosTools/findykill.html

besthiba · Answer

Bonsoir,

Voilà la rapport :


############################## | FindyKill V5.011 |

# User : HIBA (Administrateurs) # PC-HIBA
# Update on 11/09/2009 by Chiquitine29
# Start at: 01:13:27 | 13/09/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html

# Intel(R) Pentium(R) Dual  CPU  T3200  @ 2.00GHz
# Microsoft® Windows Vista™ Édition Familiale Premium  (6.0.6001 32-bit) # Service Pack 1
# Internet Explorer 8.0.6001.18372
# Windows Firewall Status : Enabled

# C:\ # Disque fixe local # 69,65 Go (30,2 Go free) [ACER] # NTFS
# D:\ # Disque fixe local # 69,64 Go (68,71 Go free) [DATA] # NTFS
# E:\ # Disque CD-ROM # 0 Mo (0 Mo free) [Audio CD] # CDFS
# F:\ # Disque amovible # 1,86 Go (51,72 Mo free) [KINGSTON] # FAT

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\PLFSetI.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Athan\Athan.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Nokia\PC Internet Access\NPCIA.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\HIBA\AppData\Local\Temp\RtkBtMnt.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\agrsmsvc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Acer\Mobility Center\MobilityService.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Windows\System32\svchost.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclIrSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe

################## | C: |

Présent ! F:\autorun.inf  

################## | C:\Windows |


################## | C:\Windows\system32 |


################## | C:\Windows\system32\drivers |


################## | C:\Users\HIBA\AppData\Roaming |


################## | Temporary Internet Files |


################## | Registre / Clés infectieuses |

Présent ! [HKLM\software\microsoft\security center] "AntiVirusDisableNotify"  
Présent ! [HKLM\software\microsoft\security center] "FirewallDisableNotify"  
Présent ! [HKLM\software\microsoft\security center\Svc] "AntiVirusOverride"  
Présent ! [HKLM\software\microsoft\security center\Svc] "FirewallOverride"  
Présent ! [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableRegistryTools"  

################## | Etat / Services / Informations |

# Affichage des fichiers cachés : OK
 
# Mode sans echec : OK

# (!) Uac = 0x0 
 
# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 ) 
# EapHost -> Start = 3 ( Good = 2 | Bad = 4 ) 
# Wlansvc -> Start = 2 ( Good = 2 | Bad = 4 ) 
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 ) 
# windefend -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 ) 


################## | Cracks / Keygens / Serials |


################## | ! Fin du rapport # FindyKill V5.011 ! |

kduc · Answer

Salut,

! Déconnecte toi et ferme toutes application en cours (navigateur compris). 

• Branche tes sources de données externes au PC (clé USB, disque dur externe, etc ...). 

• Clique droit sur le raccourci FindyKill présent sur ton bureau et choisis "éxécuter en tant qu'administrateur".

• Au menu principal, choisis l'option F pour français et tape sur [entrée]. 

• Au second menu, choisis l'option 2 (suppression) et tape sur [entrée]. 

• Le PC va redémarrer automatiquement ... 

Le programme va travailler : ne touche à rien ... !
Ton bureau ne sera pas accessible, c est normal ! 

-> Poste le rapport qui apparait à la fin (le rapport est conservé sous C:\FindyKill.txt) 

/!\ Si le Bureau ne réapparait pas, presse Ctrl+Alt+Suppr, onglet "Fichier", "Nouvelle tâche", 
tape explorer.exe et valide. 

Aides en images : http://pagesperso-orange.fr/NosTools/findykill.html