Rapport Hijackthis

merci voici le rapport

.
======= RAPPORT D'AD-REMOVER 1.1.4.6_D | UNIQUEMENT XP/VISTA/7 =======
.
Mit à jour par C_XX le 26.11.2009 à 22:49
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 11:10:19, 27/11/2009 | Mode Normal | Option: CLEAN
Exécuté de: C:\Program Files\Ad-Remover\
Système d'exploitation: Microsoft® Windows Vista™ Home Premium Service Pack 1 v6.0.6001
Nom du PC: PC-DE-OLIVIER | Utilisateur actuel: olivier
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.
C:\Program Files\AskBarDis
C:\Program Files\Mozilla FireFox\Components\AskSearch.js
C:\Users\olivier\AppData\Roaming\MICROS~1\Windows\Cookies\olivier@ask[1].txt
C:\Users\olivier\AppData\Roaming\MICROS~1\Windows\Cookies\Low\olivier@ask[2].txt
.
HKCU\software\appdatalow\AskBarDis
HKCU\software\AskBarDis
HKCU\software\microsoft\internet explorer\searchscopes\{CF739809-1C6C-47C0-85B9-569DBB141420}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{3041d03e-fd4b-44e0-b742-2d9b88305f98}
HKLM\software\appdatalow\AskBarDis
HKLM\Software\Classes\CLSID\{0702a2b6-13aa-4090-9e01-bcdc85dd933f}
HKLM\Software\Classes\CLSID\{201f27d4-3704-41d6-89c1-aa35e39143ed}
HKLM\Software\Classes\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}
HKLM\Software\Classes\CLSID\{622fd888-4e91-4d68-84d4-7262fd0811bf}
HKLM\Software\Classes\CLSID\{b0de3308-5d5a-470d-81b9-634fc078393b}
HKLM\Software\Classes\TypeLib\{4B1C1E16-6B34-430E-B074-5928ECA4C150}
HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{3041d03e-fd4b-44e0-b742-2d9b88305f98}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}

(!) -- Fichiers temporaires supprimés.

.
============== Scan additionnel ==============
.
.
* Internet Explorer Version 7.0.6001.18000 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Start Page: hxxp://fr.msn.com/
Default_search_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Default_page_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Start Page: hxxp://fr.msn.com/
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://search.msn.com/spbasic.htm
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
============== Suspect (Cracks, Serials, ...) ==============
.
C:\Users\olivier\Downloads\patch\crack.exe
.
===================================
.
2786 Octet(s) - C:\Ad-Report-CLEAN[1].log
.
567 Fichier(s) - C:\Users\olivier\AppData\Local\Temp
18 Fichier(s) - C:\Windows\Temp
.
20 Fichier(s) - C:\Program Files\Ad-Remover\BACKUP
14 Fichier(s) - C:\Program Files\Ad-Remover\QUARANTINE
.
Fin à: 11:16:50 | 27/11/2009 - CLEAN[1]
.
============== E.O.F ==============
.

http://www.cijoint.fr/cjlink.php?file=cj200911/cij7xm3NQR.txt
voici le fichier OTL.TXT

========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!

OTL by OldTimer - Version 3.1.11.0 log created on 11272009_195056
desole j ai fais la manip 2 fois pour supprimer

List'em by g3n-h@ckm@n 1.0.5.6

Thx to Chiquitine29.....

User : olivier (Administrateurs) # PC-DE-OLIVIER
Update on 25/11/2009 by g3n-h@ckm@n ::::: 13:00
Start at: 20:16:42 | 27/11/2009
Contact : g3n-h@ckm@n sur CCM

AMD Athlon(tm) 64 X2 Dual Core Processor 4000+
Microsoft® Windows Vista™ Édition Familiale Premium (6.0.6001 32-bit) # Service Pack 1
Internet Explorer 7.0.6001.18000
Windows Firewall Status : Disabled
AV : avast! antivirus 4.8.1351 [VPS 091127-1] 4.8.1351 [ Enabled | Updated ]

C:\ -> Disque fixe local | 228,13 Go (196,83 Go free) [ACER] | NTFS
D:\ -> Disque fixe local | 227,87 Go (222,26 Go free) [DATA] | NTFS
E:\ -> Disque CD-ROM | 0 Mo (0 Mo free) [Audio CD] | CDFS
F:\ -> Disque amovible
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processus en cours

C:\Windows\System32\smss.exe 436
C:\Windows\system32\csrss.exe 580
C:\Windows\system32\wininit.exe 636
C:\Windows\system32\csrss.exe 648
C:\Windows\system32\services.exe 684
C:\Windows\system32\lsass.exe 696
C:\Windows\system32\lsm.exe 708
C:\Windows\system32\winlogon.exe 788
C:\Windows\system32\svchost.exe 888
C:\Windows\system32\svchost.exe 972
C:\Windows\System32\svchost.exe 1008
C:\Windows\system32\Ati2evxx.exe 1096
C:\Windows\System32\svchost.exe 1116
C:\Windows\System32\svchost.exe 1192
C:\Windows\system32\svchost.exe 1204
C:\Windows\system32\SLsvc.exe 1320
C:\Windows\system32\svchost.exe 1380
C:\Windows\system32\svchost.exe 1536
C:\Windows\system32\Ati2evxx.exe 1612
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe 1660
C:\Program Files\Alwil Software\Avast4\ashServ.exe 1676
C:\Windows\System32\spoolsv.exe 1992
C:\Windows\system32\svchost.exe 2016
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe 884
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe 1056
C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe 1688
C:\Program Files\Common Files\LightScribe\LSSrvc.exe 296
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE 2092
C:\Program Files\Microsoft LifeCam\MSCamS32.exe 2144
C:\Windows\system32\svchost.exe 2172
C:\Program Files\CyberLink\Shared Files\RichVideo.exe 2200
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 2232
C:\Windows\system32\svchost.exe 2308
C:\Windows\System32\svchost.exe 2348
C:\Windows\system32\SearchIndexer.exe 2412
C:\Windows\system32\taskeng.exe 2420
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe 2480
C:\Windows\system32\WUDFHost.exe 2748
C:\Windows\system32\taskeng.exe 3480
C:\Windows\system32\Dwm.exe 3512
C:\Program Files\Windows Defender\MSASCui.exe 3848
C:\Windows\RtHDVCpl.exe 3860
C:\Acer\Empowering Technology\SysMonitor.exe 3880
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 3892
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE 3968
C:\Program Files\Alwil Software\Avast4\ashDisp.exe 4004
C:\Windows\vVX1000.exe 4044
C:\Program Files\Windows Sidebar\sidebar.exe 4060
C:\Windows\ehome\ehtray.exe 2088
C:\Program Files\Orange\Media Player\Media Player.exe 2264
C:\Program Files\uTorrent\uTorrent.exe 184
C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe 2500
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe 1876
C:\Program Files\Vidalia Bundle\Privoxy\privoxy.exe 2720
C:\Windows\ehome\ehmsas.exe 2872
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe 2324
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE 4128
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE 4208
C:\Program Files\Vidalia Bundle\Tor\tor.exe 4560
C:\Windows\system32\wuauclt.exe 5672
C:\Windows\System32\wsqmcons.exe 3340
C:\Windows\System32\mobsync.exe 5204
C:\Program Files\Windows Media Player\wmplayer.exe 964
C:\Windows\explorer.exe 6032
C:\Program Files\Internet Explorer\iexplore.exe 5240
C:\Program Files\Windows Live\Toolbar\wltuser.exe 5836
C:\Windows\system32\SearchProtocolHost.exe 4504
C:\Windows\system32\SearchFilterHost.exe 2992
C:\Users\olivier\Desktop\List_Kill'em.exe 5296
C:\Windows\system32\conime.exe 5792
C:\Windows\system32\cmd.exe 4512
C:\Windows\system32\wbem\wmiprvse.exe 5896
C:\Users\olivier\AppData\Local\Temp\4869.tmp\pv.exe 5716

======================
Cles de demarrage "Run"
======================

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Sidebar REG_SZ C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
Acer Tour Reminder REG_SZ C:\Acer\AcerTour\Reminder.exe
MsnMsgr REG_SZ "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
ehTray.exe REG_SZ C:\Windows\ehome\ehTray.exe
OrangePlayer REG_SZ C:\Program Files\Orange\Media Player\Media Player.exe /systray
uTorrent REG_SZ "C:\Program Files\uTorrent\uTorrent.exe"
Vidalia REG_SZ "C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe"

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Windows Defender REG_EXPAND_SZ %ProgramFiles%\Windows Defender\MSASCui.exe -hide
RtHDVCpl REG_SZ RtHDVCpl.exe
Acer Tour REG_SZ
Acer Empowering Technology Monitor REG_SZ C:\Acer\Empowering Technology\SysMonitor.exe
eDataSecurity Loader REG_SZ C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
StartCCC REG_SZ C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
WarReg_PopUp REG_SZ C:\Acer\WR_PopUp\WarReg_PopUp.exe
eRecoveryService REG_SZ
Acer Tour Reminder REG_SZ C:\Acer\AcerTour\Reminder.exe
Apanel REG_SZ C:\ACERSW\config\NewSetApanel.cmd
Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
avast! REG_SZ C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
LifeCam REG_SZ "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
VX1000 REG_SZ C:\Windows\vVX1000.exe
fssui REG_SZ "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents
=====================
cles additionnelles
=====================

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
ConsentPromptBehaviorAdmin REG_DWORD 0x2
ConsentPromptBehaviorUser REG_DWORD 0x1
EnableInstallerDetection REG_DWORD 0x1
EnableLUA REG_DWORD 0x0
EnableSecureUIAPaths REG_DWORD 0x1
EnableVirtualization REG_DWORD 0x1
PromptOnSecureDesktop REG_DWORD 0x1
ValidateAdminCodeSignatures REG_DWORD 0x0
dontdisplaylastusername REG_DWORD 0x0
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
scforceoption REG_DWORD 0x0
shutdownwithoutlogon REG_DWORD 0x1
undockwithoutlogon REG_DWORD 0x1
FilterAdministratorToken REG_DWORD 0x0
EnableUIADesktopToggle REG_DWORD 0x0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\UIPI
===============
===============
BHO :
======

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4f3ed5cd-0726-42a9-87f5-d13f3d2976ac}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

Ndisuio : 0x3
EapHost : 0x3
Wlansvc : 0x3
SharedAccess : 0x4
windefend : 0x2
wuauserv : 0x2
=========

=========================
Environnement variables :
=========================

ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\olivier\AppData\Roaming
choix=1
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=PC-DE-OLIVIER
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\olivier
LOCALAPPDATA=C:\Users\olivier\AppData\Local
LOGONSERVER=\\PC-DE-OLIVIER
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 107 Stepping 1, AuthenticAMD
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=6b01
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
PROMPT=$P$G
PUBLIC=C:\Users\Public
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\olivier\AppData\Local\Temp
TMP=C:\Users\olivier\AppData\Local\Temp
USERDOMAIN=PC-de-olivier
USERNAME=olivier
USERPROFILE=C:\Users\olivier
windir=C:\Windows


¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :


¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes :


=====================
Verification Rootkits
=====================

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-27 20:18:09
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


¤¤¤¤¤¤¤¤¤¤ C:\Windows\Prefetch :

ACRORD32.EXE-DE3ACCC1.pf
AD-R.EXE-5715228D.pf
AD-R[1].EXE-3FE4641B.pf
ADOBEUPDATER.EXE-9A17D89B.pf
AgAppLaunch.db
AgCx_S1_S-1-5-21-1216364523-3819575748-351290812-1000.snp.db
AgCx_SC1.db
AgCx_SC1.db.trx
AgGlFaultHistory.db
AgGlFgAppHistory.db
AgGlGlobalHistory.db
AgGlUAD_P_S-1-5-21-1216364523-3819575748-351290812-1000.db
AgGlUAD_S-1-5-21-1216364523-3819575748-351290812-1000.db
AgRobust.db
ASHSERV.EXE-56323471.pf
ASKUPGRADE.EXE-11555FEB.pf
ASPNET_REGIIS.EXE-A5891C91.pf
ASWUPDSV.EXE-22A0C186.pf
ATI2EVXX.EXE-0327F1E7.pf
ATTRIB.EXE-A990CB86.pf
AU_.EXE-B7767B8F.pf
AVAST.SETUP-499863F4.pf
BFSVC.EXE-9C7A4DEE.pf
BURNMACHINE.EXE-64DD4317.pf
CCC.EXE-AE792174.pf
CHCP.COM-61043047.pf
CLMSSERVER.EXE-D39D0A86.pf
CMD.EXE-4A81B364.pf
CONIME.EXE-9781FD5F.pf
CONSENT.EXE-531BD9EA.pf
CONTROL.EXE-817F8F1D.pf
CSC.EXE-A3B8D95D.pf
CSRSS.EXE-3FE41F7E.pf
CVTRES.EXE-069169FB.pf
DEFRAG.EXE-588F90AD.pf
DFRGNTFS.EXE-7E4077FE.pf
DLLHOST.EXE-4F28A26F.pf
DLLHOST.EXE-5E46FA0D.pf
DLLHOST.EXE-6BCB9FAA.pf
DLLHOST.EXE-74857ABA.pf
DLLHOST.EXE-766398D2.pf
DLLHOST.EXE-7FAA2E4C.pf
DLLHOST.EXE-B2EB1806.pf
DRVINST.EXE-4CB4314A.pf
DWM.EXE-6FFD3DA8.pf
EDSSERVICE.EXE-B588D2B3.pf
EHMSAS.EXE-2D3B2F21.pf
ENCRYPTION.EXE-7C042229.pf
ERECOVERY.EXE-CD817917.pf
ERUNT.COM-07498A99.pf
EXPLORER.EXE-A80E4F97.pf
FLASHUTIL10B.EXE-06DAF439.pf
FVEUPDATE.EXE-0CFD1236.pf
GOOGLECRASHHANDLER.EXE-8A3B4C33.pf
GOOGLETOOLBARNOTIFIER.EXE-EB3F2433.pf
GOOGLETOOLBARUSER_32.EXE-4E14BB2A.pf
GOOGLEUPDATE.EXE-FE771DDA.pf
GOOGLEUPDATERSERVICE.EXE-09540BCD.pf
GREP.COM-7CEEBED7.pf
HIJACKTHIS.EXE-F31997E8.pf
HIJACKTHIS[1].EXE-F448196E.pf
IE4UINIT.EXE-3A7E0C67.pf
IEUSER.EXE-7C0FE221.pf
IEXPLORE.EXE-908C99F8.pf
INFOCARD.EXE-ECED8D38.pf
ISADMIN.COM-34AD35BA.pf
Layout.ini
LODCTR.EXE-72CD50D0.pf
LOGONUI.EXE-09140401.pf
LSSRVC.EXE-0D95A0DF.pf
MBRWRWIN.EXE-2144233B.pf
MEMCHECK.EXE-097EA243.pf
MOBSYNC.EXE-C5E2284F.pf
MODE.COM-DB34C082.pf
MPAS-D_BD1.EXE-97E29C40.pf
MPCMDRUN.EXE-F401FBB4.pf
MPMINISIGSTUB.EXE-CD6D72E3.pf
MPSIGSTUB.EXE-6CB27A06.pf
MSCORSVW.EXE-90526FAC.pf
MSDTC.EXE-CC1DEC77.pf
MSFEEDSSYNC.EXE-6E6FBDF4.pf
MSIEXEC.EXE-A2D55CB6.pf
MSXML4-KB973688-ENU.EXE-B20BB4A9.pf
NETCFG.EXE-F61A0ADB.pf
NETSH.EXE-F1B6DA12.pf
NIRCMD.COM-6EFE3EBA.pf
NOTEPAD.EXE-86E0E9B9.pf
NOTEPAD.EXE-D8414F97.pf
NSS.EXE-6F7F8FBC.pf
NTOSBOOT-B00DFAAD.pf
OTL.EXE-D5FF457C.pf
PfSvPerfStats.bin
POQEXEC.EXE-F7DA341E.pf
PROCESS.COM-70074B9C.pf
PV.COM-57B6C3DF.pf
ReadyBoot
REG.EXE-E7E8BD26.pf
REGDACL.COM-EB6F03CB.pf
REGSVR32.EXE-8461DBEE.pf
RUNDLL32.EXE-230FC512.pf
RUNDLL32.EXE-5BCD36AF.pf
RUNDLL32.EXE-DEB9473F.pf
SDBINST.EXE-5CC2F88B.pf
SEARCHFILTERHOST.EXE-77482212.pf
SEARCHPROTOCOLHOST.EXE-0CB8CADE.pf
SED.COM-2489B655.pf
SETPATH.COM-A135C716.pf
SMCONFIGINSTALLER.EXE-039D5D2E.pf
SMSS.EXE-E9C28FC6.pf
SORT.EXE-99A4F778.pf
SPCLITE.EXE-15A12E27.pf
SPCLITEGFX.EXE-7ECB1FE5.pf
SPOOLSV.EXE-D1F6B8B6.pf
SVCHOST.EXE-17944F30.pf
SVCHOST.EXE-7CFEDEA3.pf
SVCHOST.EXE-FEDB32D0.pf
SWREG.COM-1BB9C479.pf
SWSC.COM-A28E2091.pf
SWXCACLS.COM-58F32669.pf
TASKENG.EXE-48D4E289.pf
TOR.EXE-40F6BC40.pf
TRUSTEDINSTALLER.EXE-3CC531E5.pf
TZUPD.EXE-37E0B552.pf
UNINSTALL ADR.EXE-7D2B0D8D.pf
UNIQ.COM-DF138372.pf
USERINIT.EXE-2257A3E7.pf
VERCLSID.EXE-7C52E31C.pf
VSSVC.EXE-B8AFC319.pf
WERCON.EXE-E36BD04E.pf
WERFAULT.EXE-E69F695A.pf
WERMGR.EXE-0F2AC88C.pf
WINLOGON.EXE-B020DC41.pf
WINMAIL.EXE-1092D371.pf
WLCOMM.EXE-272FF9F7.pf
WLTUSER.EXE-697D492E.pf
WMIADAP.EXE-F8DFDFA2.pf
WMIPRVSE.EXE-1628051C.pf
WMPLAYER.EXE-BAD6BD53.pf
WSMANHTTPCONFIG.EXE-22C77AEF.pf
WUAPP.EXE-C6167071.pf
WUAUCLT.EXE-70318591.pf
WUIESETUP_PREREQ.EXE-9BEAF3DD.pf




¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

Kill'em by g3n-h@ckm@n 1.0.5.6

User : olivier (Administrateurs) # PC-DE-OLIVIER
Update on 25/11/2009 by g3n-h@ckm@n ::::: 13:00
Start at: 20:58:16 | 27/11/2009
Contact : g3n-h@ckm@n sur CCM

AMD Athlon(tm) 64 X2 Dual Core Processor 4000+
Microsoft® Windows Vista™ Édition Familiale Premium (6.0.6001 32-bit) # Service Pack 1
Internet Explorer 7.0.6001.18000
Windows Firewall Status : Disabled
AV : avast! antivirus 4.8.1351 [VPS 091127-1] 4.8.1351 [ Enabled | Updated ]

C:\ -> Disque fixe local | 228,13 Go (196,83 Go free) [ACER] | NTFS
D:\ -> Disque fixe local | 227,87 Go (222,26 Go free) [DATA] | NTFS
E:\ -> Disque CD-ROM | 0 Mo (0 Mo free) [Audio CD] | CDFS
F:\ -> Disque amovible
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible


¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processus en cours


C:\Windows\System32\smss.exe 436
C:\Windows\system32\csrss.exe 580
C:\Windows\system32\wininit.exe 636
C:\Windows\system32\csrss.exe 648
C:\Windows\system32\services.exe 684
C:\Windows\system32\lsass.exe 696
C:\Windows\system32\lsm.exe 708
C:\Windows\system32\winlogon.exe 788
C:\Windows\system32\svchost.exe 888
C:\Windows\system32\svchost.exe 972
C:\Windows\System32\svchost.exe 1008
C:\Windows\system32\Ati2evxx.exe 1096
C:\Windows\System32\svchost.exe 1116
C:\Windows\System32\svchost.exe 1192
C:\Windows\system32\svchost.exe 1204
C:\Windows\system32\SLsvc.exe 1320
C:\Windows\system32\svchost.exe 1380
C:\Windows\system32\svchost.exe 1536
C:\Windows\system32\Ati2evxx.exe 1612
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe 1660
C:\Program Files\Alwil Software\Avast4\ashServ.exe 1676
C:\Windows\System32\spoolsv.exe 1992
C:\Windows\system32\svchost.exe 2016
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe 884
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe 1056
C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe 1688
C:\Program Files\Common Files\LightScribe\LSSrvc.exe 296
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE 2092
C:\Program Files\Microsoft LifeCam\MSCamS32.exe 2144
C:\Windows\system32\svchost.exe 2172
C:\Program Files\CyberLink\Shared Files\RichVideo.exe 2200
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 2232
C:\Windows\system32\svchost.exe 2308
C:\Windows\System32\svchost.exe 2348
C:\Windows\system32\SearchIndexer.exe 2412
C:\Windows\system32\taskeng.exe 2420
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe 2480
C:\Windows\system32\WUDFHost.exe 2748
C:\Windows\system32\taskeng.exe 3480
C:\Windows\system32\Dwm.exe 3512
C:\Program Files\Windows Defender\MSASCui.exe 3848
C:\Windows\RtHDVCpl.exe 3860
C:\Acer\Empowering Technology\SysMonitor.exe 3880
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 3892
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE 3968
C:\Program Files\Alwil Software\Avast4\ashDisp.exe 4004
C:\Windows\vVX1000.exe 4044
C:\Program Files\Windows Sidebar\sidebar.exe 4060
C:\Windows\ehome\ehtray.exe 2088
C:\Program Files\Orange\Media Player\Media Player.exe 2264
C:\Program Files\uTorrent\uTorrent.exe 184
C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe 2500
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe 1876
C:\Program Files\Vidalia Bundle\Privoxy\privoxy.exe 2720
C:\Windows\ehome\ehmsas.exe 2872
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe 2324
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE 4128
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE 4208
C:\Program Files\Vidalia Bundle\Tor\tor.exe 4560
C:\Windows\system32\wuauclt.exe 5672
C:\Windows\System32\wsqmcons.exe 3340
C:\Windows\System32\mobsync.exe 5204
C:\Program Files\Windows Media Player\wmplayer.exe 964
C:\Windows\explorer.exe 6032
C:\Program Files\Windows Live\Toolbar\wltuser.exe 5836
C:\Users\olivier\Desktop\List_Kill'em.exe 5296
C:\Windows\system32\conime.exe 5792
C:\Windows\system32\cmd.exe 4512
C:\Windows\system32\notepad.exe 4864
C:\Users\olivier\Desktop\List_Kill'em.exe 6120
C:\Windows\system32\cmd.exe 3632
C:\Windows\system32\wbem\wmiprvse.exe 5696
C:\Users\olivier\AppData\Local\Temp\A420.tmp\pv.exe 2408

Fichiers analysés :
=================


¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :



¤¤¤¤¤¤¤¤¤¤ Action sur les fichiers :

Quarantaine :


====================
Fichiers hosts nettoyés
====================
¤¤¤¤¤¤¤¤¤¤ C:\Windows\Prefetch

AgAppLaunch.db
AgCx_S1_S-1-5-21-1216364523-3819575748-351290812-1000.snp.db
AgCx_SC1.db
AgCx_SC1.db.trx
AgGlFaultHistory.db
AgGlFgAppHistory.db
AgGlGlobalHistory.db
AgGlUAD_P_S-1-5-21-1216364523-3819575748-351290812-1000.db
AgGlUAD_S-1-5-21-1216364523-3819575748-351290812-1000.db
AgRobust.db
Layout.ini
NTOSBOOT-B00DFAAD.pf
PfSvPerfStats.bin
ReadyBoot



¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

j ai deja supprimer ad remover sur le pc

############################## | FindyKill V5.020 |

# User : olivier (Administrateurs) # PC-DE-OLIVIER
# Update on 26/11/2009 by Chiquitine29
# Start at: 21:37:53 | 27/11/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

# AMD Athlon(tm) 64 X2 Dual Core Processor 4000+
# Microsoft® Windows Vista™ Édition Familiale Premium (6.0.6001 32-bit) # Service Pack 1
# Internet Explorer 7.0.6001.18000
# Windows Firewall Status : Disabled
# AV : avast! antivirus 4.8.1351 [VPS 091127-1] 4.8.1351 [ Enabled | Updated ]

# C:\ # Disque fixe local # 228,13 Go (196,84 Go free) [ACER] # NTFS
# D:\ # Disque fixe local # 227,87 Go (222,26 Go free) [DATA] # NTFS
# E:\ # Disque CD-ROM # 0 Mo (0 Mo free) [Audio CD] # CDFS
# F:\ # Disque amovible
# G:\ # Disque amovible
# H:\ # Disque amovible
# I:\ # Disque amovible

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Windows\system32\svchost.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskeng.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\vVX1000.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Orange\Media Player\Media Player.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
C:\Program Files\Vidalia Bundle\Privoxy\privoxy.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Vidalia Bundle\Tor\tor.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\System32\wsqmcons.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Windows\explorer.exe
C:\Windows\system32\conime.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Windows\system32\wbem\wmiprvse.exe

################## | C: |


################## | C:\Windows |


################## | C:\Windows\system32 |


################## | C:\Windows\system32\drivers |


################## | C:\Users\olivier\AppData\Roaming |


################## | Autres detections ... |

################## | Temporary Internet Files |


################## | Registre / Clés infectieuses |

Présent ! [HKLM\software\microsoft\security center] "UacDisableNotify"
Présent ! [HKLM\software\microsoft\security center\Svc] "AntiVirusOverride"
Présent ! [HKLM\software\microsoft\security center\Svc] "FirewallOverride"

################## | Etat / Services / Informations |

# Affichage des fichiers cachés : OK

# Mode sans echec : OK

# (!) Uac = 0x0

# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 )
# EapHost -> Start = 3 ( Good = 2 | Bad = 4 )
# Wlansvc -> Start = 3 ( Good = 2 | Bad = 4 )
# (!) SharedAccess -> Start = 4 ( Good = 2 | Bad = 4 )
# windefend -> Start = 2 ( Good = 2 | Bad = 4 )
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 )
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 )


################## | Cracks / Keygens / Serials |

"C:\Users\olivier\Downloads\patch\crack.exe"
26/09/2009 19:41 |Size 106496 |Crc32 f2dc34a0 |Md5 1a34086424214c8e1240f7ea2be6d8c4


################## | ! Fin du rapport # FindyKill V5.020 ! |

puige remetre antivirus et le par feu

############################## | FindyKill V5.020 |

# User : olivier (Administrateurs) # PC-DE-OLIVIER
# Update on 26/11/2009 by Chiquitine29
# Start at: 21:55:45 | 27/11/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

# AMD Athlon(tm) 64 X2 Dual Core Processor 4000+
# Microsoft® Windows Vista™ Édition Familiale Premium (6.0.6001 32-bit) # Service Pack 1
# Internet Explorer 7.0.6001.18000
# Windows Firewall Status : Disabled
# AV : avast! antivirus 4.8.1351 [VPS 091127-1] 4.8.1351 [ Enabled | Updated ]

# C:\ # Disque fixe local # 228,13 Go (196,84 Go free) [ACER] # NTFS
# D:\ # Disque fixe local # 227,87 Go (222,26 Go free) [DATA] # NTFS
# E:\ # Disque CD-ROM # 0 Mo (0 Mo free) [Audio CD] # CDFS
# F:\ # Disque amovible
# G:\ # Disque amovible
# H:\ # Disque amovible
# I:\ # Disque amovible
# K:\ # Disque fixe local # 1,87 Go (543,34 Mo free) [USB DISK] # FAT

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Windows\system32\svchost.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskeng.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\vVX1000.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Orange\Media Player\Media Player.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
C:\Program Files\Vidalia Bundle\Privoxy\privoxy.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Vidalia Bundle\Tor\tor.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\System32\wsqmcons.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Windows\explorer.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\notepad.exe
C:\Windows\system32\wbem\wmiprvse.exe

################## | C: |


################## | C:\Windows |


################## | C:\Windows\system32 |


################## | C:\Windows\system32\drivers |


################## | C:\Users\olivier\AppData\Roaming |


################## | Autres detections ... |

################## | Temporary Internet Files |


################## | Registre / Clés infectieuses |

Présent ! [HKLM\software\microsoft\security center] "UacDisableNotify"
Présent ! [HKLM\software\microsoft\security center\Svc] "AntiVirusOverride"
Présent ! [HKLM\software\microsoft\security center\Svc] "FirewallOverride"

################## | Etat / Services / Informations |

# Affichage des fichiers cachés : OK

# Mode sans echec : OK

# (!) Uac = 0x0

# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 )
# EapHost -> Start = 3 ( Good = 2 | Bad = 4 )
# Wlansvc -> Start = 3 ( Good = 2 | Bad = 4 )
# (!) SharedAccess -> Start = 4 ( Good = 2 | Bad = 4 )
# windefend -> Start = 2 ( Good = 2 | Bad = 4 )
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 )
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 )


################## | Cracks / Keygens / Serials |

"C:\Users\olivier\Downloads\patch\crack.exe"
26/09/2009 19:41 |Size 106496 |Crc32 f2dc34a0 |Md5 1a34086424214c8e1240f7ea2be6d8c4


################## | ! Fin du rapport # FindyKill V5.020 ! |