Aidez moi sur l'analyse de mon scan

gabrielcash Messages postés 3 Statut Membre -  
kalimusic Messages postés 14619 Statut Contributeur sécurité -
Bonjour,
mon ordi a ramé du jour au lendemain sans savoir pourquoi,peut etre est ce le fait de telecharger des mises a jours... cela dit j'ai fait un scan de mon pc et voila le resultat

MSIE: Internet Explorer v8.00 (8.00.6001.18828)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\CyberLink\PCM4Everio\EverioService.exe
C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Piolet\Piolet.exe
C:\Program Files\PowerArchiver\PASTARTER.EXE
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Windows\system32\igfxsrvc.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Windows\System32\mobsync.exe
C:\PROGRA~1\WI1F86~1\MESSEN~1\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10c.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Users\jerome\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VEM2GMJN\HiJackThis[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O1 - Hosts: ::1 localhost
O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb127\Dealio.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb127\Dealio.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: My &Search Bar - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ALaunch] C:\Acer\ALaunch\AlaunchClient.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [SetPanel] C:\Acer\APanel\APanel.cmd
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [EverioService] "C:\Program Files\CyberLink\PCM4Everio\EverioService.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe" /autorun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Piolet] C:\Program Files\Piolet\Piolet.exe SILENT
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [PowerArchiver Tray] C:\Program Files\PowerArchiver\PASTARTER.EXE
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [AutoStartNPSAgent] C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
O4 - Startup: RegFreeze.lnk = C:\Program Files\RegFreeze\regfreeze.exe
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Users\jerome\AppData\LocalLow\Dealio\kb127\res\DealioSearch.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O13 - Gopher Prefix:
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://ma-config.com/activex/hardwaredetection_3_1_0_4.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe
O23 - Service: Service Google Update (gupdate1c9951ef46252e6) (gupdate1c9951ef46252e6) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: R54G Wireless Service - Unknown owner - C:\Program Files\Wireless 802.11g Monitor\WLService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 11766 bytes

si quelqu'un peut m'aider pour savoir si tout va bien ou s'il y a un souci avec un virus ou autre?

d'avance merci
Configuration: Windows Vista Internet Explorer 8.0

7 réponses

  1.
    kalimusic Messages postés 14619 Statut Contributeur sécurité 3 027
     
    Bonsoir,

    Ferme toutes tes applications en cours.

    * Télécharge ToolBarS&D ici : https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cpVobGk5bHnxrhQ4yaoEUDJvOYNnEGyYjgqHZz5GqZLfutR3fMFPlsC3-CGIilfupPAguYATNyua3csodN_frdMK8sSzUpit10Yac-QJCOkMqJKkbdKcP6ySs8trWPgoNVIq4TGGWCe6o0txXQv-ZueJF9vZzw3RXsGwFYIqN2lvF2LPdQzS8mE1d5kWOVOz6EMzQuE5-lClSJM869uq3oc7-t7yg%3D%3D&attredirects=3
    et lance l'installation en double-cliquant sur l'icône
    * Une fois installé, un raccourci sera crée sur le bureau.
    * Clic-droit "Exécuter en tant qu'administrateur" pour démarrer l'outil
    * Clique sur F puis Entrée pour la langue
    * Tape 1 puis valide sur Entrée pour lancer la recherche

    ! ! Pendant la recherche l'écran devient rouge !!
    => Patiente jusqu'à la fin de la recherche cela peut prendre plusieurs minutes, ne touche à rien.

    * A la fin, Le rapport s'ouvre au format bloc-note
    * Enregistre-le, copie-colle ce rapport dans la réponse

    Le rapport se trouve également dans ce répertoire : C:\TB.txt

    A +
    0
  2. gabrielcash Messages postés 3 Statut Membre
     
    je vais essayer merci
    0
  3. gabrielcash Messages postés 3 Statut Membre
     
    voila le resultat,y'a t'il quelque chose d'anormal?
    d'avance merci

    -----------\\ ToolBar S&D 1.2.9 XP/Vista

    Microsoft® Windows Vista™ Édition Familiale Basique ( v6.0.6002 ) Service Pack 2
    X86-based PC ( Multiprocessor Free : Intel(R) Celeron(R) CPU 550 @ 2.00GHz )
    BIOS : Default System BIOS
    USER : jerome ( Administrator )
    BOOT : Normal boot
    C:\ (Local Disk) - NTFS - Total:50 Go (Free:17 Go)
    D:\ (Local Disk) - NTFS - Total:49 Go (Free:27 Go)
    F:\ (CD or DVD)

    "C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
    Option : [1] ( 14/11/2009|15:04 )

    [ UAC => 1 ]

    -----------\\ Recherche de Fichiers / Dossiers ...

    C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Dealio
    C:\Program Files\Dealio
    C:\Program Files\Dealio\DealioAU.exe
    C:\Program Files\Dealio\kb127
    C:\Program Files\Dealio\SearchSettingsKit.exe
    C:\Program Files\Dealio\kb127\Dealio Deskbar.exe
    C:\Program Files\Dealio\kb127\Dealio.dll
    C:\Program Files\Dealio\kb127\DealioRes409.dll
    C:\Program Files\Dealio\kb127\res
    C:\Program Files\Dealio\kb127\resDN
    C:\Program Files\Dealio\kb127\rules
    C:\Program Files\Dealio\kb127\temp
    C:\Program Files\Dealio\kb127\res\alerts.gif
    C:\Program Files\Dealio\kb127\res\alerts_over.gif
    C:\Program Files\Dealio\kb127\res\alerts_rec.gif
    C:\Program Files\Dealio\kb127\res\alerts_rec_over.gif
    C:\Program Files\Dealio\kb127\res\chevron-small.gif
    C:\Program Files\Dealio\kb127\res\DealioSearch.html
    C:\Program Files\Dealio\kb127\res\deals-leftcap.gif
    C:\Program Files\Dealio\kb127\res\deal_report.jpg
    C:\Program Files\Dealio\kb127\res\ebay_login.jpg
    C:\Program Files\Dealio\kb127\res\err_mainwindow.html
    C:\Program Files\Dealio\kb127\res\err_toolbar.html
    C:\Program Files\Dealio\kb127\res\global_scripts.js
    C:\Program Files\Dealio\kb127\res\headerbgthin.jpg
    C:\Program Files\Dealio\kb127\res\highlight-bg.png
    C:\Program Files\Dealio\kb127\res\logo.gif
    C:\Program Files\Dealio\kb127\res\logo_over.gif
    C:\Program Files\Dealio\kb127\res\man_toolbar.css
    C:\Program Files\Dealio\kb127\res\man_toolbar.html
    C:\Program Files\Dealio\kb127\res\man_toolbar.js
    C:\Program Files\Dealio\kb127\res\man_toolbarl.js
    C:\Program Files\Dealio\kb127\res\post-this-deal.gif
    C:\Program Files\Dealio\kb127\res\post-this-deal_over.gif
    C:\Program Files\Dealio\kb127\res\scripts.js
    C:\Program Files\Dealio\kb127\res\scroller.js
    C:\Program Files\Dealio\kb127\res\search-chevron.gif
    C:\Program Files\Dealio\kb127\res\search-chevron_over.gif
    C:\Program Files\Dealio\kb127\res\search_bg_blink.gif
    C:\Program Files\Dealio\kb127\res\separator.gif
    C:\Program Files\Dealio\kb127\res\settings.gif
    C:\Program Files\Dealio\kb127\res\settings_over.gif
    C:\Program Files\Dealio\kb127\res\yahoo-search.png
    C:\Program Files\Dealio\kb127\resDN\bottom.gif
    C:\Program Files\Dealio\kb127\resDN\chevron_down.gif
    C:\Program Files\Dealio\kb127\resDN\chevron_up.gif
    C:\Program Files\Dealio\kb127\resDN\close.gif
    C:\Program Files\Dealio\kb127\resDN\deskbar.css
    C:\Program Files\Dealio\kb127\resDN\deskbar.js
    C:\Program Files\Dealio\kb127\resDN\dispatch_helper.js
    C:\Program Files\Dealio\kb127\resDN\ebay_compatible.jpg
    C:\Program Files\Dealio\kb127\resDN\logo.gif
    C:\Program Files\Dealio\kb127\resDN\logo_chevron_bkg.gif
    C:\Program Files\Dealio\kb127\resDN\losing.gif
    C:\Program Files\Dealio\kb127\resDN\lost.gif
    C:\Program Files\Dealio\kb127\resDN\man_deskbar.html
    C:\Program Files\Dealio\kb127\resDN\menu_arrow.gif
    C:\Program Files\Dealio\kb127\resDN\menu_check.gif
    C:\Program Files\Dealio\kb127\resDN\no_image.gif
    C:\Program Files\Dealio\kb127\resDN\prod_img.gif
    C:\Program Files\Dealio\kb127\resDN\search_chevron.gif
    C:\Program Files\Dealio\kb127\resDN\spacer.gif
    C:\Program Files\Dealio\kb127\resDN\textfield_bkg.gif
    C:\Program Files\Dealio\kb127\resDN\top.gif
    C:\Program Files\Dealio\kb127\resDN\unknown.gif
    C:\Program Files\Dealio\kb127\resDN\winning.gif
    C:\Program Files\Dealio\kb127\resDN\won.gif
    C:\Program Files\Dealio\kb127\rules\index.76.35
    C:\Program Files\Dealio\kb127\rules\rules.1.10.76
    C:\Program Files\Dealio\kb127\rules\rules.1.109.43
    C:\Program Files\Dealio\kb127\rules\rules.1.110.43
    C:\Program Files\Dealio\kb127\rules\rules.1.12.52
    C:\Program Files\Dealio\kb127\rules\rules.1.13.58
    C:\Program Files\Dealio\kb127\rules\rules.1.130.58
    C:\Program Files\Dealio\kb127\rules\rules.1.135.50
    C:\Program Files\Dealio\kb127\rules\rules.1.153.44
    C:\Program Files\Dealio\kb127\rules\rules.1.155.43
    C:\Program Files\Dealio\kb127\rules\rules.1.156.49
    C:\Program Files\Dealio\kb127\rules\rules.1.16.60
    C:\Program Files\Dealio\kb127\rules\rules.1.161.52
    C:\Program Files\Dealio\kb127\rules\rules.1.178.66
    C:\Program Files\Dealio\kb127\rules\rules.1.184.55
    C:\Program Files\Dealio\kb127\rules\rules.1.188.52
    C:\Program Files\Dealio\kb127\rules\rules.1.189.45
    C:\Program Files\Dealio\kb127\rules\rules.1.196.43
    C:\Program Files\Dealio\kb127\rules\rules.1.198.56
    C:\Program Files\Dealio\kb127\rules\rules.1.199.43
    C:\Program Files\Dealio\kb127\rules\rules.1.200.53
    C:\Program Files\Dealio\kb127\rules\rules.1.201.43
    C:\Program Files\Dealio\kb127\rules\rules.1.202.43
    C:\Program Files\Dealio\kb127\rules\rules.1.203.71
    C:\Program Files\Dealio\kb127\rules\rules.1.205.62
    C:\Program Files\Dealio\kb127\rules\rules.1.213.71
    C:\Program Files\Dealio\kb127\rules\rules.1.214.49
    C:\Program Files\Dealio\kb127\rules\rules.1.215.43
    C:\Program Files\Dealio\kb127\rules\rules.1.216.67
    C:\Program Files\Dealio\kb127\rules\rules.1.217.67
    C:\Program Files\Dealio\kb127\rules\rules.1.218.52
    C:\Program Files\Dealio\kb127\rules\rules.1.219.43
    C:\Program Files\Dealio\kb127\rules\rules.1.220.43
    C:\Program Files\Dealio\kb127\rules\rules.1.221.57
    C:\Program Files\Dealio\kb127\rules\rules.1.222.43
    C:\Program Files\Dealio\kb127\rules\rules.1.223.68
    C:\Program Files\Dealio\kb127\rules\rules.1.226.68
    C:\Program Files\Dealio\kb127\rules\rules.1.227.43
    C:\Program Files\Dealio\kb127\rules\rules.1.228.62
    C:\Program Files\Dealio\kb127\rules\rules.1.229.76
    C:\Program Files\Dealio\kb127\rules\rules.1.23.63
    C:\Program Files\Dealio\kb127\rules\rules.1.239.43
    C:\Program Files\Dealio\kb127\rules\rules.1.24.43
    C:\Program Files\Dealio\kb127\rules\rules.1.240.43
    C:\Program Files\Dealio\kb127\rules\rules.1.241.43
    C:\Program Files\Dealio\kb127\rules\rules.1.242.43
    C:\Program Files\Dealio\kb127\rules\rules.1.243.43
    C:\Program Files\Dealio\kb127\rules\rules.1.244.63
    C:\Program Files\Dealio\kb127\rules\rules.1.245.43
    C:\Program Files\Dealio\kb127\rules\rules.1.247.43
    C:\Program Files\Dealio\kb127\rules\rules.1.248.43
    C:\Program Files\Dealio\kb127\rules\rules.1.249.43
    C:\Program Files\Dealio\kb127\rules\rules.1.250.43
    C:\Program Files\Dealio\kb127\rules\rules.1.251.43
    C:\Program Files\Dealio\kb127\rules\rules.1.252.43
    C:\Program Files\Dealio\kb127\rules\rules.1.253.43
    C:\Program Files\Dealio\kb127\rules\rules.1.254.43
    C:\Program Files\Dealio\kb127\rules\rules.1.255.43
    C:\Program Files\Dealio\kb127\rules\rules.1.256.43
    C:\Program Files\Dealio\kb127\rules\rules.1.257.43
    C:\Program Files\Dealio\kb127\rules\rules.1.279.43
    C:\Program Files\Dealio\kb127\rules\rules.1.28.58
    C:\Program Files\Dealio\kb127\rules\rules.1.282.75
    C:\Program Files\Dealio\kb127\rules\rules.1.283.43
    C:\Program Files\Dealio\kb127\rules\rules.1.284.43
    C:\Program Files\Dealio\kb127\rules\rules.1.289.67
    C:\Program Files\Dealio\kb127\rules\rules.1.290.62
    C:\Program Files\Dealio\kb127\rules\rules.1.291.61
    C:\Program Files\Dealio\kb127\rules\rules.1.296.43
    C:\Program Files\Dealio\kb127\rules\rules.1.297.43
    C:\Program Files\Dealio\kb127\rules\rules.1.304.43
    C:\Program Files\Dealio\kb127\rules\rules.1.307.43
    C:\Program Files\Dealio\kb127\rules\rules.1.308.75
    C:\Program Files\Dealio\kb127\rules\rules.1.31.47
    C:\Program Files\Dealio\kb127\rules\rules.1.310.46
    C:\Program Files\Dealio\kb127\rules\rules.1.311.43
    C:\Program Files\Dealio\kb127\rules\rules.1.315.43
    C:\Program Files\Dealio\kb127\rules\rules.1.316.43
    C:\Program Files\Dealio\kb127\rules\rules.1.317.43
    C:\Program Files\Dealio\kb127\rules\rules.1.318.43
    C:\Program Files\Dealio\kb127\rules\rules.1.319.49
    C:\Program Files\Dealio\kb127\rules\rules.1.32.48
    C:\Program Files\Dealio\kb127\rules\rules.1.334.44
    C:\Program Files\Dealio\kb127\rules\rules.1.335.60
    C:\Program Files\Dealio\kb127\rules\rules.1.336.44
    C:\Program Files\Dealio\kb127\rules\rules.1.337.44
    C:\Program Files\Dealio\kb127\rules\rules.1.338.75
    C:\Program Files\Dealio\kb127\rules\rules.1.339.47
    C:\Program Files\Dealio\kb127\rules\rules.1.34.43
    C:\Program Files\Dealio\kb127\rules\rules.1.340.47
    C:\Program Files\Dealio\kb127\rules\rules.1.341.47
    C:\Program Files\Dealio\kb127\rules\rules.1.349.50
    C:\Program Files\Dealio\kb127\rules\rules.1.35.48
    C:\Program Files\Dealio\kb127\rules\rules.1.350.50
    C:\Program Files\Dealio\kb127\rules\rules.1.351.51
    C:\Program Files\Dealio\kb127\rules\rules.1.352.54
    C:\Program Files\Dealio\kb127\rules\rules.1.353.51
    C:\Program Files\Dealio\kb127\rules\rules.1.354.51
    C:\Program Files\Dealio\kb127\rules\rules.1.357.62
    C:\Program Files\Dealio\kb127\rules\rules.1.358.52
    C:\Program Files\Dealio\kb127\rules\rules.1.359.52
    C:\Program Files\Dealio\kb127\rules\rules.1.360.53
    C:\Program Files\Dealio\kb127\rules\rules.1.361.54
    C:\Program Files\Dealio\kb127\rules\rules.1.362.68
    C:\Program Files\Dealio\kb127\rules\rules.1.363.58
    C:\Program Files\Dealio\kb127\rules\rules.1.364.54
    C:\Program Files\Dealio\kb127\rules\rules.1.365.53
    C:\Program Files\Dealio\kb127\rules\rules.1.367.56
    C:\Program Files\Dealio\kb127\rules\rules.1.368.58
    C:\Program Files\Dealio\kb127\rules\rules.1.369.55
    C:\Program Files\Dealio\kb127\rules\rules.1.370.56
    C:\Program Files\Dealio\kb127\rules\rules.1.371.56
    C:\Program Files\Dealio\kb127\rules\rules.1.372.57
    C:\Program Files\Dealio\kb127\rules\rules.1.373.55
    C:\Program Files\Dealio\kb127\rules\rules.1.375.56
    C:\Program Files\Dealio\kb127\rules\rules.1.376.57
    C:\Program Files\Dealio\kb127\rules\rules.1.377.55
    C:\Program Files\Dealio\kb127\rules\rules.1.378.65
    C:\Program Files\Dealio\kb127\rules\rules.1.384.58
    C:\Program Files\Dealio\kb127\rules\rules.1.386.71
    C:\Program Files\Dealio\kb127\rules\rules.1.387.59
    C:\Program Files\Dealio\kb127\rules\rules.1.388.59
    C:\Program Files\Dealio\kb127\rules\rules.1.389.59
    C:\Program Files\Dealio\kb127\rules\rules.1.390.60
    C:\Program Files\Dealio\kb127\rules\rules.1.391.60
    C:\Program Files\Dealio\kb127\rules\rules.1.392.60
    C:\Program Files\Dealio\kb127\rules\rules.1.393.60
    C:\Program Files\Dealio\kb127\rules\rules.1.394.60
    C:\Program Files\Dealio\kb127\rules\rules.1.396.61
    C:\Program Files\Dealio\kb127\rules\rules.1.397.61
    C:\Program Files\Dealio\kb127\rules\rules.1.398.60
    C:\Program Files\Dealio\kb127\rules\rules.1.399.60
    C:\Program Files\Dealio\kb127\rules\rules.1.403.61
    C:\Program Files\Dealio\kb127\rules\rules.1.404.63
    C:\Program Files\Dealio\kb127\rules\rules.1.405.61
    C:\Program Files\Dealio\kb127\rules\rules.1.406.61
    C:\Program Files\Dealio\kb127\rules\rules.1.407.76
    C:\Program Files\Dealio\kb127\rules\rules.1.408.63
    C:\Program Files\Dealio\kb127\rules\rules.1.409.61
    C:\Program Files\Dealio\kb127\rules\rules.1.412.62
    C:\Program Files\Dealio\kb127\rules\rules.1.413.62
    C:\Program Files\Dealio\kb127\rules\rules.1.414.62
    C:\Program Files\Dealio\kb127\rules\rules.1.415.62
    C:\Program Files\Dealio\kb127\rules\rules.1.416.62
    C:\Program Files\Dealio\kb127\rules\rules.1.417.62
    C:\Program Files\Dealio\kb127\rules\rules.1.418.62
    C:\Program Files\Dealio\kb127\rules\rules.1.419.62
    C:\Program Files\Dealio\kb127\rules\rules.1.420.62
    C:\Program Files\Dealio\kb127\rules\rules.1.421.62
    C:\Program Files\Dealio\kb127\rules\rules.1.423.63
    C:\Program Files\Dealio\kb127\rules\rules.1.424.63
    C:\Program Files\Dealio\kb127\rules\rules.1.425.63
    C:\Program Files\Dealio\kb127\rules\rules.1.426.63
    C:\Program Files\Dealio\kb127\rules\rules.1.427.63
    C:\Program Files\Dealio\kb127\rules\rules.1.428.65
    C:\Program Files\Dealio\kb127\rules\rules.1.429.63
    C:\Program Files\Dealio\kb127\rules\rules.1.430.63
    C:\Program Files\Dealio\kb127\rules\rules.1.432.65
    C:\Program Files\Dealio\kb127\rules\rules.1.433.64
    C:\Program Files\Dealio\kb127\rules\rules.1.434.65
    C:\Program Files\Dealio\kb127\rules\rules.1.435.64
    C:\Program Files\Dealio\kb127\rules\rules.1.436.76
    C:\Program Files\Dealio\kb127\rules\rules.1.437.64
    C:\Program Files\Dealio\kb127\rules\rules.1.438.71
    C:\Program Files\Dealio\kb127\rules\rules.1.439.71
    C:\Program Files\Dealio\kb127\rules\rules.1.440.75
    C:\Program Files\Dealio\kb127\rules\rules.1.442.73
    C:\Program Files\Dealio\kb127\rules\rules.1.443.73
    C:\Program Files\Dealio\kb127\rules\rules.1.444.73
    C:\Program Files\Dealio\kb127\rules\rules.1.445.68
    C:\Program Files\Dealio\kb127\rules\rules.1.446.69
    C:\Program Files\Dealio\kb127\rules\rules.1.450.67
    C:\Program Files\Dealio\kb127\rules\rules.1.451.67
    C:\Program Files\Dealio\kb127\rules\rules.1.452.68
    C:\Program Files\Dealio\kb127\rules\rules.1.453.68
    C:\Program Files\Dealio\kb127\rules\rules.1.454.69
    C:\Program Files\Dealio\kb127\rules\rules.1.456.69
    C:\Program Files\Dealio\kb127\rules\rules.1.457.75
    C:\Program Files\Dealio\kb127\rules\rules.1.458.70
    C:\Program Files\Dealio\kb127\rules\rules.1.459.70
    C:\Program Files\Dealio\kb127\rules\rules.1.460.69
    C:\Program Files\Dealio\kb127\rules\rules.1.462.74
    C:\Program Files\Dealio\kb127\rules\rules.1.463.69
    C:\Program Files\Dealio\kb127\rules\rules.1.464.70
    C:\Program Files\Dealio\kb127\rules\rules.1.465.68
    C:\Program Files\Dealio\kb127\rules\rules.1.468.70
    C:\Program Files\Dealio\kb127\rules\rules.1.469.70
    C:\Program Files\Dealio\kb127\rules\rules.1.470.70
    C:\Program Files\Dealio\kb127\rules\rules.1.471.73
    C:\Program Files\Dealio\kb127\rules\rules.1.472.70
    C:\Program Files\Dealio\kb127\rules\rules.1.478.74
    C:\Program Files\Dealio\kb127\rules\rules.1.479.73
    C:\Program Files\Dealio\kb127\rules\rules.1.480.68
    C:\Program Files\Dealio\kb127\rules\rules.1.481.71
    C:\Program Files\Dealio\kb127\rules\rules.1.482.74
    C:\Program Files\Dealio\kb127\rules\rules.1.49.67
    C:\Program Files\Dealio\kb127\rules\rules.1.50.43
    C:\Program Files\Dealio\kb127\rules\rules.1.500.71
    C:\Program Files\Dealio\kb127\rules\rules.1.501.74
    C:\Program Files\Dealio\kb127\rules\rules.1.502.71
    C:\Program Files\Dealio\kb127\rules\rules.1.51.69
    C:\Program Files\Dealio\kb127\rules\rules.1.52.72
    C:\Program Files\Dealio\kb127\rules\rules.1.520.76
    C:\Program Files\Dealio\kb127\rules\rules.1.521.76
    C:\Program Files\Dealio\kb127\rules\rules.1.522.76
    C:\Program Files\Dealio\kb127\rules\rules.1.53.51
    C:\Program Files\Dealio\kb127\rules\rules.1.531.76
    C:\Program Files\Dealio\kb127\rules\rules.1.532.75
    C:\Program Files\Dealio\kb127\rules\rules.1.534.75
    C:\Program Files\Dealio\kb127\rules\rules.1.54.47
    C:\Program Files\Dealio\kb127\rules\rules.1.55.45
    C:\Program Files\Dealio\kb127\rules\rules.1.56.69
    C:\Program Files\Dealio\kb127\rules\rules.1.57.43
    C:\Program Files\Dealio\kb127\rules\rules.1.58.47
    C:\Program Files\Dealio\kb127\rules\rules.1.593.76
    C:\Program Files\Dealio\kb127\rules\rules.1.595.76
    C:\Program Files\Dealio\kb127\rules\rules.1.63.57
    C:\Program Files\Dealio\kb127\rules\rules.1.66.47
    C:\Program Files\Dealio\kb127\rules\rules.1.70.75
    C:\Program Files\Dealio\kb127\rules\rules.1.71.43
    C:\Program Files\DAEMON Tools Toolbar
    C:\Program Files\DAEMON Tools Toolbar\_DTLite.xml
    C:\Program Files\MySearch
    C:\Program Files\MySearch\bar
    C:\Program Files\MySearch\bar\1.bin
    C:\Program Files\MySearch\bar\1.bin\MYSEARCHPLUGINPROXY.CLASS
    C:\Program Files\MySearch\bar\1.bin\NPMYSRCH.DLL
    C:\Program Files\MySearch\bar\1.bin\PARTNER.BMP
    C:\Program Files\MySearch\bar\1.bin\PARTNER.DAT
    C:\Program Files\MySearch\bar\1.bin\S42NS.EXE
    C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL
    C:\Program Files\MySearch\bar\1.bin\UNINSTALL.INF
    C:\Program Files\Piolet
    C:\Program Files\Piolet\MSINET.OCX
    C:\Program Files\Piolet\MSWINSCK.OCX
    C:\Program Files\Piolet\NCTAudioFile.dll
    C:\Program Files\Piolet\NCTAudioInformation.dll
    C:\Program Files\Piolet\NCTAudioPlayer.dll
    C:\Program Files\Piolet\NCTAudioVisualization.dll
    C:\Program Files\Piolet\Piolet.exe
    C:\Program Files\Piolet\SmartUI2.ocx
    C:\Program Files\Search Settings
    C:\Program Files\Search Settings\kb127
    C:\Program Files\Search Settings\SearchSettings.exe
    C:\Program Files\Search Settings\kb127\res
    C:\Program Files\Search Settings\kb127\SearchSettings.dll
    C:\Program Files\Search Settings\kb127\SearchSettingsRes409.dll
    C:\Program Files\Search Settings\kb127\temp

    -----------\\ [..\Internet Explorer\Main]

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
    "Local Page"="C:\\Windows\\system32\\blank.htm"
    "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
    "Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"
    "Start Page Redirect Cache"="https://www.msn.com/fr-fr?ocid=iehp"
    "Url"="https://www.msn.com/fr-fr/actualite/"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
    "Start Page"="https://fr.yahoo.com/"
    "Default_Page_URL"="https://fr.yahoo.com/"
    "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
    "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
    "Local Page"="C:\\Windows\\System32\\blank.htm"

    --------------------\\ Recherche d'autres infections

    Aucune autre infection trouvée !

    [ UAC => 1 ]

    1 - "C:\ToolBar SD\TB_1.txt" - 14/11/2009|15:05 - Option : [1]

    -----------\\ Fin du rapport a 15:05:31,98
    0
  4. kalimusic Messages postés 14619 Statut Contributeur sécurité 3 027
     
    Salut, tu es infecté (voir détails ici https://forum.malekal.com/viewtopic.php?t=21599&start=

    Procédure pour désactiver l'UAC sous Windows Vista :

    Va dans le Menu Démarrer de la barre des taches, clique sur panneau de configuration
    * Clique sur l'icône compte utilisateurs
    Une fenêtre va s'ouvrir, elle vous propose de modifier votre compte utilisateur
    * Clique sur le dernier item : "Activer ou désactiver le contrôle des comptes d'utilisateurs"
    L'UAC demande si l'utilisateur est bien à l'origine de cette action
    * Clique sur "continuer"
    Une nouvelle fenêtre va s'ouvrir,
    * Décoche la case en bas "Utiliser le contrôle des comptes d'utilisateurs pour vous aider à protéger votre ordinateur" ensuite clique sur OK.

    Windows va proposer ensuite de redémarrer le système afin de prendre en compte la désactivation de l'UAC.

    Ferme toutes des application en cours

    !!Désactive Avast et Windows Defender pendant la procédure !!

    1. Relance ToolbarS&D en faisant clic-droit "Exécuter en tant qu'administrateur"
    * Choisis maintenant l'option 2 et valide sur Entrée

    /!\ Ne ferme pas la fenêtre lors de la suppression /!\

    * A la fin, Le rapport s'ouvre au format bloc-note
    * Enregistre-le, copie-colle ce rapport dans la réponse

    2. Télécharge ATF(A Tribune) http://www.atribune.org/ccount/click.php?id=1 sur le bureau et lance le en double cliquant sur son icône

    * Choisis ton navigateur (IE ou firefox ou opera ).
    * Coche Select All
    * Clique sur Empty Selected
    (Si tu souhaites conserver les mots de passe sauvegardés, clique No à l'invite)
    * Accepte de tout supprimer

    3. Télécharge MBAM et installe le selon l'emplacement suivant C:\Program Files\MalwareBytes'Anti-Malware
    * Effectue la mise à jour et lance Malwarebytes' Anti-Malware
    * Clique dans l'onglet du haut "Recherche"
    * Coche l'option "Exécuter un examen rapide" puis sur le bouton "Rechercher"
    A la fin de l'analyse, un message s'affiche : "L'examen s'est terminé normalement. Cliquez sur "Afficher les résultats" pour afficher tous les objets trouvés."
    * Clique sur OK
    * Choisis l'option "Supprimer la sélection"
    * Si MBAM demande le redémarrage de Windows : Clique sur "Oui"
    * Une fois le PC redémarré, le rapport se trouve dans l'onglet "Rapports/Logs"
    * Sinon le rapport s'ouvre automatiquement après la suppression, copie/colle le rapport dans le prochain message.

    J'attends donc 2 rapports, surtout continue la désinfection jusqu'à la fin même si ton PC va mieux.

    A +
    0
    1. gabrielcash
       
      voila le rapport:

      -----------\\ ToolBar S&D 1.2.9 XP/Vista

      Microsoft® Windows Vista™ Édition Familiale Basique ( v6.0.6002 ) Service Pack 2
      X86-based PC ( Multiprocessor Free : Intel(R) Celeron(R) CPU 550 @ 2.00GHz )
      BIOS : Default System BIOS
      USER : jerome ( Administrator )
      BOOT : Normal boot
      C:\ (Local Disk) - NTFS - Total:50 Go (Free:15 Go)
      D:\ (Local Disk) - NTFS - Total:49 Go (Free:26 Go)
      F:\ (CD or DVD)

      "C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
      Option : [2] ( 14/11/2009|19:00 )

      [ UAC => 0 ]

      -----------\\ SUPPRESSION

      Supprime! - C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Dealio
      Supprime! - C:\Program Files\Dealio\DealioAU.exe
      Supprime! - C:\Program Files\Dealio\kb127
      Supprime! - C:\Program Files\Dealio\SearchSettingsKit.exe
      Supprime! - C:\Program Files\DAEMON Tools Toolbar\_DTLite.xml
      Supprime! - C:\Program Files\MySearch\bar
      Supprime! - C:\Program Files\Piolet\MSINET.OCX
      Supprime! - C:\Program Files\Piolet\MSWINSCK.OCX
      Supprime! - C:\Program Files\Piolet\NCTAudioFile.dll
      Supprime! - C:\Program Files\Piolet\NCTAudioInformation.dll
      Supprime! - C:\Program Files\Piolet\NCTAudioPlayer.dll
      Supprime! - C:\Program Files\Piolet\NCTAudioVisualization.dll
      Supprime! - C:\Program Files\Piolet\Piolet.exe
      Supprime! - C:\Program Files\Piolet\SmartUI2.ocx
      Supprime! - C:\Program Files\Search Settings\kb127
      Supprime! - C:\Program Files\Search Settings\SearchSettings.exe
      Supprime! - C:\Program Files\Dealio
      Supprime! - C:\Program Files\DAEMON Tools Toolbar
      Supprime! - C:\Program Files\MySearch
      Supprime! - C:\Program Files\Piolet
      Supprime! - C:\Program Files\Search Settings

      -----------\\ Recherche de Fichiers / Dossiers ...

      C:\Users\jerome\AppData\Roaming\MICROS~1\Windows\Cookies\jerome@ads.piolet[1].txt
      C:\Users\jerome\AppData\Roaming\MICROS~1\Windows\Cookies\jerome@piolet[1].txt
      C:\Users\jerome\AppData\Roaming\MICROS~1\Windows\Cookies\jerome@www.piolet[1].txt

      -----------\\ [..\Internet Explorer\Main]

      [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
      "Local Page"="C:\\Windows\\system32\\blank.htm"
      "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
      "Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"
      "Start Page Redirect Cache"="https://www.msn.com/fr-fr?ocid=iehp"
      "Url"="https://www.msn.com/fr-fr/actualite/"

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
      "Start Page"="https://www.msn.com/fr-fr/"
      "Default_Page_URL"="https://fr.yahoo.com/"
      "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
      "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
      "Local Page"="C:\\Windows\\System32\\blank.htm"


      --------------------\\ Recherche d'autres infections


      Aucune autre infection trouvée !

      [ UAC => 1 ]


      1 - "C:\ToolBar SD\TB_1.txt" - 14/11/2009|15:05 - Option : [1]
      2 - "C:\ToolBar SD\TB_2.txt" - 14/11/2009|19:01 - Option : [2]

      -----------\\ Fin du rapport a 19:01:01,48
      0
    2. gabrielcash
       
      voila le deuxieme rapport avec malwarebytes:
      Malwarebytes' Anti-Malware 1.41
      Version de la base de données: 3171
      Windows 6.0.6002 Service Pack 2

      14/11/2009 19:40:42
      mbam-log-2009-11-14 (19-40-42).txt

      Type de recherche: Examen rapide
      Eléments examinés: 90348
      Temps écoulé: 6 minute(s), 43 second(s)

      Processus mémoire infecté(s): 0
      Module(s) mémoire infecté(s): 0
      Clé(s) du Registre infectée(s): 7
      Valeur(s) du Registre infectée(s): 2
      Elément(s) de données du Registre infecté(s): 0
      Dossier(s) infecté(s): 0
      Fichier(s) infecté(s): 0

      Processus mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Module(s) mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Clé(s) du Registre infectée(s):
      HKEY_CLASSES_ROOT\Interface\{014da6c4-189f-421a-88cd-07cfe51cff10} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{014da6c6-189f-421a-88cd-07cfe51cff10} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{014da6cc-189f-421a-88cd-07cfe51cff10} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Typelib\{014da6c0-189f-421a-88cd-07cfe51cff10} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{014da6c1-189f-421a-88cd-07cfe51cff10} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{014da6c9-189f-421a-88cd-07cfe51cff10} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo (Rogue.Eorezo) -> Quarantined and deleted successfully.

      Valeur(s) du Registre infectée(s):
      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{014da6c9-189f-421a-88cd-07cfe51cff10} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{014da6c9-189f-421a-88cd-07cfe51cff10} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

      Elément(s) de données du Registre infecté(s):
      (Aucun élément nuisible détecté)

      Dossier(s) infecté(s):
      (Aucun élément nuisible détecté)

      Fichier(s) infecté(s):
      (Aucun élément nuisible détecté)


      merci d'avance
      0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. kalimusic Messages postés 14619 Statut Contributeur sécurité 3 027
     
    salut

    Ok tu peux la suite stp ?

    A +
    0
    1. gabrielcash
       
      quelle suite apres les deux rapports?
      0
  7. kalimusic Messages postés 14619 Statut Contributeur sécurité 3 027
     
    Salut

    oups, désolé pas vu le 2ème désolé !!

    Désactive l'UAC et ferme les applications en cours

    "Process.exe" est détecté par certains antivirus comme étant un RiskTool.
    Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus
    Le mieux est de désactiver temporairement Avast et Windows defender

    Télécharge AD-Remover (CC_X) http://pagesperso-orange.fr/NosTools/C_XX/AD-R.exe sur le bureau et installe le dans le répertoire suivant C:\Program Files\Ad-remover

    * Double clique sur l'icône Ad-Remover du bureau, clique sur "Oui" dans la boite de dialogue
    * Au menu principal choisi l'option "L (Lancer le nettoyage )" puis Entrée
    * Patiente le temps du scan (le bureau peut disparaitre), appuie sur n'importe quelle touche quand l'outil te le demandera.

    Copie/colle le rapport dans ton prochain message.

    Si le rapport ne s'ouvrent pas spontanément il est ici C:\Ad-report(date).log

    Relance HijackThis
    * Dans la fenêtre "Main Menu" clique sur le bouton "None of the above, just start the program"
    * Clique sur le bouton Scan dans le sous-menu Scan & fix stuff
    * Après le balayage, coche les cases indiquées si toujours présentes :

    R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
    O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\ bar\1.bin\S4BAR.DLL
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
    O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb127\Dealio.dll
    O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
    O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
    O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb127\Dealio.dll
    O3 - Toolbar: My &Search Bar - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL
    O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
    O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\\Reader9.0\Reader\Reader_sl.exe"
    O4 - Startup: RegFreeze.lnk = C:\Program Files\RegFreeze\regfreeze.exe
    O8 - Extra context menu item: Compare Prices with &Dealio - C:\Users\jerome\AppData\LocalLow\Dealio\kb127\res\DealioSearch.html
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
    O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
    O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll

    * Clique ensuite sur le bouton Fix checked dans le sous-menu Scan & fix stuff
    * Répond "Oui" dans la fenêtre d'avertissement, referme le programme après la suppression.

    Télécharge random's system information tool RSIT (de random/random) sur le bureau.
    lien : http://images.malwareremoval.com/random/RSIT.exe

    * Lance RSIT clic-droit sur son icône " Exécuter en tant qu'administrateur"
    * La fenêtre de Disclaimer apparait : clique sur "Continue" (laisse par défaut 1 month)
    * Si HijackThis n'est pas présent, pas à jour ou non détecté sur l'ordinateur, il sera téléchargé : Tu dois l'autoriser et accepter la licence.
    * Après le balayage, 2 rapports vont s'ouvrir au format bloc-note : log.txt (qui sera affiché) ainsi que de info.txt
    * Copie-colle les rapports dans ton prochain message

    Si les rapports ne s'ouvrent pas spontanément ils se trouvent dans le répertoire suivant : C:\rsit\

    Si les rapports sont trop longs : http://www.cijoint.fr/

    A+
    0
    1. gabrielcash
       
      voila le rapport ad remover:
      .
      ======= RAPPORT D'AD-REMOVER 1.1.4.6_C | UNIQUEMENT XP/VISTA/7 =======
      .
      Mit à jour par C_XX le 14.11.2009 à 20:32
      Contact: AdRemover.contact@gmail.com
      Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
      .
      Lancé à: 8:31:24, 15/11/2009 | Mode Normal | Option: CLEAN
      Exécuté de: C:\Program Files\Ad-Remover\
      Système d'exploitation: Microsoft® Windows Vista™ Home Basic Service Pack 2 v6.0.6002
      Nom du PC: PC-DE-JEROME | Utilisateur actuel: jerome
      .
      ============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
      .

      HKCU\Software\EoRezo
      HKCU\Software\Grand Virtual
      HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Search Settings
      HKLM\Software\Classes\SearchSettings.BHO
      HKLM\Software\Classes\SearchSettings.BHO.1
      HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Everest Poker
      HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\EoEngine
      HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F}
      HKLM\Software\Classes\CLSID\{6A87B991-A31F-4130-AE72-6D0C294BF082}
      HKLM\Software\Classes\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
      HKLM\Software\Classes\TypeLib\{CD082CCA-086F-4FD8-8FD7-247A0DBBD1CC}
      .
      C:\Users\jerome\AppData\Roaming\AD ON Multimedia
      C:\Users\jerome\AppData\Roaming\EoRezo
      C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Everest Poker
      C:\Users\jerome\AppData\LocalLow\Dealio
      C:\Users\jerome\AppData\LocalLow\Search Settings
      C:\Program Files\Everest Poker
      C:\Program Files\Mozilla FireFox\Components\AskSearch.js
      C:\Windows\Installer\19cabb7.msi
      C:\Windows\Installer\19cabbe.msi
      C:\Users\Public\Desktop\Everest Poker.lnk
      C:\Users\jerome\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Ebay.lnk
      C:\Users\jerome\AppData\Roaming\MICROS~1\Windows\STARTM~1\Ebay.lnk
      C:\Users\jerome\AppData\Roaming\MICROS~1\Windows\Cookies\Low\jerome@eurobarre[2].txt

      (!) -- Fichiers temporaires supprimés.

      .
      ============== Scan additionnel ==============
      .
      .
      * Internet Explorer Version 8.0.6001.18828 *
      .
      [HKEY_CURRENT_USER\..\Internet Explorer\Main]
      .
      Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
      Start Page: hxxp://fr.msn.com/
      Start Page Redirect Cache: hxxp://fr.msn.com/?ocid=iehp
      Start Page Redirect Cache_TIMESTAMP: NARY 800130dada63ca01
      Start Page Redirect Cache AcceptLangs: fr
      Default_search_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
      Default_page_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
      Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
      .
      [HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
      .
      Start Page: hxxp://fr.msn.com/
      Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
      Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
      Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
      Search bar: hxxp://search.msn.com/spbasic.htm
      .
      [HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
      .
      Tabs: res://ieframe.dll/tabswelcome.htm
      .
      ============== Suspect (Cracks, Serials, ...) ==============
      .
      C:\Users\jerome\Downloads\Patch.exe
      .
      ===================================
      .
      3187 Octet(s) - C:\Ad-Report-CLEAN[1].log
      .
      1 Fichier(s) - C:\Users\jerome\AppData\Local\Temp
      0 Fichier(s) - C:\Windows\Temp
      .
      19 Fichier(s) - C:\Program Files\Ad-Remover\BACKUP
      386 Fichier(s) - C:\Program Files\Ad-Remover\QUARANTINE
      .
      Fin à: 8:39:29 | 15/11/2009 - CLEAN[1]
      .
      ============== E.O.F ==============
      .

      voila le second rapport:
      Logfile of random's system information tool 1.06 (written by random/random)
      Run by jerome at 2009-11-15 09:06:24
      Microsoft® Windows Vista™ Édition Familiale Basique Service Pack 2
      System drive C: has 14 GB (28%) free of 51 GB
      Total RAM: 2037 MB (48% free)

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 09:06:43, on 15/11/2009
      Platform: Windows Vista SP2 (WinNT 6.00.1906)
      MSIE: Internet Explorer v8.00 (8.00.6001.18828)
      Boot mode: Normal

      Running processes:
      C:\Windows\system32\Dwm.exe
      C:\Windows\system32\taskeng.exe
      C:\Windows\RtHDVCpl.exe
      C:\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
      C:\Windows\System32\igfxtray.exe
      C:\Windows\System32\hkcmd.exe
      C:\Windows\System32\igfxpers.exe
      C:\Program Files\Launch Manager\LManager.exe
      C:\Program Files\Apoint2K\Apoint.exe
      C:\Program Files\Alwil Software\Avast4\ashDisp.exe
      C:\Program Files\CyberLink\PCM4Everio\EverioService.exe
      C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
      C:\Program Files\Java\jre6\bin\jusched.exe
      C:\Program Files\PowerArchiver\PASTARTER.EXE
      C:\Program Files\DAEMON Tools Lite\daemon.exe
      C:\Program Files\Windows Media Player\wmpnscfg.exe
      C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
      C:\Windows\system32\igfxsrvc.exe
      C:\Program Files\Apoint2K\ApMsgFwd.exe
      C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
      C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
      C:\Windows\system32\igfxext.exe
      C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
      C:\Program Files\Apoint2K\Apntex.exe
      C:\Windows\explorer.exe
      C:\Windows\system32\wbem\unsecapp.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Windows Live\Toolbar\wltuser.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Windows\system32\SearchFilterHost.exe
      C:\Windows\system32\SearchProtocolHost.exe
      C:\Users\jerome\Desktop\RSIT.exe
      C:\Users\jerome\Desktop\jerome.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
      R3 - Default URLSearchHook is missing
      O1 - Hosts: ::1 localhost
      O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
      O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
      O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
      O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
      O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
      O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
      O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
      O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
      O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
      O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
      O4 - HKLM\..\Run: [ALaunch] C:\Acer\ALaunch\AlaunchClient.exe
      O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
      O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
      O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
      O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
      O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
      O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
      O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
      O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
      O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
      O4 - HKLM\..\Run: [SetPanel] C:\Acer\APanel\APanel.cmd
      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      O4 - HKLM\..\Run: [EverioService] "C:\Program Files\CyberLink\PCM4Everio\EverioService.exe"
      O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe" /autorun
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
      O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
      O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
      O4 - HKCU\..\Run: [PowerArchiver Tray] C:\Program Files\PowerArchiver\PASTARTER.EXE
      O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
      O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
      O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
      O4 - HKCU\..\Run: [AutoStartNPSAgent] C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
      O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
      O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
      O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
      O13 - Gopher Prefix:
      O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
      O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://ma-config.com/activex/hardwaredetection_3_1_0_4.cab
      O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
      O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
      O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
      O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
      O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
      O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
      O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe
      O23 - Service: Service Google Update (gupdate1c9951ef46252e6) (gupdate1c9951ef46252e6) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
      O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
      O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
      O23 - Service: R54G Wireless Service - Unknown owner - C:\Program Files\Wireless 802.11g Monitor\WLService.exe
      O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
      O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
      O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
      0
      1. gabrielcash > gabrielcash
         
        voila la suite:

        Les champs relatifs au réseau indiquent la provenance d’une demande d’ouverture de session à distance. Le nom de la station de travail n’étant pas toujours disponible, peut être laissé vide dans certains cas.

        Les champs relatifs aux informations d’authentification fournissent des détails sur cette demande d’ouverture de session spécifique.
        - Le GUID d’ouverture de session est un identificateur unique pouvant servir à associer cet événement à un événement KDC .
        - Les services en transit indiquent les services intermédiaires qui ont participé à cette demande d’ouverture de session.
        - Nom du package indique quel est le sous-protocole qui a été utilisé parmi les protocoles NTLM.
        - La longueur de la clé indique la longueur de la clé de session générée. Elle a la valeur 0 si aucune clé de session n’a été demandée.
        Record Number: 30749
        Source Name: Microsoft-Windows-Security-Auditing
        Time Written: 20081220051506.252961-000
        Event Type: Succès de l'audit
        User:

        ======Environment variables======

        "ComSpec"=%SystemRoot%\system32\cmd.exe
        "FP_NO_HOST_CHECK"=NO
        "OS"=Windows_NT
        "Path"=C:\Program Files\PC Connectivity Solution\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Acer\Empowering Technology\eDataSecurity\;C:\Acer\Empowering Technology\eDataSecurity\x86;C:\Acer\Empowering Technology\eDataSecurity\x64;C:\Program Files\Common Files\Ulead Systems\MPEG
        "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
        "PROCESSOR_ARCHITECTURE"=x86
        "TEMP"=%SystemRoot%\TEMP
        "TMP"=%SystemRoot%\TEMP
        "USERNAME"=SYSTEM
        "windir"=%SystemRoot%
        "PROCESSOR_LEVEL"=6
        "PROCESSOR_IDENTIFIER"=x86 Family 6 Model 22 Stepping 1, GenuineIntel
        "PROCESSOR_REVISION"=1601
        "NUMBER_OF_PROCESSORS"=1
        "TRACE_FORMAT_SEARCH_PATH"=\\NTREL202.ntdev.corp.microsoft.com\4F18C3A5-CA09-4DBD-B6FC-219FDD4C6BE0\TraceFormat
        "DFSTRACINGON"=FALSE

        -----------------EOF-----------------
        0
      2. gabrielcash > gabrielcash
         
        voila le deuxieme rapport log txt:

        Logfile of random's system information tool 1.06 (written by random/random)
        Run by jerome at 2009-11-15 09:06:24
        Microsoft® Windows Vista™ Édition Familiale Basique Service Pack 2
        System drive C: has 14 GB (28%) free of 51 GB
        Total RAM: 2037 MB (48% free)

        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 09:06:43, on 15/11/2009
        Platform: Windows Vista SP2 (WinNT 6.00.1906)
        MSIE: Internet Explorer v8.00 (8.00.6001.18828)
        Boot mode: Normal

        Running processes:
        C:\Windows\system32\Dwm.exe
        C:\Windows\system32\taskeng.exe
        C:\Windows\RtHDVCpl.exe
        C:\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
        C:\Windows\System32\igfxtray.exe
        C:\Windows\System32\hkcmd.exe
        C:\Windows\System32\igfxpers.exe
        C:\Program Files\Launch Manager\LManager.exe
        C:\Program Files\Apoint2K\Apoint.exe
        C:\Program Files\Alwil Software\Avast4\ashDisp.exe
        C:\Program Files\CyberLink\PCM4Everio\EverioService.exe
        C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
        C:\Program Files\Java\jre6\bin\jusched.exe
        C:\Program Files\PowerArchiver\PASTARTER.EXE
        C:\Program Files\DAEMON Tools Lite\daemon.exe
        C:\Program Files\Windows Media Player\wmpnscfg.exe
        C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
        C:\Windows\system32\igfxsrvc.exe
        C:\Program Files\Apoint2K\ApMsgFwd.exe
        C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
        C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
        C:\Windows\system32\igfxext.exe
        C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
        C:\Program Files\Apoint2K\Apntex.exe
        C:\Windows\explorer.exe
        C:\Windows\system32\wbem\unsecapp.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\Program Files\Windows Live\Toolbar\wltuser.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\Windows\system32\SearchFilterHost.exe
        C:\Windows\system32\SearchProtocolHost.exe
        C:\Users\jerome\Desktop\RSIT.exe
        C:\Users\jerome\Desktop\jerome.exe

        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
        R3 - Default URLSearchHook is missing
        O1 - Hosts: ::1 localhost
        O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
        O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
        O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
        O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
        O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
        O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
        O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
        O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
        O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
        O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
        O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
        O4 - HKLM\..\Run: [ALaunch] C:\Acer\ALaunch\AlaunchClient.exe
        O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
        O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
        O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
        O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
        O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
        O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
        O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
        O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
        O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
        O4 - HKLM\..\Run: [SetPanel] C:\Acer\APanel\APanel.cmd
        O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        O4 - HKLM\..\Run: [EverioService] "C:\Program Files\CyberLink\PCM4Everio\EverioService.exe"
        O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe" /autorun
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
        O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
        O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
        O4 - HKCU\..\Run: [PowerArchiver Tray] C:\Program Files\PowerArchiver\PASTARTER.EXE
        O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
        O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
        O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
        O4 - HKCU\..\Run: [AutoStartNPSAgent] C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
        O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
        O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
        O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
        O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
        O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
        O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
        O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
        O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
        O13 - Gopher Prefix:
        O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
        O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://ma-config.com/activex/hardwaredetection_3_1_0_4.cab
        O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
        O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
        O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
        O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
        O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
        O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
        O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
        O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe
        O23 - Service: Service Google Update (gupdate1c9951ef46252e6) (gupdate1c9951ef46252e6) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
        O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
        O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
        O23 - Service: R54G Wireless Service - Unknown owner - C:\Program Files\Wireless 802.11g Monitor\WLService.exe
        O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
        O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
        O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
        0
  8. kalimusic Messages postés 14619 Statut Contributeur sécurité 3 027
     
    Salut,

    Le rapport RSIT a révélé d'autres infections, alors on continue :

    Désinstalle via le Ajout/Suppression de programme : RegFreeze
    C'est un faux logiciel de sécurité
    Et si toujours présent : Dealio Toolbar 3.4

    Je veux plus voir ça non plus : C:\Users\jerome\Downloads\Patch.exe

    Désactive l'UAC et ferme les applications en cours
    Désactive les protections résidentes d'Avast et Windows defender

    Télécharge USBFix sur ton bureau, lien = http://pagesperso-orange.fr/NosTools/Chiquitine29/UsbFix.exe
    Branche tes supports amovibles à ton PC (clé USB, disque dur externe, etc...)
    * Double clique sur le raccourci UsbFix présent sur ton bureau
    * Au menu principal choisis F pour français et tape sur Entrée
    * Choisis l’option 2 ( Suppression )
    * Le bureau va disparaître et le PC redémarrera
    * Au redémarrage, UsbFix scanne ton pc, laisse travailler l’outil.

    Poste le rapport UsbFix.txt qui s'ouvre sur le bureau .

    Le rapport UsbFix.txt est sauvegardé à la racine du disque.( C:\UsbFix.txt )

    A +
    0

Discussions similaires

Nouveau tag ajouté | Nouvelle option activé sans permission?
BountyFullChest -
CCMBot -

1 réponse
Huawei P8 Lite "nouveau tag ajouté"
ArianeKathleen -
Mn -

25 réponses
Nouveau tag ajouté - Utilité
Eerfers -
madmyke -

1 réponse
Google Chrome "  Échec de l'analyse antivirus "
jmpower -
RBmoon -

18 réponses
" Échec de l'analyse antivirus " la solution.
bazfile -
bazfile -

0 réponse