Win32:Adware.gen(ADW)

bonjour
ogfile of HijackThis v1.99.1

supprime hijackthis car il est obselète
retélécharge le
Télécharge Hijackthis, outil de diagnostic et de réparation
http://www.trendsecure.com/portal/en-US/tools/security_tools­/hijackthis/download
* Clique sur exécutable, et clique sur enregistrer
* Place Hijackthis.exe sur ton bureau, puis lance le
* Clique sur exécuter
* Clique sur Do a system scan and save a log file
* Clique sur Save log pour enregistrer le rapport qui s'ouvrira
avec le bloc-note
* Poste le rapport: Clique sur édition en haut du bloc-note
Clique sur tout sélectionner, revenir sur "édition", et clique sur
copier. Reviens sur le forum sur ta réponse, clic droit sur la zone du
message, puis coller

Ton lien ne marchait pas, alors je suis été chercher sur un autre site, version 2.02

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:35:21, on 2010-01-09
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18865)
Boot mode: Safe mode with network support

Running processes:
C:\Windows\Explorer.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
F:\RegCleaner.exe
F:\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rds.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.fr.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.mirarsearch.com/?useie5=1&q=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.fr.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: (no name) - {50635E50-A9FB-49EB-B6D3-D64DEC8E4CE7} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [eAudio] "C:\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [WhereSphere] C:\Users\Simon Allard\AppData\Roaming\WhereSphere\wheresphere.exe
O4 - HKCU\..\Run: [SfKg6wIPuS] C:\Users\Simon Allard\AppData\Roaming\Microsoft\Windows\oulwsv.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'Default user')
O4 - Global Startup: Empowering Technology Launcher.lnk = C:\Acer\Empowering Technology\eAPLauncher.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: (no name) - {49783ED4-258D-4f9f-BE11-137C18D3E543} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file)
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O13 - Gopher Prefix:
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: Google Update Service (gupdate1ca8afa5435345) (gupdate1ca8afa5435345) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kwanzy Service - Unknown owner - C:\ProgramData\Kwanzy\kwanzy135.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: RelevantKnowledge - Unknown owner - C:\Program Files\RelevantKnowledge\rlservice.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

J'avais oublié de le dire mon Laptop (ordi) inffecter est en mode sans échec avec prise du réseau. Voilà ton LOP.

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6002 ) Service Pack 2
X86-based PC ( Multiprocessor Free : AMD Turion(tm) 64 X2 Mobile Technology TL-58 )
BIOS : PhoenixBIOS 4.0 Release 6.1
USER : Simon Allard ( Administrator )
BOOT : Fail-safe with network boot
C:\ (Local Disk) - NTFS - Total:111 Go (Free:36 Go)
D:\ (Local Disk) - NTFS - Total:111 Go (Free:101 Go)
E:\ (CD or DVD)
F:\ (USB) - FAT - Total:982 Mo (Free:0 Go)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( 2010-01-09|12:46 )

[ UAC => 0 ]

--------------------\\ Listing des dossiers dans Local

[2007-12-15|18:21] C:\Users\SIMONA~1\AppData\Local\Acer Arcade Deluxe
[2007-12-16|05:32] C:\Users\SIMONA~1\AppData\Local\acer eNM
[2007-12-16|10:37] C:\Users\SIMONA~1\AppData\Local\Adobe
[2007-12-21|13:37] C:\Users\SIMONA~1\AppData\Local\Apple
[2008-07-30|05:49] C:\Users\SIMONA~1\AppData\Local\Apple Computer
[2007-12-16|05:30] C:\Users\SIMONA~1\AppData\Local\Application Data
[2007-12-18|00:05] C:\Users\SIMONA~1\AppData\Local\CyberLink
[2009-03-14|20:56] C:\Users\SIMONA~1\AppData\Local\d3d9caps.dat
[2010-01-08|11:02] C:\Users\SIMONA~1\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008-08-25|16:44] C:\Users\SIMONA~1\AppData\Local\Downloaded Installations
[2007-12-16|01:04] C:\Users\SIMONA~1\AppData\Local\DV Wizard
[2009-05-25|19:04] C:\Users\SIMONA~1\AppData\Local\FullTiltPoker
[2009-08-04|08:57] C:\Users\SIMONA~1\AppData\Local\GDIPFONTCACHEV1.DAT
[2010-01-01|10:49] C:\Users\SIMONA~1\AppData\Local\Google
[2007-12-16|05:30] C:\Users\SIMONA~1\AppData\Local\Historique
[2007-12-18|00:05] C:\Users\SIMONA~1\AppData\Local\HomeMedia
[2009-10-15|09:34] C:\Users\SIMONA~1\AppData\Local\Microsoft
[2008-07-19|09:18] C:\Users\SIMONA~1\AppData\Local\Microsoft Games
[2009-05-02|18:19] C:\Users\SIMONA~1\AppData\Local\Microsoft Help
[2008-07-03|19:14] C:\Users\SIMONA~1\AppData\Local\Mozilla
[2008-08-25|16:46] C:\Users\SIMONA~1\AppData\Local\PC_Drivers_Headquarters
[2009-02-01|14:27] C:\Users\SIMONA~1\AppData\Local\PlayMovie
[2009-12-16|06:30] C:\Users\SIMONA~1\AppData\Local\PokerStars
[2007-12-15|18:20] C:\Users\SIMONA~1\AppData\Local\PowerCinema
[2010-01-09|12:44] C:\Users\SIMONA~1\AppData\Local\Temp
[2007-12-16|05:30] C:\Users\SIMONA~1\AppData\Local\Temporary Internet Files
[2007-12-17|14:58] C:\Users\SIMONA~1\AppData\Local\VirtualStore

--------------------\\ Tâches planifiées dans C:\Windows\tasks

[2010-01-09 12:45][--a------] C:\Windows\tasks\Ad-Aware Update (Weekly).job
[2010-01-09 12:45][--a------] C:\Windows\tasks\Ad-Aware Update (Daily 4).job
[2010-01-09 12:45][--a------] C:\Windows\tasks\Ad-Aware Update (Daily 3).job
[2010-01-09 12:45][--a------] C:\Windows\tasks\Ad-Aware Update (Daily 2).job
[2010-01-09 12:45][--a------] C:\Windows\tasks\Ad-Aware Update (Daily 1).job
[2010-01-09 11:11][--a------] C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010-01-09 11:17][--a------] C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010-01-08 20:00][--a------] C:\Windows\tasks\Norton Internet Security - Analyse systŠme complŠte - Simon Allard.job
[2010-01-09 08:16][--ah-----] C:\Windows\tasks\User_Feed_Synchronization-{7B3208A9-DA50-4C77-A8A2-0715C4526F0D}.job
[2010-01-07 08:51][--ah-----] C:\Windows\tasks\SA.DAT
[2010-01-06 20:27][--a------] C:\Windows\tasks\SCHEDLGU.TXT

--------------------\\ Listing des dossiers dans C:\ProgramData

[2010-01-01|10:49] C:\ProgramData\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
[2007-08-07|01:27] C:\ProgramData\Adobe
[2007-12-21|13:36] C:\ProgramData\Apple
[2008-01-01|14:31] C:\ProgramData\Apple Computer
[2006-11-02|08:02] C:\ProgramData\Application Data
[2009-01-13|22:35] C:\ProgramData\avg8
[2007-12-16|05:27] C:\ProgramData\Bureau
[2007-12-15|20:56] C:\ProgramData\CyberLink
[2009-12-19|08:41] C:\ProgramData\DAEMON Tools Lite
[2006-11-02|08:02] C:\ProgramData\Desktop
[2006-11-02|08:02] C:\ProgramData\Documents
[2007-12-16|05:27] C:\ProgramData\Favoris
[2006-11-02|08:02] C:\ProgramData\Favorites
[2008-05-21|19:01] C:\ProgramData\Hewlett-Packard
[2007-12-16|09:56] C:\ProgramData\HipSoft
[2008-05-21|19:14] C:\ProgramData\HP
[2008-05-21|19:16] C:\ProgramData\hpzinstall.log
[2010-01-07|08:53] C:\ProgramData\Kwanzy
[2010-01-01|10:49] C:\ProgramData\Lavasoft
[2008-12-16|14:16] C:\ProgramData\Malwarebytes
[2007-12-16|05:27] C:\ProgramData\Menu D‚marrer
[2009-05-27|14:31] C:\ProgramData\Messenger Plus!
[2009-03-20|14:51] C:\ProgramData\Microsoft
[2009-12-10|14:48] C:\ProgramData\Microsoft Help
[2007-12-16|05:27] C:\ProgramData\ModŠles
[2009-01-05|11:19] C:\ProgramData\Norton
[2009-01-05|11:16] C:\ProgramData\NortonInstaller
[2009-08-05|08:04] C:\ProgramData\ntuser.pol
[2009-11-14|10:28] C:\ProgramData\NVIDIA
[2010-01-09|11:41] C:\ProgramData\nvModes.001
[2010-01-09|11:41] C:\ProgramData\nvModes.dat
[2008-08-25|16:45] C:\ProgramData\PC Drivers HeadQuarters
[2009-01-13|13:49] C:\ProgramData\Spybot - Search & Destroy
[2006-11-02|08:02] C:\ProgramData\Start Menu
[2009-01-13|12:45] C:\ProgramData\SUPERAntiSpyware.com
[2009-01-05|10:56] C:\ProgramData\Symantec
[2007-12-17|15:02] C:\ProgramData\TEMP
[2006-11-02|08:02] C:\ProgramData\Templates
[2008-02-21|20:23] C:\ProgramData\Trymedia
[2008-05-21|19:16] C:\ProgramData\WEBREG
[2007-12-15|19:37] C:\ProgramData\WLInstaller
[2007-12-31|20:01] C:\ProgramData\Xerox

--------------------\\ Listing des dossiers dans C:\Program Files

[2007-12-16|05:34] C:\Program Files\Acer Arcade Deluxe
[2008-12-21|22:01] C:\Program Files\Acer GameZone
[2007-12-16|05:50] C:\Program Files\Acer Inc
[2007-08-07|01:27] C:\Program Files\Adobe
[2009-12-19|08:52] C:\Program Files\Alcohol Soft
[2009-08-30|17:16] C:\Program Files\Alwil Software
[2007-12-16|05:43] C:\Program Files\Apoint2K
[2008-07-29|17:56] C:\Program Files\Apple Software Update
[2009-01-13|12:52] C:\Program Files\AVG
[2009-01-13|00:58] C:\Program Files\Bonjour
[2008-12-18|12:51] C:\Program Files\CCleaner
[2010-01-01|10:25] C:\Program Files\Common Files
[2009-01-06|19:13] C:\Program Files\Conduit
[2007-08-07|00:12] C:\Program Files\CONEXANT
[2007-08-07|00:56] C:\Program Files\CyberLink
[2009-12-19|08:42] C:\Program Files\DAEMON Tools Lite
[2009-12-19|08:42] C:\Program Files\DAEMON Tools Toolbar
[2010-01-03|15:03] C:\Program Files\Everest Poker
[2007-12-16|05:27] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
[2009-08-09|20:37] C:\Program Files\Full Tilt Poker
[2007-12-16|00:45] C:\Program Files\GamesBar
[2010-01-01|11:06] C:\Program Files\Google
[2008-05-21|19:13] C:\Program Files\Hewlett-Packard
[2008-05-21|19:14] C:\Program Files\HP
[2010-01-01|10:27] C:\Program Files\InstallShield Installation Information
[2009-12-13|21:26] C:\Program Files\Internet Explorer
[2008-07-29|18:12] C:\Program Files\iPod
[2008-07-29|18:12] C:\Program Files\iTunes
[2008-11-28|22:29] C:\Program Files\java
[2008-12-21|10:55] C:\Program Files\K-Lite Codec Pack
[2010-01-09|11:46] C:\Program Files\Kwanzy
[2009-01-13|21:43] C:\Program Files\Launch Manager
[2010-01-01|10:49] C:\Program Files\Lavasoft
[2009-02-02|00:44] C:\Program Files\LEGO Media
[2007-12-16|10:54] C:\Program Files\licenses
[2008-01-02|15:14] C:\Program Files\Maxis
[2009-03-02|11:32] C:\Program Files\MediaInfo
[2009-05-27|14:12] C:\Program Files\Messenger Plus! Live
[2009-11-10|07:16] C:\Program Files\Microsoft
[2006-11-02|07:37] C:\Program Files\Microsoft Games
[2008-02-20|17:26] C:\Program Files\Microsoft Office
[2009-09-09|21:25] C:\Program Files\Microsoft Silverlight
[2008-02-20|17:26] C:\Program Files\Microsoft Visual Studio
[2008-02-20|17:20] C:\Program Files\Microsoft Visual Studio 8
[2009-08-03|20:42] C:\Program Files\Microsoft Works
[2008-02-20|17:24] C:\Program Files\Microsoft.NET
[2009-11-13|23:24] C:\Program Files\Movie Maker
[2010-01-07|08:54] C:\Program Files\Mozilla Firefox
[2008-02-20|17:26] C:\Program Files\MSBuild
[2007-12-15|19:54] C:\Program Files\MSXML 4.0
[2007-08-07|00:54] C:\Program Files\NewTech Infosystems
[2008-12-21|11:44] C:\Program Files\NoAdware
[2009-06-15|07:36] C:\Program Files\Patrician III
[2008-08-25|16:45] C:\Program Files\PC Drivers HeadQuarters
[2009-07-25|19:27] C:\Program Files\Picasa2
[2009-05-25|19:04] C:\Program Files\PokerStars
[2008-07-29|18:11] C:\Program Files\QuickTime
[2007-12-16|05:35] C:\Program Files\Realtek
[2006-11-02|07:37] C:\Program Files\Reference Assemblies
[2010-01-09|12:13] C:\Program Files\RegCleaner
[2009-06-30|20:05] C:\Program Files\SharkScope
[2009-01-13|13:52] C:\Program Files\Spybot - Search & Destroy
[2009-01-13|13:50] C:\Program Files\SUPERAntiSpyware
[2006-11-02|08:01] C:\Program Files\Uninstall Information
[2008-12-20|23:45] C:\Program Files\uTorrent
[2009-01-21|21:05] C:\Program Files\VideoLAN
[2009-11-13|23:24] C:\Program Files\Windows Calendar
[2009-11-13|23:24] C:\Program Files\Windows Collaboration
[2009-11-13|23:24] C:\Program Files\Windows Defender
[2009-11-13|23:24] C:\Program Files\Windows Journal
[2009-11-10|07:19] C:\Program Files\Windows Live
[2009-03-20|14:54] C:\Program Files\Windows Live SkyDrive
[2009-12-13|21:26] C:\Program Files\Windows Mail
[2009-11-13|23:24] C:\Program Files\Windows Media Player
[2007-12-16|05:27] C:\Program Files\Windows NT
[2009-11-13|23:24] C:\Program Files\Windows Photo Gallery
[2009-11-16|18:19] C:\Program Files\Windows Portable Devices
[2009-11-13|23:24] C:\Program Files\Windows Sidebar
[2008-12-27|23:46] C:\Program Files\WinRAR
[2007-12-16|05:30] C:\Program Files\Yahoo!

--------------------\\ Listing des dossiers dans C:\Program Files\Common Files

[2007-08-07|01:27] C:\Program Files\Common Files\Adobe
[2007-12-21|13:36] C:\Program Files\Common Files\Apple
[2008-02-20|17:26] C:\Program Files\Common Files\DESIGNER
[2008-05-21|19:13] C:\Program Files\Common Files\Hewlett-Packard
[2008-05-21|19:12] C:\Program Files\Common Files\HP
[2007-08-07|00:56] C:\Program Files\Common Files\InstallShield
[2007-12-16|10:55] C:\Program Files\Common Files\Java
[2007-08-07|00:53] C:\Program Files\Common Files\LightScribe
[2009-08-03|20:42] C:\Program Files\Common Files\microsoft shared
[2007-08-07|00:53] C:\Program Files\Common Files\muvee Technologies
[2007-08-07|00:54] C:\Program Files\Common Files\NewTech Infosystems
[2006-11-02|06:18] C:\Program Files\Common Files\Services
[2006-11-02|06:18] C:\Program Files\Common Files\SpeechEngines
[2009-01-05|11:16] C:\Program Files\Common Files\Symantec Shared
[2009-11-13|23:24] C:\Program Files\Common Files\System
[2009-03-20|14:51] C:\Program Files\Common Files\Windows Live
[2007-12-15|19:40] C:\Program Files\Common Files\WindowsLiveInstaller

--------------------\\ Process

( 30 Processes )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-09 12:46:27
Windows 6.0.6002 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\Users\SIMONA~1\AppData\Roaming\Azureus\torrents\Druide_Antidote_RX_v5.0_Incl.Keygen_FRANCAIS[www.quebectorrent.com][1].torrent
C:\Users\SIMONA~1\AppData\Roaming\uTorrent\Norton Internet Security 2009 activation crack x13.exe.torrent
C:\Users\SIMONA~1\Documents\Programme\Antidote RX v8 - Fran‡ais\Antidote RX v8 - Fran‡ais\3 - Activation\keygen RX v2.[LaFaucheuse].exe
C:\Users\SIMONA~1\Downloads\Druide_Antidote_RX_v5.0_Incl.Keygen_FRENCH-BS
C:\Users\SIMONA~1\Downloads\Druide_Antidote_RX_v5.0_Incl.Keygen_FRENCH-BS\AntidoteRX5
C:\Users\SIMONA~1\Downloads\Druide_Antidote_RX_v5.0_Incl.Keygen_FRENCH-BS\bs.nfo
C:\Users\SIMONA~1\Downloads\Druide_Antidote_RX_v5.0_Incl.Keygen_FRENCH-BS\AntidoteRX5\keygen.exe
C:\Users\SIMONA~1\Downloads\Druide_Antidote_RX_v5.0_Incl.Keygen_FRENCH-BS\AntidoteRX5\setup.msi

[F:30][D:3]-> C:\Users\SIMONA~1\AppData\Local\Temp
[F:15][D:1]-> C:\Users\SIMONA~1\AppData\Roaming\MICROS~1\Windows\Cookies
[F:6][D:4]-> C:\Users\SIMONA~1\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
[F:5][D:5]-> C:\$Recycle.Bin

1 - "C:\Lop SD\LopR_1.txt" - 2010-01-09|12:48 - Option : [1]

--------------------\\ Fin du rapport a 12:48:59
[ UAC => 1 ]

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3531
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18865

2010-01-09 17:24:19
mbam-log-2010-01-09 (17-24-19).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 254899
Temps écoulé: 1 hour(s), 6 minute(s), 33 second(s)

Processus mémoire infecté(s): 2
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 8
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 3
Fichier(s) infecté(s): 11

Processus mémoire infecté(s):
C:\Users\Simon Allard\AppData\Roaming\Microsoft\Windows\oulwsv.exe (Trojan.Downloader) -> Unloaded process successfully.
C:\Users\Simon Allard\AppData\Roaming\WhereSphere\WhereSphere.exe (Adware.WhereSphere) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
C:\Users\Simon Allard\AppData\Roaming\Mozilla\Firefox\Profiles\awmotktn.default\extensions\{e45a0de0-b4de-11de-8a39-0800200c9a66}\components\wsff.dll (Adware.WhereSphere) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\internetprogram.pornpro_bho (Adware.PLayMP3z) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\internetprogram.pornpro_bho.1 (Adware.PLayMP3z) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{88c9b3c7-06b6-5c05-cfec-c09dbc10cc30} (Adware.PLayMP3z) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{88c9b3c7-06b6-5c05-cfec-c09dbc10cc30} (Adware.PLayMP3z) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\kwanzy (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\wheresphere (Adware.WhereSphere) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\WhereSphere (Adware.WhereSphere) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Kwanzy Service (Adware.Kwanzy) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sfkg6wipus (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wheresphere (Adware.WhereSphere) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Users\Simon Allard\AppData\Roaming\WhereSphere (Adware.WhereSphere) -> Quarantined and deleted successfully.
C:\Program Files\Kwanzy (Adware.Kwanzy) -> Quarantined and deleted successfully.
C:\ProgramData\Kwanzy (Adware.Kwanzy) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Users\Simon Allard\AppData\Roaming\Microsoft\Windows\oulwsv.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Users\Simon Allard\AppData\Roaming\Mozilla\Firefox\Profiles\awmotktn.default\extensions\{e45a0de0-b4de-11de-8a39-0800200c9a66}\components\wsff.dll (Adware.WhereSphere) -> Quarantined and deleted successfully.
C:\Program Files\Kwanzy\kwanzy.exe (Adware.Kwanzy) -> Quarantined and deleted successfully.
C:\Program Files\Kwanzy\uninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\ProgramData\Kwanzy\kwanzy135.exe (Adware.Kwanzy) -> Quarantined and deleted successfully.
C:\hijackthis_199\backups\backup-20100109-115605-631.dll (Adware.Mirar) -> Quarantined and deleted successfully.
C:\Users\Simon Allard\AppData\Roaming\WhereSphere\config.cfg (Adware.WhereSphere) -> Quarantined and deleted successfully.
C:\Users\Simon Allard\AppData\Roaming\WhereSphere\wheresphere.exe (Adware.WhereSphere) -> Quarantined and deleted successfully.
C:\Users\Simon Allard\AppData\Roaming\WhereSphere\WSUninstall.exe (Adware.WhereSphere) -> Quarantined and deleted successfully.
C:\Program Files\mozilla firefox\searchPlugins\kwanzy135.xml (Adware.Kwanzy) -> Quarantined and deleted successfully.
C:\Users\Simon Allard\Documents\My Documents.url (Trojan.Zlob) -> Quarantined and deleted successfully.

http://www.cijoint.fr/cjlink.php?file=cj201001/cijLdnOoQK.txt
http://www.cijoint.fr/cjlink.php?file=cj201001/cijiRCl8QN.txt

-----------\\ ToolBar S&D 1.2.9 XP/Vista

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6002 ) Service Pack 2
X86-based PC ( Multiprocessor Free : AMD Turion(tm) 64 X2 Mobile Technology TL-58 )
BIOS : PhoenixBIOS 4.0 Release 6.1
USER : Simon Allard ( Administrator )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total:111 Go (Free:33 Go)
D:\ (Local Disk) - NTFS - Total:111 Go (Free:101 Go)
E:\ (CD or DVD)
F:\ (CD or DVD)
G:\ (CD or DVD)

"C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
Option : [1] ( 2010-01-10| 9:11 )

[ UAC => 0 ]

-----------\\ Recherche de Fichiers / Dossiers ...

C:\Program Files\DAEMON Tools Toolbar
C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT
C:\Program Files\DAEMON Tools Toolbar\Resources
C:\Program Files\DAEMON Tools Toolbar\uninst.exe
C:\Program Files\DAEMON Tools Toolbar\_DTLite.xml
C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT\chrome
C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT\chrome.manifest
C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT\components
C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT\install.rdf
C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT\chrome\dttoolbar.jar
C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT\components\DTToolbarFF.dll
C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT\components\DTToolbarFF.xpt
C:\Program Files\DAEMON Tools Toolbar\Resources\about.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\AboutWindow.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\AddRadioStation.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\as.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\as.png
C:\Program Files\DAEMON Tools Toolbar\Resources\astro.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\az.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\b1.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\b1.png
C:\Program Files\DAEMON Tools Toolbar\Resources\BurnImage.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\buy.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\cond000.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond001.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond003.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond004.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond005.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond006.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond007.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond008.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond009.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond010.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond011.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond019.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond020.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond021.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond022.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond023.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond024.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond025.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond026.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond037.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond038.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond039.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond040.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond041.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond046.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond048.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond050.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond051.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond052.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond053.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond054.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond055.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond056.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond057.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond058.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond059.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond060.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond061.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond062.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond063.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond064.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond065.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond066.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond067.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond068.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond069.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond075.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond076.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond077.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond078.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond079.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond080.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond084.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond085.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond086.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond087.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond088.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond089.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond090.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond091.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond092.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond093.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond094.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond095.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond108.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond109.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond110.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond111.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond112.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond113.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond120.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond121.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond122.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond126.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond127.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond128.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond129.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond130.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond131.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond132.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond133.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond134.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond135.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond136.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond137.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond138.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond140.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond141.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond142.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond143.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond148.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond149.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond152.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond154.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond155.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond156.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\cond157.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\Config.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\d.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\d2.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\daemon.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\ds.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\dsearch.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\dt.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\DTPro.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\Dwnl.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\emulation.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\features.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\GameCentrix.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\gd.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\genre.xml
C:\Program Files\DAEMON Tools Toolbar\Resources\globe.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\GrabImage.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\hb.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\hb.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\help.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\ip.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\lang.xml
C:\Program Files\DAEMON Tools Toolbar\Resources\lingvo.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\m.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\mail.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\mailc.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\mailc_disable.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\mailc_down.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\mailc_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\mailc_under.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\mail_disable.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\mail_down.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\mail_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\mail_under.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\MenuRadioConfig.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\MenuRadioStation.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\MenuRSCur.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\MenuTr.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\next.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\next_down.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\next_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\next_under.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\none.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\none_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\noW.gif
C:\Program Files\DAEMON Tools Toolbar\Resources\op.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\play.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\play.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\play_down.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\play_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\play_under.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\pragma.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\prev.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\prev_down.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\prev_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\prev_under.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\prod.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\Radio.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioBg.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioBg.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioBgMask.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioDisp.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioDisp_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioDown.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioDown.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioDown_down.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioDown_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioDown_under.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioE.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioG.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioL.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioLDotMask.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioLeft.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioLeftMask.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioLM.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioN.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioR.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioR.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioRM.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioRU.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioVolume.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioVolume_down.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioVolume_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioVolume_under.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\RadioW.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\refresh.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\refresh_down.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\refresh_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\refresh_under.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\Rss.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\Rss1.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\rssClose.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\rssL.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\rssOpen.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\size.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\size_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\skins.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\spt.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\stop.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\stop.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\stop_down.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\stop_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\stop_under.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\style.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\SupportRequest.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\time.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\TitleIcon.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\toolbar.xml
C:\Program Files\DAEMON Tools Toolbar\Resources\trans.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\Trash.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\Trash_disable.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\Trash_down.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\Trash_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\Trash_under.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\u.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\vol.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\vol.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\vol_back.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\vol_dott.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\vol_dott_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\vol_down.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\vol_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\vol_under.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\wb.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\wBtClose.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\wBtClose_down.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\wBtClose_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\wBtClose_under.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\wBtText.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\wBtText_down.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\wBtText_m.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\wBtText_under.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\Weather_m42.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\Weather_m43.bmp
C:\Program Files\DAEMON Tools Toolbar\Resources\wi.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\wi0.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\wi1.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\wi10.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\wi11.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\wi12.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\wi13.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\wi2.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\wi3.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\wi4.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\wi5.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\wi6.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\wi7.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\wi8.ico
C:\Program Files\DAEMON Tools Toolbar\Resources\wi9.ico
C:\Program Files\GamesBar
C:\Program Files\GamesBar\Localization-English.ini

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"SEARCH PAGE"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Local Page"="C:\\Windows\\system32\\blank.htm"
"SearchMigratedDefaultURL"="https://search.yahoo.com/web{searchTerms}&ei=utf-8&fr=b1ie7"
"Start Page"="https://www.rds.ca/"
"Url"="http://www.microsoft.com/athome/community/rss.xml"
"Url"="http://rss.msn.com/en-us/?feedoutput=rss&ocid=iehrs&unsub=true"
"Url"="http://www.microsoft.com/atwork/community/rss.xml"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="https://fr.yahoo.com/"
"Default_Page_URL"="https://fr.yahoo.com/"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Local Page"="C:\\Windows\\System32\\blank.htm"
"Search Bar"="http://www.mirarsearch.com/?useie5=1&q="

--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\Users\SIMONA~1\AppData\Roaming\Azureus\torrents\Druide_Antidote_RX_v5.0_Incl.Keygen_FRANCAIS[www.quebectorrent.com][1].torrent
C:\Users\SIMONA~1\AppData\Roaming\uTorrent\Norton Internet Security 2009 activation crack x13.exe.torrent
C:\Users\SIMONA~1\Documents\Programme\Antidote RX v8 - Fran‡ais\Antidote RX v8 - Fran‡ais\3 - Activation\keygen RX v2.[LaFaucheuse].exe

[ UAC => 1 ]

1 - "C:\ToolBar SD\TB_1.txt" - 2010-01-10| 9:12 - Option : [1]

-----------\\ Fin du rapport a 9:12:38,63

-----------\\ ToolBar S&D 1.2.9 XP/Vista

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6002 ) Service Pack 2
X86-based PC ( Multiprocessor Free : AMD Turion(tm) 64 X2 Mobile Technology TL-58 )
BIOS : PhoenixBIOS 4.0 Release 6.1
USER : Simon Allard ( Administrator )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total:111 Go (Free:33 Go)
D:\ (Local Disk) - NTFS - Total:111 Go (Free:101 Go)
E:\ (CD or DVD)
F:\ (CD or DVD)
G:\ (CD or DVD)

"C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
Option : [2] ( 2010-01-10|11:06 )

[ UAC => 1 ]

-----------\\ SUPPRESSION

Supprime! - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
Supprime! - C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT
Supprime! - C:\Program Files\DAEMON Tools Toolbar\Resources
Supprime! - C:\Program Files\DAEMON Tools Toolbar\uninst.exe
Supprime! - C:\Program Files\DAEMON Tools Toolbar\_DTLite.xml
Supprime! - C:\Program Files\GamesBar\Localization-English.ini
Supprime! - C:\Program Files\DAEMON Tools Toolbar
Supprime! - C:\Program Files\GamesBar

-----------\\ Recherche de Fichiers / Dossiers ...

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"SEARCH PAGE"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Local Page"="C:\\Windows\\system32\\blank.htm"
"SearchMigratedDefaultURL"="https://search.yahoo.com/web{searchTerms}&ei=utf-8&fr=b1ie7"
"Start Page"="https://www.rds.ca/"
"Url"="http://go.microsoft.com/fwlink/?LinkID=68928"
"Url"="http://go.microsoft.com/fwlink/?LinkID=44406"
"Url"="http://go.microsoft.com/fwlink/?LinkID=68929"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="https://www.msn.com/fr-fr/"
"Default_Page_URL"="https://fr.yahoo.com/"
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Local Page"="C:\\Windows\\System32\\blank.htm"
"Search Bar"="http://www.mirarsearch.com/?useie5=1&q="

--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\Users\SIMONA~1\AppData\Roaming\Azureus\torrents\Druide_Antidote_RX_v5.0_Incl.Keygen_FRANCAIS[www.quebectorrent.com][1].torrent
C:\Users\SIMONA~1\AppData\Roaming\uTorrent\Norton Internet Security 2009 activation crack x13.exe.torrent
C:\Users\SIMONA~1\Documents\Programme\Antidote RX v8 - Fran‡ais\Antidote RX v8 - Fran‡ais\3 - Activation\keygen RX v2.[LaFaucheuse].exe

[ UAC => 1 ]

1 - "C:\ToolBar SD\TB_1.txt" - 2010-01-10| 9:12 - Option : [1]
2 - "C:\ToolBar SD\TB_2.txt" - 2010-01-10|11:07 - Option : [2]

-----------\\ Fin du rapport a 11:07:50,41

.
======= LOGFILE OF AD-REMOVER 1.1.4.6_G | ONLY XP/VISTA/7 =======
.
Updated by C_XX on 05.01.2010 at 18:50
Contact: AdRemover.contact@gmail.com
Website: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Launch at: 11:25:17, 2010-01-10 | Normal Boot | Option: CLEAN
Executed from: C:\Program Files\Ad-Remover\
Operating system: Microsoft® Windows Vista™ Home Premium Service Pack 2 v6.0.6002
Computer Name: PORTABLE | Current user: Simon Allard

.
============== NEUTRALIZED ELEMENT(S) ==============
.
Service: RelevantKnowledge - ... [b]NOT DELETED !![/b]

C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Games\PartyPoker.lnk
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Titan Poker.lnk
C:\Poker\Poker 770
C:\Programs\PartyGaming
C:\Users\SIMONA~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Poker 770
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Everest Poker
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\PartyPoker
C:\Program Files\Everest Poker
C:\ProgramData\Trymedia
C:\Users\Public\Desktop\Everest Poker.lnk

(!) -- Temp files deleted.

.
HKCU\software\Grand Virtual
HKCU\software\InternetProgram
HKLM\Software\Classes\AppID\{C58810EE-6B56-BDD6-5FAE-D204717DA8F6}
HKLM\software\classes\appid\InternetProgram.DLL
HKLM\Software\Classes\Interface\{133548AB-2040-C274-3F84-B4F038825BE1}
HKLM\Software\Classes\Interface\{2E194B1B-87C9-59A8-0CF4-3AE44A06DA1F}
HKLM\Software\Classes\Interface\{35D3032D-F301-7A91-0C1F-6A346950470E}
HKLM\Software\Classes\Interface\{8EE8D862-C866-C104-4964-8CD062B2A7F5}
HKLM\Software\Classes\Interface\{9EBD4DDC-B5A2-4731-57AE-5D300F116E3A}
HKLM\Software\Classes\Interface\{C8C038A1-9D2C-40AC-6D03-9ED96B02AF42}
HKLM\Software\Classes\Interface\{DB885111-F39F-4D88-9EE5-C88460B6DF7B}
HKLM\Software\Microsoft\Internet Explorer\Extensions\{49783ED4-258D-4f9f-BE11-137C18D3E543}
HKLM\Software\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}
HKLM\software\microsoft\windows\currentversion\uninstall\Everest Poker
.
============== Added scan ==============
.
.
* Mozilla FireFox Version 3.0.16 [fr] *
.
ProfilePath: awmotktn.default (Simon Allard)
.
(SIMONA~1, prefs.js) Browser.download.dir, C:\Users\Simon Allard\Downloads
(SIMONA~1, prefs.js) Browser.download.lastDir, C:\Users\Simon Allard\Videos\Partie\zzz_torrent\Jacks.Teen.America.Mission.22
(SIMONA~1, prefs.js) Browser.search.defaultenginename, Web Search
(SIMONA~1, prefs.js) Browser.search.defaulturl, hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1640187&SearchSource=3&q=
(SIMONA~1, prefs.js) Browser.startup.homepage, hxxp://www.torrent411.com/index.php
(SIMONA~1, prefs.js) Extensions.enabledItems, DTToolbar@toolbarnet.com:1.0.7.0088,{e45a0de0-b4de-11de-8a39-0800200c9a66}:2,{e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20080609.0,{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07,{4E551550-1870-479D-BF66-DF77900E100E}:1.0,{20a82645-c095-46ed-80e3-08825760534b}:1.1,{8241b8d6-6bac-4f48-b012-464cf0f636e9}:1.5.48.0,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.16
(SIMONA~1, prefs.js) Privacy.popups.showBrowserMessage, false
.
(SIMONA~1, prefs.js) ERASED - Browser.search.defaultenginename, Web Search
.
.
.
* Internet Explorer Version 8.0.6001.18865 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Do404Search: 01000000
Local Page: C:\Windows\system32\blank.htm
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Enable Browser Extensions: yes
Use Custom Search URL: 1 (0x1)
Default_search_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Default_page_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Start Page: hxxp://fr.msn.com/
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\Windows\System32\blank.htm
Use Custom Search URL: 1 (0x1)
Search Bar: hxxp://search.msn.com/spbasic.htm
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
============== Suspect (Cracks, Serials, ...) ==============
.
C:\Users\Simon Allard\AppData\Roaming\Azureus\torrents\Druide_Antidote_RX_v5.0_Incl.Keygen_FRANCAIS[www.quebectorrent.com][1].torrent
C:\Users\Simon Allard\AppData\Roaming\uTorrent\Norton Internet Security 2009 activation crack x13.exe.torrent
C:\Users\Simon Allard\Documents\Programme\Antidote RX v8 - Fran‡ais\Antidote RX v8 - Fran‡ais\3 - Activation\AntidoteRXvx_Patcher.[LaFaucheuse].exe
C:\Users\Simon Allard\Documents\Programme\Antidote RX v8 - Fran‡ais\Antidote RX v8 - Fran‡ais\3 - Activation\keygen RX v2.[LaFaucheuse].exe
.
===================================
.
4950 Byte(s) - C:\Ad-Report-CLEAN[1].log
.
0 File(s) - C:\Users\SIMONA~1\AppData\Local\Temp
3 File(s) - C:\Windows\Temp
8 File(s) - C:\Windows\Prefetch
.
20 File(s) - C:\Program Files\Ad-Remover\BACKUP
1425 File(s) - C:\Program Files\Ad-Remover\QUARANTINE
.
End at: 11:39:35 | 2010-01-10 - CLEAN[1]
.
============== E.O.F ==============
.