Virus ?

Question

Bonjour a tous 

Mon ordi est long a charger les pages
firefox a mis 45 secondes pour ouvrir une page l'autre jour 
un virus ?

Configuration: Windows Vista / Firefox 3.6.3

archet9 · Answer

Bonsoir,

Pour voir cela:

Télécharge RSIT (de random/random) sur le bureau :

- Double clique sur RSIT.exe qui est sur le bureau
- Clique sur "Continue" dans la fenêtre
- RSIT téléchargera HijackThis si il n'est pas présent où détecté, alors il faudra accepter la licence
- Poste le contenu de log.txt plus info.txt (réduit ds la barre de taches) à la fin de l'analyse .

Les rapports sont dans le dossier ici C:\rsit
a+

Lulu · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by jes at 2010-04-03 19:37:25
Microsoft® Windows Vista(TM) Édition Familiale Premium  Service Pack 2
System drive C: has 204 GB (70%) free of 293 GB
Total RAM: 3326 MB (53% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:37:53, on 03/04/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Packard Bell\FIJI\ABoard.exe
C:\Windows\System32undll32.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Kaspersky Lab\Kaspersky PURE\avp.exe
C:\Program Files\Iminent\IMBooster\IMBooster.exe
C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
C:\Program Files\OrangeHSS\Launcher\Launcher.exe
C:\Program Files\Packard Bell\FIJI\AOSD.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\OrangeHSS\systray\systrayapp.exe
C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Windows\system32\conime.exe
C:\Program Files\Windows Live\Messenger\wlcsdk.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Kaspersky Lab\Kaspersky PURE\klwtblfs.exe
C:\Users\jes\Desktop\RSIT.exe
C:\Program Files	rend micro\jes.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail?kw=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
R3 - URLSearchHook: IMBooster4web-en Toolbar - {346de098-61f9-4b42-89da-6dfba7091bb6} - C:\Program Files\IMBooster4web-en	bIMBo.dll
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: IMBooster4web-en Toolbar - {346de098-61f9-4b42-89da-6dfba7091bb6} - C:\Program Files\IMBooster4web-en	bIMBo.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky PURE\ievkbd.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: CHelperBHO - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - C:\Program Files\Iminent\SearchTheWeb\Iminent.BHO.NavigationError.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: IMinent WebBooster - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - C:\Program Files\Iminent\IMBooster4Web\Iminent.WebBooster.dll
O2 - BHO: Iminent.LinkToContent - {A6E9BAAF-53CD-4575-967B-2AF710A7D21F} - C:\Program Files\Iminent\IMBooster\Iminent.LinkToContent.dll (file missing)
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: IMBooster4web-en Toolbar - {346de098-61f9-4b42-89da-6dfba7091bb6} - C:\Program Files\IMBooster4web-en	bIMBo.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
O4 - HKLM\..\Run: [ACTIVBOARD] C:\Program Files\Packard Bell\FIJI\aboard.exe
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky PURE\avp.exe"
O4 - HKLM\..\Run: [IMBooster] C:\Program Files\Iminent\IMBooster\imbooster.exe /warmup
O4 - HKLM\..\Run: [Iminent.Notifier] C:\Program Files\Iminent\SearchTheWeb\Iminent.Notifier.exe
O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [EPSON Stylus DX4400 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE /FU "C:\Windows\TEMP\E_S2ECA.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [VeohPlugin] "C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe"
O4 - HKCU\..\RunOnce: [Iminent.Notifier Install] "C:\Users\jes\AppData\Local\Temp\NotifierSetup.exe" /s
O4 - HKCU\..\RunOnce: [.IMinentUpdate] C:\Users\jes\AppData\Local\Temp\NotifierSetup.exe /s
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: Ajouter à l'Anti-bannière - C:\Program Files\Kaspersky Lab\Kaspersky PURE\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Mon Clavier &virtuel - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Analyse des &liens - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll
O13 - Gopher Prefix: 
O15 - Trusted Zone: http://*.mappy.com
O15 - Trusted Zone: http://*.orange.fr
O15 - Trusted Zone: http://rw.search.ke.voila.fr
O15 - Trusted Zone: http://orange.weborama.fr
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Kaspersky PURE (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky PURE\avp.exe
O23 - Service: Service de gestion du système CryproStorage (CSObjectsSrv) - Infowatch - C:\Program Files\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Desktop Manager 5.7.807.15159 (GoogleDesktopManager-071508-051939) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

archet9 · Answer

---> Télécharge OTM (OldTimer) sur ton Bureau : 
 http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/ 


--->Clique droit sur "OTMoveIt3.exe" et choisis "exécuter en tant qu'administrateur" afin de le lancer. 

---> Copie (Ctrl+C) le texte suivant en gras ci-dessous : 




:files 
c:\program files\iminent\imbooster\imbooster.exe
c:\program files\iminent\searchtheweb\iminent.bho.navigationerror.dll
c:\program files\iminent\imbooster4web\iminent.webbooster.dll
c:\program files\iminent\imbooster\iminent.linktocontent.dll
c:\program files\iminent\searchtheweb\iminent.notifier.exe
c:\users\jes\appdata\local	emp
otifiersetup.exe


:reg 
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84FF7BD6-B47F-46F8-9130-01B2696B36CB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{84FF7BD6-B47F-46F8-9130-01B2696B36CB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6E9BAAF-53CD-4575-967B-2AF710A7D21F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A6E9BAAF-53CD-4575-967B-2AF710A7D21F}]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IMBooster"=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Iminent.Notifier"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Iminent.Notifier Install"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
".IMinentUpdate"=-






:commands 
[purity] 
[emptytemp] 
[start explorer] 
[Reboot]



---> Colle (Ctrl+V) le texte précédemment copié dans le cadre:
 Paste Instructions for Items to be Moved. 

---> Clique maintenant sur le bouton MoveIt! 

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. 
Accepte en cliquant sur YES. 

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\ 
Le nom du rapport correspond au moment de sa création : date_heure.log 


a+

Lulu · Answer

All processes killed
========== FILES ==========
c:\program files\iminent\imbooster\IMBooster.exe moved successfully.
c:\program files\iminent\searchtheweb\Iminent.BHO.NavigationError.dll moved successfully.
c:\program files\iminent\imbooster4web\Iminent.WebBooster.dll moved successfully.
File/Folder c:\program files\iminent\imbooster\iminent.linktocontent.dll not found.
c:\program files\iminent\searchtheweb\Iminent.Notifier.exe moved successfully.
File/Folder c:\users\jes\appdata\local	emp
otifiersetup.exe not found.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84FF7BD6-B47F-46F8-9130-01B2696B36CB}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84FF7BD6-B47F-46F8-9130-01B2696B36CB}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{84FF7BD6-B47F-46F8-9130-01B2696B36CB}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84FF7BD6-B47F-46F8-9130-01B2696B36CB}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6E9BAAF-53CD-4575-967B-2AF710A7D21F}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6E9BAAF-53CD-4575-967B-2AF710A7D21F}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A6E9BAAF-53CD-4575-967B-2AF710A7D21F}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6E9BAAF-53CD-4575-967B-2AF710A7D21F}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\IMBooster deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Iminent.Notifier deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\Iminent.Notifier Install deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\.IMinentUpdate deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrator
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: jes
->Temp folder emptied: 267708605 bytes
->Temporary Internet Files folder emptied: 27277628 bytes
->Java cache emptied: 49764560 bytes
->FireFox cache emptied: 92797786 bytes
->Google Chrome cache emptied: 8115259 bytes
->Flash cache emptied: 13349244 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1189812 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 10663202 bytes
%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 48860206 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 496,00 mb
 
 
OTM by OldTimer - Version 3.1.10.1 log created on 04042010_114723

Files moved on Reboot...
File C:\Users\jes\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FA3JDIIG\01[1].htm not found!
File C:\Users\jes\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FA3JDIIG\ADSAdClient31[4].htm not found!

Registry entries deleted on Reboot...

archet9 · Answer

Ok,

Fais maintenant un scan avec cet antispyware : 
Malwarebytes + tutoriel 
 
Tu l'installes; mets le a jour...(onglet mise a jour)
Click maintenant sur l'onglet recherche et coche la case :
 "Executer un examen rapide".
Puis click sur "rechercher". 
Laisses le scanner le pc...
A la fin du scan, clique sur Afficher les résultats 
Si des elements on ete trouvés : 
> click sur supprimer la selection.
si il t'es demandé de redemarrer > click sur "oui".
A la fin un rapport va s'ouvrir; 
sauvegarde le de maniere a le retrouver en vue de le poster sur le forum.
Copies et colles le rapport stp.  

a+

Lulu · Answer

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Version de la base de données: 3955

Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005

05/04/2010 11:42:35
mbam-log-2010-04-05 (11-42-35).txt

Type d'examen: Examen rapide
Elément(s) analysé(s): 103986
Temps écoulé: 6 minute(s), 25 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

archet9 · Answer

Toujours des soucis ?

a+

Lulu · Answer

oui, ca doit venir de Firefox pacque avec Internet explorer ca y fait pas

Lulu · Answer

Comment on le désinstalle ?

Lulu · Answer

Pour les chargement de page apparemment y bug plu ^^
mais pour lancer la page il est toujours long

archet9 · Answer

Relance RSIT et colle le rapport stp

a+

Lulu · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by jes at 2010-04-05 16:50:14
Microsoft® Windows Vista(TM) Édition Familiale Premium  Service Pack 2
System drive C: has 205 GB (70%) free of 293 GB
Total RAM: 3326 MB (53% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:50:57, on 05/04/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Packard Bell\FIJI\ABoard.exe
C:\Program Files\Packard Bell\FIJI\AOSD.exe
C:\Program Files\OrangeHSS\Launcher\Launcher.exe
C:\Windows\System32undll32.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Kaspersky Lab\Kaspersky PURE\avp.exe
C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
C:\Program Files\OrangeHSS\systray\systrayapp.exe
C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Windows Live\Messenger\wlcsdk.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Kaspersky Lab\Kaspersky PURE\klwtblfs.exe
C:\Users\jes\Desktop\RSIT.exe
C:\Program Files	rend micro\jes.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail?kw=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
R3 - URLSearchHook: IMBooster4web-en Toolbar - {346de098-61f9-4b42-89da-6dfba7091bb6} - C:\Program Files\IMBooster4web-en	bIMBo.dll
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: IMBooster4web-en Toolbar - {346de098-61f9-4b42-89da-6dfba7091bb6} - C:\Program Files\IMBooster4web-en	bIMBo.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky PURE\ievkbd.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: IMBooster4web-en Toolbar - {346de098-61f9-4b42-89da-6dfba7091bb6} - C:\Program Files\IMBooster4web-en	bIMBo.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
O4 - HKLM\..\Run: [ACTIVBOARD] C:\Program Files\Packard Bell\FIJI\aboard.exe
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky PURE\avp.exe"
O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [EPSON Stylus DX4400 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE /FU "C:\Windows\TEMP\E_S2ECA.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [VeohPlugin] "C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: Ajouter à l'Anti-bannière - C:\Program Files\Kaspersky Lab\Kaspersky PURE\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Mon Clavier &virtuel - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Analyse des &liens - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll
O13 - Gopher Prefix: 
O15 - Trusted Zone: http://*.mappy.com
O15 - Trusted Zone: http://*.orange.fr
O15 - Trusted Zone: http://rw.search.ke.voila.fr
O15 - Trusted Zone: http://orange.weborama.fr
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Kaspersky PURE (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky PURE\avp.exe
O23 - Service: Service de gestion du système CryproStorage (CSObjectsSrv) - Infowatch - C:\Program Files\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Desktop Manager 5.7.807.15159 (GoogleDesktopManager-071508-051939) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

archet9 · Answer

Impératif sous vista: 

desactives tes comptes d'utilisateur:
https://www.zebulon.fr/astuces/pratique/220-desactiver-l-uac-dans-vista.html 

Puis:

Télécharge Toolbar-S&D (Team IDN) sur ton Bureau. 
TOOLbar-s&d 

* Lance l'installation du programme en exécutant le fichier téléchargé. 
* Clique droit maintenant sur le raccourci de Toolbar-S&D et choisis "exécuter en tant qu'administrateur" 
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée. 
* Choisis maintenant l'option 2 (suppression). Patiente jusqu'à la fin de la recherche. 
* Poste le rapport généré. (C:\TB.txt)

a+

Lulu · Answer

-----------\  ToolBar S&D 1.2.9   XP/Vista

   Microsoft® Windows Vista(TM) Édition Familiale Premium  ( v6.0.6002 ) Service Pack 2
   X86-based PC ( Multiprocessor Free : AMD Phenom(tm) 9100e Quad-Core Processor )
   BIOS : BIOS Date: 08/05/08 10:31:05 Ver: 08.00.14
   USER : jes ( Administrator )
   BOOT : Normal boot
   C:\ (Local Disk) - NTFS - Total:286 Go (Free:197 Go)
   D:\ (USB)
   E:\ (USB)
   F:\ (USB)
   G:\ (USB)
   H:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
   Option : [2] ( 07/04/2010| 9:42 )

   [ UAC => 0 ]

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\Windows\system32\blank.htm"
   "Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
   "Start Page"="https://www.google.fr/?gws_rd=ssl"
   "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
   "Default_search_url"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Search bar"="https://www.orange.fr/portail?kw="
   "Url"="http://go.microsoft.com/fwlink/?LinkID=68928"
   "Url"="http://go.microsoft.com/fwlink/?LinkID=44406"
   "Url"="http://go.microsoft.com/fwlink/?LinkID=68929"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="https://www.msn.com/fr-fr/"
   "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
   "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Search bar"="http://www.bing.com/spresults.aspx"


   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [ UAC => 1 ]


   1 - "C:\ToolBar SD\TB_1.txt" - 07/04/2010| 9:43 - Option : [2]

   -----------\  Fin du rapport a  9:43:15,15

archet9 · Answer

Comment se comporte le pc ?

a+

Lulu · Answer

Toujours pareil, quand je clic sur le logo firefox la page met du temps a venir et si je clic plusieurs foi c'est pareil ca met du temps pi elles vont arrivé tout d'un seul coup

archet9 · Answer

Fais ceci pour voir.

https://www.commentcamarche.net/faq/9525-reinitialiser-firefox-reset

a+

Lulu · Answer

J'arrive pas a avoir 'l'interface' a la place ca ouvre une nouvelle page google

archet9 · Answer

Ok
Ca sent un Rootkit ....

--> Télécharge ComboFix.exe de sUBs et <gras>Enregistre le sur sur ton Bureau :</gras>
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

Clique droit maintenant sur le raccourci de Combofix et choisis "exécuter en tant qu'administrateur"

Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"

---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix.txt

a+

Lulu · Answer

Je l'ai fait trois fois pacque la première je l'ai fermé sans faire gaffe pi en cherchant dans le dossier y avait rien donc j'ai refait pi 
la deuxième fois quand c'était fini impossible d'ouvrir quelque chose ni internet rien ca disait ca : 'Tentative d'opération non autorisée sur une clé du Registre marqué pour suppression' donc j'ai redémarré l'ordi une foi fini pareil je pouvais rien ouvrir avec toujours le meme message sauf que cette foi j'avais enregistré pfiou lol


ComboFix 10-04-08.06 - jes 09/04/2010  20:28:01.3.4 - x86
Microsoft® Windows Vista(TM) Édition Familiale Premium   6.0.6002.2.1252.33.1036.18.3326.2136 [GMT 2:00]
Lancé depuis: c:\users\jes\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((   Fichiers créés du 2010-03-09 au 2010-04-09  ))))))))))))))))))))))))))))))))))))
.

2010-04-09 18:35 . 2010-04-09 18:36	--------	d-----w-	c:\users\jes\AppData\Local	emp
2010-04-09 18:35 . 2010-04-09 18:35	--------	d-----w-	c:\users\Public\AppData\Local	emp
2010-04-09 18:35 . 2010-04-09 18:35	--------	d-----w-	c:\users\Default\AppData\Local	emp
2010-04-09 18:35 . 2010-04-09 18:35	--------	d-----w-	c:\users\Administrator\AppData\Local	emp
2010-04-07 07:40 . 2010-04-07 07:43	--------	d-----w-	C:\ToolBar SD
2010-04-04 09:47 . 2010-04-04 09:47	--------	d-----w-	C:\_OTM
2010-04-03 17:37 . 2010-04-03 17:37	--------	d-----w-	C:sit
2010-04-01 17:53 . 2010-02-11 16:14	2329000	----a-w-	c:\programdata\{2855FFC2-C82B-4C72-B953-0C2E7BD530D8}\IMBooster4Web.Setup.exe
2010-04-01 17:53 . 2010-04-01 17:53	--------	d--h--w-	c:\programdata\{2855FFC2-C82B-4C72-B953-0C2E7BD530D8}
2010-04-01 17:53 . 2010-02-11 16:05	9216	----a-w-	c:\programdata\{2855FFC2-C82B-4C72-B953-0C2E7BD530D8}\offline\24E8FDD5\AAE467FD\Iminent.MMServerPS.dll
2010-04-01 17:53 . 2010-02-11 16:05	9728	----a-w-	c:\programdata\{2855FFC2-C82B-4C72-B953-0C2E7BD530D8}\offline\4B31F41B\AAE467FD\Iminent.MMServer.WinTracker.dll
2010-04-01 17:53 . 2010-02-11 16:05	232184	----a-w-	c:\programdata\{2855FFC2-C82B-4C72-B953-0C2E7BD530D8}\offline\163ED3D\51D32D94\Iminent.WebBooster.dll
2010-04-01 17:53 . 2010-02-11 16:04	19968	----a-w-	c:\programdata\{2855FFC2-C82B-4C72-B953-0C2E7BD530D8}\offline\6B1DF0D0\460B3CA\Iminent.XPCOM.dll
2010-04-01 17:53 . 2010-02-11 16:09	63224	----a-w-	c:\programdata\{2855FFC2-C82B-4C72-B953-0C2E7BD530D8}\offline\95715CE5\AAE467FD\Iminent.MMServer.exe
2010-04-01 17:53 . 2010-02-11 09:59	2347712	----a-w-	c:\programdata\{8C099C9B-807F-4928-BCA6-4A5473D9A6B9}\SearchTheWeb.exe
2010-04-01 17:53 . 2010-04-01 17:53	--------	d--h--w-	c:\programdata\{8C099C9B-807F-4928-BCA6-4A5473D9A6B9}
2010-04-01 17:52 . 2010-02-08 10:20	44280	----a-w-	c:\programdata\{8C099C9B-807F-4928-BCA6-4A5473D9A6B9}\offline\1B39965F\21A18D0C\Iminent.BHO.NavigationError.dll
2010-04-01 17:52 . 2010-02-08 10:50	528896	----a-w-	c:\programdata\{8C099C9B-807F-4928-BCA6-4A5473D9A6B9}\offline\A5E06B3C\21A18D0C\Iminent.Notifier.exe
2010-04-01 17:52 . 2010-04-01 17:52	--------	d-----w-	c:\program files\IMBooster4web-en
2010-04-01 17:52 . 2010-04-01 17:52	--------	d-----w-	c:\programdata\Iminent
2010-03-31 16:19 . 2010-03-31 16:19	932368	----a-w-	c:\programdata\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\profiles-1-6.dll
2010-03-31 16:19 . 2010-03-31 16:19	678416	----a-w-	c:\programdata\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\content_interpreter-1-1.dll
2010-03-31 16:19 . 2010-03-31 16:19	604688	----a-w-	c:\programdata\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\gsg-3-9.dll
2010-03-31 16:19 . 2010-03-31 16:19	522768	----a-w-	c:\programdata\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\database-1-5.dll
2010-03-31 16:19 . 2010-03-31 16:19	1096208	----a-w-	c:\programdata\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\filtration-4-6.dll
2010-03-31 13:40 . 2010-03-31 13:40	95259	----a-w-	c:\windows\system32\drivers\klick.dat
2010-03-31 13:40 . 2010-03-31 13:40	108059	----a-w-	c:\windows\system32\drivers\klin.dat
2010-03-31 13:40 . 2009-12-14 10:44	88632	----a-w-	c:\windows\system32\drivers\CSCrySec.sys
2010-03-31 13:40 . 2009-12-14 10:44	39352	----a-w-	c:\windows\system32\drivers\CSVirtualDiskDrv.sys
2010-03-31 13:39 . 2010-04-09 18:01	--------	d-----w-	c:\programdata\Kaspersky Lab
2010-03-31 13:39 . 2010-03-31 13:39	--------	d-----w-	c:\program files\Kaspersky Lab
2010-03-31 13:39 . 2010-03-31 13:39	--------	d-----w-	c:\program files\Common Files\InfoWatch
2010-03-31 13:33 . 2010-03-31 13:33	--------	d-----w-	c:\programdata\Kaspersky Lab Setup Files
2010-03-31 12:28 . 2010-03-31 12:28	680	----a-w-	c:\users\jes\AppData\Local\d3d9caps.dat
2010-03-31 06:15 . 2010-03-09 15:42	834048	----a-w-	c:\windows\system32\wininet.dll
2010-03-31 06:15 . 2010-03-09 16:25	78336	----a-w-	c:\windows\system32\ieencode.dll
2010-03-29 17:11 . 2010-03-29 17:11	443912	----a-w-	c:\users\jes\AppData\Roaming\Real\Update\setup3.10\setup.exe
2010-03-28 15:24 . 2010-03-28 15:24	--------	d-----w-	c:\program files\VirginMega
2010-03-24 08:05 . 2010-02-12 10:32	293376	----a-w-	c:\windows\system32\browserchoice.exe
2010-03-19 16:05 . 2010-03-19 16:05	--------	d-----w-	c:\windows\Downloaded Installations
2010-03-11 21:15 . 2010-02-20 23:06	24064	----a-w-	c:\windows\system32
shhttp.dll
2010-03-11 21:15 . 2010-02-20 23:05	30720	----a-w-	c:\windows\system32\httpapi.dll
2010-03-11 21:15 . 2010-02-20 20:53	411648	----a-w-	c:\windows\system32\drivers\http.sys

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-09 18:05 . 2008-09-25 18:33	669328	----a-w-	c:\windows\system32\perfh00C.dat
2010-04-09 18:05 . 2008-09-25 18:33	123350	----a-w-	c:\windows\system32\perfc00C.dat
2010-04-07 14:19 . 2008-12-12 09:43	1	----a-w-	c:\users\jes\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-04-05 14:50 . 2009-10-01 13:44	--------	d-----w-	c:\program files\Trend Micro
2010-04-05 07:12 . 2009-10-02 07:07	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-04-04 05:24 . 2008-12-04 15:07	136136	----a-w-	c:\users\jes\AppData\Local\GDIPFONTCACHEV1.DAT
2010-04-01 17:53 . 2009-11-15 19:17	--------	d-----w-	c:\program files\Iminent
2010-04-01 17:51 . 2010-04-01 17:51	--------	d--h--w-	c:\programdata\{EA9CE86F-8625-4C5D-A7DE-52142EF5AB8A}
2010-03-29 22:46 . 2009-10-02 07:07	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-29 22:45 . 2009-10-02 07:07	20824	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-03-28 15:20 . 2009-05-23 13:26	--------	d-----w-	c:\programdata\Downloaded Installations
2010-03-28 14:15 . 2008-09-25 09:37	--------	d-----w-	c:\program files\Google
2010-03-22 12:38 . 2010-04-01 17:51	2487856	----a-w-	c:\programdata\{EA9CE86F-8625-4C5D-A7DE-52142EF5AB8A}\IMBoosterSetup.exe
2010-03-19 09:09 . 2010-02-08 07:44	--------	d-----w-	c:\users\jes\AppData\Roaming\SecondLife
2010-03-12 07:51 . 2006-11-02 11:18	--------	d-----w-	c:\program files\Windows Mail
2010-03-11 21:18 . 2008-09-25 09:50	--------	d-----w-	c:\programdata\Microsoft Help
2010-03-06 07:03 . 2008-12-24 22:59	588472	----a-w-	c:\windows\system32\ezsvc7x.dll
2010-02-24 09:16 . 2010-01-16 11:31	181632	------w-	c:\windows\system32\MpSigStub.exe
2010-02-11 10:04 . 2010-02-11 10:04	64048	----a-w-	c:\programdata\Kaspersky Lab Setup Files\Kaspersky PURE 9.0.0.192\French\setup.exe
2010-01-25 12:00 . 2010-02-24 12:49	471552	----a-w-	c:\windows\system32\secproc_isv.dll
2010-01-25 12:00 . 2010-02-24 12:49	152576	----a-w-	c:\windows\system32\secproc_ssp_isv.dll
2010-01-25 12:00 . 2010-02-24 12:49	152064	----a-w-	c:\windows\system32\secproc_ssp.dll
2010-01-25 12:00 . 2010-02-24 12:49	471552	----a-w-	c:\windows\system32\secproc.dll
2010-01-25 11:58 . 2010-02-24 12:49	332288	----a-w-	c:\windows\system32\msdrm.dll
2010-01-25 08:21 . 2010-02-24 12:49	526336	----a-w-	c:\windows\system32\RMActivate_isv.exe
2010-01-25 08:21 . 2010-02-24 12:49	346624	----a-w-	c:\windows\system32\RMActivate_ssp_isv.exe
2010-01-25 08:21 . 2010-02-24 12:49	518144	----a-w-	c:\windows\system32\RMActivate.exe
2010-01-25 08:21 . 2010-02-24 12:49	347136	----a-w-	c:\windows\system32\RMActivate_ssp.exe
2010-01-23 09:26 . 2010-02-24 12:49	2048	----a-w-	c:\windows\system32	zres.dll
2010-01-16 09:16 . 2010-01-16 09:08	56816	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2010-01-15 12:48 . 2010-01-15 12:48	5115824	----a-w-	c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2008-09-25 18:59 . 2008-09-25 18:39	8192	--sha-w-	c:\windows\Users\Default\NTUSER.DAT
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{346de098-61f9-4b42-89da-6dfba7091bb6}"= "c:\program files\IMBooster4web-en	bIMBo.dll" [2009-12-31 2349080]

[HKEY_CLASSES_ROOT\clsid\{346de098-61f9-4b42-89da-6dfba7091bb6}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{346de098-61f9-4b42-89da-6dfba7091bb6}]
2009-12-31 09:53	2349080	----a-w-	c:\program files\IMBooster4web-en	bIMBo.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{346de098-61f9-4b42-89da-6dfba7091bb6}"= "c:\program files\IMBooster4web-en	bIMBo.dll" [2009-12-31 2349080]

[HKEY_CLASSES_ROOT\clsid\{346de098-61f9-4b42-89da-6dfba7091bb6}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{346DE098-61F9-4B42-89DA-6DFBA7091BB6}"= "c:\program files\IMBooster4web-en	bIMBo.dll" [2009-12-31 2349080]

[HKEY_CLASSES_ROOT\clsid\{346de098-61f9-4b42-89da-6dfba7091bb6}]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\KAVOverlayIcon]
@="{dd230880-495a-11d1-b064-008048ec2fc5}"
[HKEY_CLASSES_ROOT\CLSID\{dd230880-495a-11d1-b064-008048ec2fc5}]
2009-12-25 14:42	129552	----a-w-	c:\program files\Kaspersky Lab\Kaspersky PURE\shellex.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmpcSys"="c:\program files\Packard Bell\SetUpMyPC\SmpSys.exe" [2008-02-04 1038136]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"VeohPlugin"="c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2009-10-06 2075384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"RtHDVCpl"="RtHDVCpl.exe" [2008-05-07 6139904]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-09-25 24064]
"toolbar_eula_launcher"="c:\program files\Packard Bell\GOOGLE_EULA\EULALauncher.exe" [2007-02-20 28672]
"ACTIVBOARD"="c:\program files\Packard Bell\FIJI\aboard.exe" [2007-01-18 79416]
"ORAHSSSessionManager"="c:\program files\OrangeHSS\SessionManager\SessionManager.exe" [2007-12-12 107248]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13580832]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 92704]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky PURE\avp.exe" [2009-12-25 340456]

c:\users\jes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 - Capture d''cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"FilterAdministratorToken"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~4\GoogleDesktopNetwork3.dll c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):52,36,9e,24,da,fb,c9,01

R2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-03-28 136176]
R3 GoogleDesktopManager-071508-051939;Google Desktop Manager 5.7.807.15159;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2008-09-25 24064]
R3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:\windows\system32\Drivers\PCAMp50.sys [2006-11-28 28224]
S0 CSCrySec;InfoWatch Encrypt Sector Library driver;c:\windows\system32\DRIVERS\CSCrySec.sys [2009-12-14 88632]
S0 KLBG;Kaspersky Lab Boot Guard Driver;c:\windows\system32\DRIVERS\klbg.sys [2009-10-14 36880]
S1 CSVirtualDiskDrv;InfoWatch Virtual Disk driver;c:\windows\system32\DRIVERS\CSVirtualDiskDrv.sys [2009-12-14 39352]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2009-09-14 21520]
S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-01-16 108289]
S2 CSObjectsSrv;Service de gestion du système CryproStorage;c:\program files\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe [2009-12-21 743992]
S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe [2008-01-21 21504]
S3 HCW85BDA;Hauppauge WinTV 885 Video Capture;c:\windows\system32\drivers\HCW85BDA.sys [2008-03-19 1176064]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-10-02 19472]
S3 X10Hid;X10 Hid Device;c:\windows\system32\Drivers\x10hid.sys [2006-11-17 13976]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
ezSharedSvc
.
Contenu du dossier 'Tâches planifiées'

2010-04-09 c:\windows\Tasks\Extension de garantie-jes.job
- c:\program files\Packard Bell\SetupmyPC\PBCarNot.exe [2008-09-25 10:13]

2010-04-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-28 14:11]

2010-04-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-28 14:11]

2010-04-09 c:\windows\Tasks\User_Feed_Synchronization-{DEA43EA6-1EB3-4794-BF28-3D763F8821E6}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mWindow Title = 
IE: Ajouter à l'Anti-bannière - c:\program files\Kaspersky Lab\Kaspersky PURE\ie_banner_deny.htm
Trusted Zone: mappy.com
Trusted Zone: orange.fr
Trusted Zone: voila.frw.search.ke
Trusted Zone: weborama.fr\orange
FF - ProfilePath - c:\users\jes\AppData\Roaming\Mozilla\Firefox\Profiles\eckmpq5t.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2032792&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - component: c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll
FF - plugin: c:\program files\Google\Google Earth\plugin
pgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23
pGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Office Live
pOLW.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer
pWebPlayerVideoPluginATL.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency",   1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug",            false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight",       2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize",       1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight",   25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight",     5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
c:\program files\Mozilla Firefox\defaults\pref\all-iminent.js - pref("iminent.currentLcid", 1036);
c:\program files\Mozilla Firefox\defaults\pref\all-iminent.js - pref("iminent.appInstanceUid", "90813e8c-d2d2-4332-a247-bf2633202ba3");
c:\program files\Mozilla Firefox\defaults\pref\all-iminent.js - pref("iminent.currentLcid", 1036);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-09 20:36
Windows 6.0.6002 Service Pack 2 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2010-04-09  20:39:22
ComboFix-quarantined-files.txt  2010-04-09 18:39
ComboFix2.txt  2010-04-09 18:15
ComboFix3.txt  2010-04-09 17:52

Avant-CF: 214 545 928 192 octets libres
Après-CF: 214 515 732 480 octets libres

- - End Of File - - 2D1332B0512187A1A932C3DE46296CF3

archet9 · Answer

Comment se comporte le pc depuis ?

*Télécharge AHK_NavScan de Batch_Man sur ton bureau 
http://batchdhelus.open-web.fr/programme/AHK_NavScan.exe 


*Lance le puis clique sur Scan et valide par Entrée 

*Poste le dans ta prochaine réponse 

a+ 


........

Lulu · Answer

Toujours pareil 

===============================================
Rapport AHK_NavScan 1.0 [4] - 10/04/2010 à 19:34,28
Windows Vista (TM) Home Premium - Mode Normal
Navigateur: Internet Explorer  [Navigateur par défaut]
Utilisateur: jes - Public
Lancement: C:\Users\jes\Desktop\AHK_NavScan.exe
===========================================================================

Informations principales:
-------------------------

Dossier d'installation: C:\Program Files\Mozilla Firefox
Dossier » paramètres: C:\Users\jes\AppData\Roaming\Mozilla\Firefox\Profiles\eckmpq5t.default

===========================================================================

Paramètres principaux:
----------------------


prefs.js --> "browser.migration.version" =  1
prefs.js --> "browser.search.defaulturl" =  "http://search.conduit.com/ResultsExt.aspx?ctid=CT2032792&SearchSource=3&q={searchTerms}"
prefs.js --> "browser.startup.homepage" =  "https://www.google.fr/?gws_rd=ssl"
prefs.js --> "extensions.update.notifyUser" =  false

Searchplugins trouvés:
-----------------------

[C:\Users\jes\AppData\Roaming\Mozilla\Firefox\Profiles\eckmpq5t.default\searchplugins]
conduit.xml --> http://search.conduit.com/ResultsExt.aspx?ctid=CT2032792&SearchSource=3&q=

[C:\Program Files\Mozilla Firefox\searchplugins]
amazon-france.xml --> https://www.amazon.fr/
cnrtl-tlfi-fr.xml --> https://www.cnrtl.fr/lexicographie/
eBay-france.xml --> http://search.ebay.fr/
google.xml --> https://www.google.com/
wikipedia-fr.xml --> https://fr.wikipedia.org/wiki/Sp%C3%A9cial:Recherche
yahoo-france.xml --> https://fr.search.yahoo.com/

Extensions actives:
-------------------


Plugins trouvés:
----------------

[HKLM\SOFTWARE\MozillaPlugins\@veoh.com/VeohWebPlayer]
Version = 1.0.0
Vendor = Veoh Networks
ProductName = Veoh Web Player Video Plugin
Path = C:\Program Files\Veoh Networks\VeohWebPlayer
pWebPlayerVideoPluginATL.dll
Description = Veoh Web Player Video Plugin

[HKLM\SOFTWARE\MozillaPlugins\@veoh.com/VeohTVPlugin]
Version = 1.0.0
Vendor = Veoh Networks
ProductName = Veoh Web Player Plugin
Path = C:\Program Files\Veoh Networks\VeohWebPlayer\NPVeohTVPlugin.dll
Description = Veoh Web Player Plugin

[HKLM\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=8]
Version = 8
Vendor = Google
ProductName = Google Update
Description = Google Update
Path = C:\Program Files\Google\Update\1.2.183.23
pGoogleOneClick8.dll

[HKLM\SOFTWARE\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=]
XPTPath = C:\Program Files\Real\RealPlayer\Netscape6
sJSRealPlayerPlugin.xpt

[HKLM\SOFTWARE\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69]
Vendor = RealNetworks
Description = 6.0.12.69
Version = 6.0.12.69
Product = RealPlayer
Path = C:\Program Files\Real\RealPlayer\Netscape6
prpjplug.dll

[HKLM\SOFTWARE\MozillaPlugins\@real.com/nprjplug;version=1.0.3.69]
Vendor = RealNetworks
Description = RealJukebox Netscape Plugin
Version = 1.0.3.69
Product = RealPlayer
Path = C:\Program Files\Real\RealPlayer\Netscape6
prjplug.dll

[HKLM\SOFTWARE\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69]
XPTPath = C:\Program Files\Real\RealPlayer\Netscape6
ppl3260.xpt
Vendor = RealNetworks
Description = RealPlayer(tm) LiveConnect-Enabled Plug-In
Version = 6.0.12.69
Product = RealPlayer
Path = C:\Program Files\Real\RealPlayer\Netscape6
ppl3260.dll

[HKLM\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
Version = 3.5
Vendor = Microsoft Corp.
ProductName = Windows Presentation Foundation
Path = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
GeckoVersion = 1.7.2
Description = Windows Presentation Foundation plug-in for Mozilla browsers

[HKLM\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709]
Vendor = Microsoft
Version = 14.0.8081.0709
ProductName = Windows Live Photo Gallery
GeckoVersion = 1.0
Description = WLPG Install MIME type
Path = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

[HKLM\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3]
ProductName = Microsoft Office Live Plug-in for Firefox
Description = Office Live Update v1.3
Vendor = Microsoft
Version = 1.3
Path = C:\Program Files\Microsoft\Office Live
pOLW.dll

[HKLM\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
Version = 3.0
Vendor = Microsoft
ProductName = Ag Player
Path = c:\Program Files\Microsoft Silverlight\3.0.50106.0
pctrl.dll
GeckoVersion = 1.7.5
Description = Ag Player Plugin

[HKLM\SOFTWARE\MozillaPlugins\@Google.com/GoogleEarthPlugin]
Path = C:\Program Files\Google\Google Earth\plugin
pgeplugin.dll
EarthVersion = 5.2.0.5860
Version = 1.0.0.0
ProductName = Google Earth Plug-in
Description = Google Earth in your browser
Vendor = Google Inc.

[HKLM\SOFTWARE\MozillaPlugins\@adobe.com/ShockwavePlayer]
Version = 11.0.3.472
Vendor = Adobe Systems Inc
ProductName = Adobe Shockwave Player
Path = C:\Windows\system32\Adobe\Director
p32dsw.dll
Description = Adobe Shockwave Player

[HKLM\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
Version = 10.0.45.2
Description = Adobe® Flash® Player 10
Vendor = Adobe Systems Incorporated
ProductName = Adobe® Flash® Player Plugin
XPTPath = C:\Windows\system32\Macromed\Flash\flashplayer.xpt
Path = C:\Windows\system32\Macromed\Flash\NPSWF32.dll

Plugins bloqués par blocklist.xml
---------------------------------

fdm_ffext@freedownloadmanager.org
langpack-vi-VN@firefox.mozilla.org
masterfiler@gmail.com
mozilla_cc@internetdownloadmanager.com
support@daemon-tools.cc
yslow@yahoo-inc.com
{2224e955-00e9-4613-a844-ce69fccaae91}
{3f963a5b-e555-4543-90e2-c3908898db71}
{4B3803EA-5230-4DC3-A7FC-33638F3D3542}
{8CE11043-9A15-4207-A565-0C94C42D590D}
{B13721C7-F507-4982-B2E5-502A71474FED}

Liste *.dll de dossiers importants:
-----------------------------------

[13/09/2009 11:36:12|A] C:\Program Files\Mozilla Firefox\plugins
pdeploytk.dll
[05/04/2010 16:23:38|A] C:\Program Files\Mozilla Firefox\plugins
pnul32.dll
[21/12/2009 19:34:06|A] C:\Program Files\Mozilla Firefox\plugins
ppdf32.dll
[05/04/2010 16:23:38|A] C:\Program Files\Mozilla Firefox\components\browserdirprovider.dll
[05/04/2010 16:23:38|A] C:\Program Files\Mozilla Firefox\components\brwsrcmp.dll


===========================================================================
Internet Explorer 7.0.6002.18005
===========================================================================

Paramètres principaux:
----------------------

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
Window Title = 
Use Search Asst = no
Enable Browser Extensions = yes
Search bar = http://www.bing.com/spresults.aspx
Secondary Start Pages = 
Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Placeholder_Height = 1A000000
Placeholder_Width = 1A000000
Use_Async_DNS = yes
Anchor_Visitation_Horizon = 01000000
Local Page = %SystemRoot%\system32\blank.htm
Delete_Temp_Files_On_Exit = yes
Cache_Percent_of_Disk = 0A000000
Enable_Disk_Cache = yes
Security Risk Page = about:SecurityRisk
Extensions Off Page = about:NoAdd-ons
Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Secondary_Page_URL = 
Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
AutoHide = yes
Start Page = https://www.msn.com/fr-fr/

[HKCU\SOFTWARE\Microsoft\Internet Explorer\Main]
StartPageCache = 1
Use Custom Search URL = 1
Use Search Asst = no
Default_search_url = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
NotifyDownloadComplete = no
Use FormSuggest = yes
Enable Browser Extensions = yes
AlwaysShowMenus = 1
Check_Associations = no
ShowedCheckBrowser = Yes
RunOnceComplete = 1
RunOnceHasShown = 1
Window_Placement = 2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF320100000900000007060000AB030000
FullScreen = no
CompatibilityFlags = 0
Start Page = https://www.google.fr/?gws_rd=ssl
Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchMigrated = 0
UseClearType = yes
NoUpdateCheck = 1
XMLHTTP = 1
Use_DlgBox_Colors = yes
Show_URLToolBar = yes
Show_URLinStatusBar = yes
Show_ToolBar = yes
Show_StatusBar = yes
Show_FullURL = no
Save_Session_History_On_Exit = no
Local Page = C:\Windows\system32\blank.htm
Do404Search = 01000000
Display Inline Images = yes
Cache_Update_Frequency = Once_Per_Session
Anchor Underline = yes
Disable Script Debugger = yes

AboutURLs:
----------

[HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
PostNotCached = res://ieframe.dll/repost.htm
blank = res://mshtml.dll/blank.htm
Home = 270
OfflineInformation = res://ieframe.dll/offcancl.htm
NavigationCanceled = res://ieframe.dll/navcancl.htm
DesktopItemNavigationFailure = res://ieframe.dll/navcancl.htm
NavigationFailure = res://ieframe.dll/navcancl.htm
Tabs = res://ieframe.dll/tabswelcome.htm
SecurityRisk = res://ieframe.dll/securityatrisk.htm
NoAdd-onsInfo = res://ieframe.dll/noaddoninfo.htm
NoAdd-ons = res://ieframe.dll/noaddon.htm


SearchScopes:
-------------

[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version]

[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}]
URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2032792
DisplayName = IMBooster4web-en Customized Web Search

[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}]
URL = https://www.google.com/webhp?gws_rd=ssl{searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
DisplayName = Search Google

[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
URL = https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&src={referrer:source?}
DisplayName = @ieframe.dll,-12512

[HKEY_USERS\S-1-5-21-4007347698-596265779-3101119184-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version]

[HKEY_USERS\S-1-5-21-4007347698-596265779-3101119184-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}]
URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2032792
DisplayName = IMBooster4web-en Customized Web Search

[HKEY_USERS\S-1-5-21-4007347698-596265779-3101119184-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}]
URL = https://www.google.com/webhp?gws_rd=ssl{searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}&rlz=1I7GGLL_fr
DisplayName = Google

[HKEY_USERS\S-1-5-21-4007347698-596265779-3101119184-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
URL = https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&src={referrer:source?}
DisplayName = @ieframe.dll,-12512

[HKEY_USERS\S-1-5-21-4007347698-596265779-3101119184-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\${searchCLSID}]
URL = https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&src={referrer:source?}
DisplayName = @ieframe.dll,-12512
@ = Live Search

Search:
-------

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Search]
SearchAssistant = https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm
CustomizeSearch = https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm


Extensions:
----------

Analyse des &liens - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll
Research -  - 
Mon Clavier &virtuel - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll
Envoyer à OneNote - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
Ajout Direct - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
Console Java (Sun) - {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC} - C:\Program Files\Java\jre6\bin\ssv.dll


Autres:
-------

[HKLM\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter]

==========================
Fin du rapport - 19:34,29
==========================

archet9 · Answer

Desactives ton antivirus le temps de la manip ainsi que ton parefeu si présent 

 Télécharges List&Kill'em et enregistre le sur ton bureau
 
http://sd-1.archive-host.com/membres/up/829108531491024/List_Killem_Install.exe 
 

 dezippes-le , (clic droit/ extraire.....) 

Il ne necessite pas d'installation 

double clic (clic droit "executer en tant qu'administrateur" pour Vista) pour lancer le scan 

choisis la langue puis choisis l'option 1 = Mode Recherche 

laisses travailler l'outil 

colles le contenu dans ta prochaine réponse , un fois la fenetre refermée : 

C:\List'em.txt 

a+

Lulu · Answer

Apres avoir choisi en francais ya ca :  

http://nsa14.casimages.com/img/2010/04/12/100412103809572089.jpg

archet9 · Answer

Effectivemment je me suis planté...lol L'outil a changé....

Choisis l'option "Search"

a+

Lulu · Answer

oki ^^ ya ca qui reste affiché c normal ? : http://nsa14.casimages.com/img/2010/04/13/100413103505190690.jpg


List'em by g3n-h@ckm@n 1.7.0.5

User : jes (Administrateurs) 
Update on 12/04/2010 by g3n-h@ckm@n ::::: 06.20
Start at: 09:51:18 | 13/04/2010

AMD Phenom(tm) 9100e Quad-Core Processor
Microsoft® Windows Vista(TM) Édition Familiale Premium  (6.0.6002 32-bit) # Service Pack 2
Internet Explorer 7.0.6002.18005
Windows Firewall Status : Disabled

C:\ -> Disque fixe local | 286,09 Go (199,74 Go free) [HDD] | NTFS
D:\ -> Disque amovible
E:\ -> Disque amovible
F:\ -> Disque amovible
G:\ -> Disque amovible
H:\ -> Disque CD-ROM
 
Boot: Normal 
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running 

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32
vvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32undll32.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Packard Bell\FIJI\ABoard.exe
C:\Program Files\Packard Bell\FIJI\AOSD.exe
C:\Program Files\OrangeHSS\Launcher\Launcher.exe
C:\Windows\System32undll32.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Kaspersky Lab\Kaspersky PURE\avp.exe
C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\OrangeHSS\systray\systrayapp.exe
C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Kaspersky Lab\Kaspersky PURE\avp.exe
C:\Program Files\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Windows\system32\IoctlSvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Kaspersky Lab\Kaspersky PURE\klwtblfs.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\List_Kill'em\List_Kill'em.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\List_Kill'em\pv.exe

======================
Keys "Run" 
======================

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
SmpcSys	REG_SZ         	C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
ehTray.exe	REG_SZ         	C:\Windows\ehome\ehTray.exe
Sidebar	REG_SZ         	C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
VeohPlugin	REG_SZ         	"C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
Windows Defender	REG_EXPAND_SZ  	%ProgramFiles%\Windows Defender\MSASCui.exe -hide 
RtHDVCpl	REG_SZ         	RtHDVCpl.exe 
Google Desktop Search	REG_SZ         	"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup 
toolbar_eula_launcher	REG_SZ         	C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe 
ACTIVBOARD	REG_SZ         	C:\Program Files\Packard Bell\FIJI\aboard.exe 
ORAHSSSessionManager	REG_SZ         	C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe 
NvCplDaemon	REG_SZ         	RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup 
NvMediaCenter	REG_SZ         	RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit 
avgnt	REG_SZ         	"C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min 
Adobe Reader Speed Launcher	REG_SZ         	"C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" 
Adobe ARM	REG_SZ         	"C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" 
SunJavaUpdateSched	REG_SZ         	"C:\Program Files\Java\jre6\bin\jusched.exe" 
AVP	REG_SZ         	"C:\Program Files\Kaspersky Lab\Kaspersky PURE\avp.exe" 
 
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] 
ConsentPromptBehaviorAdmin	REG_DWORD      	2 (0x2) 
ConsentPromptBehaviorUser	REG_DWORD      	1 (0x1) 
EnableInstallerDetection	REG_DWORD      	1 (0x1) 
EnableLUA	REG_DWORD      	1 (0x1) 
EnableSecureUIAPaths	REG_DWORD      	1 (0x1) 
EnableVirtualization	REG_DWORD      	1 (0x1) 
PromptOnSecureDesktop	REG_DWORD      	1 (0x1) 
ValidateAdminCodeSignatures	REG_DWORD      	0 (0x0) 
dontdisplaylastusername	REG_DWORD      	0 (0x0) 
legalnoticecaption	REG_SZ         	 
legalnoticetext	REG_SZ         	 
scforceoption	REG_DWORD      	0 (0x0) 
shutdownwithoutlogon	REG_DWORD      	1 (0x1) 
undockwithoutlogon	REG_DWORD      	1 (0x1) 
FilterAdministratorToken	REG_DWORD      	1 (0x1) 
EnableUIADesktopToggle	REG_DWORD      	0 (0x0) 
DisableRegistryTools	REG_DWORD      	0 (0x0) 

===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] 
NoDrives	REG_DWORD      	0 (0x0) 

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] 
BindDirectlyToPropertySetStorage	REG_DWORD      	0 (0x0) 
NoDrives	REG_DWORD      	0 (0x0) 

=============== 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS	REG_SZ         	C:\PROGRA~1\Google\GOOGLE~4\GoogleDesktopNetwork3.dll C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll

===============

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 
 ReportBootOk	REG_SZ         	1 
 Shell	REG_SZ         	Explorer.exe 
 Userinit	REG_SZ         	C:\Windows\system32\userinit.exe, 
 VmApplet	REG_SZ         	rundll32 shell32,Control_RunDLL "sysdm.cpl" 
 AutoRestartShell	REG_DWORD      	1 (0x1) 
 LegalNoticeCaption	REG_SZ         	 
 LegalNoticeText	REG_SZ         	 
 PowerdownAfterShutdown	REG_SZ         	0 
 ShutdownWithoutLogon	REG_SZ         	0 
 cachedlogonscount	REG_SZ         	10 
 forceunlocklogon	REG_DWORD      	0 (0x0) 
 passwordexpirywarning	REG_DWORD      	14 (0xe) 
 Background	REG_SZ         	0 0 0 
 DebugServerCommand	REG_SZ         	no 
 WinStationsDisabled	REG_SZ         	0 
 DisableCAD	REG_DWORD      	1 (0x1) 
 scremoveoption	REG_SZ         	0 
 ShutdownFlags	REG_DWORD      	43 (0x2b) 
 Windows Shell (ezShellStart)	REG_SZ         	C:\Windows\system32\userinit.exe, 
 System	REG_SZ         	 
 SFCDisable	REG_DWORD      	0 (0x0) 

===============

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\klogon]

===============

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{E54729E8-BB3D-4270-9D49-7389EA579090}	REG_SZ         	EasyBits Security Shield Hook - prevents launching insecure programs by kids 
{AEB6717E-7E19-11d0-97EE-00C04FD91972}	REG_SZ         	 

===============

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
C:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe	REG_SZ         	C:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

===============
ActivX controls
===============

[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]

===============
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{233C1507-6A77-46A4-9443-F871F945D258}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2A202491-F00D-11cf-87CC-0020AFEECF20}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7C028AF8-F614-47B3-82DA-BA94E41B1089}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]

==============
BHO :
======
[<NO NAME>	REG_SZ         	]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{346de098-61f9-4b42-89da-6dfba7091bb6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E33CF602-D945-461A-83F0-819F76A199F8}]

===
DNS
===

HKLM\SYSTEM\CCS\Services\Tcpip\..\{3277018D-B9F7-4BB5-BB04-63FD1EC325B3}: DhcpNameServer=192.168.1.1 192.168.1.1 
HKLM\SYSTEM\CS1\Services\Tcpip\..\{3277018D-B9F7-4BB5-BB04-63FD1EC325B3}: DhcpNameServer=192.168.1.1 192.168.1.1 
HKLM\SYSTEM\CS3\Services\Tcpip\..\{3277018D-B9F7-4BB5-BB04-63FD1EC325B3}: DhcpNameServer=192.168.1.1 192.168.1.1 
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1 
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1 
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1 

================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page	REG_SZ         	https://www.msn.com/fr-fr/
Local Page	REG_EXPAND_SZ  	%SystemRoot%\system32\blank.htm
Default_Search_URL	REG_SZ         	https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL	REG_SZ         	https://www.msn.com/fr-fr/?ocid=iehp
Search Page	REG_SZ         	https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page	REG_SZ         	https://www.google.fr/?gws_rd=ssl
Local Page	REG_SZ         	C:\Windows\system32\blank.htm
Search Page	REG_SZ         	http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services] 

Ndisuio : 0x3 ( OK = 3 )
EapHost : 0x3 ( OK = 2 )
Wlansvc : 0x3 ( OK = 2 )
SharedAccess : 0x2 ( OK = 2 )
windefend : 0x2 ( OK = 2 )
wuauserv : 0x2 ( OK = 2 )
wscsvc : 0x2 ( OK = 2 )

========
Safemode
========

"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot" : OK !!  
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal" : OK !!  
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network" : OK !!  
 
=========
Atapi.sys
=========

%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\Windows\ERDNT\cache\atapi.sys
## 
19944,1f05b78ab91c9075565a9d8a4b880bc4,737be9f9376dab0ccdfed93ea6d67f0c432367ea63cd772a453485be769af3bd,C:\Windows\ERDNT\cache\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\Windows\System32\drivers\atapi.sys
## 
19944,1f05b78ab91c9075565a9d8a4b880bc4,737be9f9376dab0ccdfed93ea6d67f0c432367ea63cd772a453485be769af3bd,C:\Windows\System32\drivers\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
## 
19944,1f05b78ab91c9075565a9d8a4b880bc4,737be9f9376dab0ccdfed93ea6d67f0c432367ea63cd772a453485be769af3bd,C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
## 
19048,4f4fcb8b6ea06784fb6d475b7ec7300f,6202d85c9a75e3f01f5f94f069c4cd8a2b9295a182301eae5940ec3bc2c1d896,C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
## 
21560,2d9c903dc76a66813d350a562de40ed9,82609f01a08c6842e4c17c077bb641c1429c0e6657964b7f2d114035e1bdcbf3,C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
## 
21560,2d9c903dc76a66813d350a562de40ed9,82609f01a08c6842e4c17c077bb641c1429c0e6657964b7f2d114035e1bdcbf3,C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
## 
19944,1f05b78ab91c9075565a9d8a4b880bc4,737be9f9376dab0ccdfed93ea6d67f0c432367ea63cd772a453485be769af3bd,C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys

Référence :
==========

Win 2000_SP2   : ff953a8f08ca3f822127654375786bbe
Win 2000_SP4   : 8c718aa8c77041b3285d55a0ce980867
Win XP_32b     : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b      : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b  : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b  : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b  : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b  : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b  : 02062C0B390B7729EDC9E69C680A6F3C
Windows 7_32b_Ultimate : 338c86357871c167a96ab976519bf59e
 
=======
Drive :
=======

D'fragmenteur de disque Windows
Copyright (c) 2006 Microsoft Corp.

Rapport d'analyse pour le volume C: HDD

    Taille du volume                	= 286 Go
    Espace libre                    	= 200 Go
     tendue d'espace libre la plus grande 	= 99.05 Go
    Pourcentage de fragmentation des fichiers 	= 1 %

    Remarqueÿ: sur les volumes NTFS, les fragments de fichiers de plus de 64ÿMo ne sont pas inclus dans les statistiques de fragmentation.

    Il n'est pas n'cessaire de d'fragmenter ce volume. 	 

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Present !! : C:\Windows\Installer\{E1B94435-241E-4519-B1C3-C4DD9EB352A2}  
Present !! : C:\Windows\System32\???????????????????????????????????????????????????????????????????????.vbs 
Present !! : C:\Windows\System32\drivers\etc\hosts.msn 
Present !! : C:\Windows\System32\EZUPBH~1.DLL"  
Present !! : C:\Users\jes\AppData\Local\d3d9caps.dat  
Present !! : C:\Users\jes\AppData\Local\GDIPFONTCACHEV1.DAT  
Present !! : C:\Users\jes\Local Settings\Temp\jes.bmp  
 
¤¤¤¤¤¤¤¤¤¤ Keys : 

Present !! : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives  
Present !! : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives  
Present !! : HKEY_USERS\S-1-5-21-4007347698-596265779-3101119184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives

archet9 · Answer

Relance List_Kill'em(soit en clic droit pour vista/7),avec le raccourci sur ton bureau. 
mais cette fois-ci : 

 choisis l'option clean 

ton PC va redemarrer, 

laisse travailler l'outil. 

en fin de scan la fenetre se ferme , et tu as un rapport du nom de Kill'em.txt sur ton bureau , 

 colle le contenu dans ta reponse 


a+

Lulu · Answer

Kill'em by g3n-h@ckm@n 1.7.0.5 
 
User : jes (Administrateurs) 
Update on 12/04/2010 by g3n-h@ckm@n ::::: 06.20
Start at: 20:11:17 | 13/04/2010

AMD Phenom(tm) 9100e Quad-Core Processor
Microsoft® Windows Vista(TM) Édition Familiale Premium  (6.0.6002 32-bit) # Service Pack 2
Internet Explorer 7.0.6002.18005
Windows Firewall Status : Enabled

C:\ -> Disque fixe local | 286,09 Go (198,78 Go free) [HDD] | NTFS
D:\ -> Disque amovible
E:\ -> Disque amovible
F:\ -> Disque amovible
G:\ -> Disque amovible
H:\ -> Disque CD-ROM
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running
 
 
¤¤¤¤¤¤¤¤¤¤ Files/folders : 

Quarantined & Deleted !! : C:\Windows\Installer\{E1B94435-241E-4519-B1C3-C4DD9EB352A2} 
 
Quarantined & Deleted !! : C:\Windows\System32\gatherWiredInfo.vbs 
Quarantined & Deleted !! : C:\Windows\System32\gatherWirelessInfo.vbs 
Quarantined & Deleted !! : C:\Windows\System32\slmgr.vbs 
Quarantined & Deleted !! : C:\Windows\System32\winrm.vbs 
Quarantined & Deleted !! : C:\Windows\System32\drivers\etc\hosts.msn 
Quarantined & Deleted !! : C:\Windows\System32\EZUPBH~1.DLL 
Quarantined & Deleted !! : C:\Users\jes\AppData\Local\d3d9caps.dat 
Quarantined & Deleted !! : C:\Users\jes\AppData\Local\GDIPFONTCACHEV1.DAT 
Quarantined & Deleted !! : C:\Users\jes\Local Settings\Temp\jes.bmp 
Deleted !! : C:\$Recycle.bin\S-1-5-21-4007347698-596265779-3101119184-1000\$IFBL00Y   
 
==============
host file OK !
==============

========
Registry
========

Deleted : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives  
Deleted : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives  
Deleted : "HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}"  
Deleted : "HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}"  
Deleted : HKCR\ezUPBHook.ShellObj  
Deleted : HKCR\ezUPBHook.ShellObj.1  
Deleted : HKCR\TypeLib\{478CAB91-9E28-11D4-97FF-0050047D51FB}  
Deleted : HKCU\software\Iminent  
Deleted : HKLM\Software\Classes\Interface\{01009AEC-AFAA-4982-9F2B-6411C5C27E77}  
Deleted : HKLM\software\Iminent  
=================
Internet Explorer
=================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page	REG_SZ         	https://www.msn.com/fr-fr/?ocid=iehp
Local Page	REG_SZ         	C:\WINDOWS\system32\blank.htm
Default_Search_URL	REG_SZ         	https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL	REG_SZ         	https://www.msn.com/fr-fr/?ocid=iehp
Search Page	REG_SZ         	https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page	REG_SZ         	https://www.google.com/?gws_rd=ssl
Local Page	REG_SZ         	C:\WINDOWS\system32\blank.htm
Search Page	REG_SZ         	http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

===============
Security Center
===============

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] 
cval	REG_DWORD      	1 (0x1) 
FirewallDisableNotify	REG_DWORD      	0 (0x0) 
AntiVirusDisableNotify	REG_DWORD      	0 (0x0) 
UpdatesDisableNotify	REG_DWORD      	0 (0x0) 
FirstRunDisabled	REG_DWORD      	1 (0x1) 
AntiVirusOverride	REG_DWORD      	1 (0x1) 
FirewallOverride	REG_DWORD      	1 (0x1) 
 
========
Services
=========

 Ndisuio : Start = 3   
 EapHost : Start = 2   
 Wlansvc : Start = 2   
 SharedAccess : Start = 2   
 windefend : Start = 2   
 wuauserv : Start = 2   
 wscsvc : Start = 2   

============
Disk Cleaned
============
 
=================
anti-ver blaster : OK !! 
=================

================
Prefetch cleaned 
================
 
 
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

Lulu · Answer

Non c'est pareil, pi ya meme Windows qui a mit un message avant hier ca disait : Windows a cessé de fonctionner, pi ca a redémarré après ché pas si ya un rapport avec

archet9 · Answer

Fais un scan ESET en ligne ici:

https://www.eset.com/

a+

Lulu · Answer

Voila le resultat ^^
http://nsa14.casimages.com/img/2010/04/15/100415052309296897.jpg

Lulu · Answer

Mais c toujours pareil

archet9 · Answer

Va ds "demarrer"->" rechercher"
Ds cete fenètre copie : c:\program files\Mozilla Firefox
Tu derais y trouver un dossier "uninstall" --> double cic dessus et procède à
la desinstallation....
Fini ensuite se désinstaller firefox (si tu le trouves) via le panneau de config.
==> Réinstalles firefox, et dis si du mieux.

a+

Lulu · Answer

Léger mieux un peu moins long ^^

Lulu · Answer

Ayé ^^ et c pareil

archet9 · Answer

Télécharge SEAF.exe de C_XX . 
Lien de téléchargement : http://pagesperso-orange.fr/NosTools/C_XX/SEAF.exe 

Miroir : https://www.androidworld.fr/ 

*Double clique sur SEAF.exe ("éxécuter en tant qu'administrateur pour vista) . 

*Une fenetre Cmd va s'ouvrir . 

*Tape "entrée" . 

mozilla firefox

*Patiente pendant la recherche . 

*Une fenetre avec un log .txt va s'afficher . 

*Copie/colle ce rapport dans ta prochaine réponse . 

a+

Lulu · Answer

Je comprend pas ca veux pas y mettre quand je valide 
j'ai essayé de collé un résulta précèdent ca marche alors pourquoi ce lui la ca marche pas ?

archet9 · Answer

Essaye ceci :

*Double clique sur SEAF.exe ("éxécuter en tant qu'administrateur pour vista) . 

*Une fenetre Cmd va s'ouvrir . 

*Tape "entrée" . 

 firefox 

*Patiente pendant la recherche . 

*Une fenetre avec un log .txt va s'afficher . 

*Copie/colle ce rapport dans ta prochaine réponse . 

a+

Lulu · Answer

Ayé mais je peu pas poster le résultat ca marche pas

archet9 · Answer

Normal, il doit etre trop long....

Héberge le sur http://www.cijoint.fr/ et colle moi le lien qui sera généré .

a demain, je coupe ce soir...

Lulu · Answer

voila ^^ http://www.cijoint.fr/cj201004/cij5r6r55r.txt

archet9 · Answer

---> Télécharge OTM (OldTimer) sur ton Bureau :  
 http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/  


--->Clique droit sur "OTMoveIt3.exe" et choisis "exécuter en tant qu'administrateur" afin de le lancer.  

---> Copie (Ctrl+C) le texte suivant en gras ci-dessous :  




:files  
c:\Users\jes\AppData\Local\Mozilla\Firefox\Profiles\eckmpq5t 


:commands  
[purity]  
[emptytemp]  
[Reboot] 



---> Colle (Ctrl+V) le texte précédemment copié dans le cadre: 
 Paste Instructions for Items to be Moved.  

---> Clique maintenant sur le bouton MoveIt!  

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.  
Accepte en cliquant sur YES.  

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\  
Le nom du rapport correspond au moment de sa création : date_heure.log  


a+ 
........

Lulu · Answer

All processes killed
========== FILES ==========
File/Folder c:\Users\jes\AppData\Local\Mozilla\Firefox\Profiles\eckmpq5t not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 0 bytes
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: jes
->Temp folder emptied: 3179305 bytes
->Temporary Internet Files folder emptied: 5831139 bytes
->Java cache emptied: 12118713 bytes
->FireFox cache emptied: 63797970 bytes
->Google Chrome cache emptied: 20235559 bytes
->Flash cache emptied: 36422 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 78254632 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 49554 bytes
%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 175,00 mb
 
 
OTM by OldTimer - Version 3.1.10.2 log created on 04212010_102112

Files moved on Reboot...

Registry entries deleted on Reboot...

Lulu · Answer

C'est bon le problème est résolut :) c'est une extension de firefox qui y ralentit apparemment voili voilou  
merci beaucoup pour votre aide et d'avoir enlever les virus :D 

A + ^^

Virus ?

44 réponses

Votre réponse

Discussions similaires

Newsletters