main.exoclick Résolu/Fermé

Question

Bonjour,

Depuis un peu plus d'une semaine je n'arrete pas d'etre redirigé sur d'autre page web quand je souhaite aller sur un site et j'ai aussi l'impression que mon pc rame.

J'ai balancé plusieurs scan mais rien (Avast) mais apparemment à chaque fois que je suis redirigé on peut voir l'adresse main.exoclick s'afficher.

Donc si quelqu'un pourrait m'aider.

Merci d'avance.

Destrio5 · Answer

Bonjour,

--> Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.

--> Double-clique sur RSIT.exe afin de lancer le programme.
(Sous Vista, il faut cliquer droit sur RSIT.exe et choisir Exécuter en tant qu'administrateur)

--> Clique sur Continue à l'écran Disclaimer.

--> Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

--> Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

Note : les rapports sont sauvegardés dans le dossier C:\rsit.

Masapaul · Answer

Ok voila pour log : 
Logfile of random's system information tool 1.06 (written by random/random)
Run by Masaru at 2009-11-17 16:05:11
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 24 GB (27%) free of 89 GB
Total RAM: 2046 MB (25% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:05:33, on 17/11/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\HP\TVPlay\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\libusbd-nt.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\Program Files\HP\TVPlay\Kernel\TV\TVPCapSvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\HP\TVPlay\Kernel\TV\TVPSched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\HP\TVPlay\TVPService.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\HPQ\SHARED\HPQTOA~1.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\SFR\Kit\9props.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Skype\Toolbars\Shared\SkypeNames.exe
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Masaru\Bureau\RSIT.exe
C:\Program Files	rend micro\Masaru.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide à la navigation SFR - {0F6E720A-1A6B-40E1-A294-1D4D19F156C8} - C:\Program Files\SFR\Kit\SFRNavErrorHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Zango - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: D - {BA473E15-CAEA-3797-98E1-0302D1B4D3EC} - C:\WINDOWS\system32\ql99883.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Zango - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TVPService] "C:\Program Files\HP\TVPlay\TVPService.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Connexion SFR 9props.exe] "C:\Program Files\SFR\Kit\9props.exe" /trayicon
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Masaru\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www8.hp.com/fr/fr/home.html
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} - http://activex.camfrogweb.com/advanced/2.0.2.3/cfweb_activex.camfrogweb.com-advanced-2.0.2.3_instmodule.exe
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - https://www.fileplanet.com/
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - https://wimpro3.cce.hp.com/ChatEntry/downloads/sysinfo.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} (DeviceEnum Class) - http://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {BA162249-F2C5-4851-8ADC-FC58CB424243} (Image Uploader Control) - http://copainsdavant.linternaute.com/html_include_bibliotheque/objimageuploader/5.0.15.0/ImageUploader5.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Media Library Service(HP TVPlay) - Cyberlink - C:\Program Files\HP\TVPlay\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: getPlus(R) Helper - Unknown owner - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe (file missing)
O23 - Service: Google Update Service (gupdate1c98bc53ec9cac0) (gupdate1c98bc53ec9cac0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\logishrd\Bluetooth\LBTServ.exe
O23 - Service: LibUsb-Win32 - Daemon, Version 0.1.10.1 (libusbd) - https://sourceforge.net/p/libusb-win32/wiki/Home/ - C:\WINDOWS\system32\libusbd-nt.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Program Files\Fichiers communs\Symantec Shared\Support Controls\ssrc.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe
O23 - Service: CyberLink Background Capture Service (CBCS HP TVPlay) (TVPCapSvc) - Unknown owner - C:\Program Files\HP\TVPlay\Kernel\TV\TVPCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS HP TVPlay) (TVPSched) - Unknown owner - C:\Program Files\HP\TVPlay\Kernel\TV\TVPSched.exe

Destrio5 · Answer

/!\ Désactive tes protections résidentes (Antivirus, etc...) /!\

--> Télécharge ComboFix (de sUBs) sur ton Bureau.
--> Double-clique sur ComboFix.exe (le .exe n'est pas forcément visible) afin de le lancer.
--> Il va te demander d'installer la console de récupération : accepte.
--> Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.

Pour t'aider : Un guide et un tutoriel sur l'utilisation de ComboFix

Masapaul · Answer

ComboFix 09-11-17.03 - Masaru 17/11/2009 16:21.1.2 - x86
Microsoft Windows XP Édition familiale  5.1.2600.3.1252.33.1036.18.2046.1416 [GMT 1:00]
Lancé depuis: c:\documents and settings\Masaru\Bureau\ComboFix.exe
AV: avast! antivirus 4.8.1356 [VPS 091117-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\_000005_.tmp.dll
c:\windows\system32\_000006_.tmp.dll
c:\windows\system32\_000007_.tmp.dll
c:\windows\system32\_000008_.tmp.dll
c:\windows\system32\_000009_.tmp.dll
c:\windows\system32\_000010_.tmp.dll
c:\windows\system32\_000011_.tmp.dll
c:\windows\system32\_000012_.tmp.dll
c:\windows\system32\_000025_.tmp.dll
c:\windows\system32\ql99883.dll
D:\Autorun.inf

.
(((((((((((((((((((((((((((((   Fichiers créés du 2009-10-17 au 2009-11-17  ))))))))))))))))))))))))))))))))))))
.

2009-11-17 15:05 . 2009-11-17 15:05	--------	d-----w-	C:sit
2009-11-17 15:05 . 2009-11-17 15:05	--------	d-----w-	c:\program files	rend micro
2009-11-15 11:44 . 2009-11-15 11:44	--------	d-sh--w-	c:\documents and settings\LocalService\PrivacIE
2009-11-15 11:44 . 2009-11-15 11:44	--------	d-sh--w-	c:\documents and settings\LocalService\IECompatCache
2009-11-15 11:42 . 2009-11-15 11:42	--------	d-----r-	c:\documents and settings\LocalService\Favoris
2009-11-14 15:29 . 2009-11-14 15:29	--------	d-----w-	c:\documents and settings\Masaru\WINDOWS
2009-11-14 06:13 . 2009-07-15 09:48	29000	----a-w-	c:\windows\system32\uxtuneup.dll
2009-11-14 06:13 . 2009-11-14 06:13	361288	----a-w-	c:\windows\system32\TuneUpDefragService.exe
2009-11-13 05:38 . 2009-11-14 06:13	604488	----a-w-	c:\windows\system32\TUProgSt.exe
2009-11-13 05:37 . 2009-11-13 05:37	--------	d-----w-	c:\documents and settings\Masaru\Application Data\TuneUp Software
2009-11-13 05:36 . 2009-11-13 05:36	--------	d-----w-	c:\documents and settings\All Users\Application Data\TuneUp Software
2009-11-13 05:36 . 2009-11-14 06:12	--------	d-----w-	c:\program files\TuneUp Utilities 2009
2009-11-13 05:35 . 2009-11-13 05:35	--------	d-sh--w-	c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-11-12 17:40 . 2009-11-12 17:53	512	---ha-w-	C:\os357577.bin
2009-11-12 17:40 . 2009-11-12 17:40	--------	d-----w-	c:\documents and settings\Masaru\Application Data\Ulead Systems
2009-11-12 17:40 . 2009-11-12 17:40	--------	d-----w-	c:\windows\Vbox
2009-11-12 17:39 . 2009-11-12 17:55	--------	d-----w-	c:\documents and settings\All Users\Application Data\Ulead Systems
2009-11-12 17:38 . 2009-11-12 17:38	--------	d-----w-	c:\windows\Noslip
2009-11-12 14:15 . 2009-11-12 14:15	--------	d-----w-	c:\documents and settings\Masaru\Local Settings\Application Data\Help
2009-11-10 05:16 . 2009-09-15 11:54	52368	----a-w-	c:\windows\system32\drivers\aswTdi.sys
2009-11-10 05:16 . 2009-09-15 11:54	23152	----a-w-	c:\windows\system32\drivers\aswRdr.sys
2009-11-10 05:16 . 2009-09-15 11:53	27408	----a-w-	c:\windows\system32\drivers\aavmker4.sys
2009-11-10 05:16 . 2009-09-15 11:53	97480	----a-w-	c:\windows\system32\AvastSS.scr
2009-11-10 05:15 . 2009-09-15 11:55	114768	----a-w-	c:\windows\system32\drivers\aswSP.sys
2009-11-10 05:15 . 2009-09-15 11:55	20560	----a-w-	c:\windows\system32\drivers\aswFsBlk.sys
2009-11-10 05:15 . 2009-09-15 11:56	93424	----a-w-	c:\windows\system32\drivers\aswmon.sys
2009-11-10 05:15 . 2009-09-15 11:56	94160	----a-w-	c:\windows\system32\drivers\aswmon2.sys
2009-11-10 05:15 . 2009-09-15 11:59	1279968	----a-w-	c:\windows\system32\aswBoot.exe
2009-11-10 05:15 . 2009-11-10 05:15	--------	d-----w-	c:\program files\Alwil Software
2009-11-04 02:38 . 2009-11-04 02:38	152576	----a-w-	c:\documents and settings\Masaru\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-10-31 05:38 . 2009-10-31 05:39	--------	d-----w-	c:\documents and settings\Masaru\Local Settings\Application Data\Temp
2009-10-29 19:17 . 2009-10-29 19:17	--------	d-----w-	c:\program files\iPod
2009-10-29 19:17 . 2009-10-29 19:18	--------	d-----w-	c:\program files\iTunes
2009-10-29 19:08 . 2009-10-29 19:08	79144	----a-w-	c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-10-26 18:26 . 2009-10-26 18:26	92192	----a-w-	c:\documents and settings\Masaru\Application Data\IMVUClient\IMVUupdater.exe
2009-10-26 18:26 . 2009-10-26 18:26	52992	----a-w-	c:\documents and settings\Masaru\Application Data\IMVUClient\IMVUClient.exe
2009-10-26 18:26 . 2009-10-26 18:26	22784	----a-w-	c:\documents and settings\Masaru\Application Data\IMVUClient\IMVUQualityAgent.exe
2009-10-26 18:25 . 2009-10-26 18:25	54784	----a-w-	c:\documents and settings\Masaru\Application Data\IMVUClient\ui\plugins
phwndproxy.dll
2009-10-26 18:25 . 2009-10-26 18:25	1155584	----a-w-	c:\documents and settings\Masaru\Application Data\IMVUClient\SceneWindow.dll
2009-10-26 18:24 . 2009-10-26 18:24	15872	----a-w-	c:\documents and settings\Masaru\Application Data\IMVUClient\MemoryHook.dll
2009-10-26 18:24 . 2009-10-26 18:24	296960	----a-w-	c:\documents and settings\Masaru\Application Data\IMVUClient\cal3d.dll
2009-10-26 18:24 . 2009-10-26 18:24	30720	----a-w-	c:\documents and settings\Masaru\Application Data\IMVUClient\CallStack.dll
2009-10-26 18:24 . 2009-10-26 18:24	190976	----a-w-	c:\documents and settings\Masaru\Application Data\IMVUClient\boost_python.dll
2009-10-26 18:24 . 2009-10-26 18:24	257536	----a-w-	c:\documents and settings\Masaru\Application Data\IMVUClient\audiere.dll
2009-10-24 14:59 . 2009-10-24 14:59	--------	d-----w-	c:\documents and settings\Masaru\Application Data\Logitech
2009-10-24 14:59 . 2009-10-24 14:59	--------	d-----w-	c:\documents and settings\Masaru\Application Data\Leadertech
2009-10-24 14:59 . 2009-10-24 14:59	--------	d-----w-	c:\documents and settings\All Users\Application Data\LogiShrd
2009-10-24 14:57 . 2009-06-17 16:55	10384	----a-w-	c:\windows\system32\drivers\LBeepKE.sys
2009-10-24 14:54 . 2009-07-20 10:25	301656	----a-w-	c:\windows\system32\BtCoreIf.dll
2009-10-24 14:54 . 2009-07-20 10:26	84496	----a-w-	c:\windows\system32\KemXML.dll
2009-10-24 14:54 . 2009-07-20 10:26	117264	----a-w-	c:\windows\system32\KemWnd.dll
2009-10-24 14:54 . 2009-07-20 10:26	145936	----a-w-	c:\windows\system32\KemUtil.dll
2009-10-24 14:54 . 2009-07-20 10:26	170512	----a-w-	c:\windows\system32\kemutb.dll
2009-10-24 14:53 . 2009-10-24 14:53	--------	d-----w-	c:\documents and settings\All Users\Application Data\Logitech
2009-10-24 14:52 . 2009-10-24 14:52	--------	d-----w-	c:\program files\Logitech
2009-10-23 17:17 . 2009-10-23 17:17	--------	d-----w-	c:\windows\Performance
2009-10-23 17:17 . 2009-10-23 17:17	--------	d-----w-	c:\documents and settings\Masaru\Local Settings\Application Data\Microsoft Corporation
2009-10-22 12:29 . 2009-10-22 12:29	--------	d-----w-	c:\documents and settings\Masaru\Local Settings\Application Data\RcIncidents

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-17 08:05 . 2009-01-20 10:45	--------	d-----w-	c:\documents and settings\All Users\Application Data\Google Updater
2009-11-16 19:50 . 2009-08-18 02:59	--------	d-----w-	c:\documents and settings\Masaru\Application Data\Skype
2009-11-16 15:01 . 2008-01-10 00:30	--------	d-----w-	c:\documents and settings\Masaru\Application Data\skypePM
2009-11-13 12:00 . 2008-05-23 04:42	--------	d-----w-	c:\documents and settings\Masaru\Application Data\IMVU
2009-11-13 11:58 . 2009-06-10 18:21	--------	d-----w-	c:\documents and settings\All Users\Application Data\Electronic Arts
2009-11-13 06:35 . 2009-10-06 12:33	--------	d-----w-	c:\documents and settings\Masaru\Application Data\FreeFLVConverter
2009-11-13 05:49 . 2009-07-29 03:03	--------	d-----w-	c:\program files\Free FLV Converter
2009-11-13 05:13 . 2008-01-09 19:06	79456	----a-w-	c:\documents and settings\Masaru\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-12 17:56 . 2006-02-27 00:22	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-11-11 13:50 . 2009-07-29 03:04	311296	----a-w-	c:\windows\system32\TubeFinder.exe
2009-11-10 09:26 . 2006-02-27 00:54	--------	d-----w-	c:\program files\Fichiers communs\Symantec Shared
2009-11-10 05:46 . 2009-07-29 05:40	--------	d-----w-	c:\documents and settings\All Users\Application Data\LICENSE ADMIN OPTION BIB
2009-11-10 05:28 . 2008-05-23 04:50	--------	d-----w-	c:\documents and settings\All Users\Application Data\Symantec
2009-11-08 12:17 . 2008-09-04 12:58	76774	----a-w-	c:\documents and settings\Masaru\Application Data\IMVUClient\Uninstall.exe
2009-11-08 12:17 . 2008-09-04 12:57	--------	d-----w-	c:\documents and settings\Masaru\Application Data\IMVUClient
2009-11-08 12:16 . 2009-06-24 07:07	18558152	----a-w-	c:\documents and settings\Masaru\Application Data\IMVUClient\installer\SetupImvu_update.exe
2009-11-06 04:11 . 2008-01-09 23:16	--------	d-----w-	c:\program files\Windows Live
2009-11-04 04:42 . 2004-08-17 09:31	87028	----a-w-	c:\windows\system32\perfc00C.dat
2009-11-04 04:42 . 2004-08-17 09:31	513532	----a-w-	c:\windows\system32\perfh00C.dat
2009-11-04 02:39 . 2006-02-27 00:27	--------	d-----w-	c:\program files\Java
2009-10-29 19:17 . 2008-01-10 00:48	--------	d-----w-	c:\program files\Fichiers communs\Apple
2009-10-24 14:59 . 2008-01-10 00:05	--------	d-----w-	c:\program files\Fichiers communs\logishrd
2009-10-24 14:57 . 2009-10-24 14:57	0	---ha-w-	c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2009-10-24 14:57 . 2009-10-24 14:57	0	---ha-w-	c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf
2009-10-24 14:57 . 2009-10-24 14:57	0	---ha-w-	c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-10-24 06:15 . 2009-07-30 03:15	--------	d-----w-	c:\program files\Fichiers communs\Nero
2009-10-24 06:14 . 2009-07-30 03:16	--------	d-----w-	c:\program files\Nero
2009-10-24 06:04 . 2009-07-30 03:15	--------	d-----w-	c:\documents and settings\All Users\Application Data\Nero
2009-10-16 11:36 . 2009-10-16 11:36	57552	---ha-w-	c:\windows\system32\mlfcache.dat
2009-10-15 16:07 . 2009-10-15 16:07	--------	d-----w-	c:\documents and settings\All Users\Application Data\fssg
2009-10-15 16:06 . 2009-10-15 16:05	--------	d-----w-	c:\documents and settings\All Users\Application Data\f-secure
2009-10-15 12:36 . 2008-01-18 09:13	--------	d-----w-	c:\program files\Fichiers communs\Adobe
2009-10-13 18:44 . 2009-03-09 00:40	--------	d-----w-	c:\program files\NCSoft
2009-10-11 14:37 . 2008-01-09 23:16	--------	d-----w-	c:\documents and settings\All Users\Application Data\WLInstaller
2009-10-11 03:17 . 2008-12-02 17:28	411368	----a-w-	c:\windows\system32\deploytk.dll
2009-10-07 19:27 . 2009-10-07 19:27	--------	d-----w-	c:\program files\SFR
2009-10-07 18:47 . 2006-02-27 01:01	--------	d-----w-	c:\documents and settings\All Users\Application Data\CyberLink
2009-10-06 10:49 . 2008-10-29 12:29	--------	d-----w-	c:\documents and settings\All Users\Application Data\WinZip
2009-10-03 04:09 . 2009-10-03 04:09	--------	d-----w-	c:\program files\Microsoft Office Outlook Connector
2009-09-21 03:40 . 2009-06-10 17:53	--------	d-----w-	c:\program files\Electronic Arts
2009-09-16 09:08 . 2009-09-16 09:08	737280	----a-w-	c:\windows\iun6002.exe
2009-09-11 14:18 . 2004-08-05 08:00	136192	----a-w-	c:\windows\system32\msv1_0.dll
2009-09-04 21:04 . 2004-08-05 08:00	58880	----a-w-	c:\windows\system32\msasn1.dll
2009-08-29 07:56 . 2009-08-29 07:56	10240	----a-w-	c:\windows\system32\ctfmon_wy.exe
2009-08-29 07:56 . 2004-08-05 08:00	916480	----a-w-	c:\windows\system32\wininet.dll
2009-08-26 08:01 . 2004-08-05 08:00	247326	----a-w-	c:\windows\system32\strmdll.dll
2006-05-06 23:44 . 2008-01-10 01:19	22	--sha-w-	c:\windows\SMINST\HPCD.SYS
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}]
2009-10-15 08:53	165184	----a-w-	c:\program files\SFR\Kit\SFRNavErrorHelper.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856]
"Connexion SFR 9props.exe"="c:\program files\SFR\Kit\9props.exe" [2009-10-15 959808]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-07-16 25604904]
"eMuleAutoStart"="c:\program files\eMule\emule.exe" [2009-02-22 5668864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-12-15 7331840]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-12-15 86016]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-11 761945]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-12-13 507904]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2005-12-12 94208]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2005-12-07 409600]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-06-29 233534]
"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"TVPService"="c:\program files\HP\TVPlay\TVPService.exe" [2005-12-16 135168]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-04 417792]
"nwiz"="nwiz.exe" - c:\windows\system32
wiz.exe [2005-12-15 1519616]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" - c:\windows\system32\CHDAudPropShortcut.exe [2005-11-08 61952]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2009-06-17 55824]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
D‚marrage rapide de HP Photosmart Premier.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-9-24 73728]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-12-15 282624]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-10-24 813584]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\LBTWlgn]
2009-07-20 10:28	72208	----a-w-	c:\program files\Fichiers communs\logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun-]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"c:\Program Files\Bonjour\mDNSResponder.exe"=
"c:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"=
"c:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe"=
"c:\Program Files\iTunes\iTunes.exe"=
"c:\Program Files\Windows Live\Messenger\wlcsdk.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\eMule\emule.exe"=
"c:\Program Files\Skype\Phone\Skype.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [10/11/2009 06:15 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [10/11/2009 06:15 20560]
R2 CyberLink Media Library Service(HP TVPlay);CyberLink Media Library Service(HP TVPlay);c:\program files\HP\TVPlay\Kernel\CLML_NTService\CLMLServer.exe [12/07/2009 20:56 1073152]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [24/10/2009 15:57 10384]
R2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;system32\libusbd-nt.exe --> system32\libusbd-nt.exe [?]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [13/11/2009 06:38 604488]
R2 TVPCapSvc;CyberLink Background Capture Service (CBCS HP TVPlay);c:\program files\HP\TVPlay\Kernel\TV\TVPCapSvc.exe [12/07/2009 20:57 258147]
R2 TVPSched;CyberLink Task Scheduler (CTS HP TVPlay);c:\program files\HP\TVPlay\Kernel\TV\TVPSched.exe [12/07/2009 20:57 114785]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [27/02/2008 18:38 33792]
S2 gupdate1c98bc53ec9cac0;Google Update Service (gupdate1c98bc53ec9cac0);c:\program files\Google\Update\GoogleUpdate.exe [10/02/2009 22:19 133104]
S3 MODBDA2;DiBcom MOD3000 TV receiver;c:\windows\system32\drivers\modbda2.sys [04/06/2005 00:56 30464]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 XDva189;XDva189;\??\c:\windows\system32\XDva189.sys --> c:\windows\system32\XDva189.sys [?]
S3 XPADFL02;XPAD Filter Service 02;c:\windows\system32\DRIVERS\xpadfl02.sys --> c:\windows\system32\DRIVERS\xpadfl02.sys [?]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - MBR
*NewlyCreated* - PROCEXP113
*Deregistered* - mbr
*Deregistered* - PROCEXP113

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
Contenu du dossier 'Tâches planifiées'

2009-11-12 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 10:34]

2009-11-17 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-01-20 13:20]

2009-11-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-10 21:18]

2009-11-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-10 21:18]

2009-11-17 c:\windows\Tasks\Maintenance en 1 clic.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-07-16 09:00]

2009-11-17 c:\windows\Tasks\User_Feed_Synchronization-{DB0943BD-CE22-4FD7-977F-E251E8D3C8AC}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Masaru\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} - hxxp://activex.camfrogweb.com/advanced/2.0.2.3/cfweb_activex.camfrogweb.com-advanced-2.0.2.3_instmodule.exe
DPF: {BA162249-F2C5-4851-8ADC-FC58CB424243} - hxxp://copainsdavant.linternaute.com/html_include_bibliotheque/objimageuploader/5.0.15.0/ImageUploader5.cab
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{BA473E15-CAEA-3797-98E1-0302D1B4D3EC} - c:\windows\system32\ql99883.dll



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-17 16:28
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe??????????s?n??|?@???? ???B?????????????hLC? ?????? 

Recherche de fichiers cachés ... 


c:\docume~1\Masaru\LOCALS~1\Temp\catchme.dll 53248 bytes executable

Scan terminé avec succès
Fichiers cachés: 1

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services
pggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-2461924951-3518128794-1205076434-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-2461924951-3518128794-1205076434-1006\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:2a,fa,36,2c,25,ae,fc,11,e2,02,61,47,01,fe,1f,47,2b,1b,14,29,3d,9d,53,
   a2,c0,c6,37,c5,0f,a8,b8,e0,3c,51,69,b9,8c,ac,aa,d0,74,47,4c,40,3d,67,92,b0,\
"??"=hex:0a,b9,d7,2a,9f,a3,5c,15,af,43,50,01,d3,5c,b9,eb

[HKEY_USERS\S-1-5-21-2461924951-3518128794-1205076434-1006\Software\SecuROM\License information*]
"datasecu"=hex:08,32,cb,6e,b8,b5,e2,5b,86,47,cf,6d,a4,c6,b3,17,fa,f0,c2,f7,05,
   e7,7a,bb,7e,16,ad,31,62,2f,e3,e5,35,b0,d1,7c,a8,c4,77,a8,92,ba,1f,30,54,d8,\
"rkeysecu"=hex:64,b6,bd,e1,3e,80,9e,c4,40,b4,90,83,87,8e,33,49

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):95,68,8e,2b,f3,9b,9f,d5,a4,fe,fe,c8,55,d6,a3,8e,78,d1,49,6a,10,
   f4,1f,0d,cf,b8,32,83,21,e4,04,39,87,53,db,1d,a4,48,e7,62,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{d1cc1ab2-fe08-4e0c-90cf-e743b98dc4ba}]
@Denied: (Full) (Everyone)
"Model"=dword:00000055
"Therad"=dword:0000001e

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
"C040110900063D11C8EF10054038389C"="C?\WINDOWS\system32\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(1132)
c:\program files\fichiers communs\logishrd\bluetooth\LBTWlgn.dll
c:\program files\fichiers communs\logishrd\bluetooth\LBTServ.dll
.
Heure de fin: 2009-11-17 16:31
ComboFix-quarantined-files.txt  2009-11-17 15:30

Avant-CF: 24 645 623 808 octets libres
Après-CF: 26 314 149 888 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

- - End Of File - - 7F09D364C4E8E2BB49FA63E5DD18FD83

Destrio5 · Answer

Je m'attendais plutôt à de gros rootkits :D

--> Menu Démarrer > Exécuter > Tape ComboFix /u et valide.

--> Télécharge Lop S&D (par Eric_71 & Angeldark) sur ton Bureau.

--> Double-clique dessus pour lancer l'installation.

--> Puis double-clique sur Lop S&D présent sur ton Bureau.
(Sous Vista, il faut cliquer droit sur Lop S&D et choisir Exécuter en tant qu'administrateur)

--> Sélectionne la langue souhaitée, puis choisis l'option 1 (Recherche).

--> Patiente jusqu'à la fin du scan.

--> Poste le rapport généré (C:\lopR.txt).

Masapaul · Answer

--------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free : Genuine Intel(R) CPU           T2300  @ 1.66GHz )
   BIOS : Ver 1.00PARTTBL
   USER : Masaru ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1356 [VPS 091117-0] 4.8.1356 (Not Activated)
   C:\ (Local Disk) - NTFS - Total:86 Go (Free:24 Go)
   D:\ (Local Disk) - FAT32 - Total:5 Go (Free:0 Go)
   E:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [1] ( 17/11/2009|17:14 )
 
   --------------------\  Listing des dossiers dans APPLIC~1

   [12/03/2009|20:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
   [13/11/2009|06:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{55A29068-F2CE-456C-9148-C869879E2357}
   [11/09/2009|05:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{755AC846-7372-4AC8-8550-C52491DAA8BD}
   [12/04/2009|00:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
   [16/02/2009|14:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\2DBoy
   [16/10/2009|04:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [10/01/2008|01:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [10/01/2008|01:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [07/10/2009|19:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
   [13/11/2009|12:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Electronic Arts
   [15/10/2009|17:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\f-secure
   [15/10/2009|17:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\fssg
   [20/03/2008|01:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [17/11/2009|09:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
   [26/12/2008|15:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP
   [10/01/2008|02:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
   [10/11/2009|06:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\LICENSE ADMIN OPTION BIB
   [24/10/2009|15:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\LogiShrd
   [24/10/2009|15:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
   [18/02/2009|04:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [24/10/2009|07:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
   [01/08/2009|03:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NOS
   [27/02/2006|01:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1
View_Profiles
   [10/01/2008|02:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
   [18/08/2009|03:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
   [10/01/2008|02:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sonic
   [10/11/2009|06:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
   [13/11/2009|06:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TuneUp Software
   [12/11/2009|18:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ulead Systems
   [09/01/2008|21:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [06/10/2009|11:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinZip
   [11/10/2009|15:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
   [06/06/2008|01:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!

   [20/06/2008|07:31] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Apple Computer
   [10/01/2008|02:03] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [15/05/2009|22:10] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Macromedia
   [10/01/2008|02:03] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [15/11/2009|13:00] C:\DOCUME~1\LOCALS~1\APPLIC~1\Adobe
   [15/11/2009|20:25] C:\DOCUME~1\LOCALS~1\APPLIC~1\Macromedia
   [18/01/2008|09:54] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [07/10/2009|06:29] C:\DOCUME~1\Masaru\APPLIC~1\Adobe
   [21/09/2008|18:22] C:\DOCUME~1\Masaru\APPLIC~1\AdobeUM
   [11/09/2009|05:42] C:\DOCUME~1\Masaru\APPLIC~1\Apple Computer
   [25/04/2008|23:30] C:\DOCUME~1\Masaru\APPLIC~1\CyberLink
   [27/03/2008|00:25] C:\DOCUME~1\Masaru\APPLIC~1\DMCache
   [12/08/2009|23:23] C:\DOCUME~1\Masaru\APPLIC~1\dvdcss
   [13/11/2009|07:35] C:\DOCUME~1\Masaru\APPLIC~1\FreeFLVConverter
   [23/05/2008|06:09] C:\DOCUME~1\Masaru\APPLIC~1\Gearbox Software
   [18/08/2009|07:17] C:\DOCUME~1\Masaru\APPLIC~1\GetRightToGo
   [02/07/2008|09:20] C:\DOCUME~1\Masaru\APPLIC~1\Google
   [28/10/2008|22:27] C:\DOCUME~1\Masaru\APPLIC~1\HP
   [10/01/2008|02:03] C:\DOCUME~1\Masaru\APPLIC~1\Identities
   [21/08/2009|11:48] C:\DOCUME~1\Masaru\APPLIC~1\IGN_DLM
   [24/06/2009|04:03] C:\DOCUME~1\Masaru\APPLIC~1\ijjigame
   [13/11/2009|13:00] C:\DOCUME~1\Masaru\APPLIC~1\IMVU
   [08/11/2009|13:17] C:\DOCUME~1\Masaru\APPLIC~1\IMVUClient
   [21/06/2008|09:54] C:\DOCUME~1\Masaru\APPLIC~1\InstallShield
   [24/10/2009|15:59] C:\DOCUME~1\Masaru\APPLIC~1\Leadertech
   [25/02/2008|01:24] C:\DOCUME~1\Masaru\APPLIC~1\LimeWire
   [24/10/2009|15:59] C:\DOCUME~1\Masaru\APPLIC~1\Logitech
   [07/10/2009|06:29] C:\DOCUME~1\Masaru\APPLIC~1\Macromedia
   [10/01/2008|16:50] C:\DOCUME~1\Masaru\APPLIC~1\Media Player Classic
   [22/09/2009|08:45] C:\DOCUME~1\Masaru\APPLIC~1\Microsoft
   [06/07/2009|05:08] C:\DOCUME~1\Masaru\APPLIC~1\Mozilla
   [30/07/2009|05:18] C:\DOCUME~1\Masaru\APPLIC~1\Nero
   [11/01/2008|01:27] C:\DOCUME~1\Masaru\APPLIC~1\Opera
   [16/10/2008|19:41] C:\DOCUME~1\Masaru\APPLIC~1\SecondLife
   [09/01/2008|22:52] C:\DOCUME~1\Masaru\APPLIC~1\SecuROM
   [16/11/2009|20:50] C:\DOCUME~1\Masaru\APPLIC~1\Skype
   [16/11/2009|16:01] C:\DOCUME~1\Masaru\APPLIC~1\skypePM
   [10/01/2008|00:15] C:\DOCUME~1\Masaru\APPLIC~1\Sun
   [27/10/2008|20:07] C:\DOCUME~1\Masaru\APPLIC~1\Symantec
   [13/08/2009|06:43] C:\DOCUME~1\Masaru\APPLIC~1\Synthesia
   [11/11/2008|22:51] C:\DOCUME~1\Masaru\APPLIC~1	eamspeak2
   [13/11/2009|06:37] C:\DOCUME~1\Masaru\APPLIC~1\TuneUp Software
   [12/11/2009|18:40] C:\DOCUME~1\Masaru\APPLIC~1\Ulead Systems
   [20/01/2009|11:41] C:\DOCUME~1\Masaru\APPLIC~1\vghd
   [18/08/2009|10:12] C:\DOCUME~1\Masaru\APPLIC~1\WinRAR

   [10/01/2008|02:03] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [17/11/2009 16:00][--a------] C:\WINDOWS	asks\Maintenance en 1 clic.job
   [17/11/2009 16:44][--a------] C:\WINDOWS	asks\GoogleUpdateTaskMachineUA.job
   [17/11/2009 06:44][--a------] C:\WINDOWS	asks\GoogleUpdateTaskMachineCore.job
   [17/11/2009 16:36][--ah-----] C:\WINDOWS	asks\User_Feed_Synchronization-{DB0943BD-CE22-4FD7-977F-E251E8D3C8AC}.job
   [17/11/2009 14:31][--a------] C:\WINDOWS	asks\Google Software Updater.job
   [12/11/2009 20:03][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [05/08/2004 09:00][-rah-----] C:\WINDOWS	asks\desktop.ini
   [17/11/2009 17:03][--ah-----] C:\WINDOWS	asks\SA.DAT

   --------------------\  Listing des dossiers dans C:\Program Files

   [15/10/2009|13:34] C:\Program Files\Adobe
   [10/06/2009|21:23] C:\Program Files\AGEIA Technologies
   [10/11/2009|06:15] C:\Program Files\Alwil Software
   [07/08/2008|02:00] C:\Program Files\Apple Software Update
   [12/03/2009|20:32] C:\Program Files\Bonjour
   [12/03/2009|11:38] C:\Program Files\Common Files
   [10/01/2008|02:05] C:\Program Files\CONEXANT
   [21/08/2009|10:16] C:\Program Files\Cryptic Studios
   [21/09/2009|04:40] C:\Program Files\Electronic Arts
   [28/07/2009|08:09] C:\Program Files\eMule
   [17/11/2009|16:58] C:\Program Files\Fichiers communs
   [21/02/2009|20:38] C:\Program Files\Free Download Manager
   [13/11/2009|06:49] C:\Program Files\Free FLV Converter
   [15/05/2009|22:10] C:\Program Files\Google
   [16/09/2008|05:05] C:\Program Files\Hewlett-Packard
   [12/07/2009|20:57] C:\Program Files\HP
   [09/01/2008|19:49] C:\Program Files\HPQ
   [12/11/2009|18:56] C:\Program Files\InstallShield Installation Information
   [10/01/2008|02:07] C:\Program Files\Intel
   [16/10/2009|02:48] C:\Program Files\Internet Explorer
   [29/10/2009|20:17] C:\Program Files\iPod
   [29/10/2009|20:18] C:\Program Files\iTunes
   [04/11/2009|03:39] C:\Program Files\Java
   [13/08/2009|04:08] C:\Program Files\K-Lite Codec Pack
   [06/03/2008|13:13] C:\Program Files\LibUSB-Win32-0.1.10.1
   [24/10/2009|15:52] C:\Program Files\Logitech
   [19/09/2008|22:36] C:\Program Files\Messenger
   [18/02/2009|04:33] C:\Program Files\Microsoft
   [10/01/2008|03:00] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [10/01/2008|02:07] C:\Program Files\microsoft frontpage
   [21/02/2009|21:46] C:\Program Files\Microsoft Games for Windows - LIVE
   [18/02/2009|05:53] C:\Program Files\Microsoft Office
   [03/10/2009|05:09] C:\Program Files\Microsoft Office Outlook Connector
   [09/09/2009|19:52] C:\Program Files\Microsoft Silverlight
   [10/01/2008|13:28] C:\Program Files\Microsoft Visual Studio
   [10/06/2009|19:20] C:\Program Files\Microsoft WSE
   [10/01/2008|13:27] C:\Program Files\Microsoft.NET
   [19/09/2008|22:29] C:\Program Files\Movie Maker
   [21/02/2009|21:56] C:\Program Files\MSBuild
   [28/10/2008|21:23] C:\Program Files\MSECACHE
   [04/05/2009|09:17] C:\Program Files\MSN
   [10/01/2008|02:08] C:\Program Files\MSN Gaming Zone
   [28/10/2008|18:40] C:\Program Files\MSXML 4.0
   [13/10/2009|19:44] C:\Program Files\NCSoft
   [24/10/2009|07:14] C:\Program Files\Nero
   [19/09/2008|22:26] C:\Program Files\NetMeeting
   [30/07/2009|20:43] C:\Program Files\NOS
   [10/01/2008|02:08] C:\Program Files\Online Services
   [10/06/2009|21:22] C:\Program Files\OpenAL
   [06/05/2009|02:44] C:\Program Files\Opera
   [13/08/2009|02:03] C:\Program Files\Outlook Express
   [29/07/2009|12:55] C:\Program Files\Philips
   [12/08/2009|20:02] C:\Program Files\Pvm
   [11/09/2009|05:29] C:\Program Files\QuickTime
   [21/02/2009|21:50] C:\Program Files\Reference Assemblies
   [18/09/2009|05:44] C:\Program Files\Replay Music 3
   [10/01/2008|02:08] C:\Program Files\Services en ligne
   [07/10/2009|20:27] C:\Program Files\SFR
   [18/08/2009|03:57] C:\Program Files\Skype
   [10/01/2008|02:09] C:\Program Files\Sonic
   [02/08/2008|18:49] C:\Program Files\Sun
   [10/01/2008|02:09] C:\Program Files\Synaptics
   [21/08/2009|09:38] C:\Program Files\SystemRequirementsLab
   [07/08/2009|06:27] C:\Program Files\Teamspeak2_RC2
   [17/11/2009|16:05] C:\Program Files	rend micro
   [14/11/2009|07:12] C:\Program Files\TuneUp Utilities 2009
   [27/02/2006|10:13] C:\Program Files\Uninstall Information
   [10/08/2009|10:57] C:\Program Files\VideoLAN
   [06/11/2009|05:11] C:\Program Files\Windows Live
   [22/12/2008|13:21] C:\Program Files\Windows Live SkyDrive
   [22/01/2008|16:53] C:\Program Files\Windows Media Connect 2
   [19/09/2008|22:26] C:\Program Files\Windows Media Player
   [19/09/2008|22:26] C:\Program Files\Windows NT
   [27/02/2006|10:13] C:\Program Files\WindowsUpdate
   [29/07/2009|08:27] C:\Program Files\WinZix
   [10/01/2008|02:09] C:\Program Files\xerox

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [15/10/2009|13:36] C:\Program Files\Fichiers communs\Adobe
   [29/10/2009|20:17] C:\Program Files\Fichiers communs\Apple
   [10/01/2008|13:28] C:\Program Files\Fichiers communs\DESIGNER
   [08/08/2008|04:34] C:\Program Files\Fichiers communs\DirectX
   [27/03/2008|20:40] C:\Program Files\Fichiers communs\Hewlett-Packard
   [10/01/2008|02:05] C:\Program Files\Fichiers communs\HP
   [10/01/2008|02:05] C:\Program Files\Fichiers communs\InstallShield
   [10/01/2008|02:05] C:\Program Files\Fichiers communs\Java
   [10/01/2008|02:05] C:\Program Files\Fichiers communs\LightScribe
   [24/10/2009|15:59] C:\Program Files\Fichiers communs\logishrd
   [18/02/2009|05:53] C:\Program Files\Fichiers communs\Microsoft Shared
   [10/01/2008|02:05] C:\Program Files\Fichiers communs\MSSoap
   [24/10/2009|07:15] C:\Program Files\Fichiers communs\Nero
   [10/01/2008|02:05] C:\Program Files\Fichiers communs\ODBC
   [10/01/2008|02:05] C:\Program Files\Fichiers communs\Services
   [18/08/2009|03:57] C:\Program Files\Fichiers communs\Skype
   [10/01/2008|02:05] C:\Program Files\Fichiers communs\Sonic Shared
   [10/01/2008|02:05] C:\Program Files\Fichiers communs\SpeechEngines
   [10/01/2008|02:05] C:\Program Files\Fichiers communs\SureThing Shared
   [10/11/2009|10:26] C:\Program Files\Fichiers communs\Symantec Shared
   [03/10/2009|05:09] C:\Program Files\Fichiers communs\System
   [10/01/2008|02:06] C:\Program Files\Fichiers communs\TiVo Shared
   [07/11/2008|20:12] C:\Program Files\Fichiers communs\Windows Live
   [10/01/2008|00:54] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [10/06/2009|21:22] C:\Program Files\Fichiers communs\Wise Installation Wizard

   --------------------\  Process

   ( 61 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\DOCUME~1\ALLUSE~1\APPLIC~1\LICENSE ADMIN OPTION BIB
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\LICENSE ADMIN OPTION BIB\Dale Pop.dat
   C:\Program Files\WinZix
   C:\DOCUME~1\Masaru\Cookies\masaru@advertstream[1].txt
   C:\DOCUME~1\Masaru\Cookies\masaru@advertstream[3].txt
   C:\DOCUME~1\Masaru\Cookies\masaru@d2.advertserve[1].txt
   C:\DOCUME~1\Masaru\Cookies\masaru@www.adserver5[1].txt
   C:\DOCUME~1\Masaru\Cookies\masaru@adultfriendfinder[1].txt
   C:\DOCUME~1\Masaru\Cookies\masaru@ads.adultadvertising[2].txt
   C:\DOCUME~1\Masaru\Cookies\masaru@advertising.virtualstar[1].txt
   C:\DOCUME~1\Masaru\Cookies\masaru@advertising[2].txt
   C:\DOCUME~1\Masaru\Cookies\masaru@ero-advertising[1].txt
   C:\DOCUME~1\Masaru\Cookies\masaru@www.adultadvertising[1].txt
   C:\DOCUME~1\Masaru\Cookies\masaru@bigpoint[1].txt
   C:\DOCUME~1\Masaru\Cookies\masaru@fr.darkorbit.bigpoint[2].txt
   C:\DOCUME~1\Masaru\Cookies\masaru@cotedazurpalace[1].txt
   C:\DOCUME~1\Masaru\Cookies\masaru@serve.cotedazurpalace[1].txt
   C:\DOCUME~1\Masaru\Cookies\masaru@www.cotedazurpalace[2].txt
   C:\DOCUME~1\Masaru\Cookies\masaru@pacificpoker[1].txt
   C:\DOCUME~1\Masaru\Cookies\masaru@partypoker[1].txt
   C:\DOCUME~1\Masaru\Cookies\masaru@www.partypoker[1].txt
   C:\DOCUME~1\Masaru\Cookies\masaru@2xmoinscher[1].txt
   C:\DOCUME~1\Masaru\Cookies\masaru@www.2xmoinscher[1].txt
 
   --------------------\  Verification du Registre

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-11-17 17:15:24
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   C:\DOCUME~1\Masaru\LOCALS~1\APPLIC~1\Microsoft\Windows Live Mail\Hotmail (ma 30e\Boîte de ré  29\687601B4-00001649.eml 2846 bytes
   scan completed successfully
   hidden processes: 0
   hidden files: 6
 
   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\Masaru\Bureau\Eminem - Relapse\50 Cent - Crack A Bottle.wma


   [F:6][D:3]-> C:\DOCUME~1\Masaru\LOCALS~1\Temp
   [F:2042][D:0]-> C:\DOCUME~1\Masaru\Cookies
   [F:15][D:5]-> C:\DOCUME~1\Masaru\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 17/11/2009|17:18 - Option : [1]

   --------------------\  Fin du rapport a 17:18:54



*--> Menu Démarrer > Exécuter > Tape ComboFix /u et valide.*
ca  servi à quoi ça j'ai pas besoin de te poster le log?

Destrio5 · Answer

"*--> Menu Démarrer > Exécuter > Tape ComboFix /u et valide.*
ca servi à quoi ça j'ai pas besoin de te poster le log?"
--> Pour désinstaller ComboFix.

--> Double-clique sur Lop S&D pour le lancer.
(Sous Vista, il faut cliquer droit sur Lop S&D et choisir Exécuter en tant qu'administrateur) 

--> Choisis cette fois-ci l'option 2 (Suppression).

--> Ne ferme pas la fenêtre lors de la suppression !

--> Poste le rapport généré (C:\lopR.txt).

(Si le Bureau ne réapparaît pas, presse Ctrl+Alt+Suppr, Onglet Fichier, Nouvelle tâche, tape explorer.exe et valide)

Masapaul · Answer

--------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free : Genuine Intel(R) CPU           T2300  @ 1.66GHz )
   BIOS : Ver 1.00PARTTBL
   USER : Masaru ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1356 [VPS 091117-0] 4.8.1356 (Not Activated)
   C:\ (Local Disk) - NTFS - Total:86 Go (Free:24 Go)
   D:\ (Local Disk) - FAT32 - Total:5 Go (Free:0 Go)
   E:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [2] ( 17/11/2009|18:55 )


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\LICENSE ADMIN OPTION BIB\Dale Pop.dat
   Supprime! - C:\DOCUME~1\Masaru\Cookies\masaru@advertstream[1].txt
   Supprime! - C:\DOCUME~1\Masaru\Cookies\masaru@advertstream[3].txt
   Supprime! - C:\DOCUME~1\Masaru\Cookies\masaru@d2.advertserve[1].txt
   Supprime! - C:\DOCUME~1\Masaru\Cookies\masaru@www.adserver5[1].txt
   Supprime! - C:\DOCUME~1\Masaru\Cookies\masaru@adultfriendfinder[1].txt
   Supprime! - C:\DOCUME~1\Masaru\Cookies\masaru@ads.adultadvertising[2].txt
   Supprime! - C:\DOCUME~1\Masaru\Cookies\masaru@advertising.virtualstar[1].txt
   Supprime! - C:\DOCUME~1\Masaru\Cookies\masaru@advertising[2].txt
   Supprime! - C:\DOCUME~1\Masaru\Cookies\masaru@ero-advertising[1].txt
   Supprime! - C:\DOCUME~1\Masaru\Cookies\masaru@www.adultadvertising[1].txt
   Supprime! - C:\DOCUME~1\Masaru\Cookies\masaru@bigpoint[1].txt
   Supprime! - C:\DOCUME~1\Masaru\Cookies\masaru@fr.darkorbit.bigpoint[2].txt
   Supprime! - C:\DOCUME~1\Masaru\Cookies\masaru@cotedazurpalace[1].txt
   Supprime! - C:\DOCUME~1\Masaru\Cookies\masaru@serve.cotedazurpalace[1].txt
   Supprime! - C:\DOCUME~1\Masaru\Cookies\masaru@www.cotedazurpalace[2].txt
   Supprime! - C:\DOCUME~1\Masaru\Cookies\masaru@pacificpoker[1].txt
   Supprime! - C:\DOCUME~1\Masaru\Cookies\masaru@partypoker[1].txt
   Supprime! - C:\DOCUME~1\Masaru\Cookies\masaru@www.partypoker[1].txt
   Supprime! - C:\DOCUME~1\Masaru\Cookies\masaru@2xmoinscher[1].txt
   Supprime! - C:\DOCUME~1\Masaru\Cookies\masaru@www.2xmoinscher[1].txt
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\LICENSE ADMIN OPTION BIB
   Supprime! - C:\Program Files\WinZix
 
   \\\\\\\\\\\\\\\ 

 
   --------------------\  Listing des dossiers dans APPLIC~1

   [12/03/2009|20:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
   [13/11/2009|06:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{55A29068-F2CE-456C-9148-C869879E2357}
   [11/09/2009|05:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{755AC846-7372-4AC8-8550-C52491DAA8BD}
   [12/04/2009|00:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
   [16/02/2009|14:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\2DBoy
   [16/10/2009|04:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [10/01/2008|01:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [10/01/2008|01:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [07/10/2009|19:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
   [13/11/2009|12:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Electronic Arts
   [15/10/2009|17:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\f-secure
   [15/10/2009|17:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\fssg
   [20/03/2008|01:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [17/11/2009|09:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
   [26/12/2008|15:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP
   [10/01/2008|02:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
   [24/10/2009|15:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\LogiShrd
   [24/10/2009|15:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
   [18/02/2009|04:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [24/10/2009|07:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
   [01/08/2009|03:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NOS
   [27/02/2006|01:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1
View_Profiles
   [10/01/2008|02:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
   [18/08/2009|03:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
   [10/01/2008|02:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sonic
   [10/11/2009|06:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
   [13/11/2009|06:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TuneUp Software
   [12/11/2009|18:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ulead Systems
   [09/01/2008|21:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [06/10/2009|11:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinZip
   [11/10/2009|15:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
   [06/06/2008|01:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!

   [20/06/2008|07:31] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Apple Computer
   [10/01/2008|02:03] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [15/05/2009|22:10] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Macromedia
   [10/01/2008|02:03] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [15/11/2009|13:00] C:\DOCUME~1\LOCALS~1\APPLIC~1\Adobe
   [15/11/2009|20:25] C:\DOCUME~1\LOCALS~1\APPLIC~1\Macromedia
   [18/01/2008|09:54] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [07/10/2009|06:29] C:\DOCUME~1\Masaru\APPLIC~1\Adobe
   [21/09/2008|18:22] C:\DOCUME~1\Masaru\APPLIC~1\AdobeUM
   [11/09/2009|05:42] C:\DOCUME~1\Masaru\APPLIC~1\Apple Computer
   [25/04/2008|23:30] C:\DOCUME~1\Masaru\APPLIC~1\CyberLink
   [27/03/2008|00:25] C:\DOCUME~1\Masaru\APPLIC~1\DMCache
   [12/08/2009|23:23] C:\DOCUME~1\Masaru\APPLIC~1\dvdcss
   [13/11/2009|07:35] C:\DOCUME~1\Masaru\APPLIC~1\FreeFLVConverter
   [23/05/2008|06:09] C:\DOCUME~1\Masaru\APPLIC~1\Gearbox Software
   [18/08/2009|07:17] C:\DOCUME~1\Masaru\APPLIC~1\GetRightToGo
   [02/07/2008|09:20] C:\DOCUME~1\Masaru\APPLIC~1\Google
   [28/10/2008|22:27] C:\DOCUME~1\Masaru\APPLIC~1\HP
   [10/01/2008|02:03] C:\DOCUME~1\Masaru\APPLIC~1\Identities
   [21/08/2009|11:48] C:\DOCUME~1\Masaru\APPLIC~1\IGN_DLM
   [24/06/2009|04:03] C:\DOCUME~1\Masaru\APPLIC~1\ijjigame
   [13/11/2009|13:00] C:\DOCUME~1\Masaru\APPLIC~1\IMVU
   [08/11/2009|13:17] C:\DOCUME~1\Masaru\APPLIC~1\IMVUClient
   [21/06/2008|09:54] C:\DOCUME~1\Masaru\APPLIC~1\InstallShield
   [24/10/2009|15:59] C:\DOCUME~1\Masaru\APPLIC~1\Leadertech
   [25/02/2008|01:24] C:\DOCUME~1\Masaru\APPLIC~1\LimeWire
   [24/10/2009|15:59] C:\DOCUME~1\Masaru\APPLIC~1\Logitech
   [07/10/2009|06:29] C:\DOCUME~1\Masaru\APPLIC~1\Macromedia
   [10/01/2008|16:50] C:\DOCUME~1\Masaru\APPLIC~1\Media Player Classic
   [22/09/2009|08:45] C:\DOCUME~1\Masaru\APPLIC~1\Microsoft
   [06/07/2009|05:08] C:\DOCUME~1\Masaru\APPLIC~1\Mozilla
   [30/07/2009|05:18] C:\DOCUME~1\Masaru\APPLIC~1\Nero
   [11/01/2008|01:27] C:\DOCUME~1\Masaru\APPLIC~1\Opera
   [16/10/2008|19:41] C:\DOCUME~1\Masaru\APPLIC~1\SecondLife
   [09/01/2008|22:52] C:\DOCUME~1\Masaru\APPLIC~1\SecuROM
   [16/11/2009|20:50] C:\DOCUME~1\Masaru\APPLIC~1\Skype
   [16/11/2009|16:01] C:\DOCUME~1\Masaru\APPLIC~1\skypePM
   [10/01/2008|00:15] C:\DOCUME~1\Masaru\APPLIC~1\Sun
   [27/10/2008|20:07] C:\DOCUME~1\Masaru\APPLIC~1\Symantec
   [13/08/2009|06:43] C:\DOCUME~1\Masaru\APPLIC~1\Synthesia
   [11/11/2008|22:51] C:\DOCUME~1\Masaru\APPLIC~1	eamspeak2
   [13/11/2009|06:37] C:\DOCUME~1\Masaru\APPLIC~1\TuneUp Software
   [12/11/2009|18:40] C:\DOCUME~1\Masaru\APPLIC~1\Ulead Systems
   [20/01/2009|11:41] C:\DOCUME~1\Masaru\APPLIC~1\vghd
   [18/08/2009|10:12] C:\DOCUME~1\Masaru\APPLIC~1\WinRAR

   [10/01/2008|02:03] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [17/11/2009 18:00][--a------] C:\WINDOWS	asks\Maintenance en 1 clic.job
   [17/11/2009 18:44][--a------] C:\WINDOWS	asks\GoogleUpdateTaskMachineUA.job
   [17/11/2009 06:44][--a------] C:\WINDOWS	asks\GoogleUpdateTaskMachineCore.job
   [17/11/2009 16:36][--ah-----] C:\WINDOWS	asks\User_Feed_Synchronization-{DB0943BD-CE22-4FD7-977F-E251E8D3C8AC}.job
   [17/11/2009 14:31][--a------] C:\WINDOWS	asks\Google Software Updater.job
   [12/11/2009 20:03][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [05/08/2004 09:00][-rah-----] C:\WINDOWS	asks\desktop.ini
   [17/11/2009 17:03][--ah-----] C:\WINDOWS	asks\SA.DAT

   --------------------\  Listing des dossiers dans C:\Program Files

   [15/10/2009|13:34] C:\Program Files\Adobe
   [10/06/2009|21:23] C:\Program Files\AGEIA Technologies
   [10/11/2009|06:15] C:\Program Files\Alwil Software
   [07/08/2008|02:00] C:\Program Files\Apple Software Update
   [12/03/2009|20:32] C:\Program Files\Bonjour
   [12/03/2009|11:38] C:\Program Files\Common Files
   [10/01/2008|02:05] C:\Program Files\CONEXANT
   [21/08/2009|10:16] C:\Program Files\Cryptic Studios
   [21/09/2009|04:40] C:\Program Files\Electronic Arts
   [28/07/2009|08:09] C:\Program Files\eMule
   [17/11/2009|16:58] C:\Program Files\Fichiers communs
   [21/02/2009|20:38] C:\Program Files\Free Download Manager
   [13/11/2009|06:49] C:\Program Files\Free FLV Converter
   [15/05/2009|22:10] C:\Program Files\Google
   [16/09/2008|05:05] C:\Program Files\Hewlett-Packard
   [12/07/2009|20:57] C:\Program Files\HP
   [09/01/2008|19:49] C:\Program Files\HPQ
   [12/11/2009|18:56] C:\Program Files\InstallShield Installation Information
   [10/01/2008|02:07] C:\Program Files\Intel
   [16/10/2009|02:48] C:\Program Files\Internet Explorer
   [29/10/2009|20:17] C:\Program Files\iPod
   [29/10/2009|20:18] C:\Program Files\iTunes
   [04/11/2009|03:39] C:\Program Files\Java
   [13/08/2009|04:08] C:\Program Files\K-Lite Codec Pack
   [06/03/2008|13:13] C:\Program Files\LibUSB-Win32-0.1.10.1
   [24/10/2009|15:52] C:\Program Files\Logitech
   [19/09/2008|22:36] C:\Program Files\Messenger
   [18/02/2009|04:33] C:\Program Files\Microsoft
   [10/01/2008|03:00] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [10/01/2008|02:07] C:\Program Files\microsoft frontpage
   [21/02/2009|21:46] C:\Program Files\Microsoft Games for Windows - LIVE
   [18/02/2009|05:53] C:\Program Files\Microsoft Office
   [03/10/2009|05:09] C:\Program Files\Microsoft Office Outlook Connector
   [09/09/2009|19:52] C:\Program Files\Microsoft Silverlight
   [10/01/2008|13:28] C:\Program Files\Microsoft Visual Studio
   [10/06/2009|19:20] C:\Program Files\Microsoft WSE
   [10/01/2008|13:27] C:\Program Files\Microsoft.NET
   [19/09/2008|22:29] C:\Program Files\Movie Maker
   [21/02/2009|21:56] C:\Program Files\MSBuild
   [28/10/2008|21:23] C:\Program Files\MSECACHE
   [04/05/2009|09:17] C:\Program Files\MSN
   [10/01/2008|02:08] C:\Program Files\MSN Gaming Zone
   [28/10/2008|18:40] C:\Program Files\MSXML 4.0
   [13/10/2009|19:44] C:\Program Files\NCSoft
   [24/10/2009|07:14] C:\Program Files\Nero
   [19/09/2008|22:26] C:\Program Files\NetMeeting
   [30/07/2009|20:43] C:\Program Files\NOS
   [10/01/2008|02:08] C:\Program Files\Online Services
   [10/06/2009|21:22] C:\Program Files\OpenAL
   [06/05/2009|02:44] C:\Program Files\Opera
   [13/08/2009|02:03] C:\Program Files\Outlook Express
   [29/07/2009|12:55] C:\Program Files\Philips
   [12/08/2009|20:02] C:\Program Files\Pvm
   [11/09/2009|05:29] C:\Program Files\QuickTime
   [21/02/2009|21:50] C:\Program Files\Reference Assemblies
   [18/09/2009|05:44] C:\Program Files\Replay Music 3
   [10/01/2008|02:08] C:\Program Files\Services en ligne
   [07/10/2009|20:27] C:\Program Files\SFR
   [18/08/2009|03:57] C:\Program Files\Skype
   [10/01/2008|02:09] C:\Program Files\Sonic
   [02/08/2008|18:49] C:\Program Files\Sun
   [10/01/2008|02:09] C:\Program Files\Synaptics
   [21/08/2009|09:38] C:\Program Files\SystemRequirementsLab
   [07/08/2009|06:27] C:\Program Files\Teamspeak2_RC2
   [17/11/2009|16:05] C:\Program Files	rend micro
   [14/11/2009|07:12] C:\Program Files\TuneUp Utilities 2009
   [27/02/2006|10:13] C:\Program Files\Uninstall Information
   [10/08/2009|10:57] C:\Program Files\VideoLAN
   [06/11/2009|05:11] C:\Program Files\Windows Live
   [22/12/2008|13:21] C:\Program Files\Windows Live SkyDrive
   [22/01/2008|16:53] C:\Program Files\Windows Media Connect 2
   [19/09/2008|22:26] C:\Program Files\Windows Media Player
   [19/09/2008|22:26] C:\Program Files\Windows NT
   [27/02/2006|10:13] C:\Program Files\WindowsUpdate
   [10/01/2008|02:09] C:\Program Files\xerox

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [15/10/2009|13:36] C:\Program Files\Fichiers communs\Adobe
   [29/10/2009|20:17] C:\Program Files\Fichiers communs\Apple
   [10/01/2008|13:28] C:\Program Files\Fichiers communs\DESIGNER
   [08/08/2008|04:34] C:\Program Files\Fichiers communs\DirectX
   [27/03/2008|20:40] C:\Program Files\Fichiers communs\Hewlett-Packard
   [10/01/2008|02:05] C:\Program Files\Fichiers communs\HP
   [10/01/2008|02:05] C:\Program Files\Fichiers communs\InstallShield
   [10/01/2008|02:05] C:\Program Files\Fichiers communs\Java
   [10/01/2008|02:05] C:\Program Files\Fichiers communs\LightScribe
   [24/10/2009|15:59] C:\Program Files\Fichiers communs\logishrd
   [18/02/2009|05:53] C:\Program Files\Fichiers communs\Microsoft Shared
   [10/01/2008|02:05] C:\Program Files\Fichiers communs\MSSoap
   [24/10/2009|07:15] C:\Program Files\Fichiers communs\Nero
   [10/01/2008|02:05] C:\Program Files\Fichiers communs\ODBC
   [10/01/2008|02:05] C:\Program Files\Fichiers communs\Services
   [18/08/2009|03:57] C:\Program Files\Fichiers communs\Skype
   [10/01/2008|02:05] C:\Program Files\Fichiers communs\Sonic Shared
   [10/01/2008|02:05] C:\Program Files\Fichiers communs\SpeechEngines
   [10/01/2008|02:05] C:\Program Files\Fichiers communs\SureThing Shared
   [10/11/2009|10:26] C:\Program Files\Fichiers communs\Symantec Shared
   [03/10/2009|05:09] C:\Program Files\Fichiers communs\System
   [10/01/2008|02:06] C:\Program Files\Fichiers communs\TiVo Shared
   [07/11/2008|20:12] C:\Program Files\Fichiers communs\Windows Live
   [10/01/2008|00:54] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [10/06/2009|21:22] C:\Program Files\Fichiers communs\Wise Installation Wizard

   --------------------\  Process

   ( 62 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-11-17 18:56:58
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 5
 
   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\Masaru\Bureau\Eminem - Relapse\50 Cent - Crack A Bottle.wma


   [F:407][D:11]-> C:\DOCUME~1\Masaru\LOCALS~1\Temp
   [F:2022][D:0]-> C:\DOCUME~1\Masaru\Cookies
   [F:1027][D:12]-> C:\DOCUME~1\Masaru\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 17/11/2009|17:18 - Option : [1]
   2 - "C:\Lop SD\LopR_2.txt" - 17/11/2009|19:01 - Option : [2]

   --------------------\  Fin du rapport a 19:01:04


"*--> Menu Démarrer > Exécuter > Tape ComboFix /u et valide.* 
ca servi à quoi ça j'ai pas besoin de te poster le log? 
--> Pour désinstaller ComboFix."

C'est normal qu'il ait fait un scan suivi d'un rapport en validant la commande et qu'il soit toujours sur le bureau? (désolé si je pose trop de questions ^^)

Destrio5 · Answer

"C'est normal qu'il ait fait un scan suivi d'un rapport en validant la commande et qu'il soit toujours sur le bureau? (désolé si je pose trop de questions ^^)"
--> Normalement non.

&#9679; Télécharge Ad-Remover (de Cyrildu17 / C_XX) sur ton Bureau.

/!\ Déconnecte-toi d'Internet et ferme toutes applications en cours. /!\

&#9679; Double-clique sur le programme AD-R situé sur ton Bureau.
(Sous Vista, il faut cliquer droit sur AD-R et choisir Exécuter en tant qu'administrateur)
&#9679; Au menu principal, choisis l'option L.
&#9679; Poste le rapport généré (C:\Ad-Report-CLEAN.log).

(CTRL+A pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller)

Note : "Process.exe", une composante de l'outil, est détectée par certains antivirus (AntiVir, Kaspersky, etc.) comme étant un RiskTool.

Masapaul · Answer

.
======= RAPPORT D'AD-REMOVER 1.1.4.6_C | UNIQUEMENT XP/VISTA/7 =======
.
Mit à jour par C_XX le 16.11.2009 à 22:21
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 19:13:53, 17/11/2009 | Mode Normal | Option: CLEAN
Exécuté de: C:\Program Files\Ad-Remover\
Système d'exploitation: Microsoft® Windows XP™  Service Pack 3 v5.1.2600
Nom du PC: PAUL | Utilisateur actuel: Masaru
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.

.
C:\DOCUME~1\Masaru\Cookies\masaru@ads.addynamix[2].txt
C:\DOCUME~1\Masaru\Cookies\masaru@divxcrawler[1].txt
C:\DOCUME~1\Masaru\Cookies\masaru@eversave[1].txt
C:\DOCUME~1\Masaru\Cookies\masaru@kiwee[2].txt
C:\DOCUME~1\Masaru\Cookies\masaru@mywebsearch[1].txt
C:\DOCUME~1\Masaru\Cookies\masaru@www1.kiwee[2].txt
 
(!) -- Fichiers temporaires supprimés. 
 
.
============== Scan additionnel ==============
.
.
* Internet Explorer Version 8.0.6001.18702 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Start Page: hxxp://fr.msn.com/
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page Redirect Cache: hxxp://fr.msn.com/?ocid=iehp
Start Page Redirect Cache_TIMESTAMP: NARY     	9ee3ef87d1b9c901
Start Page Redirect Cache AcceptLangs: fr
Default_search_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Default_page_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/
Search bar: hxxp://search.msn.com/spbasic.htm
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
============== Suspect (Cracks, Serials, ...) ==============
.
C:\Documents and Settings\Masaru\Application Data\IMVUClient\GeckoBin\TestPlainTextSerializer.exe
.
===================================
.
2213 Octet(s) - C:\Ad-Report-CLEAN[1].log 
.
22 Fichier(s) - C:\DOCUME~1\Masaru\LOCALS~1\Temp 
5 Fichier(s) - C:\WINDOWS\Temp 
.
17 Fichier(s) - C:\Program Files\Ad-Remover\BACKUP
6 Fichier(s) - C:\Program Files\Ad-Remover\QUARANTINE 
.
Fin à: 19:18:24 | 17/11/2009 - CLEAN[1]
.
============== E.O.F ==============
.


""C'est normal qu'il ait fait un scan suivi d'un rapport en validant la commande et qu'il soit toujours sur le bureau? (désolé si je pose trop de questions ^^)" 
--> Normalement non. "
Y'a bien un espace entre ComboFix et /u? c'est pas grave on s'en occupe plus tard?

Destrio5 · Answer

"Y'a bien un espace entre ComboFix et /u?"
--> Oui.

---> Désinstalle Ad-Remover.

---> Télécharge Malwarebytes' Anti-Malware (MBAM) sur ton Bureau.
---> Double-clique sur le fichier téléchargé pour lancer le processus d'installation.
---> Dans l'onglet Mise à jour, clique sur le bouton Recherche de mise à jour : si le pare-feu demande l'autorisation à MBAM de se connecter à Internet, accepte.
---> Une fois la mise à jour terminée, rends-toi dans l'onglet Recherche.
---> Sélectionne Exécuter un examen rapide.
---> Clique sur Rechercher. L'analyse démarre.

A la fin de l'analyse, un message s'affiche :

L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.

---> Clique sur OK pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
---> Ferme tes navigateurs.
Si des malwares ont été détectés, clique sur Afficher les résultats.
---> Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre infectés et en mettre une copie dans la quarantaine.
---> MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport dans ta prochaine réponse.

Masapaul · Answer

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 3188
Windows 5.1.2600 Service Pack 3

17/11/2009 20:25:33
mbam-log-2009-11-17 (20-25-33).txt

Type de recherche: Examen rapide
Eléments examinés: 104470
Temps écoulé: 2 minute(s), 7 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Destrio5 · Answer

--> Refais un scan RSIT et poste le rapport log.

Masapaul · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by Masaru at 2009-11-17 20:31:14
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 25 GB (28%) free of 89 GB
Total RAM: 2046 MB (65% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:31:17, on 17/11/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\HP\TVPlay\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\libusbd-nt.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\Program Files\HP\TVPlay\Kernel\TV\TVPCapSvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\HP\TVPlay\Kernel\TV\TVPSched.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\HP\TVPlay\TVPService.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\HPQ\SHARED\HPQTOA~1.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\SFR\Kit\9props.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Documents and Settings\Masaru\Bureau\RSIT.exe
C:\Program Files	rend micro\Masaru.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide à la navigation SFR - {0F6E720A-1A6B-40E1-A294-1D4D19F156C8} - C:\Program Files\SFR\Kit\SFRNavErrorHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TVPService] "C:\Program Files\HP\TVPlay\TVPService.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Connexion SFR 9props.exe] "C:\Program Files\SFR\Kit\9props.exe" /trayicon
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Masaru\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www8.hp.com/fr/fr/home.html
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} - http://activex.camfrogweb.com/advanced/2.0.2.3/cfweb_activex.camfrogweb.com-advanced-2.0.2.3_instmodule.exe
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - https://www.fileplanet.com/
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - https://wimpro3.cce.hp.com/ChatEntry/downloads/sysinfo.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} (DeviceEnum Class) - http://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {BA162249-F2C5-4851-8ADC-FC58CB424243} (Image Uploader Control) - http://copainsdavant.linternaute.com/html_include_bibliotheque/objimageuploader/5.0.15.0/ImageUploader5.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Media Library Service(HP TVPlay) - Cyberlink - C:\Program Files\HP\TVPlay\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: getPlus(R) Helper - Unknown owner - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe (file missing)
O23 - Service: Google Update Service (gupdate1c98bc53ec9cac0) (gupdate1c98bc53ec9cac0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\logishrd\Bluetooth\LBTServ.exe
O23 - Service: LibUsb-Win32 - Daemon, Version 0.1.10.1 (libusbd) - https://sourceforge.net/p/libusb-win32/wiki/Home/ - C:\WINDOWS\system32\libusbd-nt.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Program Files\Fichiers communs\Symantec Shared\Support Controls\ssrc.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe
O23 - Service: CyberLink Background Capture Service (CBCS HP TVPlay) (TVPCapSvc) - Unknown owner - C:\Program Files\HP\TVPlay\Kernel\TV\TVPCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS HP TVPlay) (TVPSched) - Unknown owner - C:\Program Files\HP\TVPlay\Kernel\TV\TVPSched.exe

Destrio5 · Answer

Le PC va mieux ?

Tu souhaites conserver Avast ?

Masapaul · Answer

Vi il semble aller mieux, tu penses qu'Antivir aurait pu éviter cette infection? Et puis dois je garder tous les programmes téléchargés?

Sur mon bureau, j'ai RSIT, ComboFix, LopSD, AD-R, mbam-setup et Malwarebytes' Anti-Malware.

Destrio5 · Answer

"tu penses qu'Antivir aurait pu éviter cette infection?"
--> Peut-être.


1/

---> Désinstalle HijackThis.

---> Télécharge ToolsCleaner2 sur ton Bureau.
* Double-clique sur ToolsCleaner2.exe pour le lancer.
* Clique sur Recherche et laisse le scan agir.
* Clique sur Suppression pour finaliser. 
* Tu peux, si tu le souhaites, te servir des Options Facultatives.
* Clique sur Quitter pour obtenir le rapport. 
* Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).


2/

---> Télécharge et installe CCleaner Slim.
* Lance-le. Va dans Options puis Avancé et décoche la case Effacer uniquement les fichiers etc....
* Va dans Nettoyeur, choisis Analyse. Une fois terminé, lance le nettoyage. 


3/

---> Il est nécessaire de désactiver puis réactiver la restauration système pour la purger.


==Prévention==

Conserve MBAM. Il te servira à scanner les fichiers douteux en complément de l'antivirus et scanne le disque dur régulièrement.

Comme navigateur, utilise plutôt Mozilla Firefox qu'Internet Explorer.

Vérifie que les mises à jour automatiques sont bien activées (Menu Démarrer, clique droit sur Poste de travail, Propriétés, onglet Mises à jour automatiques).

Par rapport au P2P : Lien

Voici un dossier complet (A lire avec Adobe Reader ou Foxit Reader) : Lien


Sois plus vigilant(e) sur Internet ;)

Masapaul · Answer

[ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ]

--> Recherche: 

C:\Combofix.txt: trouvé !
C:\lopR.txt: trouvé !
C:\Combofix: trouvé !
C:\Lop SD: trouvé !
C:\Qoobox: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\Masaru\Bureau\LopSD.exe: trouvé !
C:\Documents and Settings\Masaru\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\Masaru\Bureau\Ad-R.exe: trouvé !
C:\Documents and Settings\Masaru\Bureau\Rsit.exe: trouvé !
C:\Lop SD\catchme.exe: trouvé !
C:\Lop SD\catchme.log: trouvé !
C:\Program Files\Ad-remover: trouvé !
C:\Program Files	rend micro\HijackThis.exe: trouvé !
C:\Program Files	rend micro\hijackthis.log: trouvé !
C:\Qoobox\Quarantine\catchme.log: trouvé !
C:\WINDOWS\mbr.exe: trouvé !

---------------------------------
--> Suppression: 

C:\Documents and Settings\Masaru\Bureau\LopSD.exe: supprimé !
C:\Documents and Settings\Masaru\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Documents and Settings\Masaru\Bureau\Ad-R.exe: supprimé !
C:\Lop SD\catchme.exe: supprimé !
C:\Program Files	rend micro\HijackThis.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\lopR.txt: supprimé !
C:\Documents and Settings\Masaru\Bureau\Rsit.exe: supprimé !
C:\Lop SD\catchme.log: supprimé !
C:\Program Files	rend micro\hijackthis.log: supprimé !
C:\Qoobox\Quarantine\catchme.log: supprimé !
C:\WINDOWS\mbr.exe: supprimé !
C:\Combofix: supprimé !
C:\Lop SD: supprimé !
C:\Qoobox: supprimé !
C:\Rsit: supprimé !
C:\Program Files\Ad-remover: ERREUR DE SUPPRESSION !!

Destrio5 · Answer

Tu peux supprimer ToolsCleaner.

;)

Masapaul · Answer

Je peux faire de même avec ccsetup225_slim, ComboFix, CCleaner et mbam-setup? Ils sont tous désinstaler?

Je garde que Malwarebytes c'est ca?

Destrio5 · Answer

Garde CCleaner et Malwarebytes' Anti-Malware.

Masapaul · Answer

Comment fonctionnent ils? C'est automatique? Ils s'activent tout seul à chaque démarage?

En tout cas je te remercie infiniment pour toute l'aide que tu m'a apporté!!!

Destrio5 · Answer

Non non, ce n'est pas automatique.

Masapaul · Answer

Rebonjour,

Quels sont les fonctions de CCleaner et Malwarebytes' Anti-Malware? A quels fréquences dois-je les utiliser? Et comment les utiliser?

En ce qui concerne Antivir (oui je vais virer avast) comment fait-on pour eviter les pages publicitaires?

Merci

Destrio5 · Answer

https://www.forumpro.fr/search/darksky1985.forumpro.fr

Main.exoclick - Page 2

Newsletters