Probleme antivir impossible desinstaller

Ouais je ne sais pas ce qui se passe, ce truc "antivir" ne cesse de s"ouvrir à chaque fois que je fais une manip... Si je vais dessus, le truc que je peux faire c'est donner mes info bancaires pour obtenir la licence, chose que bien evidement je ne veux pas faire...... Je veux juste m'en debarasser. Ca me met que j'ai des trojans qui infecteny

Donc G téléchargé RSIT avec bcp de mal car Antivir bloquait tout... Voilà ce que j'obtiens :
Logfile of random's system information tool 1.06 (written by random/random)
Run by Marine at 2009-11-28 18:27:37
Microsoft® Windows Vista™ Home Premium Service Pack 1
System drive C: has 94 GB (42%) free of 226 GB
Total RAM: 3061 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:27:57 PM, on 28/11/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18319)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Dell\DellDock\DellDock.exe
C:\Windows\system32\conime.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Windows\OEM02Mon.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe
C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\AV\antivir.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Marine\Downloads\RSIT.exe
C:\Program Files\trend micro\Marine.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.ca
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: &UpdateCheck.dll - {35A5B43B-CB8A-49CA-A9F4-D3B308D2E3CC} - C:\Windows\System32\UpdateCheck.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"
O4 - HKLM\..\Run: [Dell DataSafe Online] "C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe" /m
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "c:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [AV] C:\Program Files\AV\Antivir.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: QuickSet.lnk = C:\Program Files\Dell\QuickSet\quickset.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL,avgrsstx.dll
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe
O23 - Service: Google Desktop Manager 5.8.809.23506 (GoogleDesktopManager-092308-165331) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
O23 - Service: Google Update Service (gupdate1ca6261c3f1bdba) (gupdate1ca6261c3f1bdba) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

je pense avoir suivis tes instructions (merci !!). Voila le rapport :
SmitFraudFix v2.424

Scan done at 18:54:43.31, 28/11/2009
Run from C:\Program Files\Mozilla Firefox\SmitfraudFix
OS: Microsoft Windows [Version 6.0.6001] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Dell\DellDock\DockLogin.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\WLTRYSVC.EXE
C:\Windows\System32\bcmwltry.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\aestsrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\Windows\system32\STacSV.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Dell\DellDock\DellDock.exe
C:\Windows\system32\conime.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Windows\OEM02Mon.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\AV\antivir.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Marine


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Marine\AppData\Local\Temp


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Marine\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Marine\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components



»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, following keys are not inevitably infected!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, following keys are not inevitably infected!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="AVGRSSTX.DLL C:\\PROGRA~1\\GOOGLE\\GOOGLE~3\\GOEC62~1.DLL"
"LoadAppInit_DLLs"=dword:00000001


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\Windows\\system32\\userinit.exe,"

»»»»»»»»»»»»»»»»»»»»»»»» RK

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]




»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Dell Wireless 1395 WLAN Mini-Card
DNS Server Search Order: 84.103.237.141
DNS Server Search Order: 86.64.145.141

HKLM\SYSTEM\CCS\Services\Tcpip\..\{54E0088E-7A06-4510-A49D-3271F3E40381}: DhcpNameServer=84.103.237.141 86.64.145.141
HKLM\SYSTEM\CCS\Services\Tcpip\..\{7CE6EDFF-E784-405C-8C06-6D87DB1698C3}: DhcpNameServer=75.154.133.68 75.154.133.100
HKLM\SYSTEM\CS1\Services\Tcpip\..\{54E0088E-7A06-4510-A49D-3271F3E40381}: DhcpNameServer=84.103.237.141 86.64.145.141
HKLM\SYSTEM\CS1\Services\Tcpip\..\{7CE6EDFF-E784-405C-8C06-6D87DB1698C3}: DhcpNameServer=75.154.133.68 75.154.133.100
HKLM\SYSTEM\CS2\Services\Tcpip\..\{54E0088E-7A06-4510-A49D-3271F3E40381}: DhcpNameServer=84.103.237.141 86.64.145.141
HKLM\SYSTEM\CS2\Services\Tcpip\..\{7CE6EDFF-E784-405C-8C06-6D87DB1698C3}: DhcpNameServer=75.154.133.68 75.154.133.100
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=84.103.237.141 86.64.145.141
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=84.103.237.141 86.64.145.141
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=84.103.237.141 86.64.145.141


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

J'ai un probleme je n'ai plus ma barre d'outils en bas, je n'ai plus rien et je n'avais pas cliquer oui ou non pour la deuxieme option du coup je ne peux pas rouvrir le fichier....
Tu vois ce que je veux dire..... ?! Je n<ai que la fenetre de Mozilla en gros mais je n<ai plus rien en bas....Comment je fais ?! jsui dsl jsui nulle....

attend : le rapport vient de se faire pour l<option 2 :
SmitFraudFix v2.424

Scan done at 19:29:42.32, 28/11/2009
Run from C:\Program Files\Mozilla Firefox\SmitfraudFix
OS: Microsoft Windows [Version 6.0.6001] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts



::1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix



»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix




»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» RK


»»»»»»»»»»»»»»»»»»»»»»»» DNS



»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!



»»»»»»»»»»»»»»»»»»»»»»»» RK.2



»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning


Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End




Je fais koi maintenant ? je fais kan meme le truc du ComboFix ou pas ???

Celui-la c le seul que j'ai...:

SmitFraudFix v2.424

Scan done at 19:29:42.32, 28/11/2009
Run from C:\Program Files\Mozilla Firefox\SmitfraudFix
OS: Microsoft Windows [Version 6.0.6001] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts



::1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix



»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix




»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» RK


»»»»»»»»»»»»»»»»»»»»»»»» DNS



»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!



»»»»»»»»»»»»»»»»»»»»»»»» RK.2



»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning


Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

Logfile of random's system information tool 1.06 (written by random/random)
Run by Marine at 2009-11-28 19:52:54
Microsoft® Windows Vista™ Home Premium Service Pack 1
System drive C: has 95 GB (42%) free of 226 GB
Total RAM: 3061 MB (52% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:53:03, on 28/11/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18319)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Dell\DellDock\DellDock.exe
C:\Windows\system32\conime.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Windows\OEM02Mon.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\AV\antivir.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\explorer.exe
C:\Windows\notepad.exe
C:\Users\Marine\Downloads\RSIT.exe
C:\Program Files\trend micro\Marine.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: &UpdateCheck.dll - {35A5B43B-CB8A-49CA-A9F4-D3B308D2E3CC} - C:\Windows\System32\UpdateCheck.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"
O4 - HKLM\..\Run: [Dell DataSafe Online] "C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe" /m
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "c:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [AV] C:\Program Files\AV\Antivir.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: QuickSet.lnk = C:\Program Files\Dell\QuickSet\quickset.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: AVGRSSTX.DLL C:\PROGRA~1\GOOGLE\GOOGLE~3\GOEC62~1.DLL
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe
O23 - Service: Google Desktop Manager 5.8.809.23506 (GoogleDesktopManager-092308-165331) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
O23 - Service: Google Update Service (gupdate1ca6261c3f1bdba) (gupdate1ca6261c3f1bdba) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

Ok. Ptites questions :
1. comment je fais pour désactiver les pare feux ?!
2. quand je telecharge les trucs styles RSIT, ils ne s installent pas sur le bureau, le seul moyen que j'ai pour les avoir c'est dans ma fenetre de telechargement....
Ca va poser un probleme ou pas ? Comment y remedier sinon ?

ok pour les pare-feux mais tjs impossible d'enregistrer sur le bureau, ca me propose d'enregistrer mais ca ne me propose aucune solution. En revanche, une fois téléchargé le fichier, dans la fenetre de telechargement je peux faire clic droit et "aller a la page de telechargement" mais ni "ouvrir" ni "ouvrir le dossier contenant le fichier"...

trop bien !! Merci !!
Bon je me lances sur ComboFix. A dans un moment alors et merci bcp !!

ah oui trop tard..... :(

Mais je suppose kil ne faut pas que je redemarre l'ordi...
j'ai fait la desinstallation mais ca me dit kil faut redemarrer d'ordi pour rendre la desinstallation effective... j,ai decliquer l'onglet "restart the computer now" mais je n ose pas cliquer ok maintenant, par peur que ca le redemarre kan meme et ke du coup G un probleme avec ComboFix.

Meme chose si j installe l'autre, ca ve me demander de redemarrer l'ordi non ?!

Combo fix est fini.
G le rapport mais Je n'ai plus acces a internet sur mon ordi !!!!
les onglets mozilla et intenet explorer ne marchent plus !!!

Que fais_je ??

Je n'ai plus rien qui marche !!! Mon ordi est tres lent !!!!!!

Flo-91 qu'est ce que je dois faire pour recuperer internet !?

Ca me dit "Illegal operation attempted on a registry key that has been marked for deletion" quand je clique sur mozilla......
Comment faire ?? Faut il que je reconfigure kelkchoz ??

Comment telecharger si internet et mozilla ne marchent plus...?

'ai fait ce que tu m'as dit et ca ne marche pas, je ne peux pas ouvrir le document une fois mis sur mon Bureau....
Le double clic, l extraire...rien a faire c bloqué.
ca me met "Illegal operation attempted on a registry key that has been marked for deletion"

J'ai telecharger ce fichier et je l'ai mis sur mon bureau mais le meme message que le precedant s affiche..... Ya plus rien qui marche....

ca c debloquer !!!
Je fais koi alors le kill 'em ou l'autre truc !??

ComboFix 09-11-27.07 - Marine 28/11/2009 21:12.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.2.1033.18.3061.1709 [GMT 1:00]
Running from: c:\users\Marine\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2773397201-2855733099-4214572315-500
c:\$recycle.bin\S-1-5-21-3434946352-2247961825-321128707-500
c:\windows\system32\404Fix.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\oem8.inf
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\System32\UpDAtecheck.dll
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_NDISRD


((((((((((((((((((((((((( Files Created from 2009-10-28 to 2009-11-28 )))))))))))))))))))))))))))))))
.

2009-11-28 20:19 . 2009-11-28 20:19 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-11-28 18:22 . 2009-11-28 18:30 35 ----a-w- c:\users\Marine\AppData\Roaming\SetValue.bat
2009-11-28 17:27 . 2009-11-28 18:52 -------- d-----w- c:\program files\trend micro
2009-11-28 17:27 . 2009-11-28 17:27 -------- d-----w- C:\rsit
2009-11-28 15:34 . 2009-11-28 15:34 -------- d-----w- c:\program files\Common Files\Uninstall
2009-11-28 14:54 . 2009-11-28 15:34 -------- d-----w- c:\program files\AV
2009-11-26 07:20 . 2009-11-06 19:24 2064152 ----a-w- c:\programdata\avg8\update\backup\avgcorex.dll
2009-11-26 07:20 . 2009-11-03 16:11 3513624 ----a-w- c:\programdata\avg8\update\backup\avgui.exe
2009-11-26 07:20 . 2009-11-03 16:11 2028312 ----a-w- c:\programdata\avg8\update\backup\avgtray.exe
2009-11-25 10:28 . 2009-10-29 09:41 2048 ----a-w- c:\windows\system32\tzres.dll
2009-11-25 09:56 . 2009-08-10 11:01 1399296 ----a-w- c:\windows\system32\msxml6.dll
2009-11-25 09:56 . 2009-08-10 11:00 1257472 ----a-w- c:\windows\system32\msxml3.dll
2009-11-13 10:03 . 2009-11-17 22:57 -------- d-----w- c:\users\Marine\AppData\Roaming\DivX
2009-11-11 09:58 . 2009-08-14 13:53 2035712 ----a-w- c:\windows\system32\win32k.sys
2009-11-11 09:58 . 2009-08-10 13:05 351232 ----a-w- c:\windows\system32\WSDApi.dll
2009-11-10 23:58 . 2009-11-10 23:58 4096 d-----w- c:\program files\Common Files\DivX Shared
2009-11-10 23:58 . 2009-11-10 23:59 8192 d-----w- c:\program files\DivX
2009-11-06 19:28 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll
2009-11-06 19:28 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-11-06 19:28 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-11-06 19:28 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll
2009-11-06 19:27 . 2009-08-07 02:24 35552 ----a-w- c:\windows\system32\wups.dll
2009-11-06 19:27 . 2009-08-07 02:23 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-11-06 19:27 . 2009-08-07 01:44 87552 ----a-w- c:\windows\system32\wudriver.dll
2009-11-06 19:27 . 2009-08-06 18:23 171608 ----a-w- c:\windows\system32\wuwebv.dll
2009-11-06 19:27 . 2009-08-06 17:44 33792 ----a-w- c:\windows\system32\wuapp.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-28 19:59 . 2009-11-28 19:59 -------- d-----w- c:\programdata\Avira
2009-11-28 19:59 . 2009-11-28 19:59 -------- d-----w- c:\program files\Avira
2009-11-28 19:31 . 2009-01-05 03:57 4096 d-----w- c:\programdata\avg8
2009-11-28 18:30 . 2009-11-28 18:22 691 ----a-w- c:\users\Marine\AppData\Roaming\GetValue.vbs
2009-11-26 14:38 . 2009-01-16 16:10 5972 ----a-w- c:\users\Marine\AppData\Local\d3d9caps.dat
2009-11-24 17:10 . 2009-01-06 02:18 4096 d-----w- c:\program files\Windows Live
2009-11-16 17:18 . 2009-01-08 02:40 4096 d-----w- c:\users\Marine\AppData\Roaming\Skype
2009-11-13 23:05 . 2009-01-08 02:43 -------- d-----w- c:\users\Marine\AppData\Roaming\skypePM
2009-11-12 05:23 . 2006-11-02 11:18 4096 d-----w- c:\program files\Windows Mail
2009-11-11 21:54 . 2008-11-25 21:42 8192 d-----w- c:\programdata\Microsoft Help
2009-11-11 00:07 . 2008-11-25 21:45 4096 d-----w- c:\program files\Google
2009-11-10 23:59 . 2008-11-25 21:54 4096 d-----w- c:\program files\Common Files\PX Storage Engine
2009-11-02 19:42 . 2009-10-04 17:33 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-10-20 14:19 . 2009-02-04 05:12 8192 d-----w- c:\users\Marine\AppData\Roaming\LimeWire
2009-10-20 14:18 . 2009-02-04 05:12 40960 d-----w- c:\program files\LimeWire
2009-10-04 18:44 . 2009-09-30 15:54 4096 d-----w- c:\program files\Picasa2
2009-10-04 18:43 . 2009-06-14 07:23 -------- d-----w- c:\users\Marine\AppData\Roaming\CameraWindowDC
2009-09-30 14:03 . 2009-09-29 16:40 -------- d-----w- c:\program files\epson
2009-09-25 16:41 . 2009-09-25 16:41 90112 ----a-w- c:\windows\system32\dpl100.dll
2009-09-25 16:41 . 2009-09-25 16:41 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-09-25 16:41 . 2009-09-25 16:41 856064 ----a-w- c:\windows\system32\divx_xx07.dll
2009-09-25 16:41 . 2009-09-25 16:41 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-09-25 16:41 . 2009-09-25 16:41 843776 ----a-w- c:\windows\system32\divx_xx16.dll
2009-09-25 16:41 . 2009-09-25 16:41 839680 ----a-w- c:\windows\system32\divx_xx11.dll
2009-09-25 16:41 . 2009-09-25 16:41 696320 ----a-w- c:\windows\system32\DivX.dll
2009-09-23 07:53 . 2009-09-23 07:53 471664 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtbA27E.tmp.exe
2009-09-14 09:44 . 2009-10-16 17:56 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2009-09-10 17:30 . 2009-10-16 18:00 213504 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-10 15:21 . 2009-10-29 08:36 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-09-10 15:21 . 2009-10-29 08:36 310784 ----a-w- c:\windows\system32\unregmp2.exe
2009-09-04 12:24 . 2009-10-16 17:56 61440 ----a-w- c:\windows\system32\msasn1.dll
2009-08-31 13:55 . 2009-10-16 17:56 293376 ----a-w- c:\windows\system32\psisdecd.dll
2009-08-31 13:55 . 2009-10-16 17:56 428544 ----a-w- c:\windows\system32\EncDec.dll
2008-11-25 21:45 . 2008-12-27 06:05 122880 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2009-09-25 16:41 . 2009-09-25 16:41 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-09-25 16:41 . 2009-09-25 16:41 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2008-11-25 21:34 . 2008-11-25 21:34 76 --sh--r- c:\windows\CT4CET.bin
2008-11-25 23:00 . 2008-11-25 22:58 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-11-25 39408]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-19 21633320]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-08-21 443968]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"AV"="c:\program files\AV\Antivir.exe" [2009-11-28 1691648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2007-09-24 159744]
"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2007-12-03 36864]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-04-22 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-04-22 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-04-22 133656]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-07-03 3563520]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-11-25 30192]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2007-12-21 184320]
"Dell DataSafe Online"="c:\program files\Dell DataSafe Online\DataSafeOnline.exe" [2008-11-03 1745648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

c:\users\Marine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-9-24 1295656]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-11-25 50688]
QuickSet.lnk - c:\program files\Dell\QuickSet\quickset.exe [2008-2-23 1193240]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-11-25 21:55 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~3\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001

R2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\AEstSrv.exe [25/11/2008 16:17 73728]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [28/11/2009 20:59 108289]
R2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [24/09/2008 05:09 155648]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [26/11/2008 00:12 179712]
R3 OEM02Dev;Creative Camera OEM002 Driver;c:\windows\System32\drivers\OEM02Dev.sys [26/11/2008 00:12 235648]
R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;c:\windows\System32\drivers\OEM02Vfx.sys [26/11/2008 00:12 7424]
S2 gupdate1ca6261c3f1bdba;Google Update Service (gupdate1ca6261c3f1bdba);c:\program files\Google\Update\GoogleUpdate.exe [11/11/2009 00:58 133104]
S3 GoogleDesktopManager-092308-165331;Google Desktop Manager 5.8.809.23506;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [25/11/2008 22:45 30192]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - SSMDRV
.
Contents of the 'Scheduled Tasks' folder

2009-11-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-10 23:58]

2009-11-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-10 23:58]

2009-11-28 c:\windows\Tasks\User_Feed_Synchronization-{2985EB3E-0D41-4819-B0E0-229632056C4A}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Marine\AppData\Roaming\Mozilla\Firefox\Profiles\fyy04xdy.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://go.microsoft.com/fwlink/?LinkId=69157
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Picasa2\npPicasa2.dll
FF - plugin: c:\program files\Picasa2\npPicasa3.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll
BHO-{A3BC75A2-1F87-4686-AA43-5347D756017C} - c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll
AddRemove-Broadcom 802.11b Network Adapter - c:\program files\Dell\Dell Wireless WLAN Card\bcmwlu00.exe verbose
AddRemove-CanonMyPrinter - c:\program files\Canon\MyPrinter\uninst.exe uninst.ini
AddRemove-CanonSolutionMenu - c:\program files\Canon\SolutionMenu\uninst.exe uninst.ini
AddRemove-Easy-PhotoPrint EX - c:\program files\Canon\Easy-PhotoPrint EX\uninst.exe uninst.ini
AddRemove-{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD} - c:\program files\DellTPad\Uninstap.exe ADDREMOVE



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-28 21:22
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

[0] 0x696F6720

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\bcmwltry.exe
c:\windows\system32\WLANExt.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\windows\system32\STacSV.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\ehome\ehmsas.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-11-28 21:31 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-28 20:31

Pre-Run: 100,588,716,032 bytes free
Post-Run: 100,172,996,608 bytes free

- - End Of File - - A3BC4902F991CE47429053F22C4DC1B0

Mozilla marche a nouveau mais c extremement lent...... Que dois_je faire d apres toi maintenant !?

Le kill'em est tjs en cours, c tres long dsl... Mon ordi rame....

C bloquer sur "tests rootkits...Patience...", l'ordi travaill mais c long

List'em by g3n-h@ckm@n 1.0.5.7

Thx to Chiquitine29.....

User : Marine (Administrators) # MARINE-PC
Update on 27/11/2009 by g3n-h@ckm@n ::::: 23:00
Start at: 23:14:23 | 28/11/2009
Contact : g3n-h@ckm@n sur CCM

Intel(R) Core(TM)2 Duo CPU T5850 @ 2.16GHz
Microsoft® Windows Vista™ Home Premium (6.0.6001 32-bit) # Service Pack 1
Internet Explorer 7.0.6001.18000
Windows Firewall Status : Disabled

C:\ -> Local Fixed Disk | 220.29 Go (93.31 Go free) [OS] | NTFS
D:\ -> Local Fixed Disk | 10 Go (4.42 Go free) [RECOVERY] | NTFS
E:\ -> CD-ROM Disc

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\Windows\System32\smss.exe 440
C:\Windows\system32\csrss.exe 572
C:\Windows\system32\wininit.exe 616
C:\Windows\system32\csrss.exe 628
C:\Windows\system32\services.exe 664
C:\Windows\system32\winlogon.exe 692
C:\Windows\system32\lsass.exe 712
C:\Windows\system32\lsm.exe 728
C:\Windows\system32\svchost.exe 868
C:\Windows\system32\svchost.exe 948
C:\Windows\System32\svchost.exe 984
C:\Windows\System32\svchost.exe 1080
C:\Windows\System32\svchost.exe 1112
C:\Windows\system32\svchost.exe 1152
C:\Windows\system32\SLsvc.exe 1288
C:\Windows\system32\svchost.exe 1316
C:\Program Files\Dell\DellDock\DockLogin.exe 1404
C:\Windows\system32\svchost.exe 1452
C:\Windows\System32\bcmwltry.exe 1604
C:\Windows\system32\WLANExt.exe 1628
C:\Windows\System32\spoolsv.exe 1764
C:\Program Files\Avira\AntiVir Desktop\sched.exe 1820
C:\Windows\system32\svchost.exe 1852
C:\Windows\system32\taskeng.exe 608
C:\Windows\system32\Dwm.exe 1908
C:\Windows\system32\taskeng.exe 1708
C:\Windows\system32\aestsrv.exe 340
C:\Program Files\Avira\AntiVir Desktop\avguard.exe 1572
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 2148
C:\Program Files\Bonjour\mDNSResponder.exe 2180
C:\Windows\system32\svchost.exe 2288
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 2408
C:\Program Files\Dell Support Center\bin\sprtsvc.exe 2600
C:\Windows\system32\STacSV.exe 2644
C:\Windows\system32\svchost.exe 2784
C:\Windows\System32\svchost.exe 2820
C:\Windows\system32\SearchIndexer.exe 2864
C:\Windows\system32\DRIVERS\xaudio.exe 2908
C:\Program Files\Windows Defender\MSASCui.exe 3960
C:\Program Files\DellTPad\Apoint.exe 3980
C:\Windows\OEM02Mon.exe 4024
C:\Windows\System32\hkcmd.exe 2596
C:\Windows\System32\igfxpers.exe 2696
C:\Windows\System32\WLTRAY.EXE 3096
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe 3120
C:\Windows\system32\igfxsrvc.exe 3292
C:\Program Files\Dell\MediaDirect\PCMService.exe 3324
C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe 1596
C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE 1360
C:\Program Files\Dell Support Center\bin\sprtcmd.exe 3420
C:\Program Files\iTunes\iTunesHelper.exe 3756
C:\Program Files\Java\jre6\bin\jusched.exe 3192
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe 1040
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe 3296
C:\Program Files\Windows Live\Messenger\msnmsgr.exe 2120
C:\Program Files\Skype\Phone\Skype.exe 2052
C:\Program Files\Picasa2\PicasaMediaDetector.exe 3492
C:\Windows\ehome\ehtray.exe 1808
C:\Windows\ehome\ehmsas.exe 324
C:\Program Files\Digital Line Detect\DLG.exe 448
C:\Program Files\Dell\QuickSet\quickset.exe 632
C:\Windows\system32\wbem\wmiprvse.exe 3144
C:\Program Files\iPod\bin\iPodService.exe 4188
C:\Windows\system32\wuauclt.exe 552
C:\Windows\system32\conime.exe 3736
C:\Windows\Explorer.exe 1812
C:\Program Files\WinRAR\WinRAR.exe 3836
C:\Users\Marine\AppData\Local\Temp\Rar$EX04.039\List_Kill'em.exe 3264
C:\Windows\system32\cmd.exe 5860
C:\Windows\system32\wbem\wmiprvse.exe 3688
C:\Users\Marine\AppData\Local\Temp\6A0A.tmp\pv.exe 4936

======================
Keys "Run"
======================

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
swg REG_SZ "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
MsnMsgr REG_SZ "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
DellSupportCenter REG_SZ "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
Skype REG_SZ "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
Sidebar REG_SZ C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
Picasa Media Detector REG_SZ C:\Program Files\Picasa2\PicasaMediaDetector.exe
ehTray.exe REG_SZ C:\Windows\ehome\ehTray.exe
AV REG_SZ C:\Program Files\AV\Antivir.exe

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Windows Defender REG_EXPAND_SZ %ProgramFiles%\Windows Defender\MSASCui.exe -hide
Apoint REG_SZ C:\Program Files\DellTPad\Apoint.exe
OEM02Mon.exe REG_SZ C:\Windows\OEM02Mon.exe
IgfxTray REG_SZ C:\Windows\system32\igfxtray.exe
HotKeysCmds REG_SZ C:\Windows\system32\hkcmd.exe
Persistence REG_SZ C:\Windows\system32\igfxpers.exe
Broadcom Wireless Manager UI REG_SZ C:\Windows\system32\WLTRAY.exe
Google Desktop Search REG_SZ "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
dscactivate REG_SZ "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
PCMService REG_SZ "C:\Program Files\Dell\MediaDirect\PCMService.exe"
Dell DataSafe Online REG_SZ "C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe" /m
Adobe Reader Speed Launcher REG_SZ "c:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
CanonSolutionMenu REG_SZ C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
CanonMyPrinter REG_SZ C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
DellSupportCenter REG_SZ "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
QuickTime Task REG_SZ "C:\Program Files\QuickTime\QTTask.exe" -atboottime
iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe"
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe"
avgnt REG_SZ "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents
=====================
Other Keys
=====================

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
ConsentPromptBehaviorAdmin REG_DWORD 0x2
ConsentPromptBehaviorUser REG_DWORD 0x1
EnableInstallerDetection REG_DWORD 0x1
EnableLUA REG_DWORD 0x0
EnableSecureUIAPaths REG_DWORD 0x1
EnableVirtualization REG_DWORD 0x1
PromptOnSecureDesktop REG_DWORD 0x1
ValidateAdminCodeSignatures REG_DWORD 0x0
dontdisplaylastusername REG_DWORD 0x0
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
scforceoption REG_DWORD 0x0
shutdownwithoutlogon REG_DWORD 0x1
undockwithoutlogon REG_DWORD 0x1
FilterAdministratorToken REG_DWORD 0x0
EnableUIADesktopToggle REG_DWORD 0x0
DisableRegistryTools REG_DWORD 0x0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\UIPI
===============
AppInit_Dlls : C:\PROGRA~1\Google\GOOGLE~3\GoogleDesktopNetwork3.dll
===============
BHO :
======

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

Ndisuio : 0x3
EapHost : 0x3
Wlansvc : 0x2
SharedAccess : 0x2
windefend : 0x2
wuauserv : 0x2
=========

=========================
Environnement variables :
=========================

ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Marine\AppData\Roaming
choix=1
CLASSPATH=.;C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=MARINE-PC
ComSpec=C:\Windows\system32\cmd.exe
DFSTRACINGON=FALSE
EVAPP=C:\Program Files\AV
EVUNINST=C:\Program Files\Common Files\Uninstall\AV\Uninstall.lnk
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Marine
LOCALAPPDATA=C:\Users\Marine\AppData\Local
LOGONSERVER=\\MARINE-PC
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\Program Files\WinRAR;C:\Windows\system32;C:\Windows;C:\Windows\system32\wbem;C:\Program Files\Common Files\Roxio Shared\DLLShared;C:\Program Files\Common Files\Roxio Shared\10.0\DLLShared;C:\Program Files\QuickTime\QTSystem;C:\Program Files\Common Files\DivX Shared
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 15 Stepping 13, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0f0d
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
PROMPT=$P$G
PUBLIC=C:\Users\Public
QTJAVA=C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip
RoxioCentral=C:\Program Files\Common Files\Roxio Shared\10.0\Roxio Central36\
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\Marine\AppData\Local\Temp
TMP=C:\Users\Marine\AppData\Local\Temp
TRACE_FORMAT_SEARCH_PATH=\\NTREL202.ntdev.corp.microsoft.com\4F18C3A5-CA09-4DBD-B6FC-219FDD4C6BE0\TraceFormat
USERDOMAIN=Marine-PC
USERNAME=Marine
USERPROFILE=C:\Users\Marine
windir=C:\Windows


¤¤¤¤¤¤¤¤¤¤ Files/folders :

C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
C:\Windows\mbr.exe
C:\Windows\System32\pmsbfn32.dll

¤¤¤¤¤¤¤¤¤¤ Keys :


=========
Rootkits
=========

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-28 23:25:30
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

C:\Users\Marine\AppData\Roaming\Mozilla\Firefox\Profiles\fyy04xdy.default\cookies.sqlite-journal 2576 bytes

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 1


¤¤¤¤¤¤¤¤¤¤ C:\Windows\Prefetch :

ACRORD32INFO.EXE-54148297.pf
ADOBE_UPDATER.EXE-5FB586F8.pf
AgAppLaunch.db
AgCx_SC1.db
AgCx_SC1.db.trx
AgCx_SC2.db
AgGlFaultHistory.db
AgGlFgAppHistory.db
AgGlGlobalHistory.db
AgGlUAD_P_S-1-5-21-3434946352-2247961825-321128707-1000.db
AgGlUAD_S-1-5-21-3434946352-2247961825-321128707-1000.db
AgRobust.db
APMSGFWD.EXE-81042282.pf
APOINT.EXE-E77F185C.pf
AVGCMGR.EXE-FA901256.pf
AVGCSRVX.EXE-93E901E7.pf
AVGNSX.EXE-AF891D49.pf
AVGSCANX.EXE-E3A45CFA.pf
AVGTOOLBARINSTALL.EXE-FA1F5B63.pf
AVGTOOLBARINSTALL.TMP-307AC598.pf
AVGUI.EXE-3696F217.pf
AVGUPD.EXE-AF783C7E.pf
CALC.EXE-43F37294.pf
CMD.EXE-0BD30981.pf
CONSENT.EXE-40419367.pf
CONTROL.EXE-6EA5489A.pf
CSC.EXE-F8803EEA.pf
CVTRES.EXE-CB8485B0.pf
DATASAFEDOTNET.EXE-2C91B23D.pf
DEFRAG.EXE-3D9E8D72.pf
DELLWMGR.EXE-32D537F9.pf
DFRGNTFS.EXE-ACFD6573.pf
DLLHOST.EXE-3C4E5BEC.pf
DLLHOST.EXE-3F401451.pf
DLLHOST.EXE-4B6CB38A.pf
DLLHOST.EXE-6389524F.pf
DLLHOST.EXE-6BFBE41F.pf
DLLHOST.EXE-A010D183.pf
DRVINST.EXE-39D9EAC7.pf
DSC.EXE-1E1AE994.pf
DSCA.EXE-E7004A8C.pf
FIREFOX.EXE-66015FD1.pf
FIXCFG.EXE-EBC4469E.pf
GOOGLEDESKTOP.EXE-A96C573C.pf
GOOGLEUPDATERSERVICE.EXE-B29A0C52.pf
HKCMD.EXE-61FD4888.pf
IGFXEXT.EXE-C31ADD58.pf
IGFXPERS.EXE-540AA77D.pf
IGFXSRVC.EXE-C5618119.pf
IGFXTRAY.EXE-F30110F3.pf
IPODSERVICE.EXE-716E0AD1.pf
ITUNES.EXE-4FE7BA9B.pf
ITUNESHELPER.EXE-C9C22763.pf
JAVA.EXE-BE8A91FF.pf
JP2LAUNCHER.EXE-B5C8DF2E.pf
JP2LAUNCHER.EXE-CEA03FFB.pf
Layout.ini
LIMEWIRE.EXE-8DF3D697.pf
LIVECAMDE.EXE-2C85B96B.pf
LOGONUI.EXE-F639BD7E.pf
MINESWEEPER.EXE-E24BA4AE.pf
MOBSYNC.EXE-B307E1CC.pf
MPAS-D.EXE-BAAEB6D7.pf
MPAS-FE_BD.EXE-9B1F21DB.pf
MPCMDRUN.EXE-2C9109F9.pf
MPSIGSTUB.EXE-4074DD7E.pf
MPSIGSTUB.EXE-503F41F8.pf
MPSIGSTUB.EXE-53742082.pf
MPSIGSTUB.EXE-6BF1371D.pf
MPSIGSTUB.EXE-9208D69F.pf
MSASCUI.EXE-AB5A490C.pf
MSIEXEC.EXE-8FFB1633.pf
NTOSBOOT-B00DFAAD.pf
OEM02MON.EXE-1FDEC150.pf
OFFICELIVESIGNIN.EXE-31EB0F05.pf
PCD.EXE-F3AC2BA2.pf
PCDRENGINE.EXE-0536ED0A.pf
PCDRSYSINFOBLUETOOTH.P5X-EB994F58.pf
PCDRSYSINFOCOMMUNICATION.P5X-233AEA28.pf
PCDRSYSINFODIRECT.P5X-E91A18D1.pf
PCDRSYSINFOPERIPHERAL.P5X-E459853E.pf
PCDRSYSINFOPROCESSOR.P5X-EC657952.pf
PCDRSYSINFOSMBIOS2.P5X-3BBAFCCD.pf
PCDRSYSINFOSOFTWARE.P5X-FE321B39.pf
PCDRSYSINFOSTORAGE.P5X-F6147EAB.pf
PCDRSYSINFOSYSTEMBOARD.P5X-B5847613.pf
PCDRSYSINFOVIDEOCAPTURE.P5X-206AECA9.pf
PfSvPerfStats.bin
PHOTOSCREENSAVER.SCR-8B2352AA.pf
POWERPNT.EXE-63730067.pf
PRESENTATIONSETTINGS.EXE-EF41B35E.pf
ReadyBoot
REGSVR32.EXE-B31EC963.pf
RUNDLL32.EXE-0D53616E.pf
RUNDLL32.EXE-38193594.pf
RUNDLL32.EXE-6CAEC25E.pf
RUNDLL32.EXE-708A2547.pf
RUNDLL32.EXE-8278D842.pf
RUNDLL32.EXE-8CAF4DE6.pf
RUNDLL32.EXE-8FE671AA.pf
RUNDLL32.EXE-9BE65666.pf
RUNDLL32.EXE-AD74316F.pf
RUNDLL32.EXE-B7AAA713.pf
RUNDLL32.EXE-C32FC95C.pf
RUNDLL32.EXE-E2A60040.pf
RUNDLL32.EXE-E74A753B.pf
RUNDLL32.EXE-F720D238.pf
RUNDLL32.EXE-FA5505C4.pf
SEARCHFILTERHOST.EXE-44162447.pf
SEARCHPROTOCOLHOST.EXE-69C456C3.pf
SETUP_WM.EXE-843EC9EF.pf
SKYPE.EXE-51BD05D1.pf
SKYPEPM.EXE-B17A1D52.pf
SOFTWAREUPDATE.EXE-9B2A9FD1.pf
SOLITAIRE.EXE-556099DE.pf
SPIDERSOLITAIRE.EXE-A6061004.pf
SPRTCMD.EXE-340347A8.pf
STARTFX.EXE-910CD215.pf
SVCHOST.EXE-6A249820.pf
TASKENG.EXE-35FA9C06.pf
TOOLBARBROKER.EXE-04896146.pf
TRUSTEDINSTALLER.EXE-766EFF52.pf
VERCLSID.EXE-AB0FD091.pf
VLC.EXE-73B04BFB.pf
VSSVC.EXE-6C8F0C66.pf
WERCON.EXE-C87ACD13.pf
WERMGR.EXE-F439C551.pf
WINDOWSPHOTOGALLERY.EXE-21DEC4DD.pf
WINWORD.EXE-276534A6.pf
WLCOMM.EXE-E9DF8E24.pf
WLTRAY.EXE-310BA6AC.pf
WLXQUICKTIMECONTROLHOST.EXE-B1E2C9F6.pf
WMIADAP.EXE-2D08C963.pf
WMIADAP.EXE-BB21CD77.pf
WMIPRVSE.EXE-E8B8DD29.pf
WMPLAYER.EXE-0FFA8967.pf
WMPLAYER.EXE-D7C621F8.pf
WMPNSCFG.EXE-18FC9E64.pf
WSCRIPT.EXE-3FF4D889.pf
WSQMCONS.EXE-4048402C.pf
WUAUCLT.EXE-5D573F0E.pf
WUDFHOST.EXE-DEBBE5F1.pf




¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

Dsl mon ordi est hyper lent c un truc de dingue.... Hier j'ai commence le scan option 1 je crois. Ca fait maintenant 11h et il est tjs en train de scanner.... C pas bien normal.....

Non mais la je te parle de Malwarebytes que tu m'as dit de lancer hier. Ca fait 12h bientot, c pas fini et 2 infections ont ete trouvees... J'ai deja fait Kill'em option 2 non ?!

Voila le rapport de Malwarebytes :

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 3252
Windows 6.0.6001 Service Pack 1

29/11/2009 12:38:14
mbam-log-2009-11-29 (12-38-14).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 258391
Temps écoulé: 12 hour(s), 19 minute(s), 57 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\av (Rogue.FakeAntivir) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Program Files\AV\antivir.exe (Rogue.FakeAntivir) -> Quarantined and deleted successfully.
C:\Program Files\Common Files\Uninstall\AV\Uninstall.lnk (Rogue.AntiVir) -> Quarantined and deleted successfully.

G suivi le guide d'aide. Mon ordi s'est rallumé, tout C remis en place et l'ordi a repris une vitesse d'execution normale je pense.... Merci bcp pour ton aide précieuse !!
Que dois-je faire maintenant ?!

Une fois fini, je pourrai désinstaller Malwarebytes. ComboFix etc. et remettre mon firewall, anti-virus de Windows ?!

Flo tu reponds plus... C bon jsui debarssee de mon rogue ou pas !?
Je peux enlever Kill'em, Malwarebytes et RSIT ou pas ??
J'ai un icone qui me dit que ca bloque des progarmmes au demarrage de Windows et ce programme en question est Malwarebytes. Je fais quoi ?!

Merci pour ton aide