explorer.exe ne demarre pas (entre autres) Résolu/Fermé

Question

Bonjour,

Pour bien commencer l'année 2010, voici un pc bien malade à désinfecter.
Souci principal, je ne sais pas si c un virus ou autre infection, explorer.exe plante au démarrage. Il faut lancer le gestionnaire des taches et executer explorer à plusieurs reprises. (PC sous Vista)
J'ai déjà supprimé quelques toolbar etc... mais y a encore un sacré boulot.

Je viens donc vous demander de l'aide pour ramener cet ordinateur à la vie.

Merci d'avance.

père noël · Answer

dans le menu démarrage place un raccourci de explorer.exe
tu peux peut etre regarder aussi du coté de msconfig et voir ce qui se lance au démarrage.

matduchesne · Answer

J'ai tenté ta méthode du raccourci explorer.exe
En fait le processus se lance apparement puis il cesse de fonctionner.
Pour se qui est de msconfig, j'ai tout réactivé pour être sûr que explorer démarre.
Je poste un rapport RSIT si ça peut aider


info.txt logfile of random's system information tool 1.06 2010-01-06 10:01:32

======Uninstall list======

-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
123 Free Solitaire 2009 v7.0-->"C:\Program Files\123 Free Solitaire\unins000.exe"
2007 Microsoft Office system-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROHYBRIDR /dll OSETUP.DLL
Activation Assistant for the 2007 Microsoft Office suites-->"C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}\Microsoft Office Activation Assistant.exe" REMOVE=TRUE MODIFY=FALSE
Adobe Flash Player 10 Plugin-->MsiExec.exe /X{ECA1A3B6-898F-4DCE-9F04-714CF3BA126B}
Adobe Flash Player ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A80000000002}
Adobe Reader 8.1.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81200000003}
ALPS Touch Pad Driver-->C:\Program Files\Apoint2K\Uninstap.exe ADDREMOVE
Assistant de connexion Windows Live-->MsiExec.exe /I{DCE8CD14-FBF5-4464-B9A4-E18E473546C7}
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
Bluetooth Stack for Windows by Toshiba-->MsiExec.exe /X{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}
Cake Mania 2-->"C:\Program Files\orange\jeux\Cake Mania 2\Uninstall.exe" "C:\Program Files\orange\jeux\Cake Mania 2\install.log"
Cake Mania Main Street-->"C:\Program Files\orange\jeux\Cake Mania Main Street\Uninstall.exe" "C:\Program Files\orange\jeux\Cake Mania Main Street\install.log"
Canon MP Navigator 3.0-->"C:\Program Files\Canon\MP Navigator 3.0\Maint.exe" /UninstallRemove C:\Program Files\Canon\MP Navigator 3.0\uninst.ini
Canon MP160-->"C:\Windows\system32\CanonIJ Uninstaller Information\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP160\DelDrv.exe" /U:{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP160 /L0x000c
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Desktop SMS-->MsiExec.exe /I{5980B928-1C95-4B3E-957B-B02D8147FF9E}
Détecteur de flux Windows Live Toolbar (Windows Live Toolbar)-->MsiExec.exe /X{EFFCB0F1-CFEC-48D4-B793-EBFCAE852976}
Diaper Dash-->"C:\Program Files\orange\jeux\Diaper Dash\Uninstall.exe" "C:\Program Files\orange\jeux\Diaper Dash\install.log"
Diner Dash-->"C:\Program Files\orange\jeux\Diner Dash\Uninstall.exe" "C:\Program Files\orange\jeux\Diner Dash\install.log"
EA Download Manager-->C:\Program Files\Electronic Arts\EADM\Uninstall.exe
Enjoy 4e-->C:\Windows\Enjoy 4e Uninstaller.exe
Fichiers de prise en charge de l'installation de Microsoft SQL Server (Français)-->MsiExec.exe /X{3380F354-C5F7-4E71-8F51-EEE6C3F06C62}
Galerie de photos Windows Live-->MsiExec.exe /X{B131E59D-202C-43C6-84C9-68F0C37541F1}
Gestionnaire de contacts professionnels pour Outlook 2007-->"c:\Program Files\Microsoft Small Business\Business Contact Manager\SetupBootstrap\Setup.exe" /remove {69ca8988-1c6c-4285-b8af-db780a6e42af}
Gestionnaire de contacts professionnels pour Outlook 2007-->MsiExec.exe /X{69ca8988-1c6c-4285-b8af-db780a6e42af}
Go-Go Gourmet-->"C:\Program Files\orange\jeux\Go-Go Gourmet\Uninstall.exe" "C:\Program Files\orange\jeux\Go-Go Gourmet\install.log"
Google Toolbar for Internet Explorer-->MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Google Earth-->MsiExec.exe /X{C084BC61-E537-11DE-8616-005056806466}
Hardwood Solitaire Deluxe-->"C:\Program Files\orange\jeux\Hardwood Solitaire Deluxe\Uninstall.exe" "C:\Program Files\orange\jeux\Hardwood Solitaire Deluxe\install.log"
Hardwood Solitaire Deluxe-->C:\Program Files\orange\jeux\Hardwood Solitaire Deluxe\solitaire.exe -Uninstall
HijackThis 2.0.2-->"C:\Program Files	rend micro\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{46ABBC54-1872-4AA3-95E2-F2C063A63F31}
Intel(R) Graphics Media Accelerator Driver-->C:\Windows\system32\igxpun.exe -uninstall
Intel(R) Network Connections Drivers-->Prounstl.exe
Intel® Matrix Storage Manager-->C:\Windows\system32\imsmudlg.exe -uninstall
Java(TM) 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java(TM) 6 Update 4-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160040}
Java(TM) SE Runtime Environment 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160000}
Jessicas Cupcake Cafe-->"C:\Program Files\orange\jeux\Jessicas Cupcake Cafe\Uninstall.exe" "C:\Program Files\orange\jeux\Jessicas Cupcake Cafe\install.log"
Junk Mail filter update-->MsiExec.exe /I{E2DFE069-083E-4631-9B6C-43C48E991DE5}
Les Sims™ 3-->"C:\Program Files\InstallShield Installation Information\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}\Sims3Setup.exe" -runfromtemp -l0x040c -removeonly
LimeWire 5.1.2-->"C:\Program Files\LimeWire\uninstall.exe"
Lovely Kitchen-->"C:\Program Files\orange\jeux\Lovely Kitchen\Uninstall.exe" "C:\Program Files\orange\jeux\Lovely Kitchen\install.log"
Mahjong Garden Deluxe-->"C:\Program Files\orange\jeux\Mahjong Garden Deluxe\Uninstall.exe" "C:\Program Files\orange\jeux\Mahjong Garden Deluxe\install.log"
Manuels TOSHIBA-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5B1DD5AA-FF34-4D6E-A912-CB46BB7378DC}\setup.exe" -l0x40c  -removeonly
Menus intelligents (Windows Live Toolbar)-->MsiExec.exe /X{0CC70FEF-5068-4CD5-B4DE-86FFD98EC929}
Messenger Plus! Live-->"C:\Program Files\Messenger Plus! Live\Uninstall.exe"
Microsoft .NET Framework 3.5 Language Pack SP1 - fra-->MsiExec.exe /I{3E31821C-7917-367E-938E-E65FC413EA31}
Microsoft .NET Framework 3.5 SP1-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
Microsoft Office 2003 Web Components-->MsiExec.exe /I{90A4040C-6000-11D3-8CFE-0150048383C9}
Microsoft Office 2007 Primary Interop Assemblies-->MsiExec.exe /X{50120000-1105-0000-0000-0000000FF1CE}
Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office Live Add-in 1.3-->MsiExec.exe /I{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}
Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Professional Hybrid 2007-->MsiExec.exe /X{91120000-0031-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Small Business Connectivity Components-->MsiExec.exe /X{A939D341-5A04-4E0A-BB55-3E65B386432D}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft Search Enhancement Pack-->MsiExec.exe /X{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)-->MsiExec.exe /I{480DBB60-F0B6-45F2-B26F-1A2E11197791}
Microsoft SQL Server 2005-->"c:\Program Files\Microsoft SQL Server\90\Setup Bootstrap\ARPWrapper.exe" /Remove
Microsoft SQL Server Native Client-->MsiExec.exe /I{90283F22-0731-43B6-81FD-E6DD911A31FB}
Microsoft SQL Server VSS Writer-->MsiExec.exe /I{C74B273E-DF20-4955-899B-15205119894C}
Microsoft Sync Framework Runtime Native v1.0 (x86)-->MsiExec.exe /I{8A74E887-8F0F-4017-AF53-CBA42211AAA5}
Microsoft Sync Framework Services Native v1.0 (x86)-->MsiExec.exe /I{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft WSE 3.0 Runtime-->MsiExec.exe /X{E3E71D07-CD27-46CB-8448-16D4FB29AA13}
Module linguistique Microsoft .NET Framework 3.5 SP1- fra-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\setup.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
myphotobook 3.1-->C:\Program Files\myphotobook\uninst.exe
NVIDIA Drivers-->C:\Windows\system32\NVUNINST.EXE UninstallGUI
OpenOffice.org 3.1-->MsiExec.exe /I{E6B87DC4-2B3D-4483-ADFF-E483BF718991}
Outil de mise à jour Google-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Outlook Express Backup Expert 1.40-->"C:\Program Files\Bodrag\Outlook Express Backup Expert\unins000.exe"
Patience 2.4-->C:\PROGRA~1\Patience\UNWISE.EXE C:\PROGRA~1\Patience\INSTALL.LOG
PhotoFiltre-->"C:\Program Files\PhotoFiltre\Uninst.exe"
PhotoScape-->"C:\Program Files\PhotoScape\uninstall.exe"
Picasa 3-->"C:\Program Files\Google\Picasa3\Uninstall.exe"
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m
Réducteur de bruit lect. CD/DVD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}\setup.exe" -l0x40c 
Registry Mechanic 7.0-->"C:\Program Files\Registry Mechanic\unins000.exe"
Search Guard Plus (My Web Tattoo)-->C:\Program Files\Search Guard Plus\uninstalSGP.exe
Search Guard Plus Updater (My Web Tattoo)-->C:\Program Files\Search Guard PlusU\uninstalSGPU.exe
Texas Instruments PCIxx21/x515/xx12 drivers.-->C:\Program Files\InstallShield Installation Information\{DB780B85-B4B5-4864-A49C-9B706B169C93}\setup.exe -runfromtemp -l0x040c
TOSHIBA Assist-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{12B3A009-A080-4619-9A2A-C6DB151D8D67}\setup.exe" -l0x40c 
TOSHIBA ConfigFree-->C:\Program Files\InstallShield Installation Information\{78C6A78A-8B03-48C8-A47C-78BA1FCA2307}\setup.exe -runfromtemp -l0x040c uninstall -removeonly
TOSHIBA Disc Creator-->MsiExec.exe /X{5DA0E02F-970B-424B-BF41-513A5018E4C0}
TOSHIBA Extended Tiles for Windows Mobility Center-->C:\Program Files\InstallShield Installation Information\{617C36FD-0CBE-4600-84B2-441CEB12FADF}\setup.exe -runfromtemp -l0x040c
TOSHIBA HDD Protection-->MsiExec.exe /X{94A90C69-71C1-470A-88F5-AA47ECC96B40}
Toshiba Online Product Information-->C:\Program Files\InstallShield Installation Information\{2290A680-4083-410A-ADCC-7092C67FC052}\setup.exe -runfromtemp -l0x040c -removeonly
TOSHIBA SD Memory Boot Utility-->MsiExec.exe /X{BBF5493A-05FB-4449-90DE-84A61EB78154}
TOSHIBA SD Memory Utilities-->MsiExec.exe /X{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}
TOSHIBA Security Assist-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1E63ACB5-D45E-4856-8FC9-78F4B0D7BB80}\setup.exe" -l0x40c  -removeonly
TOSHIBA Software Modem-->Tosmreg -U
TOSHIBA Value Added Package-->C:\Program Files\InstallShield Installation Information\{FEDD27A0-B306-45EF-BF58-B527406B42C8}\setup.exe -runfromtemp -l0x040c
TOSHIBA Wireless Key Logon-->MsiExec.exe /X{FC4C645F-8EBC-4F1E-A517-D1505B43A374}
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
Update for Office 2007 (KB934528)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {2B939677-2FFD-48F6-9075-7BF48CB87C80}
Update for Office System 2007 Setup (KB929722)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {D8E9BEBD-655F-467D-8176-CA9959C140A3}
VideoLAN VLC media player 0.8.6c-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Contrôle parental-->MsiExec.exe /X{D5D81435-B8DE-4CAF-867F-7998F2B92CFC}
Windows Live FolderShare-->MsiExec.exe /X{2075CB0A-D26F-4DAA-B424-5079296B43BA}
Windows Live Mail-->MsiExec.exe /I{5DD76286-9BE7-4894-A990-E905E91AC818}
Windows Live Messenger-->MsiExec.exe /I{F6326B60-1B1D-4ABF-BFCD-7B7404F44411}
Windows Live Messenger-->MsiExec.exe /X{770F1BEC-2871-4E70-B837-FB8525FFA3B1}
Windows Live Movie Maker-->MsiExec.exe /X{53B20C18-D8D4-4588-8737-9BBFE303C354}
Windows Live Sign-in Assistant-->MsiExec.exe /I{49672EC2-171B-47B4-8CE7-50D7806360D7}
Windows Live Toolbar-->MsiExec.exe /X{F7D27C70-90F5-49B9-B188-0A133C0CE353}
Windows Live Writer-->MsiExec.exe /X{4634B21A-CC07-4396-890C-2B8168661FEA}
WinDVD for TOSHIBA-->C:\Program Files\InstallShield Installation Information\{20471B27-D702-4FE8-8DEC-0702CC8C0A85}\setup.exe -runfromtemp -l0x040c
Zuma Deluxe-->"C:\Program Files\orange\jeux\Zuma Deluxe\Uninstall.exe" "C:\Program Files\orange\jeux\Zuma Deluxe\install.log"

======Security center information======

AS: Windows Defender (disabled)

======System event log======

Computer Name: PC-de-frederiqu
Event Code: 4376
Message: Servicing a requis un redémarrage pour terminer la définition du package KB944036(Update) à l’état Installation demandée(Install Requested)
Record Number: 154365
Source Name: Microsoft-Windows-Servicing
Time Written: 20100106085933.000000-000
Event Type: Avertissement
User: PC-de-frederiqu\frederique

Computer Name: PC-de-frederiqu
Event Code: 4376
Message: Servicing a requis un redémarrage pour terminer la définition du package KB976325(Security Update) à l’état Installation demandée(Install Requested)
Record Number: 154479
Source Name: Microsoft-Windows-Servicing
Time Written: 20100106090129.000000-000
Event Type: Avertissement
User: PC-de-frederiqu\frederique

Computer Name: PC-de-frederiqu
Event Code: 4376
Message: Servicing a requis un redémarrage pour terminer la définition du package KB976325(Security Update) à l’état Installation demandée(Install Requested)
Record Number: 154481
Source Name: Microsoft-Windows-Servicing
Time Written: 20100106090129.000000-000
Event Type: Avertissement
User: PC-de-frederiqu\frederique

Computer Name: PC-de-frederiqu
Event Code: 4376
Message: Servicing a requis un redémarrage pour terminer la définition du package KB976325(Security Update) à l’état Installation demandée(Install Requested)
Record Number: 154483
Source Name: Microsoft-Windows-Servicing
Time Written: 20100106090129.000000-000
Event Type: Avertissement
User: PC-de-frederiqu\frederique

Computer Name: PC-de-frederiqu
Event Code: 4376
Message: Servicing a requis un redémarrage pour terminer la définition du package KB976325(Security Update) à l’état Installation demandée(Install Requested)
Record Number: 154485
Source Name: Microsoft-Windows-Servicing
Time Written: 20100106090129.000000-000
Event Type: Avertissement
User: PC-de-frederiqu\frederique

=====Application event log=====

Computer Name: PC-de-frederiqu
Event Code: 1000
Message: Application défaillante explorer.exe, version 6.0.6001.18164, horodatage 0x4907e242, module défaillant dmocx32.dll, version 0.0.0.0, horodatage 0x4b338711, code d’exception 0xc0000005, décalage d’erreur 0x00010d39, ID du processus 0xb98, heure de début de l’application 0x01ca8e3587f4eead.
Record Number: 71650
Source Name: Application Error
Time Written: 20100105183311.000000-000
Event Type: Erreur
User: 

Computer Name: PC-de-frederiqu
Event Code: 1000
Message: Application défaillante explorer.exe, version 6.0.6001.18164, horodatage 0x4907e242, module défaillant dmocx32.dll, version 0.0.0.0, horodatage 0x4b338711, code d’exception 0xc0000005, décalage d’erreur 0x0000200d, ID du processus 0xf04, heure de début de l’application 0x01ca8e362109a784.
Record Number: 71705
Source Name: Application Error
Time Written: 20100105183733.000000-000
Event Type: Erreur
User: 

Computer Name: PC-de-frederiqu
Event Code: 1000
Message: Application défaillante explorer.exe, version 6.0.6001.18164, horodatage 0x4907e242, module défaillant dmocx32.dll_unloaded, version 0.0.0.0, horodatage 0x4b338711, code d’exception 0xc0000005, décalage d’erreur 0x10010d39, ID du processus 0xee0, heure de début de l’application 0x01ca8e3668f371c4.
Record Number: 71707
Source Name: Application Error
Time Written: 20100105183928.000000-000
Event Type: Erreur
User: 

Computer Name: PC-de-frederiqu
Event Code: 1000
Message: Application défaillante Explorer.EXE, version 6.0.6001.18164, horodatage 0x4907e242, module défaillant dmocx32.dll, version 0.0.0.0, horodatage 0x4b338711, code d’exception 0xc0000005, décalage d’erreur 0x0000200d, ID du processus 0x848, heure de début de l’application 0x01ca8e3b85484655.
Record Number: 71722
Source Name: Application Error
Time Written: 20100105191610.000000-000
Event Type: Erreur
User: 

Computer Name: PC-de-frederiqu
Event Code: 1000
Message: Application défaillante explorer.exe, version 6.0.6001.18164, horodatage 0x4907e242, module défaillant SHLWAPI.dll, version 6.0.6001.18000, horodatage 0x4791a75c, code d’exception 0xc0000005, décalage d’erreur 0x00020d4c, ID du processus 0xad4, heure de début de l’application 0x01ca8e3bab0fb8f5.
Record Number: 71783
Source Name: Application Error
Time Written: 20100106085450.000000-000
Event Type: Erreur
User: 

=====Security event log=====

Computer Name: PC-de-frederiqu
Event Code: 4672
Message: Privilèges spéciaux attribués à la nouvelle ouverture de session.

Sujet :
	ID de sécurité :		S-1-5-18
	Nom du compte :		SYSTEM
	Domaine du compte :		AUTORITE NT
	ID d’ouverture de session :		0x3e7

Privilèges :		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
Record Number: 28849
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090212125027.780400-000
Event Type: Succès de l'audit
User: 

Computer Name: PC-de-frederiqu
Event Code: 4647
Message: Fermeture de session initiée par l’utilisateur :

Sujet :
	ID de sécurité :		S-1-5-21-4183581156-1823947664-1311954497-1003
	Nom du compte :		frederique
	Domaine du compte :		PC-de-frederiqu
	ID d’ouverture de session :		0x399d2

Cet événement est généré lorsqu’une fermeture de session est initiée, mais que le nombre de références du jeton n’étant pas zéro, la session ouverte ne peut pas être supprimée. Aucune autre activité initiée par l’utilisateur ne peut se produire. Cet événement peut être interprété comme un événement de fermeture de session.
Record Number: 28850
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090212134508.493000-000
Event Type: Succès de l'audit
User: 

Computer Name: PC-de-frederiqu
Event Code: 1100
Message: Le service d’enregistrement des événements a été arrêté.
Record Number: 28851
Source Name: Microsoft-Windows-Eventlog
Time Written: 20090212134521.675000-000
Event Type: Succès de l'audit
User: 

Computer Name: PC-de-frederiqu
Event Code: 4616
Message: L’heure du système a été modifiée.

Sujet :
	ID de sécurité :		S-1-5-19
	Nom du compte :		SERVICE LOCAL
	Domaine du compte :		AUTORITE NT
	ID d’ouverture de session :		0x3e5

Informations sur le processus :
	ID du processus :	0x5a4
	Nom :		C:\Windows\System32\svchost.exe

Heure précédente :		14:45:21 12/02/2009
Nouvelle heure :		14:45:21 12/02/2009

Cet événement est généré lorsque l’heure du système est modifiée. Le changement régulier de l’heure du système est une opération normale de la part du service de temps Windows qui s’exécute avec des privilèges système. Mais, d’autres modifications de l’heure du système peuvent indiquer des tentatives de falsification de l’ordinateur.
Record Number: 28852
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090212134525.480800-000
Event Type: Succès de l'audit
User: 

Computer Name: PC-de-frederiqu
Event Code: 4634
Message: Fermeture de session d’un compte.

Sujet :
	ID de sécurité :		S-1-5-7
	Nom du compte :		ANONYMOUS LOGON
	Domaine du compte :		AUTORITE NT
	ID du compte :		0x33fa3

Type d’ouverture de session :			3

Cet événement est généré lorsqu’une session ouverte est supprimée. Il peut être associé à un événement d’ouverture de session en utilisant la valeur ID d’ouverture de session. Les ID d’ouverture de session ne sont uniques qu’entre les redémarrages sur un même ordinateur.
Record Number: 28853
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090212134556.134800-000
Event Type: Succès de l'audit
User: 

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;c:\Program Files\Microsoft SQL Server\90\Tools\binn\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel
"PROCESSOR_REVISION"=0f0d
"NUMBER_OF_PROCESSORS"=2

-----------------EOF-----------------
Logfile of random's system information tool 1.06 (written by random/random)
Run by frederique at 2010-01-06 09:59:19
Microsoft® Windows Vista™ Professionnel  Service Pack 1
System drive C: has 10 GB (17%) free of 57 GB
Total RAM: 1014 MB (19% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:01:14, on 06/01/2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18349)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Search Guard Plus\SearchGuardPlus.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\System32\ThpSrv.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Winsudate\gibusr.exe
C:\Program Files\Electronic Arts\EADM\Core.exe
C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Protector Suite QL\psqltray.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\conime.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Windows\explorer.exe
C:\Windows\system32\wuauclt.exe
C:\Users\frederique\Desktop\RSIT.exe
C:\Program Files	rend micro\frederique.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: SearchHelper Class - {91C18ED5-5E1C-4AE5-A148-A861DE8C8E16} - C:\Program Files\SGPSA\mtwb3sh.dll
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {0365D4B0-3A0D-4DE5-AD4F-BE080B219667} - C:\Windows\System32\dwmredir32.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: BrowserHelper Class - {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - C:\Program Files\SGPSA\SearchAssistant.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [TOSDCR] %ProgramFiles%\TOSHIBA\PasswordUtility\TOSDCR.exe
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information	opi.exe -startup
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [PopUp Destroy] C:\Program Files\PopUp Destroy\Popup-Destroy.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe
O4 - HKLM\..\Run: [TosAutLk] c:\Program Files\TOSHIBA\WirelessKeyLogon\TosAutLk.exe -s
O4 - HKLM\..\Run: [ThpSrv] C:\Windows\system32	hpsrv /logon
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [Desktop SMS] C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe /auto
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
O4 - HKCU\..\Run: [WinUsr] C:\Program Files\Winsudate\gibusr.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - HKCU\..\Run: [RTHDBPL] C:\Users\frederique\AppData\Roaming\SystemProc\lsass.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD	oscdspd.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: eBay - Achetez, Vendez - {76577871-04EC-495E-A12B-91F7C3600AFA} - https://www.ebay.fr (file missing)
O9 - Extra button: Amazon.fr - {8A918C1D-E123-4E36-B562-5C1519E434CE} - https://www.amazon.fr/exec/obidos/subst/home/home.html/262-6263521-6325360?_encoding=UTF8&link_code=hom&tag=Toshibafrbholink-21 (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/MessengerGamesContent/GameContent/fr/uno1/GAME_UNO1.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O20 - AppInit_DLLs: C:\Windows\System32\dmocx32.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Service Google Update (gupdate1c99b42a509777f) (gupdate1c99b42a509777f) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: TOSHIBA HDD Protection (Thpsrv) - TOSHIBA Corporation - C:\Windows\system32\ThpSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - Unknown owner - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (file missing)
O23 - Service: Gestionnaire de mise à jour Winsudate (WinSvc) - Winsudate - C:\Program Files\Winsudate\gibsvc.exe

matduchesne · Answer

Hello Nathandre, voici le rapport Malwarebytes :

Malwarebytes' Anti-Malware 1.43
Version de la base de données: 3499
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18865

06/01/2010 17:08:03
mbam-log-2010-01-06 (17-08-03).txt

Type de recherche: Examen complet (C:\|E:\|)
Eléments examinés: 239244
Temps écoulé: 1 hour(s), 26 minute(s), 0 second(s)

Processus mémoire infecté(s): 2
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 4
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 34

Processus mémoire infecté(s):
C:\Program Files\Winsudate\gibusr.exe (Adware.Gibmedia) -> Unloaded process successfully.
C:\Program Files\Winsudate\gibsvc.exe (Adware.Gibmedia) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
C:\Windows\System32\dmocx32.dll (Trojan.Tracur) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winsvc (Adware.Gibmedia) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1a93c934-025b-4c3a-b38e-9654a7003239} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\.fsharproj (Trojan.BHO) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winusr (Adware.Gibmedia) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rthdbpl (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\desktop sms (Worm.P2P) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Tracur) -> Data: c:\windows\system32\dmocx32.dll -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Tracur) -> Data: system32\dmocx32.dll -> Delete on reboot.

Dossier(s) infecté(s):
C:\Program Files\Winsudate (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32 (Worm.Archive) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Windows\System32\dmocx32.dll (Trojan.Tracur) -> Delete on reboot.
C:\Program Files\Winsudate\gibusr.exe (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files\Winsudate\gibsvc.exe (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DA1LM9VL\gibupt[1].exe (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DA1LM9VL\gibusr[1].exe (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EZKU384H\gibcom[1].dll (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EZKU384H\gibidl[1].dll (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V4ML8LGU\gibsvc[1].exe (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files\Winsudate\gibcom.dll (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files\Winsudate\gibidl.dll (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files\Winsudate\gibupt.exe (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\@i104748141v4 (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\@i104748141v6 (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\@i104748141v7 (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\@u104748141v5 (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\mi104748141v4 (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\mi104748141v4.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\mi104748141v6 (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\mi104748141v6.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\mi104748141v7 (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\mi104748141v7.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\mu104748141v5 (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\mu104748141v5.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\wu104748141v0.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\wu104748141v1.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\wu104748141v2.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\wu104748141v3.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\_i104748141v4 (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\_i104748141v6 (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\_i104748141v7 (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\_u104748141v5 (Worm.Archive) -> Quarantined and deleted successfully.
C:\Users\frederique\AppData\Roaming\SystemProc\lsass.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\GnuHashes.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\confin.sys (Malware.Trace) -> Quarantined and deleted successfully.

matduchesne · Answer

Bon déjà, je sais pas par quelle manoeuvre mais le pb de l'explorateur est résolu.
Est ce que je peux supprimer la quarantaine de Malwarebytes ?
Sinon j'essaie de lancer un nettoyage de Ad-Remover, l'ordinateur redemarre mais AD-R ne se lance jamais au redémarrage.
Voici le rapport RSIT :

Logfile of random's system information tool 1.06 (written by random/random)
Run by frederique at 2010-01-07 10:19:43
Microsoft® Windows Vista™ Professionnel  Service Pack 2
System drive C: has 16 GB (28%) free of 57 GB
Total RAM: 1014 MB (25% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:21:41, on 07/01/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18865)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\System32\ThpSrv.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Adobe\Reader 9.0\Readereader_sl.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Users\frederique\Desktop\RSIT.exe
C:\Program Files	rend micro\frederique.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\system32\conime.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - Default URLSearchHook is missing
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: BrowserHelper Class - {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - C:\Program Files\SGPSA\SearchAssistant.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TosAutLk] c:\Program Files\TOSHIBA\WirelessKeyLogon\TosAutLk.exe -s
O4 - HKLM\..\Run: [ThpSrv] C:\Windows\system32	hpsrv /logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD	oscdspd.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: eBay - Achetez, Vendez - {76577871-04EC-495E-A12B-91F7C3600AFA} - https://www.ebay.fr (file missing)
O9 - Extra button: Amazon.fr - {8A918C1D-E123-4E36-B562-5C1519E434CE} - https://www.amazon.fr/exec/obidos/subst/home/home.html/262-6263521-6325360?_encoding=UTF8&link_code=hom&tag=Toshibafrbholink-21 (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (no file)
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O13 - Gopher Prefix: 
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/MessengerGamesContent/GameContent/fr/uno1/GAME_UNO1.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: TOSHIBA HDD Protection (Thpsrv) - TOSHIBA Corporation - C:\Windows\system32\ThpSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - Unknown owner - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (file missing)

Utilisateur anonyme · Answer

je reviens sur mon post 7, c'est normal qu'il n'y a pas le rapport info.txt
héberge le rapport log.txt sur le site ci joint.fr, car il n'est pas complet

matduchesne · Answer

Voici le lien du fichier log.txt :

http://www.cijoint.fr/cjlink.php?file=cj201001/cijpEZxeac.txt

matduchesne · Answer

Toujours le meme problème, je lance AD-R.exe en tant qu'administrateur, le controle de comptes est désactivé, l'ordintateur redémarre mais au redémarrage, AD-R ne s'exécute pas après avoir ouvert la session.

matduchesne · Answer

Je desespérais, j'aurais pu y penser plus tôt. Voici le rapport :
.
======= RAPPORT D'AD-REMOVER 1.1.4.6_G | UNIQUEMENT XP/VISTA/7 =======
.
Mis à jour par C_XX le 05.01.2010 à 18:50
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 18:04:40, 07/01/2010 | Mode Normal | Option: CLEAN
Exécuté de: C:\Program Files\Ad-Remover\
Système d'exploitation: Microsoft® Windows Vista™ Business Service Pack 2 v6.0.6002
Nom du PC: PC-DE-FREDERIQU | Utilisateur actuel: frederique

.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.

C:\Program Files\SGPSA 
C:\Program Files\Winletmin 

(!) -- Fichiers temporaires supprimés.
 
.
HKLM\Software\Classes\CLSID\{8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6}
HKLM\Software\Classes\TypeLib\{4509D3CC-B642-4745-B030-645B79522C6D}
HKLM\software\classes\URLSearchHook.ToolbarURLSearchHook
HKLM\software\classes\URLSearchHook.ToolbarURLSearchHook.1
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8EEB63E6-3F4D-4203-8605-1240BEB0CBD4}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6}
HKU\.default\software\GamesBar
.
============== Scan additionnel ==============
.
.
* Internet Explorer Version 8.0.6001.18865 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Do404Search: 01000000
Local Page: C:\Windows\system32\blank.htm
Show_ToolBar: yes
Enable Browser Extensions: yes
Start Page: hxxp://fr.msn.com/
Use Search Asst: 
Use Custom Search URL: 1 (0x1)
Search Bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchAssistant: 
Default_page_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Start Page: hxxp://fr.msn.com/
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\Windows\System32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
===================================
.
2349 Octet(s) - C:\Ad-Report-CLEAN[1].log 
.
0 Fichier(s) - C:\Users\FREDER~1\AppData\Local\Temp 
1 Fichier(s) - C:\Windows\Temp 
0 Fichier(s) - C:\Windows\Prefetch 
.
19 Fichier(s) - C:\Program Files\Ad-Remover\BACKUP
3 Fichier(s) - C:\Program Files\Ad-Remover\QUARANTINE 
.
Fin à: 18:08:28 | 07/01/2010 - CLEAN[1]
.
============== E.O.F ==============
.

matduchesne · Answer

Voici :

http://www.cijoint.fr/cjlink.php?file=cj201001/cijNqAAvV4.txt

Utilisateur anonyme · Answer

je verrai cela dans la soirée

matduchesne · Answer

Ca donne quoi ce rapport ?

matduchesne · Answer

J'ai analysé les fichiers.
Aucun virus détectés.
Encore des procédures à effectuer ?

fix200 · Answer

Salut à vous 2,

Coucou Mat' ... :)

Pour suivre.

PS: les fichiers semblent infectieux ... ;)
et le dossier, ça ressemble à une infection genre security tool.
sauf le dernier, il est sain.
Ne pas oublier, l'UAC et norton ...

matduchesne · Answer

Hello fix,
En l'occurence non ces fichiers n'ont pas été détectés.
Le dossier je ne l'ai pas passé sur virus total (le dossier est vide d'ailleurs donc comment faire ?)
Pour l'UAC et Norton, que faut il faire ?
L'UAC est désactivée, et en fait l'alerte du centre de sécurité n'apparait meme pas dans la zone de notification.

gen-hackman · Answer

bonsoir mat bonne Année

bonsoir à tous

pour suivre

Utilisateur anonyme · Answer

bonsoir mat, désolée, j'étais occupée
Attention, avant de commencer, lit attentivement la procédure, et imprime la

 Télécharge ComboFix de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

/!\ Déconnecte-toi du net et DESACTIVES TOUTES LES DEFENSES, antivirus et antispyware y compris /!\
---> Clic droit sur ComboFix.exe, et sur exécuter en tant qu'administrateur
Un "pop-up" va apparaître qui dit que ComboFix est utilisé à vos risques et avec aucune garantie... Clique sur oui pour accepter
SURTOUT INSTALLES LA CONSOLE DE RECUPERATION
---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

 Ne touche à rien(souris, clavier) tant que le scan n'est pas terminé, car tu risques de planter ton PC

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix.txt

matduchesne · Answer

ComboFix 10-01-04.01 - frederique 11/01/2010  10:40:04.1.2 - x86
Microsoft® Windows Vista™ Professionnel   6.0.6002.2.1252.33.1036.18.1014.294 [GMT 1:00]
Lancé depuis: c:\users\frederique\Desktop\ComboFix.exe
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-54147300-3733482535-1002236262-500
c:\$recycle.bin\S-1-5-21-918056312-2952985149-2686913973-500
c:\users\frederique\AppData\Roaming\020000003f421330724C.manifest
c:\users\frederique\AppData\Roaming\020000003f421330724O.manifest
c:\users\frederique\AppData\Roaming\020000003f421330724P.manifest
c:\users\frederique\AppData\Roaming\020000003f421330724S.manifest
c:\users\frederique\AppData\Roaming\SystemProc
c:\windows\system32\1851156816
c:\windows\system32\6D7yOJp.vbs
c:\windows\system32\config\systemprofile\AppData\Roaming\020000003f421330724C.manifest
c:\windows\system32\config\systemprofile\AppData\Roaming\020000003f421330724O.manifest
c:\windows\system32\config\systemprofile\AppData\Roaming\020000003f421330724P.manifest
c:\windows\system32\config\systemprofile\AppData\Roaming\020000003f421330724S.manifest
c:\windows\system32\jfFZq.vbs
c:\windows\system32\oQaqe.vbs
c:\windows\system32C9dC3L.vbs
c:\windows\system32\unrar.exe
c:\windows\system32\Zv6eP.vbs

.
(((((((((((((((((((((((((((((   Fichiers créés du 2009-12-11 au 2010-01-11  ))))))))))))))))))))))))))))))))))))
.

2010-01-07 17:32 . 2010-01-07 17:32	--------	d-----w-	c:\windows\system32\config\systemprofile\AppData\Roaming\TeamViewer
2010-01-07 17:32 . 2010-01-07 17:32	--------	d-----w-	c:\users\frederique\AppData\Roaming\TeamViewer
2010-01-07 17:31 . 2010-01-07 17:31	--------	d-----w-	c:\program files\TeamViewer
2010-01-07 17:31 . 2010-01-07 17:31	--------	d-----w-	c:\users\frederique	emp
2010-01-07 17:12 . 2009-08-24 11:36	377344	----a-w-	c:\windows\system32\winhttp.dll
2010-01-07 17:03 . 2010-01-07 17:08	--------	d-----w-	c:\program files\Ad-Remover
2010-01-06 19:17 . 2010-01-06 19:19	--------	d-----w-	C:\ToolBar SD
2010-01-06 18:52 . 2010-01-06 18:52	--------	d-----w-	c:\program files\CCleaner
2010-01-06 18:48 . 2010-01-06 19:29	--------	d-----w-	C:\GenProc
2010-01-06 18:28 . 2009-06-15 14:52	499712	----a-w-	c:\windows\system32\kerberos.dll
2010-01-06 18:28 . 2009-06-15 14:53	270848	----a-w-	c:\windows\system32\schannel.dll
2010-01-06 18:24 . 2010-01-06 18:24	104040	----a-w-	c:\windows\system32\GDIPFONTCACHEV1.DAT
2010-01-06 17:57 . 2010-01-06 18:07	--------	d-----w-	c:\programdata\NOS
2010-01-06 17:57 . 2010-01-06 17:57	--------	d-----w-	c:\program files\NOS
2010-01-06 16:52 . 2010-01-06 16:52	--------	d-----w-	c:\program files\Windows Portable Devices
2010-01-06 16:50 . 2009-09-10 02:00	92672	----a-w-	c:\windows\system32\UIAnimation.dll
2010-01-06 16:50 . 2009-09-10 02:01	3023360	----a-w-	c:\windows\system32\UIRibbon.dll
2010-01-06 16:50 . 2009-09-10 02:00	1164800	----a-w-	c:\windows\system32\UIRibbonRes.dll
2010-01-06 16:48 . 2009-10-01 01:02	30208	----a-w-	c:\windows\system32\WPDShextAutoplay.exe
2010-01-06 16:46 . 2009-10-08 21:08	234496	----a-w-	c:\windows\system32\oleacc.dll
2010-01-06 16:46 . 2009-10-08 21:07	4096	----a-w-	c:\windows\system32\oleaccrc.dll
2010-01-06 16:46 . 2009-10-08 21:08	555520	----a-w-	c:\windows\system32\UIAutomationCore.dll
2010-01-06 14:40 . 2010-01-06 14:40	--------	d-----w-	c:\users\frederique\AppData\Roaming\Malwarebytes
2010-01-06 14:40 . 2009-12-30 13:55	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-06 14:40 . 2010-01-06 14:40	--------	d-----w-	c:\programdata\Malwarebytes
2010-01-06 14:40 . 2010-01-06 14:40	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-01-06 14:40 . 2009-12-30 13:54	19160	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-01-06 10:59 . 2010-01-06 10:59	--------	d-----w-	c:\program files\VS Revo Group
2010-01-06 10:28 . 2010-01-06 10:28	107888	----a-w-	c:\windows\system32\CmdLineExt.dll
2010-01-06 10:22 . 2010-01-06 10:22	--------	d-----w-	c:\program files\ESET
2010-01-06 09:51 . 2010-01-06 09:51	--------	d-----w-	c:\windows\system32\ca-ES
2010-01-06 09:51 . 2010-01-06 09:51	--------	d-----w-	c:\windows\system32\eu-ES
2010-01-06 09:51 . 2010-01-06 09:51	--------	d-----w-	c:\windows\system32\vi-VN
2010-01-06 09:24 . 2010-01-06 09:24	--------	d-----w-	c:\windows\system32\EventProviders
2010-01-06 01:50 . 2009-04-11 05:03	12240896	----a-w-	c:\windows\system32\NlsLexicons0007.dll
2010-01-06 01:48 . 2009-04-11 06:28	754688	----a-w-	c:\windows\system32\propsys.dll
2010-01-06 01:47 . 2009-04-11 06:28	189952	----a-w-	c:\windows\system32\winmm.dll
2010-01-06 01:46 . 2009-04-11 06:28	31744	----a-w-	c:\windows\system32\bitsigd.dll
2010-01-06 01:45 . 2009-04-11 06:28	705536	----a-w-	c:\windows\system32\SmiEngine.dll
2010-01-06 01:45 . 2009-04-11 06:28	218624	----a-w-	c:\windows\system32\wdscore.dll
2010-01-06 01:45 . 2009-04-11 06:27	130560	----a-w-	c:\windows\system32\PkgMgr.exe
2010-01-06 01:45 . 2009-04-11 06:28	247808	----a-w-	c:\windows\system32\drvstore.dll
2010-01-05 17:59 . 2010-01-05 17:59	--------	d-----w-	c:\users\frederique\AppData\Local\Seven Zip
2009-12-29 17:49 . 2009-10-29 09:17	2048	----a-w-	c:\windows\system32	zres.dll
2009-12-29 17:45 . 2009-11-09 12:31	24064	----a-w-	c:\windows\system32
shhttp.dll
2009-12-29 17:45 . 2009-11-09 10:36	411648	----a-w-	c:\windows\system32\drivers\http.sys
2009-12-29 17:45 . 2009-11-09 12:30	30720	----a-w-	c:\windows\system32\httpapi.dll
2009-12-25 15:42 . 2010-01-05 18:17	12288	----a-w-	c:\users\Public\mtwb.dat
2009-12-25 15:19 . 2009-12-25 15:19	--------	d-----w-	c:\programdata\Electronic Arts
2009-12-25 15:17 . 2009-12-25 15:17	10134	----a-r-	c:\users\frederique\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2009-12-25 15:17 . 2009-12-25 15:17	--------	d-----w-	c:\program files\Microsoft WSE
2009-12-25 15:16 . 2006-09-28 15:05	2414360	----a-w-	c:\windows\system32\d3dx9_31.dll
2009-12-25 15:06 . 2009-12-25 15:06	--------	d-----w-	c:\programdata\WindowsSearch
2009-12-25 14:51 . 2010-01-06 11:59	--------	d-----w-	c:\program files\Electronic Arts

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-07 17:24 . 2010-01-06 08:59	--------	d-----w-	c:\program files	rend micro
2010-01-06 19:23 . 2008-01-16 14:22	104040	----a-w-	c:\users\frederique\AppData\Local\GDIPFONTCACHEV1.DAT
2010-01-06 18:02 . 2007-07-18 09:31	--------	d-----w-	c:\program files\Common Files\Adobe
2010-01-06 17:54 . 2009-11-14 09:30	--------	d-----w-	c:\program files\OpenOffice.org 3
2010-01-06 17:29 . 2009-03-06 14:49	411368	----a-w-	c:\windows\system32\deploytk.dll
2010-01-06 17:28 . 2007-07-18 08:27	--------	d-----w-	c:\program files\Java
2010-01-06 17:07 . 2007-07-18 08:36	--------	d--h--w-	c:\program files\InstallShield Installation Information
2010-01-06 17:07 . 2007-07-18 07:34	--------	d-----w-	c:\program files\TOSHIBA
2010-01-06 17:06 . 2008-01-26 13:20	--------	d-----w-	c:\program files\Google
2010-01-06 17:02 . 2006-11-02 15:47	724052	----a-w-	c:\windows\system32\perfh00C.dat
2010-01-06 17:02 . 2006-11-02 15:47	146398	----a-w-	c:\windows\system32\perfc00C.dat
2010-01-06 16:52 . 2006-11-02 10:25	665600	----a-w-	c:\windows\inf\drvindex.dat
2010-01-06 16:52 . 2010-01-06 16:52	0	---ha-w-	c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2010-01-06 16:52 . 2010-01-06 16:52	0	---ha-w-	c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2010-01-06 10:30 . 2009-11-14 09:41	1	----a-w-	c:\users\frederique\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-01-06 10:18 . 2010-01-06 10:18	1372	----a-w-	c:\users\frederique\AppData\Roaming\CuPR1COaX1RLyUG.vbs
2010-01-06 09:52 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Calendar
2010-01-06 09:52 . 2006-11-02 11:18	--------	d-----w-	c:\program files\Windows Mail
2010-01-06 09:52 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Sidebar
2010-01-06 09:52 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Journal
2010-01-06 09:52 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Collaboration
2010-01-06 09:52 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Photo Gallery
2010-01-06 09:52 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Defender
2010-01-05 18:25 . 2009-09-26 14:02	--------	d-----w-	c:\program files\Spybot - Search & Destroy
2010-01-05 18:23 . 2009-09-26 14:02	--------	d-----w-	c:\programdata\Spybot - Search & Destroy
2010-01-05 18:08 . 2007-07-18 09:46	--------	d-----w-	c:\programdata\Symantec
2010-01-05 18:08 . 2007-07-18 09:46	--------	d-----w-	c:\program files\Common Files\Symantec Shared
2010-01-05 18:01 . 2008-02-22 09:07	--------	d-----w-	c:\program files\DivX
2009-12-29 17:45 . 2009-09-16 12:59	--------	d-----w-	c:\program files\Microsoft Silverlight
2009-12-28 09:20 . 2009-12-28 09:20	0	---ha-w-	c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-12-25 19:00 . 2008-05-02 08:04	--------	d-----w-	c:\users\frederique\AppData\Roaming\LimeWire
2009-12-25 18:40 . 2009-12-25 18:40	1372	----a-w-	c:\users\frederique\AppData\Roaming\x6QHe0H.vbs
2009-12-12 20:59 . 2008-01-16 14:16	104040	----a-w-	c:\windows\system32\config\systemprofile\AppData\Local\GDIPFONTCACHEV1.DAT
2009-12-04 17:55 . 2009-12-04 17:53	--------	d-----w-	c:\users\frederique\AppData\Roaming\Go Go Gourmet
2009-12-04 17:52 . 2009-01-29 12:56	--------	d-----w-	c:\program files\Oberon Media
2009-12-04 17:02 . 2009-12-04 17:02	--------	d-----w-	c:\users\frederique\AppData\Roaming\CupcakeCafe
2009-11-24 23:54 . 2009-09-26 14:24	1280480	----a-w-	c:\windows\system32\aswBoot.exe
2009-11-24 23:49 . 2009-09-26 14:25	48560	----a-w-	c:\windows\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2009-09-26 14:25	23120	----a-w-	c:\windows\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2009-09-26 14:25	97480	----a-w-	c:\windows\system32\AvastSS.scr
2009-11-21 06:40 . 2010-01-06 08:59	916480	----a-w-	c:\windows\system32\wininet.dll
2009-11-21 06:34 . 2010-01-06 08:59	71680	----a-w-	c:\windows\system32\iesetup.dll
2009-11-21 06:34 . 2010-01-06 08:59	109056	----a-w-	c:\windows\system32\iesysprep.dll
2009-11-21 04:59 . 2010-01-06 08:59	133632	----a-w-	c:\windows\system32\ieUnatt.exe
2009-11-14 09:40 . 2009-11-14 09:40	--------	d-----w-	c:\users\frederique\AppData\Roaming\OpenOffice.org
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
@="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2006-12-03 15:03	2854912	----a-w-	c:\program files\Protector Suite QL\farchns.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
@="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2006-12-03 15:03	2854912	----a-w-	c:\program files\Protector Suite QL\farchns.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD	oscdspd.exe" [2006-11-13 413696]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32	hpsrv" [X]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2007-04-26 538744]
"NvSvc"="c:\windows\system32
vsvc.dll" [2007-05-11 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-05-11 8429568]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-05-11 81920]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-04-06 138008]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-04-06 154392]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-04-06 133912]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-09 4390912]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2006-09-11 180224]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"TosAutLk"="c:\program files\TOSHIBA\WirelessKeyLogon\TosAutLk.exe" [2007-06-13 116304]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-01-06 149280]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"FilterAdministratorToken"= 1 (0x1)
"DisableCAD"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\psfus]
2006-12-03 14:50	90112	----a-w-	c:\windows\System32\psqlpwd.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages	REG_MULTI_SZ   	scecli psqlpwd

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HSON]
2006-12-07 14:49	55416	----a-w-	c:\program files\TOSHIBA\TBS\HSON.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PSQLLauncher]
2006-12-03 14:29	49168	----a-w-	c:\program files\Protector Suite QL\launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]
2007-05-16 13:52	509496	----a-w-	c:\program files\TOSHIBA\SmoothView\SmoothView.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Speech Recognition]
2008-01-19 07:33	49664	----a-w-	c:\windows\Speech\Common\sapisvr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-01-06 17:29	149280	----a-w-	c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg	opi]
2007-04-02 10:48	577536	----a-w-	c:\program files\TOSHIBA\Toshiba Online Product Information\TOPI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TOSDCR]
2007-01-10 09:59	174200	----a-w-	c:\program files\TOSHIBA\PasswordUtility\TOSDCR.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Toshiba Registration]
2007-05-04 11:05	571024	----a-w-	c:\program files\TOSHIBA\Registration\ToshibaRegistration.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPwrMain]
2007-03-29 08:39	411192	----a-w-	c:\program files\TOSHIBA\Power Saver\TPwrMain.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):21,e5,97,31,b7,8e,ca,01

R0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\System32\drivers	hpdrv.sys [27/04/2007 09:22 21504]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\System32\drivers\Thpevm.sys [07/02/2007 16:29 6528]
R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [26/09/2009 15:24 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [26/09/2009 15:24 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [26/09/2009 15:24 53328]
R2 TeamViewer4;TeamViewer 4;c:\program files\TeamViewer\Version4\TeamViewer_Service.exe [07/10/2009 13:50 185640]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\System32\drivers\NETw5v32.sys [17/11/2008 15:40 3668480]
S3 FontCache;Service de cache de police Windows;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [21/06/2008 10:26 21504]
S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [16/09/2009 13:59 54632]
S3 fsssvc;Service Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 21:48 704864]
S4 gupdate1c99b42a509777f;Service Google Update (gupdate1c99b42a509777f);c:\program files\Google\Update\GoogleUpdate.exe [02/03/2009 15:24 133104]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork	REG_MULTI_SZ   	PLA DPS BFE mpssvc
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
getPlusHelper	REG_MULTI_SZ   	getPlusHelper
.
Contenu du dossier 'Tâches planifiées'

2010-01-11 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-01-26 14:44]

2010-01-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-02 14:24]

2010-01-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-02 14:24]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.orange.fr/
mWindow Title = 
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: {{76577871-04EC-495E-A12B-91F7C3600AFA} - https://www.ebay.fr
IE: {{8A918C1D-E123-4E36-B562-5C1519E434CE} - https://www.amazon.fr/exec/obidos/subst/home/home.html/262-6263521-6325360?_encoding=UTF8&link_code=hom&tag=Toshibafrbholink-21
DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} - hxxps://secure.gopetslive.com/dev/GoPetsWeb.cab
.
- - - - ORPHELINS SUPPRIMES - - - -

MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe
MSConfigStartUp-NDSTray - NDSTray.exe
MSConfigStartUp-PopUp Destroy - c:\program files\PopUp Destroy\Popup-Destroy.exe
MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-11 10:51
Windows 6.0.6002 Service Pack 2 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'lsass.exe'(720)
c:\windows\system32\psqlpwd.dll
c:\program files\Protector Suite QL\homefus2.dll
c:\program files\Protector Suite QL\infra.dll
.
Heure de fin: 2010-01-11  10:56:31
ComboFix-quarantined-files.txt  2010-01-11 09:56

Avant-CF: 17 016 754 176 octets libres
Après-CF: 17 209 384 960 octets libres

- - End Of File - - E24724159CF83CBDAA06F2D71D9A4B15

matduchesne · Answer

Voilà qui est fait.
Encore des manipulations ?

matduchesne · Answer

http://www.cijoint.fr/cjlink.php?file=cj201001/cijEQY7ipu.txt

matduchesne · Answer

Voici ToolsCleaner, j'ai supprimé manuellement ce qui était en erreur. Je continue la suite.

[ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ]

--> Recherche: 

C:\Combofix.txt: trouvé !
C:\TB.txt: trouvé !
C:\Combofix: trouvé !
C:\GenProc: trouvé !
C:\Qoobox: trouvé !
C:\Toolbar SD: trouvé !
C:\Rsit: trouvé !
C:\GenProc\Genproc.exe: trouvé !
C:\GenProc\Outil\hijackthis.log: trouvé !
C:\GenProc\Outil\mbr.exe: trouvé !
C:\GenProc\Outil\ZHPDiag: trouvé !
C:\GenProc\Outil\ZHPDiag\ZHPdiag.exe: trouvé !
C:\GenProc\Page\GenProc[*].html: trouvé !
C:\Program Files\Ad-remover: trouvé !
C:\Program Files\Ad-Remover\BACKUP\Ad-R.exe: trouvé !
C:\Program Files	rend micro\HijackThis.exe: trouvé !
C:\Program Files	rend micro\hijackthis.log: trouvé !
C:\Qoobox\Quarantine\catchme.log: trouvé !
C:\Users\frederique\Desktop\ComboFix.exe: trouvé !
C:\Users\frederique\Desktop\Ad-R.exe: trouvé !
C:\Users\frederique\Desktop\ToolBarSD.exe: trouvé !
C:\Users\frederique\Desktop\Rsit.exe: trouvé !
C:\Users\frederique\Downloads\Ad-R.exe: trouvé !
C:\Windows\mbr.exe: trouvé !

---------------------------------
--> Suppression: 

C:\GenProc\Outil\ZHPDiag\ZHPdiag.exe: supprimé !
C:\Program Files\Ad-Remover\BACKUP\Ad-R.exe: supprimé !
C:\Program Files	rend micro\HijackThis.exe: supprimé !
C:\Users\frederique\Desktop\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Users\frederique\Desktop\Ad-R.exe: supprimé !
C:\Users\frederique\Desktop\ToolBarSD.exe: supprimé !
C:\Users\frederique\Downloads\Ad-R.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\TB.txt: supprimé !
C:\GenProc\Genproc.exe: supprimé !
C:\GenProc\Outil\hijackthis.log: supprimé !
C:\GenProc\Outil\mbr.exe: supprimé !
C:\GenProc\Page\GenProc[*].html: ERREUR DE SUPPRESSION !!
C:\Program Files	rend micro\hijackthis.log: supprimé !
C:\Qoobox\Quarantine\catchme.log: supprimé !
C:\Users\frederique\Desktop\Rsit.exe: supprimé !
C:\Windows\mbr.exe: supprimé !
C:\Combofix: supprimé !
C:\GenProc: supprimé !
C:\Qoobox: supprimé !
C:\Toolbar SD: supprimé !
C:\Rsit: supprimé !
C:\Program Files\Ad-remover: supprimé !

Corbeille vidée!
Fichiers temporaires nettoyés !

matduchesne · Answer

Ca y est j'ai tout fait !
Sujet résolu ?

matduchesne · Answer

Tout à l'air d'aller quand je vois le massacre au départ...
A bientôt très certainement pour d'autres PC.
Et surtout merci beaucoup pour l'aide précieuse et le temps consacré !

Explorer.exe ne demarre pas (entre autres)

22 réponses

Discussions similaires