Suppression trojandownloader:win32/renos.jm

Merci pour ta réponse rapide !
Voici le rapport...


.
======= LOGFILE OF AD-REMOVER 1.1.4.6_I | ONLY XP/VISTA/7 =======
.
Updated by C_XX on 19.01.2010 at 21:16
Contact: AdRemover.contact@gmail.com
Website: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Launch at: 13:53:23, mer. 20/01/2010 | Normal Boot | Option: CLEAN
Executed from: C:\Ad-Remover\
Operating system: Microsoft® Windows Vista™ HomePremium Service Pack 2 v6.0.6001
Computer Name: PC-DE-TANITA | Current user: Tanita
.
============== NEUTRALIZED ELEMENT(S) ==============
.

C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar
C:\Users\Tanita\AppData\Local\Temp\AskInstallChecker.exe
C:\Users\Tanita\AppData\Local\Temp\AskSearch
C:\Program Files\Ask.com
C:\Users\Tanita\AppData\LocalLow\AskToolbar

(!) -- Temp files deleted.

.
HKCU\software\appdatalow\AskBarDis
HKCU\software\appdatalow\AskHomepage
HKCU\software\appdatalow\AskToolbarInfo
HKCU\software\appdatalow\software\AskToolbar
HKCU\software\Ask.com
HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
HKCU\software\microsoft\internet explorer\searchscopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKLM\Software\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
HKLM\software\classes\appid\GenericAskToolbar.DLL
HKLM\Software\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKLM\software\classes\GenericAskToolbar.ToolbarWnd
HKLM\software\classes\GenericAskToolbar.ToolbarWnd.1
HKLM\software\classes\installer\Products\A28B4D68DEBAA244EB686953B7074FEF
HKLM\Software\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
HKLM\Software\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
HKLM\Software\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
HKLM\Software\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
HKLM\software\microsoft\windows\currentversion\uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
.
============== Added scan ==============
.
.
* Internet Explorer Version 8.0.6001.18865 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Do404Search: 01000000
Local Page: C:\Windows\system32\blank.htm
Show_ToolBar: yes
Enable Browser Extensions: yes
Start Page: hxxp://fr.msn.com/
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_search_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Start Page: hxxp://fr.msn.com/
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\Windows\System32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
===================================
.
4472 Byte(s) - C:\Ad-Report-CLEAN[1].log
.
833 File(s) - C:\Users\Tanita\AppData\Local\Temp
1221 File(s) - C:\Windows\Temp
11 File(s) - C:\Windows\Prefetch
.
18 File(s) - C:\Ad-Remover\BACKUP
14 File(s) - C:\Ad-Remover\QUARANTINE
.
End at: 13:56:30 | mer. 20/01/2010 - CLEAN[1]
.
============== E.O.F ==============
.

Sinon, sur base de ton conseil j'ai désactivé la Ask Toolbar (avant de lancer l'analyse) et pourtant je vois que ça apparaît à diverses reprises dans le rapport... Cela veut-il dire qu'il est encore installé quelque part? J'ai fait une recherche mais ne trouve rien.

Ce fut long mais le voici. On dirait qu'il était bien atteint... Y a-t-il encore des étapes ou tout est-il nettoyé maintenant? Et aussi, dans les programmes que j'ai utilisé, y en a-t-il certains qu'il serait judicieux de conserver et faire tourner une fois de temps en temps?

Je te remercie.


Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3601
Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.18865

20/01/2010 16:00:43
mbam-log-2010-01-20 (16-00-43).txt

Type de recherche: Examen complet (C:\|D:\|E:\|)
Eléments examinés: 271029
Temps écoulé: 1 hour(s), 22 minute(s), 57 second(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3

Processus mémoire infecté(s):
C:\Windows\msa.exe (Trojan.Agent) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\WS9E3IQBKY (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Users\Tanita\AppData\Local\Temp\Wlz.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Windows\msa.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully.

J'ai plusieurs clés USB et une disque dur externe, mais ils n'ont plus été branchés depuis un moment. Mais bon tant que j'y suis, je veux bien checker quand même car ça ne veut pas dire qu'ils sont "propres" pour autant...Par contre, mon appareil photo était connecté lorsque le virus est apparu, est-ce possible qu'il ait été transmis à la carte mémoire? (Désolée pour la possible naïveté de cette question...)

Et aussi, les fichiers en quarantaine, je les laisse là où ils sont ou je les supprime?

Merci!

Je flippe complètement là! J'ai fait tourner mon antivirus (avira antivir) pour être sûre qu'il ne reste rien de défectueux et il détecte des virus qui n'y étaient pas il y a quelques heures encore (je l'avais fait tourner début d'après-midi, il ne trouvait rien). Il est à 36% et il y a déjà 4 détections et 2 avertissements...
Du coup je n'ai pas mis les clés USB... J'attends la fin du scan.

Tiens c'est étrange, j'étais sûre d'avoir répondu...

En fait si j'ai fait un scan avira, c'est parce que finalwar a proposé que je fasse tourner mon antivirus habituel, et j'ai pensé que ça ne pouvait pas faire de tord... Maintenant que tu me précises de nouveau ce que tu avais indiqué, je comprends mieux ce que tu voulais dire et il semble, vu ce que je comprends du rapport, que c'est peut-être ça que le programme a détecté.

Les voici les voilà...


Avira AntiVir Personal
Report file date: mercredi 20 janvier 2010 16:29

Scanning for 1570785 virus strains and unwanted programs.

Licensee : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows Vista
Windows version : (Service Pack 1) [6.0.6001]
Boot mode : Normally booted
Username : SYSTEM
Computer name : PC-DE-TANITA

Version information:
BUILD.DAT : 9.0.0.418 21723 Bytes 2/12/2009 16:28:00
AVSCAN.EXE : 9.0.3.10 466689 Bytes 19/11/2009 21:07:03
AVSCAN.DLL : 9.0.3.0 40705 Bytes 27/02/2009 09:58:24
LUKE.DLL : 9.0.3.2 209665 Bytes 20/02/2009 10:35:49
LUKERES.DLL : 9.0.2.0 12033 Bytes 27/02/2009 09:58:52
VBASE000.VDF : 7.10.0.0 19875328 Bytes 6/11/2009 21:07:03
VBASE001.VDF : 7.10.1.0 1372672 Bytes 19/11/2009 21:07:03
VBASE002.VDF : 7.10.1.1 2048 Bytes 19/11/2009 21:07:03
VBASE003.VDF : 7.10.1.2 2048 Bytes 19/11/2009 21:07:03
VBASE004.VDF : 7.10.1.3 2048 Bytes 19/11/2009 21:07:03
VBASE005.VDF : 7.10.1.4 2048 Bytes 19/11/2009 21:07:03
VBASE006.VDF : 7.10.1.5 2048 Bytes 19/11/2009 21:07:03
VBASE007.VDF : 7.10.1.6 2048 Bytes 19/11/2009 21:07:03
VBASE008.VDF : 7.10.1.7 2048 Bytes 19/11/2009 21:07:03
VBASE009.VDF : 7.10.1.8 2048 Bytes 19/11/2009 21:07:03
VBASE010.VDF : 7.10.1.9 2048 Bytes 19/11/2009 21:07:03
VBASE011.VDF : 7.10.1.10 2048 Bytes 19/11/2009 21:07:03
VBASE012.VDF : 7.10.1.11 2048 Bytes 19/11/2009 21:07:03
VBASE013.VDF : 7.10.1.79 209920 Bytes 25/11/2009 21:29:48
VBASE014.VDF : 7.10.1.128 197632 Bytes 30/11/2009 12:58:58
VBASE015.VDF : 7.10.1.178 195584 Bytes 7/12/2009 18:01:36
VBASE016.VDF : 7.10.1.224 183296 Bytes 14/12/2009 14:58:00
VBASE017.VDF : 7.10.1.247 182272 Bytes 15/12/2009 16:46:24
VBASE018.VDF : 7.10.2.30 198144 Bytes 21/12/2009 15:17:21
VBASE019.VDF : 7.10.2.63 187392 Bytes 24/12/2009 20:42:06
VBASE020.VDF : 7.10.2.93 195072 Bytes 29/12/2009 20:42:07
VBASE021.VDF : 7.10.2.131 201216 Bytes 7/01/2010 20:41:58
VBASE022.VDF : 7.10.2.158 192000 Bytes 11/01/2010 20:40:31
VBASE023.VDF : 7.10.2.186 200704 Bytes 14/01/2010 17:43:38
VBASE024.VDF : 7.10.2.205 201728 Bytes 15/01/2010 17:43:40
VBASE025.VDF : 7.10.2.219 158720 Bytes 18/01/2010 17:43:44
VBASE026.VDF : 7.10.2.230 173056 Bytes 19/01/2010 15:12:46
VBASE027.VDF : 7.10.2.231 2048 Bytes 19/01/2010 15:12:46
VBASE028.VDF : 7.10.2.232 2048 Bytes 19/01/2010 15:12:47
VBASE029.VDF : 7.10.2.233 2048 Bytes 19/01/2010 15:12:47
VBASE030.VDF : 7.10.2.234 2048 Bytes 19/01/2010 15:12:47
VBASE031.VDF : 7.10.2.239 75776 Bytes 19/01/2010 18:05:44
Engineversion : 8.2.1.142
AEVDF.DLL : 8.1.1.2 106867 Bytes 15/09/2009 19:02:16
AESCRIPT.DLL : 8.1.3.7 594296 Bytes 4/01/2010 20:43:17
AESCN.DLL : 8.1.3.1 127348 Bytes 18/01/2010 17:44:14
AESBX.DLL : 8.1.1.1 246132 Bytes 19/11/2009 21:07:03
AERDL.DLL : 8.1.3.4 479605 Bytes 30/11/2009 20:41:46
AEPACK.DLL : 8.2.0.5 422262 Bytes 18/01/2010 17:44:13
AEOFFICE.DLL : 8.1.0.38 196987 Bytes 23/07/2009 08:59:39
AEHEUR.DLL : 8.1.0.195 2232695 Bytes 18/01/2010 17:44:09
AEHELP.DLL : 8.1.10.0 237942 Bytes 18/01/2010 17:43:54
AEGEN.DLL : 8.1.1.83 369014 Bytes 4/01/2010 20:42:53
AEEMU.DLL : 8.1.1.0 393587 Bytes 3/10/2009 00:52:18
AECORE.DLL : 8.1.9.5 184693 Bytes 18/01/2010 17:43:53
AEBB.DLL : 8.1.0.3 53618 Bytes 9/10/2008 13:32:40
AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 07:47:59
AVPREF.DLL : 9.0.3.0 44289 Bytes 8/09/2009 21:00:33
AVREP.DLL : 8.0.0.3 155905 Bytes 20/01/2009 13:34:28
AVREG.DLL : 9.0.0.0 36609 Bytes 5/12/2008 09:32:09
AVARKT.DLL : 9.0.0.3 292609 Bytes 24/03/2009 14:05:41
AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 30/01/2009 09:37:08
SQLITE3.DLL : 3.6.1.0 326401 Bytes 28/01/2009 14:03:49
SMTPLIB.DLL : 9.2.0.25 28417 Bytes 2/02/2009 07:21:33
NETNT.DLL : 9.0.0.0 11521 Bytes 5/12/2008 09:32:10
RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 15/05/2009 14:39:58
RCTEXT.DLL : 9.0.73.0 86785 Bytes 19/11/2009 21:07:02

Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, D:,
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium

Start of the scan: mercredi 20 janvier 2010 16:29

Starting search for hidden objects.
'111795' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'chrome.exe' - '1' Module(s) have been scanned
Scan process 'chrome.exe' - '1' Module(s) have been scanned
Scan process 'chrome.exe' - '1' Module(s) have been scanned
Scan process 'chrome.exe' - '1' Module(s) have been scanned
Scan process 'chrome.exe' - '1' Module(s) have been scanned
Scan process 'chrome.exe' - '1' Module(s) have been scanned
Scan process 'chrome.exe' - '1' Module(s) have been scanned
Scan process 'mbam.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'wlcomm.exe' - '1' Module(s) have been scanned
Scan process 'SynTPHelper.exe' - '1' Module(s) have been scanned
Scan process 'BTStackServer.exe' - '1' Module(s) have been scanned
Scan process 'soffice.bin' - '1' Module(s) have been scanned
Scan process 'soffice.exe' - '1' Module(s) have been scanned
Scan process 'BTTray.exe' - '1' Module(s) have been scanned
Scan process 'Skype.exe' - '1' Module(s) have been scanned
Scan process 'GoogleUpdate.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'LightScribeControlPanel.exe' - '1' Module(s) have been scanned
Scan process 'sidebar.exe' - '1' Module(s) have been scanned
Scan process 'gnotify.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'PDVDServ.exe' - '1' Module(s) have been scanned
Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned
Scan process 'RtHDVCpl.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'MSASCui.exe' - '1' Module(s) have been scanned
Scan process 'dmhkcore.exe' - '1' Module(s) have been scanned
Scan process 'EasyBatteryMgr3.exe' - '1' Module(s) have been scanned
Scan process 'EasySpeedUpManager.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'MagicDoctorKbdHk.exe' - '1' Module(s) have been scanned
Scan process 'dwm.exe' - '1' Module(s) have been scanned
Scan process 'taskeng.exe' - '1' Module(s) have been scanned
Scan process 'WmiPrvSE.exe' - '1' Module(s) have been scanned
Scan process 'SearchIndexer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'sqlwriter.exe' - '1' Module(s) have been scanned
Scan process 'sqlbrowser.exe' - '1' Module(s) have been scanned
Scan process 'SeaPort.exe' - '1' Module(s) have been scanned
Scan process 'RichVideo.exe' - '1' Module(s) have been scanned
Scan process 'RegSrvc.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned
Scan process 'EvtEng.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'BcmSqlStartupSvc.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'taskeng.exe' - '1' Module(s) have been scanned
Scan process 'wlanext.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'SLsvc.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'audiodg.exe' - '0' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'nvvsvc.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsm.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'wininit.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
78 processes with 78 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!

Starting to scan executable files (registry).
The registry was scanned ( '46' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\hiberfil.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
C:\pagefile.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
C:\Ad-Remover\1\List.dat
[DETECTION] Contains recognition pattern of the HTML/Malicious.ActiveX.Gen HTML script virus
C:\Users\Tanita\AppData\Local\Google\Chrome\User Data\Default\Cache\f_0005ac
[0] Archive type: NSIS
--> ProgramFilesDir/List.dat
[DETECTION] Contains recognition pattern of the HTML/Malicious.ActiveX.Gen HTML script virus
C:\Users\Tanita\Documents\Downloads\AD-R (1).exe
[0] Archive type: NSIS
--> ProgramFilesDir/List.dat
[DETECTION] Contains recognition pattern of the HTML/Malicious.ActiveX.Gen HTML script virus
C:\Users\Tanita\Documents\Downloads\AD-R.exe
[0] Archive type: NSIS
--> ProgramFilesDir/List.dat
[DETECTION] Contains recognition pattern of the HTML/Malicious.ActiveX.Gen HTML script virus
Begin scan in 'D:\'

Beginning disinfection:
C:\Ad-Remover\1\List.dat
[DETECTION] Contains recognition pattern of the HTML/Malicious.ActiveX.Gen HTML script virus
[NOTE] The file was moved to '4bca35f0.qua'!
C:\Users\Tanita\AppData\Local\Google\Chrome\User Data\Default\Cache\f_0005ac
[NOTE] The file was moved to '4b8735e6.qua'!
C:\Users\Tanita\Documents\Downloads\AD-R (1).exe
[NOTE] The file was moved to '4b8435cb.qua'!
C:\Users\Tanita\Documents\Downloads\AD-R.exe
[NOTE] The file was moved to '4d627b94.qua'!


End of the scan: mercredi 20 janvier 2010 17:55
Used time: 1:18:29 Hour(s)

The scan has been done completely.

23466 Scanned directories
1012046 Files were scanned
4 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
4 Files were moved to quarantine
0 Files were renamed
2 Files cannot be scanned
1012040 Files not concerned
4586 Archives were scanned
2 Warnings
6 Notes
111795 Objects were scanned with rootkit scan
0 Hidden objects were found


Et pour mes clés USB:



############################## | UsbFix V6.075 |

User : Tanita (Administrateurs) # PC-DE-TANITA
Update on 19/01/2010 by El Desaparecido , C_XX & Chimay8
Start at: 11:19:16 | 21/01/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Core(TM)2 Duo CPU T6400 @ 2.00GHz
Microsoft® Windows Vista™ Édition Familiale Premium (6.0.6001 32-bit) # Service Pack 1
Internet Explorer 8.0.6001.18865
Windows Firewall Status : Enabled

C:\ -> Disque fixe local # 51,09 Go (12,58 Go free) # NTFS
D:\ -> Disque fixe local # 237 Go (183,71 Go free) # NTFS
E:\ -> Disque CD-ROM # 7,16 Go (0 Mo free) [RA3] # UDF
F:\ -> Disque CD-ROM # 6,67 Mo (0 Mo free) [U3 System] # CDFS
G:\ -> Disque amovible # 7,46 Go (6,6 Go free) [USB2] # FAT32
H:\ -> Disque amovible # 1,86 Go (923,56 Mo free) # FAT
I:\ -> Disque amovible # 959,97 Mo (29,45 Mo free) # FAT

############################## | Processus actifs |

C:\Windows\System32\smss.exe 524
C:\Windows\system32\csrss.exe 620
C:\Windows\system32\wininit.exe 672
C:\Windows\system32\csrss.exe 684
C:\Windows\system32\services.exe 720
C:\Windows\system32\lsass.exe 732
C:\Windows\system32\lsm.exe 744
C:\Windows\system32\svchost.exe 876
C:\Windows\system32\nvvsvc.exe 944
C:\Windows\system32\svchost.exe 972
C:\Windows\System32\svchost.exe 1012
C:\Windows\System32\svchost.exe 1060
C:\Windows\System32\svchost.exe 1096
C:\Windows\system32\svchost.exe 1132
C:\Windows\system32\svchost.exe 1212
C:\Windows\system32\SLsvc.exe 1232
C:\Windows\system32\svchost.exe 1284
C:\Windows\system32\winlogon.exe 1372
C:\Windows\system32\svchost.exe 1468
C:\Windows\system32\rundll32.exe 1624
C:\Windows\system32\WLANExt.exe 1744
C:\Windows\System32\spoolsv.exe 1832
C:\Windows\system32\taskeng.exe 1840
C:\Program Files\Avira\AntiVir Desktop\sched.exe 1868
C:\Windows\system32\svchost.exe 1888
C:\Program Files\Avira\AntiVir Desktop\avguard.exe 596
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe 612
C:\Windows\system32\svchost.exe 712
C:\Program Files\Intel\WiFi\bin\EvtEng.exe 812
C:\Program Files\Common Files\LightScribe\LSSrvc.exe 2032
C:\Windows\system32\svchost.exe 2128
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe 2152
C:\Program Files\CyberLink\Shared Files\RichVideo.exe 2164
C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe 2188
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 2212
C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe 2244
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe 2264
C:\Windows\system32\svchost.exe 2300
C:\Windows\System32\svchost.exe 2336
C:\Windows\system32\SearchIndexer.exe 2388
C:\Windows\system32\WUDFHost.exe 2616
C:\Windows\system32\wbem\wmiprvse.exe 2796
C:\Windows\servicing\TrustedInstaller.exe 3148
C:\Windows\system32\Dwm.exe 4056
C:\Windows\system32\taskeng.exe 2072
C:\Windows\Explorer.EXE 2140
C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe 2468
C:\Windows\system32\runonce.exe 1720
C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe 2672
C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe 1552
C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe 1792
C:\Windows\system32\conime.exe 3088
C:\Windows\system32\PresentationSettings.exe 2412
C:\Windows\system32\wbem\wmiprvse.exe 1308

################## | Elements infectieux |

Supprimé ! C:\Users\Tanita\AppData\Local\Temp\uttACA3.tmp.exe
Supprimé ! C:\Users\Tanita\AppData\Local\Temp\a.dat
Supprimé ! C:\$Recycle.Bin\S-1-5-21-2083984861-3840251556-860543850-1003
Supprimé ! C:\$Recycle.Bin\S-1-5-21-2083984861-3840251556-860543850-500
Supprimé ! C:\$Recycle.Bin\S-1-5-21-2083984861-3840251556-860543850-501
Supprimé ! C:\$Recycle.Bin\S-1-5-21-445972690-782477315-519018674-500
Supprimé ! D:\$Recycle.Bin\S-1-5-21-2083984861-3840251556-860543850-1003
Supprimé ! D:\$Recycle.Bin\S-1-5-21-2083984861-3840251556-860543850-501
Non supprimé ! E:\autorun.inf
Non supprimé ! F:\autorun.inf
G:\autorun.inf -> fichier appelé : "G:\SLATKO/torta.exe" ( Présent ! )
Non supprimé ! G:\SLATKO/torta.exe
G:\autorun.inf -> fichier appelé : "G:\SLATKO/torta.exe" ( Présent ! )
Non supprimé ! G:\SLATKO/torta.exe
Supprimé ! G:\jedna
Supprimé ! G:\SLATKO\Desktop.ini
Supprimé ! G:\SLATKO\torta.exe
Supprimé ! G:\SLATKO
Supprimé ! G:\Toy.exe
Supprimé ! G:\autorun.inf
Supprimé ! H:\Recycler\S-1-5-21-1482476501-1644491937-682003330-1013
I:\autorun.inf -> fichier appelé : "I:\yo2mq6.exe" ( Absent ! )
I:\autorun.inf -> fichier appelé : "I:\yo2mq6.exe" ( Absent ! )
Supprimé ! I:\.vbs
Supprimé ! I:\awda2.exe
Supprimé ! I:\g83816.com
Supprimé ! I:\Knight.exe
Supprimé ! I:\t.com
Supprimé ! I:\autorun.inf
Supprimé ! I:\Recycler\S-1-5-21-1482476501-1644491937-682003330-1013\isew32.exe
Supprimé ! I:\Recycler\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini
Supprimé ! I:\Recycler\S-1-5-21-1482476501-1644491937-682003330-1013

################## | Registre |


################## | Mountpoints2 |

Supprimé ! HKCU\...\Explorer\MountPoints2\{078d2ed8-fba8-11de-b07a-806e6f6e6963}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{2200e369-709f-11de-89ef-806e6f6e6963}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{6a8bd19c-7177-11de-b9ec-002269fbfd1d}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{dfc4c149-84b8-11de-9dd3-002269fbfd1d}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{e368e4c6-05d4-11df-8f95-002269fbfd1d}\Shell\AutoRun\Command

################## | Listing des fichiers présent |

[20/01/2010 13:56|--a------|4807] C:\Ad-Report-CLEAN[1].log
[18/09/2006 22:43|--a------|24] C:\autoexec.bat
[21/01/2008 03:24|-rahs----|333203] C:\bootmgr
[08/02/2008 10:31|-ra-s----|8192] C:\BOOTSECT.BAK
[18/09/2006 22:43|--a------|10] C:\config.sys
[?|?|?] C:\hiberfil.sys
[23/10/2008 08:13|-rahs----|0] C:\IO.SYS
[23/10/2008 08:13|-rahs----|0] C:\MSDOS.SYS
[?|?|?] C:\pagefile.sys
[21/10/2008 10:01|--a------|366] C:\RHDSetup.log
[15/07/2009 20:58|--a------|173] C:\setup.log
[21/01/2010 11:25|--a------|6274] C:\UsbFix.txt
[25/09/2009 17:14|--a------|28978304] D:\cours1-1Šre.wav
[25/09/2009 17:18|--a------|32854656] D:\Cours1-2Šme.wav
[01/12/2009 22:28|--a------|95693068] D:\Cours10a.wav
[01/12/2009 22:31|--a------|86532524] D:\Cours10b.wav
[09/12/2009 01:45|--a------|177187116] D:\Cours11.wav
[22/09/2009 17:15|--a------|75251840] D:\Cours2.wav
[22/09/2009 17:08|--a------|72932480] D:\Cours2geronto.wav
[12/10/2009 19:53|--a------|75019904] D:\Cours3.wav
[05/10/2009 17:32|--a------|77638784] D:\Cours3geronto.wav
[21/10/2009 12:57|--a------|75027584] D:\Cours4.wav
[12/10/2009 19:45|--a------|76030592] D:\Cours4geronto.wav
[21/10/2009 13:01|--a------|40784000] D:\Cours5-1Šre.wav
[21/10/2009 13:04|--a------|30518912] D:\Cours5-2Šme.wav
[02/11/2009 16:05|--a------|76492928] D:\Cours6.wav
[10/11/2009 10:28|--a------|56627840] D:\Cours7.wav
[17/11/2009 12:29|--a------|71146112] D:\Cours8.wav
[16/12/2009 13:38|--a------|76743296] D:\Cours9.wav
[29/11/2009 22:54|--a------|112776460] D:\Cours9a.wav
[29/11/2009 22:58|--a------|87284172] D:\Cours9b.wav
[09/12/2009 18:35|--a------|7501] D:\Fin.htm
[23/10/2007 09:45|-ra------|1336632] D:\LaunchU3.exe
[24/11/2009 15:09|--a------|1001472] D:\lecteur-dvd3.doc
[24/11/2009 15:07|--a------|585] D:\lecteur-dvd3.txt
[09/12/2009 13:25|--a------|1023613] D:\psychophysio PEtechnique.pdf
[01/12/2009 15:55|--a------|2071715] D:\psychophysio.pdf
[10/10/2008 15:51|-ra------|447752] E:\AutoRun.exe
[10/10/2008 15:30|-ra------|86991621] E:\Core_0.cab
[10/10/2008 15:30|-ra------|4720372] E:\Core_1.cab
[10/10/2008 15:30|-ra------|27695] E:\Core_2.cab
[10/10/2008 15:31|-ra------|3803578] E:\Core_3.cab
[10/10/2008 15:33|-ra------|445526] E:\Core_4.cab
[10/10/2008 15:33|-ra------|433805588] E:\Core_5.cab
[10/10/2008 15:30|-ra------|114309447] E:\Core_6.cab
[10/10/2008 15:42|-ra------|435913366] E:\Core_7.cab
[10/10/2008 15:51|-ra------|447752] E:\EASetup.exe
[10/10/2008 15:31|-ra------|513309] E:\Group0.cab
[10/10/2008 15:30|-ra------|131909] E:\Launche1.cab
[10/10/2008 15:31|-ra------|7645790] E:\Launche2.cab
[10/10/2008 15:31|-ra------|3057] E:\Launche3.cab
[10/10/2008 15:30|-ra------|1660856] E:\Launche6.cab
[10/10/2008 15:30|-ra------|182991541] E:\Maps_0.cab
[10/10/2008 15:31|-ra------|178580869] E:\Maps_1.cab
[10/10/2008 15:30|-ra------|24334393] E:\Maps_2.cab
[10/10/2008 15:33|-ra------|108944] E:\RetailE4.cab
[10/10/2008 15:31|-ra------|11982639] E:\RetailE5.cab
[10/10/2008 15:51|-ra------|1588224] E:\autorun.dat
[10/10/2008 15:51|-ra------|137] E:\autorun.inf
[27/09/2008 00:01|-ra------|29310] E:\ra3.ico
[23/10/2007 08:22|-r-------|285] F:\autorun.inf
[23/10/2007 08:45|-r-------|1336632] F:\LaunchU3.exe
[04/03/2008 15:59|-r-------|5606296] F:\LaunchPad.zip
[27/12/2009 16:52|--a------|296] G:\WMPInfo.xml
[21/01/2010 11:16|--a------|1562] G:\BOOTEX.LOG
[23/10/2007 09:45|-ra------|1336632] H:\LaunchU3.exe
[26/11/2009 13:12|--a------|1644] H:\BOOTEX.LOG
[24/11/2009 15:07|--a------|585] H:\lecteur-dvd3.txt
[24/11/2009 15:09|--a------|1001472] H:\lecteur-dvd3.doc
[01/12/2009 15:55|--a------|2071715] H:\psychophysio.pdf
[09/12/2009 18:35|--a------|7501] H:\Fin.htm
[19/07/2008 21:50|--a------|4116999] I:\Arno - Elisa (with Jane Birkin).mp3
[13/06/2008 21:57|--a------|33160] I:\El miembro fantasma.rtf
[19/07/2008 19:04|--a------|4757629] I:\Arno - Les filles du bord de mer.mp3
[19/07/2008 18:03|--a------|5625778] I:\Arno & Tc Matic - Putain Putain (1983).mp3
[20/07/2008 18:12|--a------|5140160] I:\De La Soul feat. Redman - Ooh.mp3
[20/07/2008 18:12|--a------|3626809] I:\Goldfrapp - Ooh La La.mp3
[20/07/2008 18:33|--a------|4161201] I:\Lauren Hill & The Fugees - Ooh La La La.mp3
[20/07/2008 15:55|--a------|220354032] I:\Louis Armstrong - The Platinum Collection (3cd) (by @G@) 2006.rar
[

################## | Vaccination |

# C:\autorun.inf -> Dossier créé par UsbFix.
# D:\autorun.inf -> Dossier créé par UsbFix.
# G:\autorun.inf -> Dossier créé par UsbFix.
# H:\autorun.inf -> Dossier créé par UsbFix.
# I:\autorun.inf -> Dossier créé par UsbFix.

Oui pour les clés USB j'avoue... hum hum... Faut dire qu'elles se baladent beaucoup, j'ai du choper toutes les crasses sur le passage.

Pour le dernier programme que tu m'as renseigné, il bloque après un moment et met le message d'erreur suivant : '5/' n'est pas une valeur entière correcte

Je fais quoi ?

Merci merci

à Finalwar: minutieux

Logfile of random's system information tool 1.06 (written by random/random)
Run by Tanita at 2010-01-21 20:26:29
Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
System drive C: has 13 GB (24%) free of 52 GB
Total RAM: 3066 MB (58% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:26:37, on 21/01/2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18865)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe
C:\Windows\Explorer.EXE
C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe
C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\rundll32.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Users\Tanita\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Tanita\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Tanita\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Tanita\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Tanita\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Users\Tanita\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Tanita\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\wuauclt.exe
C:\Users\Tanita\Documents\Downloads\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Tanita.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Users\Tanita\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [EPSON Stylus DX4000 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\Windows\TEMP\E_S34C8.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [EPSON Stylus DX4000 Series (Copie 1)] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\Windows\TEMP\E_S32A6.tmp" /EF "HKCU"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Envoyer l'&image au périphérique Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Samsung Update Plus - Unknown owner - C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe

Bonsoir!

Mon PC va super bien! Je te dois une fière chandelle... Un énorme merci pour tes conseils rapides et efficaces! :-) J'ai commencé à faire 2-3 des mises à jour etc. que tu m'as proposées, mais là je pars aux sports d'hiver pour une semaine et j'suis un peu juste question temps, donc je terminerai ça à mon retour.

Encore merci, j'ai eu de la chance de tomber sur toi !

Bonne soirée,

Tania