A voir également:
- Antispyware soft bloc mon PC
- Mon pc est lent - Guide
- Reinitialiser pc - Guide
- Test performance pc - Guide
- Plus de son sur mon pc - Guide
- Downloader for pc - Télécharger - Téléchargement & Transfert
31 réponses
Salut,
O_O oula , ton PC est ... ca sera un peu dur :s
Pas mal d'outils a passer, puisque tu dit que tu ne peut rien lancer en mode normal, fait tout en mode sans echec (telecharge les en mode normal et execute les en mode sans echec)
De crainte qu'ils soient reconnuss ... renomme les au telechargement :
Ad remover
* Télécharge AD-Remover (de C_XX) sur ton Bureau. https://www.androidworld.fr/
!!! Déconnecte toi et ferme toutes les applications en cours !!!
* Double-clique sur l'icône AD-Remover
* Au menu principal, clique sur "Nettoyer"
* Confirme le lancement de l'analyse et laisse l'outil travailler
* Poste le rapport qui apparait à la fin (il est aussi sauvegardé sous C:\Ad-report-CLEAN.txt )
(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )
Navilog :
* Télécharge sur le bureau Navilog1 http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe
* Si ton antivirus s'affole , le désactiver
* sous vista : Clic-droit sur le raccourci Navilog1 présent sur le bureau et choisis "Exécuter en tant qu'administrateur"
* sous XP : double-clic dessus pour le lancer
* taper 1 pour Français
* Appuyer sur une touche jusqu' arriver aux options
* Choisir Recherche/Désinfection automatique ( = taper 1 )
* un rapport : fixnavi.txt dans ==> C :
* le copier et le coller dans la réponse
USBfix :
* Télécharge UsbFix (créé par El Desaparecido & C_XX) https://www.ionos.fr/?affiliate_id=77097 sur ton Bureau. Si ton antivirus affiche une alerte, ignore le et désactive le temporairement.
* Branche tes sources de données externes à ton PC (clé USB, disque dur externe, etc...) sans les ouvrir
* Double clique sur le raccourci UsbFix sur ton Bureau, l'installation se fera automatiquement
* Clique sur "Recherche"
* Laisse travailler l'outil
* A la fin, le rapport va s'afficher : poste le dans ta prochaine réponse (il est aussi sauvegardé a la racine du disque dur)
Aide en images : Tutoriel "Recherche"
http://pagesperso-orange.fr/nostools/tuto_usbfix2.html
MalwareBytes AntiMalware :
* Télécharge Malwarebytes https://www.androidworld.fr/
* Tu auras un tutoriel à ta disposition pour l'installer et l'utiliser correctement.
* Fais la mise à jour du logiciel (elle se fait normalement à l'installation)
* Lance une analyse complète en cliquant sur "Exécuter un examen complet"
* Sélectionne les disques que tu veux analyser et clique sur "Lancer l'examen"
* L'analyse peut durer un bon moment.....
* Une fois l'analyse terminée, clique sur "OK" puis sur "Afficher les résultats"
* Vérifie que tout est bien coché et clique sur "Supprimer la sélection" => et ensuite sur "OK"
* Un rapport va s'ouvrir dans le bloc note... Fais un copié/collé du rapport dans ta prochaine réponse sur le forum
* Il se pourrait que certains fichiers devront être supprimés au redémarrage du PC... Fais le en cliquant sur "oui" à la question posée
Poste tout les rapports et refait un log de RSIT pour voir ;)
++
Bonne avec tout ca
Karel
O_O oula , ton PC est ... ca sera un peu dur :s
Pas mal d'outils a passer, puisque tu dit que tu ne peut rien lancer en mode normal, fait tout en mode sans echec (telecharge les en mode normal et execute les en mode sans echec)
De crainte qu'ils soient reconnuss ... renomme les au telechargement :
Ad remover
* Télécharge AD-Remover (de C_XX) sur ton Bureau. https://www.androidworld.fr/
!!! Déconnecte toi et ferme toutes les applications en cours !!!
* Double-clique sur l'icône AD-Remover
* Au menu principal, clique sur "Nettoyer"
* Confirme le lancement de l'analyse et laisse l'outil travailler
* Poste le rapport qui apparait à la fin (il est aussi sauvegardé sous C:\Ad-report-CLEAN.txt )
(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )
Navilog :
* Télécharge sur le bureau Navilog1 http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe
* Si ton antivirus s'affole , le désactiver
* sous vista : Clic-droit sur le raccourci Navilog1 présent sur le bureau et choisis "Exécuter en tant qu'administrateur"
* sous XP : double-clic dessus pour le lancer
* taper 1 pour Français
* Appuyer sur une touche jusqu' arriver aux options
* Choisir Recherche/Désinfection automatique ( = taper 1 )
* un rapport : fixnavi.txt dans ==> C :
* le copier et le coller dans la réponse
USBfix :
* Télécharge UsbFix (créé par El Desaparecido & C_XX) https://www.ionos.fr/?affiliate_id=77097 sur ton Bureau. Si ton antivirus affiche une alerte, ignore le et désactive le temporairement.
* Branche tes sources de données externes à ton PC (clé USB, disque dur externe, etc...) sans les ouvrir
* Double clique sur le raccourci UsbFix sur ton Bureau, l'installation se fera automatiquement
* Clique sur "Recherche"
* Laisse travailler l'outil
* A la fin, le rapport va s'afficher : poste le dans ta prochaine réponse (il est aussi sauvegardé a la racine du disque dur)
Aide en images : Tutoriel "Recherche"
http://pagesperso-orange.fr/nostools/tuto_usbfix2.html
MalwareBytes AntiMalware :
* Télécharge Malwarebytes https://www.androidworld.fr/
* Tu auras un tutoriel à ta disposition pour l'installer et l'utiliser correctement.
* Fais la mise à jour du logiciel (elle se fait normalement à l'installation)
* Lance une analyse complète en cliquant sur "Exécuter un examen complet"
* Sélectionne les disques que tu veux analyser et clique sur "Lancer l'examen"
* L'analyse peut durer un bon moment.....
* Une fois l'analyse terminée, clique sur "OK" puis sur "Afficher les résultats"
* Vérifie que tout est bien coché et clique sur "Supprimer la sélection" => et ensuite sur "OK"
* Un rapport va s'ouvrir dans le bloc note... Fais un copié/collé du rapport dans ta prochaine réponse sur le forum
* Il se pourrait que certains fichiers devront être supprimés au redémarrage du PC... Fais le en cliquant sur "oui" à la question posée
Poste tout les rapports et refait un log de RSIT pour voir ;)
++
Bonne avec tout ca
Karel
voila le rapport ad-remover :
.
======= RAPPORT D'AD-REMOVER 2.0.0.0,D | UNIQUEMENT XP/VISTA/7 =======
.
Mis à jour par C_XX le 19/05/10 à 19:20
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 16:39:32 le 05/06/2010 | Mode normal | Option: CLEAN
Exécuté de: C:\Ad-Remover\ADR.exe
SE: Microsoft® Windows Vista(TM) Édition Familiale Premium (Service Pack 2 - X86)
Nom du PC: ETOILENOIRE (HP-Pavilion GG684AA-ABF a6157.fr)
Utilisateur actuel: MANU
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.
Service: *MyWebSearchService*
.
\Users\crash\AppData\Local\kfcrn_navps.dat
\Users\crash\AppData\Local\VirtualStore\Program Files\AskTBar
\Users\crash\AppData\LocalLow\AskToolbar
\Users\crash\AppData\LocalLow\Dealio
\Users\crash\AppData\LocalLow\FunWebProducts
\Users\crash\AppData\LocalLow\MyWebSearch
\Users\crash\AppData\LocalLow\Search Settings
\Users\crash\AppData\LocalLow\Zango
\Users\crash\AppData\Roaming\EoRezo
\Users\crash\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\5LGCAP6E\casino.com
\Users\MANU\AppData\Local\AskToolbar
\Users\MANU\AppData\Local\susssqe_navps.dat
\Users\MANU\AppData\Local\Temp\AskSearch
\Users\MANU\AppData\Local\VirtualStore\Program Files\AskTBar
\Users\MANU\AppData\Local\VirtualStore\Program Files\InternetGameBox
\Users\MANU\AppData\LocalLow\AskToolbar
\Users\MANU\AppData\LocalLow\FunWebProducts
\Users\MANU\AppData\LocalLow\MyWebSearch
\Users\MANU\AppData\LocalLow\Search Settings
\Users\MANU\AppData\Roaming\EoRezo
\Users\MANU\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PlayMP3z
\Users\MANU\AppData\Roaming\Mozilla\Firefox\Profiles\f4tdm179.default\searchplugins\Yoog Search.xml
\Users\MANU\AppData\Roaming\Search Settings
\Users\p'tit poie\AppData\Local\VirtualStore\Program Files\AskTBar
\Users\p'tit poie\AppData\LocalLow\Dealio
\Users\p'tit poie\AppData\LocalLow\Search Settings
\Users\p'tit poie\AppData\LocalLow\Zango
\Users\p'tit poie\AppData\Roaming\EoRezo
C:\Program Files\Ask.com
C:\Program Files\AskTBar
C:\Program Files\Dealio
C:\Program Files\EoRezo
C:\Program Files\EvenMoreMegaSwellAdsForYou
C:\Program Files\Mozilla FireFox\extensions\EvenMoreMegaSwellAdsForYou@EvenMoreMegaSwellAdsForYou
C:\Program Files\Mozilla FireFox\extensions\search@searchsettings.com
C:\Program Files\MyWebSearch
C:\Program Files\PlayMP3z
C:\Program Files\Search Settings
C:\Users\MANU\AppData\Local\kfcav.bat
C:\Users\MANU\AppData\Local\susssqe.dat
C:\Users\MANU\AppData\Local\susssqe_nav.dat
C:\Users\MANU\AppData\Local\Temp\ASKSUTBLOG
C:\Users\MANU\AppData\Roaming\Mozilla\FireFox\Profiles\f4tdm179.default\extensions\toolbar@ask.com
C:\Users\MANU\AppData\Roaming\Mozilla\FireFox\Profiles\f4tdm179.default\searchplugins\mywebsearch.xml
C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
C:\Windows\system32\a714e0f0-692c-f9d1-ee4d-0dfbe13d3dc4.exe
C:\Windows\system32\cdlwqqasfck.dll-uninst.exe
C:\Windows\system32\nsb7B9E.dll
C:\Windows\system32\Tasks\Scheduled Update for Ask Toolbar
(!) -- Fichiers temporaires supprimés.
.
HKCU\Software\AppDataLow\6772f3f4-2b28-ffd5-4445-1a65a74169bc
HKCU\Software\AppDataLow\AskToolbarInfo
HKCU\Software\AppDataLow\HavingFunOnline
HKCU\Software\AppDataLow\Software\AskToolbar
HKCU\Software\AppDataLow\Software\Fun Web Products
HKCU\Software\AppDataLow\Software\FunWebProducts
HKCU\Software\AppDataLow\Software\MyWebSearch
HKCU\Software\Ask.com
HKCU\Software\AskToolbar
HKCU\Software\EoRezo
HKCU\Software\fcn
HKCU\Software\FunWebProducts
HKCU\Software\ItsLabel
HKCU\Software\MediaHoldings
HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\{FC28D89F-A49C-AD10-FF88-F275E0E77BFE}
HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Search Settings
HKCU\Software\Microsoft\Internet Explorer\MenuExt\&Search
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1F20F6AF-E17C-4AA1-8D8E-42366E2F935A}
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{78444BEC-0312-4AFF-8643-92671C348EE2}
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{23B35258-D05F-892D-955A-455373B44400}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9CB65201-89C4-402c-BA80-02D8C59F9B1D}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{bf881efd-922b-84d6-03b2-8b3091f03852}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FE063DB9-4EC0-403e-8DD8-394C54984B2C}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{23B35258-D05F-892D-955A-455373B44400}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9CB65201-89C4-402c-BA80-02D8C59F9B1D}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{bf881efd-922b-84d6-03b2-8b3091f03852}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FC28D89F-A49C-AD10-FF88-F275E0E77BFE}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FE063DB9-4EC0-403e-8DD8-394C54984B2C}
HKCU\Software\PlayMP3
HKCU\Software\Search Settings
HKLM\Software\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
HKLM\Software\Classes\AppID\GenericAskToolbar.DLL
HKLM\Software\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
HKLM\Software\Classes\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
HKLM\Software\Classes\CLSID\{23B35258-D05F-892D-955A-455373B44400}
HKLM\Software\Classes\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}
HKLM\Software\Classes\CLSID\{9CB65201-89C4-402c-BA80-02D8C59F9B1D}
HKLM\Software\Classes\CLSID\{bf881efd-922b-84d6-03b2-8b3091f03852}
HKLM\Software\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKLM\Software\Classes\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKLM\Software\Classes\CLSID\{FC28D89F-A49C-AD10-FF88-F275E0E77BFE}
HKLM\Software\Classes\CLSID\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}
HKLM\Software\Classes\CLSID\{FE063DB9-4EC0-403e-8DD8-394C54984B2C}
HKLM\Software\Classes\CLSID\{FE063DBB-4EC0-403e-8DD8-394C54984B2C}
HKLM\Software\Classes\EoRezoBHO.EoBho
HKLM\Software\Classes\EoRezoBHO.EoBho.1
HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd
HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd.1
HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
HKLM\Software\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
HKLM\Software\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
HKLM\Software\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
HKLM\Software\Classes\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
HKLM\Software\Classes\Interface\{D5A1EF9A-7948-435D-8B87-D6A598317288}
HKLM\Software\Classes\SearchSettings.BHO
HKLM\Software\Classes\SearchSettings.BHO.1
HKLM\Software\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
HKLM\Software\Classes\TypeLib\{CD082CCA-086F-4FD8-8FD7-247A0DBBD1CC}
HKLM\Software\Dealio
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{23B35258-D05F-892D-955A-455373B44400}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9CB65201-89C4-402c-BA80-02D8C59F9B1D}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bf881efd-922b-84d6-03b2-8b3091f03852}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{FE063DBB-4EC0-403e-8DD8-394C54984B2C}
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2DEF3672-4482-4E0F-8CC9-76EF0658FD5D}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3D9BB77E-156F-FD07-1DD2-E45DA2E10915}
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\a714e0f0-692c-f9d1-ee4d-0dfbe13d3dc4
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\EvenMoreMegaSwellAdsForYou
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\kfcav
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\PlayMP3
HKLM\Software\Search Settings
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{07B18EA9-A523-4961-B6BB-170DE4475CCA}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F}
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks|{9CB65206-89C4-402C-BA80-02D8C59F9B1D}
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks|{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKCU\Software\Microsoft\Windows\CurrentVersion\Run|susssqe
HKLM\Software\Microsoft\Internet Explorer\Toolbar|{07B18EA9-A523-4961-B6BB-170DE4475CCA}
HKLM\Software\Microsoft\Internet Explorer\Toolbar|{D4027C7F-154A-4066-A1AD-4243D8127440}
HKLM\Software\Microsoft\Internet Explorer\Toolbar|{FE063DB9-4EC0-403E-8DD8-394C54984B2C}
HKLM\Software\Microsoft\Windows\CurrentVersion\Run|My Web Search Bar Search Scope Monitor
HKLM\Software\Microsoft\Windows\CurrentVersion\Run|SearchSettings
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\Search Settings\kb127\SearchSettings.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\Search Settings\kb127\SearchSettingsRes409.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\Search Settings\SearchSettings.exe
.
.
============== SCAN ADDITIONNEL ==============
.
* Mozilla FireFox Version 3.5.9 (fr) *
.
C:\Users\MANU\..\f4tdm179.default\prefs.js - browser.download.dir: C:\\Users\\MANU\\Downloads
C:\Users\MANU\..\f4tdm179.default\prefs.js - browser.download.lastDir: C:\\Users\\MANU\\Documents
C:\Users\MANU\..\f4tdm179.default\prefs.js - browser.search.defaultenginename: Yoog Search
C:\Users\MANU\..\f4tdm179.default\prefs.js - browser.search.defaulturl: hxxp://www27.searchonthego.net/search.php?q=
C:\Users\MANU\..\f4tdm179.default\prefs.js - browser.search.selectedEngine: Yoog Search
C:\Users\MANU\..\f4tdm179.default\prefs.js - browser.startup.homepage: hxxp://www.google.com/intl/fr/
C:\Users\MANU\..\f4tdm179.default\prefs.js - browser.startup.homepage_override.mstone: rv:1.9.1.9
C:\Users\MANU\..\f4tdm179.default\prefs.js - keyword.URL: hxxp://www27.searchonthego.net/search.php?q=
C:\Users\MANU\..\f4tdm179.default\prefs.js - privacy.popups.showBrowserMessage, false
\Users\crash\..\kl4257fc.default\prefs.js - browser.download.dir: C:\\Users\\crash\\Downloads
\Users\crash\..\kl4257fc.default\prefs.js - browser.download.lastDir: C:\\Users\\crash\\Pictures\\jeux vidéos\\halo
\Users\crash\..\kl4257fc.default\prefs.js - browser.search.defaultenginename: Fast Browser Search
\Users\crash\..\kl4257fc.default\prefs.js - browser.search.defaulturl: hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q=
\Users\crash\..\kl4257fc.default\prefs.js - browser.search.selectedEngine: Google
\Users\crash\..\kl4257fc.default\prefs.js - browser.startup.homepage: hxxp://www.google.com/intl/fr/
\Users\crash\..\kl4257fc.default\prefs.js - browser.startup.homepage_override.mstone: rv:1.9.1.9
\Users\crash\..\kl4257fc.default\prefs.js - keyword.URL: hxxp://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=19&tid={B99BFD94-6520-2868-2A8C-C1133BA75A65}&q=
\Users\crash\..\kl4257fc.default\prefs.js - privacy.popups.showBrowserMessage, false
\Users\MANU\..\f4tdm179.default\prefs.js - browser.download.dir: C:\\Users\\MANU\\Downloads
\Users\MANU\..\f4tdm179.default\prefs.js - browser.download.lastDir: C:\\Users\\MANU\\Documents
\Users\MANU\..\f4tdm179.default\prefs.js - browser.search.defaultenginename: Yoog Search
\Users\MANU\..\f4tdm179.default\prefs.js - browser.search.defaulturl: hxxp://www27.searchonthego.net/search.php?q=
\Users\MANU\..\f4tdm179.default\prefs.js - browser.search.selectedEngine: Yoog Search
\Users\MANU\..\f4tdm179.default\prefs.js - browser.startup.homepage: hxxp://www.google.com/intl/fr/
\Users\MANU\..\f4tdm179.default\prefs.js - browser.startup.homepage_override.mstone: rv:1.9.1.9
\Users\MANU\..\f4tdm179.default\prefs.js - keyword.URL: hxxp://www27.searchonthego.net/search.php?q=
\Users\MANU\..\f4tdm179.default\prefs.js - privacy.popups.showBrowserMessage, false
\Users\p'tit poie\..\mducg6qk.default\prefs.js - browser.download.dir: C:\\Users\\p'tit poie\\Downloads
\Users\p'tit poie\..\mducg6qk.default\prefs.js - browser.download.lastDir: C:\\Users\\p'tit poie\\Downloads
\Users\p'tit poie\..\mducg6qk.default\prefs.js - browser.startup.homepage_override.mstone: rv:1.9.0.3
.
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("browser.search.defaultenginename", "Yoog Search");
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("browser.search.selectedEngine", "Yoog Search");
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.asktb.cbid", "OF");
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.asktb.default-channel-url-mask", "hxxp://fr.ask.com/web?q={query}&o={o}&l={l}&qsrc={qsrc}");
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.asktb.dtid", "VIN003YYFR");
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.asktb.fresh-install", false);
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.asktb.l", "dis");
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.asktb.last-config-req", "1275686552594");
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.asktb.locale", "fr_FR");
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.asktb.o", "16050");
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.asktb.overlay-reloaded-using-restart", true);
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.asktb.qsrc", "2871");
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.asktb.r", "3");
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.asktb.to", "16105");
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.enabledItems", "toolbar@ask.com:3.6.8.107,{3112ca9c-de6d-4884-a869-9855de68056c}:7.0.20100326W,{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}:6.0.16,{20a82645-c095-46ed-80e3-08825760534b}:1.2.1,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.9");
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.mywebsearch.openSearchURL", "hxxp://search.mywebsearch.com/mywebsearch/opensearch.jhtml?id=ZCfox000(2)&ptb=9d9VPEBMqxLaCMefF9zJBQ");
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.mywebsearch.prevKwdEnabled", true);
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.mywebsearch.prevKwdURL", "hxxp://mystart.incredimail.com/?loc=ff_address_bar&search=");
.
* Internet Explorer Version 8.0.6001.18904 *
.
[HKCU\Software\Microsoft\Internet Explorer\Main]
.
AutoHide: yes
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\Windows\system32\blank.htm
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Use Search Asst: no
.
[HKLM\Software\Microsoft\Internet Explorer\Main]
.
AutoHide: yes
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Enable Browser Extensions: yes
Local Page: C:\Windows\System32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/
Use Search Asst: no
.
[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm
.
========================================
.
C:\Ad-Remover\Quarantine: 2199 Fichier(s)
C:\Ad-Remover\Backup: 15 Fichier(s)
.
\Ad-Report-CLEAN[1].txt - 17752 Octet(s)
.
Fin à: 16:50:04, 05/06/2010
.
============== E.O.F - CLEAN[1] ==============
.
======= RAPPORT D'AD-REMOVER 2.0.0.0,D | UNIQUEMENT XP/VISTA/7 =======
.
Mis à jour par C_XX le 19/05/10 à 19:20
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 16:39:32 le 05/06/2010 | Mode normal | Option: CLEAN
Exécuté de: C:\Ad-Remover\ADR.exe
SE: Microsoft® Windows Vista(TM) Édition Familiale Premium (Service Pack 2 - X86)
Nom du PC: ETOILENOIRE (HP-Pavilion GG684AA-ABF a6157.fr)
Utilisateur actuel: MANU
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.
Service: *MyWebSearchService*
.
\Users\crash\AppData\Local\kfcrn_navps.dat
\Users\crash\AppData\Local\VirtualStore\Program Files\AskTBar
\Users\crash\AppData\LocalLow\AskToolbar
\Users\crash\AppData\LocalLow\Dealio
\Users\crash\AppData\LocalLow\FunWebProducts
\Users\crash\AppData\LocalLow\MyWebSearch
\Users\crash\AppData\LocalLow\Search Settings
\Users\crash\AppData\LocalLow\Zango
\Users\crash\AppData\Roaming\EoRezo
\Users\crash\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\5LGCAP6E\casino.com
\Users\MANU\AppData\Local\AskToolbar
\Users\MANU\AppData\Local\susssqe_navps.dat
\Users\MANU\AppData\Local\Temp\AskSearch
\Users\MANU\AppData\Local\VirtualStore\Program Files\AskTBar
\Users\MANU\AppData\Local\VirtualStore\Program Files\InternetGameBox
\Users\MANU\AppData\LocalLow\AskToolbar
\Users\MANU\AppData\LocalLow\FunWebProducts
\Users\MANU\AppData\LocalLow\MyWebSearch
\Users\MANU\AppData\LocalLow\Search Settings
\Users\MANU\AppData\Roaming\EoRezo
\Users\MANU\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PlayMP3z
\Users\MANU\AppData\Roaming\Mozilla\Firefox\Profiles\f4tdm179.default\searchplugins\Yoog Search.xml
\Users\MANU\AppData\Roaming\Search Settings
\Users\p'tit poie\AppData\Local\VirtualStore\Program Files\AskTBar
\Users\p'tit poie\AppData\LocalLow\Dealio
\Users\p'tit poie\AppData\LocalLow\Search Settings
\Users\p'tit poie\AppData\LocalLow\Zango
\Users\p'tit poie\AppData\Roaming\EoRezo
C:\Program Files\Ask.com
C:\Program Files\AskTBar
C:\Program Files\Dealio
C:\Program Files\EoRezo
C:\Program Files\EvenMoreMegaSwellAdsForYou
C:\Program Files\Mozilla FireFox\extensions\EvenMoreMegaSwellAdsForYou@EvenMoreMegaSwellAdsForYou
C:\Program Files\Mozilla FireFox\extensions\search@searchsettings.com
C:\Program Files\MyWebSearch
C:\Program Files\PlayMP3z
C:\Program Files\Search Settings
C:\Users\MANU\AppData\Local\kfcav.bat
C:\Users\MANU\AppData\Local\susssqe.dat
C:\Users\MANU\AppData\Local\susssqe_nav.dat
C:\Users\MANU\AppData\Local\Temp\ASKSUTBLOG
C:\Users\MANU\AppData\Roaming\Mozilla\FireFox\Profiles\f4tdm179.default\extensions\toolbar@ask.com
C:\Users\MANU\AppData\Roaming\Mozilla\FireFox\Profiles\f4tdm179.default\searchplugins\mywebsearch.xml
C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
C:\Windows\system32\a714e0f0-692c-f9d1-ee4d-0dfbe13d3dc4.exe
C:\Windows\system32\cdlwqqasfck.dll-uninst.exe
C:\Windows\system32\nsb7B9E.dll
C:\Windows\system32\Tasks\Scheduled Update for Ask Toolbar
(!) -- Fichiers temporaires supprimés.
.
HKCU\Software\AppDataLow\6772f3f4-2b28-ffd5-4445-1a65a74169bc
HKCU\Software\AppDataLow\AskToolbarInfo
HKCU\Software\AppDataLow\HavingFunOnline
HKCU\Software\AppDataLow\Software\AskToolbar
HKCU\Software\AppDataLow\Software\Fun Web Products
HKCU\Software\AppDataLow\Software\FunWebProducts
HKCU\Software\AppDataLow\Software\MyWebSearch
HKCU\Software\Ask.com
HKCU\Software\AskToolbar
HKCU\Software\EoRezo
HKCU\Software\fcn
HKCU\Software\FunWebProducts
HKCU\Software\ItsLabel
HKCU\Software\MediaHoldings
HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\{FC28D89F-A49C-AD10-FF88-F275E0E77BFE}
HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Search Settings
HKCU\Software\Microsoft\Internet Explorer\MenuExt\&Search
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1F20F6AF-E17C-4AA1-8D8E-42366E2F935A}
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{78444BEC-0312-4AFF-8643-92671C348EE2}
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{23B35258-D05F-892D-955A-455373B44400}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9CB65201-89C4-402c-BA80-02D8C59F9B1D}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{bf881efd-922b-84d6-03b2-8b3091f03852}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FE063DB9-4EC0-403e-8DD8-394C54984B2C}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{23B35258-D05F-892D-955A-455373B44400}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9CB65201-89C4-402c-BA80-02D8C59F9B1D}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{bf881efd-922b-84d6-03b2-8b3091f03852}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FC28D89F-A49C-AD10-FF88-F275E0E77BFE}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FE063DB9-4EC0-403e-8DD8-394C54984B2C}
HKCU\Software\PlayMP3
HKCU\Software\Search Settings
HKLM\Software\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
HKLM\Software\Classes\AppID\GenericAskToolbar.DLL
HKLM\Software\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
HKLM\Software\Classes\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
HKLM\Software\Classes\CLSID\{23B35258-D05F-892D-955A-455373B44400}
HKLM\Software\Classes\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}
HKLM\Software\Classes\CLSID\{9CB65201-89C4-402c-BA80-02D8C59F9B1D}
HKLM\Software\Classes\CLSID\{bf881efd-922b-84d6-03b2-8b3091f03852}
HKLM\Software\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKLM\Software\Classes\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKLM\Software\Classes\CLSID\{FC28D89F-A49C-AD10-FF88-F275E0E77BFE}
HKLM\Software\Classes\CLSID\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}
HKLM\Software\Classes\CLSID\{FE063DB9-4EC0-403e-8DD8-394C54984B2C}
HKLM\Software\Classes\CLSID\{FE063DBB-4EC0-403e-8DD8-394C54984B2C}
HKLM\Software\Classes\EoRezoBHO.EoBho
HKLM\Software\Classes\EoRezoBHO.EoBho.1
HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd
HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd.1
HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
HKLM\Software\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
HKLM\Software\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
HKLM\Software\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
HKLM\Software\Classes\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
HKLM\Software\Classes\Interface\{D5A1EF9A-7948-435D-8B87-D6A598317288}
HKLM\Software\Classes\SearchSettings.BHO
HKLM\Software\Classes\SearchSettings.BHO.1
HKLM\Software\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
HKLM\Software\Classes\TypeLib\{CD082CCA-086F-4FD8-8FD7-247A0DBBD1CC}
HKLM\Software\Dealio
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{23B35258-D05F-892D-955A-455373B44400}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9CB65201-89C4-402c-BA80-02D8C59F9B1D}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bf881efd-922b-84d6-03b2-8b3091f03852}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{FE063DBB-4EC0-403e-8DD8-394C54984B2C}
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2DEF3672-4482-4E0F-8CC9-76EF0658FD5D}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3D9BB77E-156F-FD07-1DD2-E45DA2E10915}
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\a714e0f0-692c-f9d1-ee4d-0dfbe13d3dc4
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\EvenMoreMegaSwellAdsForYou
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\kfcav
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\PlayMP3
HKLM\Software\Search Settings
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{07B18EA9-A523-4961-B6BB-170DE4475CCA}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F}
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks|{9CB65206-89C4-402C-BA80-02D8C59F9B1D}
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks|{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKCU\Software\Microsoft\Windows\CurrentVersion\Run|susssqe
HKLM\Software\Microsoft\Internet Explorer\Toolbar|{07B18EA9-A523-4961-B6BB-170DE4475CCA}
HKLM\Software\Microsoft\Internet Explorer\Toolbar|{D4027C7F-154A-4066-A1AD-4243D8127440}
HKLM\Software\Microsoft\Internet Explorer\Toolbar|{FE063DB9-4EC0-403E-8DD8-394C54984B2C}
HKLM\Software\Microsoft\Windows\CurrentVersion\Run|My Web Search Bar Search Scope Monitor
HKLM\Software\Microsoft\Windows\CurrentVersion\Run|SearchSettings
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\Search Settings\kb127\SearchSettings.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\Search Settings\kb127\SearchSettingsRes409.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\Search Settings\SearchSettings.exe
.
.
============== SCAN ADDITIONNEL ==============
.
* Mozilla FireFox Version 3.5.9 (fr) *
.
C:\Users\MANU\..\f4tdm179.default\prefs.js - browser.download.dir: C:\\Users\\MANU\\Downloads
C:\Users\MANU\..\f4tdm179.default\prefs.js - browser.download.lastDir: C:\\Users\\MANU\\Documents
C:\Users\MANU\..\f4tdm179.default\prefs.js - browser.search.defaultenginename: Yoog Search
C:\Users\MANU\..\f4tdm179.default\prefs.js - browser.search.defaulturl: hxxp://www27.searchonthego.net/search.php?q=
C:\Users\MANU\..\f4tdm179.default\prefs.js - browser.search.selectedEngine: Yoog Search
C:\Users\MANU\..\f4tdm179.default\prefs.js - browser.startup.homepage: hxxp://www.google.com/intl/fr/
C:\Users\MANU\..\f4tdm179.default\prefs.js - browser.startup.homepage_override.mstone: rv:1.9.1.9
C:\Users\MANU\..\f4tdm179.default\prefs.js - keyword.URL: hxxp://www27.searchonthego.net/search.php?q=
C:\Users\MANU\..\f4tdm179.default\prefs.js - privacy.popups.showBrowserMessage, false
\Users\crash\..\kl4257fc.default\prefs.js - browser.download.dir: C:\\Users\\crash\\Downloads
\Users\crash\..\kl4257fc.default\prefs.js - browser.download.lastDir: C:\\Users\\crash\\Pictures\\jeux vidéos\\halo
\Users\crash\..\kl4257fc.default\prefs.js - browser.search.defaultenginename: Fast Browser Search
\Users\crash\..\kl4257fc.default\prefs.js - browser.search.defaulturl: hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q=
\Users\crash\..\kl4257fc.default\prefs.js - browser.search.selectedEngine: Google
\Users\crash\..\kl4257fc.default\prefs.js - browser.startup.homepage: hxxp://www.google.com/intl/fr/
\Users\crash\..\kl4257fc.default\prefs.js - browser.startup.homepage_override.mstone: rv:1.9.1.9
\Users\crash\..\kl4257fc.default\prefs.js - keyword.URL: hxxp://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=19&tid={B99BFD94-6520-2868-2A8C-C1133BA75A65}&q=
\Users\crash\..\kl4257fc.default\prefs.js - privacy.popups.showBrowserMessage, false
\Users\MANU\..\f4tdm179.default\prefs.js - browser.download.dir: C:\\Users\\MANU\\Downloads
\Users\MANU\..\f4tdm179.default\prefs.js - browser.download.lastDir: C:\\Users\\MANU\\Documents
\Users\MANU\..\f4tdm179.default\prefs.js - browser.search.defaultenginename: Yoog Search
\Users\MANU\..\f4tdm179.default\prefs.js - browser.search.defaulturl: hxxp://www27.searchonthego.net/search.php?q=
\Users\MANU\..\f4tdm179.default\prefs.js - browser.search.selectedEngine: Yoog Search
\Users\MANU\..\f4tdm179.default\prefs.js - browser.startup.homepage: hxxp://www.google.com/intl/fr/
\Users\MANU\..\f4tdm179.default\prefs.js - browser.startup.homepage_override.mstone: rv:1.9.1.9
\Users\MANU\..\f4tdm179.default\prefs.js - keyword.URL: hxxp://www27.searchonthego.net/search.php?q=
\Users\MANU\..\f4tdm179.default\prefs.js - privacy.popups.showBrowserMessage, false
\Users\p'tit poie\..\mducg6qk.default\prefs.js - browser.download.dir: C:\\Users\\p'tit poie\\Downloads
\Users\p'tit poie\..\mducg6qk.default\prefs.js - browser.download.lastDir: C:\\Users\\p'tit poie\\Downloads
\Users\p'tit poie\..\mducg6qk.default\prefs.js - browser.startup.homepage_override.mstone: rv:1.9.0.3
.
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("browser.search.defaultenginename", "Yoog Search");
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("browser.search.selectedEngine", "Yoog Search");
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.asktb.cbid", "OF");
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.asktb.default-channel-url-mask", "hxxp://fr.ask.com/web?q={query}&o={o}&l={l}&qsrc={qsrc}");
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.asktb.dtid", "VIN003YYFR");
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.asktb.fresh-install", false);
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.asktb.l", "dis");
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.asktb.last-config-req", "1275686552594");
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.asktb.locale", "fr_FR");
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.asktb.o", "16050");
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.asktb.overlay-reloaded-using-restart", true);
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.asktb.qsrc", "2871");
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.asktb.r", "3");
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.asktb.to", "16105");
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.enabledItems", "toolbar@ask.com:3.6.8.107,{3112ca9c-de6d-4884-a869-9855de68056c}:7.0.20100326W,{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}:6.0.16,{20a82645-c095-46ed-80e3-08825760534b}:1.2.1,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.9");
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.mywebsearch.openSearchURL", "hxxp://search.mywebsearch.com/mywebsearch/opensearch.jhtml?id=ZCfox000(2)&ptb=9d9VPEBMqxLaCMefF9zJBQ");
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.mywebsearch.prevKwdEnabled", true);
EFFACÉ: C:\Users\MANU\..\f4tdm179.default\prefs.js - user_pref("extensions.mywebsearch.prevKwdURL", "hxxp://mystart.incredimail.com/?loc=ff_address_bar&search=");
.
* Internet Explorer Version 8.0.6001.18904 *
.
[HKCU\Software\Microsoft\Internet Explorer\Main]
.
AutoHide: yes
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\Windows\system32\blank.htm
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Use Search Asst: no
.
[HKLM\Software\Microsoft\Internet Explorer\Main]
.
AutoHide: yes
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Enable Browser Extensions: yes
Local Page: C:\Windows\System32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/
Use Search Asst: no
.
[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm
.
========================================
.
C:\Ad-Remover\Quarantine: 2199 Fichier(s)
C:\Ad-Remover\Backup: 15 Fichier(s)
.
\Ad-Report-CLEAN[1].txt - 17752 Octet(s)
.
Fin à: 16:50:04, 05/06/2010
.
============== E.O.F - CLEAN[1] ==============
voila le rapport navilog :
Fix Navipromo version 4.0.8 commencé le 05/06/2010 18:01:01,07
!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
Outil exécuté depuis C:\navilog1
Mise à jour le 09.03.2010 à 18h00 par IL-MAFIOSO
Microsoft® Windows Vista(TM) Édition Familiale Premium ( v6.0.6002 ) Service Pack 2
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU 4400 @ 2.00GHz )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : MANU ( Not Administrator ! )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total:290 Go (Free:120 Go)
D:\ (Local Disk) - NTFS - Total:8 Go (Free:1 Go)
E:\ (CD or DVD)
G:\ (USB)
H:\ (USB)
I:\ (USB)
J:\ (USB)
Recherche executée en mode normal
Fix Navipromo version 4.0.8 commencé le 05/06/2010 18:01:01,07
!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
Outil exécuté depuis C:\navilog1
Mise à jour le 09.03.2010 à 18h00 par IL-MAFIOSO
Microsoft® Windows Vista(TM) Édition Familiale Premium ( v6.0.6002 ) Service Pack 2
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU 4400 @ 2.00GHz )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : MANU ( Not Administrator ! )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total:290 Go (Free:120 Go)
D:\ (Local Disk) - NTFS - Total:8 Go (Free:1 Go)
E:\ (CD or DVD)
G:\ (USB)
H:\ (USB)
I:\ (USB)
J:\ (USB)
Recherche executée en mode normal
voila le rapport usbfix :
############################## | Usbfix 7.004 | [Recherche]
Utilisateur: MANU (Administrateur) # ETOILENOIRE [HP-Pavilion GG684AA-ABF a6157.fr]
Mis à jour le 04/06/10 par El Desaparecido / C_XX
Lancé à 18:20:59 | 05/06/2010
Site Web: http://pagesperso-orange.fr/NosTools/index.html
Contact: FindyKill.Contact@gmail.com
CPU: Intel(R) Core(TM)2 CPU 4400 @ 2.00GHz
CPU 2: Intel(R) Core(TM)2 CPU 4400 @ 2.00GHz
Microsoft® Windows Vista(TM) Édition Familiale Premium (6.0.6002 32-Bit) # Service Pack 2
Internet Explorer 8.0.6001.18904
Pare-feu Windows: Activé
RAM -> 2046 Mo
C:\ -> Disque fixe # 290 Go (120 Go libre(s) - 41%) [r2d2] # NTFS
D:\ -> Disque fixe # 8 Go (1 Go libre(s) - 13%) [Recovery] # NTFS
E:\ -> CD-ROM
################## | Éléments infectieux |
Présent! C:\Windows\system32\autorun.inf
Présent! C:\$Recycle.Bin\S-1-5-21-1467351081-4176806283-3864117359-500
Présent! C:\$Recycle.Bin\S-1-5-21-2152478756-3922319563-605102323-500
Présent! C:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-1001
Présent! C:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-1002
Présent! C:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-1003
Présent! C:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-500
Présent! D:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-1001
Présent! D:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-1002
Présent! D:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-1003
Présent! D:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-500
################## | Registre |
################## | Mountpoints2 |
HKCU\.\.\.\.\Explorer\MountPoints2\{d4aa489b-ad7f-11dd-8a44-0008d3355b70}
Shell\Auto\Command = auto.exe
Shell\AutoRun\Command = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\
################## | Vaccin |
(!) Cet ordinateur n'est pas vacciné!
################## | E.O.F |
############################## | Usbfix 7.004 | [Recherche]
Utilisateur: MANU (Administrateur) # ETOILENOIRE [HP-Pavilion GG684AA-ABF a6157.fr]
Mis à jour le 04/06/10 par El Desaparecido / C_XX
Lancé à 18:20:59 | 05/06/2010
Site Web: http://pagesperso-orange.fr/NosTools/index.html
Contact: FindyKill.Contact@gmail.com
CPU: Intel(R) Core(TM)2 CPU 4400 @ 2.00GHz
CPU 2: Intel(R) Core(TM)2 CPU 4400 @ 2.00GHz
Microsoft® Windows Vista(TM) Édition Familiale Premium (6.0.6002 32-Bit) # Service Pack 2
Internet Explorer 8.0.6001.18904
Pare-feu Windows: Activé
RAM -> 2046 Mo
C:\ -> Disque fixe # 290 Go (120 Go libre(s) - 41%) [r2d2] # NTFS
D:\ -> Disque fixe # 8 Go (1 Go libre(s) - 13%) [Recovery] # NTFS
E:\ -> CD-ROM
################## | Éléments infectieux |
Présent! C:\Windows\system32\autorun.inf
Présent! C:\$Recycle.Bin\S-1-5-21-1467351081-4176806283-3864117359-500
Présent! C:\$Recycle.Bin\S-1-5-21-2152478756-3922319563-605102323-500
Présent! C:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-1001
Présent! C:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-1002
Présent! C:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-1003
Présent! C:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-500
Présent! D:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-1001
Présent! D:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-1002
Présent! D:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-1003
Présent! D:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-500
################## | Registre |
################## | Mountpoints2 |
HKCU\.\.\.\.\Explorer\MountPoints2\{d4aa489b-ad7f-11dd-8a44-0008d3355b70}
Shell\Auto\Command = auto.exe
Shell\AutoRun\Command = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\
################## | Vaccin |
(!) Cet ordinateur n'est pas vacciné!
################## | E.O.F |
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
et voila le rapport malwarebyte :
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Database version: 4052
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18904
05/06/2010 22:30:06
mbam-log-2010-06-05 (22-30-06).txt
Scan type: Full scan (C:\|D:\|E:\|G:\|H:\|I:\|J:\|)
Objects scanned: 306011
Time elapsed: 1 hour(s), 21 minute(s), 2 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 12
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 3
Files Infected: 8
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\ultimatecontext.pornpro_bho (Adware.UltimateContext) -> Delete on reboot.
HKEY_CLASSES_ROOT\ultimatecontext.pornpro_bho.1 (Adware.UltimateContext) -> Delete on reboot.
HKEY_CLASSES_ROOT\Interface\{8db37db8-524c-46d3-a5b4-19e44dca247e} (Trojan.FakeAlert) -> Delete on reboot.
HKEY_CLASSES_ROOT\Interface\{bca77fe1-e612-4f63-911a-76e84edff5d7} (Trojan.FakeAlert) -> Delete on reboot.
HKEY_CLASSES_ROOT\Typelib\{6518d7d9-b830-4bb1-9990-cc2e7212f4e8} (Trojan.FakeAlert) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ultimatecontext (Adware.UltimateContext) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EvenMoreMegaSwellAdsForYouFF (Adware.EvenMoreMegaSwellAdsForYou) -> Delete on reboot.
HKEY_CLASSES_ROOT\videoPl.chl (Trojan.Zlob) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MediaAccumulativeCodec (Trojan.FakeAlert) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MultiMedia Software (Trojan.Zlob) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2def3673-4482-4e0f-8cc9-76ef0658fd5d} (Trojan.BHO) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{2def3673-4482-4e0f-8cc9-76ef0658fd5d} (Trojan.BHO) -> Delete on reboot.
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\winid (Malware.Trace) -> Quarantined and deleted successfully.
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
C:\Program Files\MediaAccumulativeCodec (Trojan.FakeAlert) -> Delete on reboot.
C:\Program Files\UltimateContext (Adware.UltimateContext) -> Delete on reboot.
C:\Program Files\Video Add-on (Trojan.Zlob) -> Delete on reboot.
Files Infected:
C:\Ad-Remover\Quarantine\C\Program Files\PlayMP3z\PlayMP3.exe.vir (Adware.BHO) -> Quarantined and deleted successfully.
C:\Ad-Remover\Quarantine\C\Windows\system32\a714e0f0-692c-f9d1-ee4d-0dfbe13d3dc4.exe.vir (Adware.AdRotator) -> Delete on reboot.
C:\Ad-Remover\Quarantine\C\Windows\system32\cdlwqqasfck.dll-uninst.exe.vir (Adware.AdRotator) -> Delete on reboot.
C:\Program Files\MediaAccumulativeCodec\install.ico (Trojan.FakeAlert) -> Delete on reboot.
C:\Program Files\UltimateContext\pcre3.dll (Adware.UltimateContext) -> Delete on reboot.
C:\Program Files\UltimateContext\UltimateContext.dat (Adware.UltimateContext) -> Delete on reboot.
C:\Program Files\UltimateContext\uninstall.exe (Adware.UltimateContext) -> Delete on reboot.
C:\Users\crash\AppData\Local\Temp\jisfije9fjoiee.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Database version: 4052
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18904
05/06/2010 22:30:06
mbam-log-2010-06-05 (22-30-06).txt
Scan type: Full scan (C:\|D:\|E:\|G:\|H:\|I:\|J:\|)
Objects scanned: 306011
Time elapsed: 1 hour(s), 21 minute(s), 2 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 12
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 3
Files Infected: 8
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\ultimatecontext.pornpro_bho (Adware.UltimateContext) -> Delete on reboot.
HKEY_CLASSES_ROOT\ultimatecontext.pornpro_bho.1 (Adware.UltimateContext) -> Delete on reboot.
HKEY_CLASSES_ROOT\Interface\{8db37db8-524c-46d3-a5b4-19e44dca247e} (Trojan.FakeAlert) -> Delete on reboot.
HKEY_CLASSES_ROOT\Interface\{bca77fe1-e612-4f63-911a-76e84edff5d7} (Trojan.FakeAlert) -> Delete on reboot.
HKEY_CLASSES_ROOT\Typelib\{6518d7d9-b830-4bb1-9990-cc2e7212f4e8} (Trojan.FakeAlert) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ultimatecontext (Adware.UltimateContext) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EvenMoreMegaSwellAdsForYouFF (Adware.EvenMoreMegaSwellAdsForYou) -> Delete on reboot.
HKEY_CLASSES_ROOT\videoPl.chl (Trojan.Zlob) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MediaAccumulativeCodec (Trojan.FakeAlert) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MultiMedia Software (Trojan.Zlob) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2def3673-4482-4e0f-8cc9-76ef0658fd5d} (Trojan.BHO) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{2def3673-4482-4e0f-8cc9-76ef0658fd5d} (Trojan.BHO) -> Delete on reboot.
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\winid (Malware.Trace) -> Quarantined and deleted successfully.
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
C:\Program Files\MediaAccumulativeCodec (Trojan.FakeAlert) -> Delete on reboot.
C:\Program Files\UltimateContext (Adware.UltimateContext) -> Delete on reboot.
C:\Program Files\Video Add-on (Trojan.Zlob) -> Delete on reboot.
Files Infected:
C:\Ad-Remover\Quarantine\C\Program Files\PlayMP3z\PlayMP3.exe.vir (Adware.BHO) -> Quarantined and deleted successfully.
C:\Ad-Remover\Quarantine\C\Windows\system32\a714e0f0-692c-f9d1-ee4d-0dfbe13d3dc4.exe.vir (Adware.AdRotator) -> Delete on reboot.
C:\Ad-Remover\Quarantine\C\Windows\system32\cdlwqqasfck.dll-uninst.exe.vir (Adware.AdRotator) -> Delete on reboot.
C:\Program Files\MediaAccumulativeCodec\install.ico (Trojan.FakeAlert) -> Delete on reboot.
C:\Program Files\UltimateContext\pcre3.dll (Adware.UltimateContext) -> Delete on reboot.
C:\Program Files\UltimateContext\UltimateContext.dat (Adware.UltimateContext) -> Delete on reboot.
C:\Program Files\UltimateContext\uninstall.exe (Adware.UltimateContext) -> Delete on reboot.
C:\Users\crash\AppData\Local\Temp\jisfije9fjoiee.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
Salut,
Bon, le PC devrait être bien plus propre, maintenant, refait USBfix (exactement comme j'ai precisé la dernière fois https://forums.commentcamarche.net/forum/affich-17882447-antispyware-soft-bloc-mon-pc#22 ) mais cette , choisi "Nettoyage" au lieu de "Recherche"
Et après ceci, refait un log RSIT pour vérifier stp ;)
++
Karel
Bon, le PC devrait être bien plus propre, maintenant, refait USBfix (exactement comme j'ai precisé la dernière fois https://forums.commentcamarche.net/forum/affich-17882447-antispyware-soft-bloc-mon-pc#22 ) mais cette , choisi "Nettoyage" au lieu de "Recherche"
Et après ceci, refait un log RSIT pour vérifier stp ;)
++
Karel
voila le rapport usbfix:
############################## | Usbfix 7.004 | [Suppression]
Utilisateur: MANU (Administrateur) # ETOILENOIRE [HP-Pavilion GG684AA-ABF a6157.fr]
Mis à jour le 04/06/10 par El Desaparecido / C_XX
Lancé à 12:47:25 | 06/06/2010
Site Web: http://pagesperso-orange.fr/NosTools/index.html
Contact: FindyKill.Contact@gmail.com
CPU: Intel(R) Core(TM)2 CPU 4400 @ 2.00GHz
CPU 2: Intel(R) Core(TM)2 CPU 4400 @ 2.00GHz
Microsoft® Windows Vista(TM) Édition Familiale Premium (6.0.6002 32-Bit) # Service Pack 2
Internet Explorer 8.0.6001.18904
Pare-feu Windows: Activé
RAM -> 2046 Mo
C:\ -> Disque fixe # 290 Go (120 Go libre(s) - 41%) [r2d2] # NTFS
D:\ -> Disque fixe # 8 Go (1 Go libre(s) - 13%) [Recovery] # NTFS
E:\ -> CD-ROM
################## | Éléments infectieux |
Supprimé! C:\Windows\system32\autorun.inf
Non supprimé ! C:\$Recycle.Bin\S-1-5-21-1467351081-4176806283-3864117359-500
Non supprimé ! C:\$Recycle.Bin\S-1-5-21-2152478756-3922319563-605102323-500
Non supprimé ! C:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-1001
Non supprimé ! C:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-1002
Non supprimé ! C:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-1003
Non supprimé ! C:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-500
Non supprimé ! D:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-1001
Non supprimé ! D:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-1002
Non supprimé ! D:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-1003
Non supprimé ! D:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-500
################## | Registre |
################## | Mountpoints2 |
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{d4aa489b-ad7f-11dd-8a44-0008d3355b70}
################## | Listing |
[17/11/2007 - 01:37:54 | SHD ] C:\$Recycle.Bin
[28/05/2010 - 22:43:49 | D ] C:\32788R22FWJFW
[25/11/2007 - 00:04:14 | D ] C:\3DO
[05/06/2009 - 04:35:14 | AH | 1100] C:\aaw7boot.cmd
[16/12/2007 - 19:15:58 | D ] C:\Acrobat3
[05/06/2010 - 16:49:37 | D ] C:\Ad-Remover
[05/06/2010 - 16:50:04 | A | 17877] C:\Ad-Report-CLEAN[1].txt
[01/06/2007 - 22:53:24 | A | 74] C:\autoexec.bat
[02/12/2008 - 12:40:39 | D ] C:\Boonty
[03/02/2010 - 19:24:44 | SHD ] C:\Boot
[11/04/2009 - 00:36:38 | RASH | 333257] C:\bootmgr
[02/06/2007 - 08:19:04 | RAS | 8192] C:\BOOTSECT.BAK
[28/11/2007 - 17:20:58 | D ] C:\Cavedog
[05/06/2010 - 18:01:21 | A | 775] C:\cleannavi.txt
[05/06/2010 - 11:24:40 | HD ] C:\Config.Msi
[18/09/2006 - 23:43:37 | A | 10] C:\config.sys
[02/11/2006 - 15:02:03 | SHD ] C:\Documents and Settings
[07/11/2007 - 09:00:40 | A | 17734] C:\eula.1028.txt
[07/11/2007 - 09:00:40 | A | 17734] C:\eula.1031.txt
[07/11/2007 - 09:00:40 | A | 10134] C:\eula.1033.txt
[07/11/2007 - 09:00:40 | A | 17734] C:\eula.1036.txt
[07/11/2007 - 09:00:40 | A | 17734] C:\eula.1040.txt
[07/11/2007 - 09:00:40 | A | 118] C:\eula.1041.txt
[07/11/2007 - 09:00:40 | A | 17734] C:\eula.1042.txt
[07/11/2007 - 09:00:40 | A | 17734] C:\eula.2052.txt
[07/11/2007 - 09:00:40 | A | 17734] C:\eula.3082.txt
[07/11/2007 - 09:00:40 | A | 1110] C:\globdata.ini
[16/02/2009 - 21:36:41 | D ] C:\hegames
[01/12/2007 - 18:08:30 | HD ] C:\hp
[18/03/2010 - 20:53:13 | A | 921624] C:\img2-001.raw
[07/11/2007 - 09:03:18 | A | 562688] C:\install.exe
[07/11/2007 - 09:00:40 | A | 843] C:\install.ini
[07/11/2007 - 09:03:18 | A | 76304] C:\install.res.1028.dll
[07/11/2007 - 09:03:18 | A | 96272] C:\install.res.1031.dll
[07/11/2007 - 09:03:18 | A | 91152] C:\install.res.1033.dll
[07/11/2007 - 09:03:18 | A | 97296] C:\install.res.1036.dll
[07/11/2007 - 09:03:18 | A | 95248] C:\install.res.1040.dll
[07/11/2007 - 09:03:18 | A | 81424] C:\install.res.1041.dll
[07/11/2007 - 09:03:18 | A | 79888] C:\install.res.1042.dll
[07/11/2007 - 09:03:18 | A | 75792] C:\install.res.2052.dll
[07/11/2007 - 09:03:18 | A | 96272] C:\install.res.3082.dll
[25/11/2007 - 12:56:46 | D ] C:\InterVideo
[25/11/2007 - 16:07:45 | RASH | 0] C:\IO.SYS
[02/12/2008 - 12:42:10 | D ] C:\KPCMS
[27/03/2008 - 22:26:36 | D ] C:\Macromedia
[23/09/2008 - 18:09:30 | D ] C:\Microsoft
[25/11/2007 - 16:07:45 | RASH | 0] C:\MSDOS.SYS
[05/06/2010 - 18:02:19 | AD ] C:\Navilog1
[27/02/2009 - 23:35:55 | D ] C:\Nostale(FR)
[01/12/2007 - 18:29:43 | RD ] C:\Outlook Express
[06/06/2010 - 12:17:41 | ASH | 2459709440] C:\pagefile.sys
[11/04/2008 - 18:52:21 | D ] C:\PDFcreator
[01/09/2008 - 13:58:59 | D ] C:\PerfLogs
[05/06/2010 - 18:00:39 | RD ] C:\Program Files
[01/06/2010 - 21:25:30 | HD ] C:\ProgramData
[02/12/2008 - 12:46:31 | D ] C:\PSFONTS
[22/06/2008 - 21:41:17 | D ] C:\QuickTime
[24/03/2010 - 18:37:16 | D ] C:\RomStation
[04/06/2010 - 20:29:10 | D ] C:\rsit
[11/04/2008 - 18:19:46 | D ] C:\Setup
[05/06/2010 - 11:23:54 | SHD ] C:\System Volume Information
[06/06/2010 - 12:51:35 | D ] C:\UsbFix
[06/06/2010 - 12:51:47 | A | 4952] C:\Usbfix.txt
[27/03/2008 - 22:00:02 | RD ] C:\Users
[07/11/2007 - 09:00:40 | A | 5686] C:\vcredist.bmp
[07/11/2007 - 09:09:22 | A | 1442522] C:\VC_RED.cab
[07/11/2007 - 09:12:28 | A | 232960] C:\VC_RED.MSI
[25/11/2007 - 00:19:18 | D ] C:\VirtualDJ
[30/05/2010 - 19:44:27 | D ] C:\Windows
[16/12/2008 - 15:05:17 | D ] C:\WTablet
[25/11/2007 - 20:04:22 | D ] C:\~QTWTMP.TMP
[17/11/2007 - 01:37:54 | SHD ] D:\$RECYCLE.BIN
[04/10/2006 - 01:02:44 | SH | 438328] D:\boo.mgr
[02/06/2007 - 09:50:25 | RSHD ] D:\boot
[02/11/2006 - 01:53:58 | SH | 438840] D:\bootmgr
[13/10/2006 - 16:00:52 | SH | 1322] D:\Desktop.ini
[02/06/2007 - 09:50:26 | RSHD ] D:\hp
[16/11/2007 - 21:43:25 | ASH | 22] D:\HPCD.sys
[16/11/2007 - 20:52:31 | SH | 189] D:\MASTER.LOG
[16/11/2007 - 21:43:25 | RSHD ] D:\PRELOAD
[10/09/2002 - 14:58:12 | SH | 181616] D:\Protect.ed
[16/11/2007 - 20:26:47 | RSH | 26] D:\RCBoot.sys
[02/06/2007 - 09:50:25 | RD ] D:\RECOVERY
[02/06/2007 - 09:50:24 | SH | 44] D:\RESTORE.INI
[02/06/2007 - 09:50:26 | RSHD ] D:\SOURCES
[21/06/2007 - 15:06:30 | SHD ] D:\System Volume Information
[07/02/2007 - 15:56:24 | SH | 34] D:\SystemRecovery.txt
[02/06/2007 - 09:50:26 | RSHD ] D:\Windows
################## | Vaccin |
C:\Autorun.inf -> Dossier créé par UsbFix (El Desaparecido & C_XX)
D:\Autorun.inf -> Dossier créé par UsbFix (El Desaparecido & C_XX)
################## | Upload |
Veuillez envoyer le fichier: \UsbFix_Upload_Me_ETOILENOIRE.zip
https://www.ionos.fr/?affiliate_id=77097
Merci de votre contribution.
################## | E.O.F |
############################## | Usbfix 7.004 | [Suppression]
Utilisateur: MANU (Administrateur) # ETOILENOIRE [HP-Pavilion GG684AA-ABF a6157.fr]
Mis à jour le 04/06/10 par El Desaparecido / C_XX
Lancé à 12:47:25 | 06/06/2010
Site Web: http://pagesperso-orange.fr/NosTools/index.html
Contact: FindyKill.Contact@gmail.com
CPU: Intel(R) Core(TM)2 CPU 4400 @ 2.00GHz
CPU 2: Intel(R) Core(TM)2 CPU 4400 @ 2.00GHz
Microsoft® Windows Vista(TM) Édition Familiale Premium (6.0.6002 32-Bit) # Service Pack 2
Internet Explorer 8.0.6001.18904
Pare-feu Windows: Activé
RAM -> 2046 Mo
C:\ -> Disque fixe # 290 Go (120 Go libre(s) - 41%) [r2d2] # NTFS
D:\ -> Disque fixe # 8 Go (1 Go libre(s) - 13%) [Recovery] # NTFS
E:\ -> CD-ROM
################## | Éléments infectieux |
Supprimé! C:\Windows\system32\autorun.inf
Non supprimé ! C:\$Recycle.Bin\S-1-5-21-1467351081-4176806283-3864117359-500
Non supprimé ! C:\$Recycle.Bin\S-1-5-21-2152478756-3922319563-605102323-500
Non supprimé ! C:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-1001
Non supprimé ! C:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-1002
Non supprimé ! C:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-1003
Non supprimé ! C:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-500
Non supprimé ! D:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-1001
Non supprimé ! D:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-1002
Non supprimé ! D:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-1003
Non supprimé ! D:\$Recycle.Bin\S-1-5-21-3558322921-953729961-3474319535-500
################## | Registre |
################## | Mountpoints2 |
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{d4aa489b-ad7f-11dd-8a44-0008d3355b70}
################## | Listing |
[17/11/2007 - 01:37:54 | SHD ] C:\$Recycle.Bin
[28/05/2010 - 22:43:49 | D ] C:\32788R22FWJFW
[25/11/2007 - 00:04:14 | D ] C:\3DO
[05/06/2009 - 04:35:14 | AH | 1100] C:\aaw7boot.cmd
[16/12/2007 - 19:15:58 | D ] C:\Acrobat3
[05/06/2010 - 16:49:37 | D ] C:\Ad-Remover
[05/06/2010 - 16:50:04 | A | 17877] C:\Ad-Report-CLEAN[1].txt
[01/06/2007 - 22:53:24 | A | 74] C:\autoexec.bat
[02/12/2008 - 12:40:39 | D ] C:\Boonty
[03/02/2010 - 19:24:44 | SHD ] C:\Boot
[11/04/2009 - 00:36:38 | RASH | 333257] C:\bootmgr
[02/06/2007 - 08:19:04 | RAS | 8192] C:\BOOTSECT.BAK
[28/11/2007 - 17:20:58 | D ] C:\Cavedog
[05/06/2010 - 18:01:21 | A | 775] C:\cleannavi.txt
[05/06/2010 - 11:24:40 | HD ] C:\Config.Msi
[18/09/2006 - 23:43:37 | A | 10] C:\config.sys
[02/11/2006 - 15:02:03 | SHD ] C:\Documents and Settings
[07/11/2007 - 09:00:40 | A | 17734] C:\eula.1028.txt
[07/11/2007 - 09:00:40 | A | 17734] C:\eula.1031.txt
[07/11/2007 - 09:00:40 | A | 10134] C:\eula.1033.txt
[07/11/2007 - 09:00:40 | A | 17734] C:\eula.1036.txt
[07/11/2007 - 09:00:40 | A | 17734] C:\eula.1040.txt
[07/11/2007 - 09:00:40 | A | 118] C:\eula.1041.txt
[07/11/2007 - 09:00:40 | A | 17734] C:\eula.1042.txt
[07/11/2007 - 09:00:40 | A | 17734] C:\eula.2052.txt
[07/11/2007 - 09:00:40 | A | 17734] C:\eula.3082.txt
[07/11/2007 - 09:00:40 | A | 1110] C:\globdata.ini
[16/02/2009 - 21:36:41 | D ] C:\hegames
[01/12/2007 - 18:08:30 | HD ] C:\hp
[18/03/2010 - 20:53:13 | A | 921624] C:\img2-001.raw
[07/11/2007 - 09:03:18 | A | 562688] C:\install.exe
[07/11/2007 - 09:00:40 | A | 843] C:\install.ini
[07/11/2007 - 09:03:18 | A | 76304] C:\install.res.1028.dll
[07/11/2007 - 09:03:18 | A | 96272] C:\install.res.1031.dll
[07/11/2007 - 09:03:18 | A | 91152] C:\install.res.1033.dll
[07/11/2007 - 09:03:18 | A | 97296] C:\install.res.1036.dll
[07/11/2007 - 09:03:18 | A | 95248] C:\install.res.1040.dll
[07/11/2007 - 09:03:18 | A | 81424] C:\install.res.1041.dll
[07/11/2007 - 09:03:18 | A | 79888] C:\install.res.1042.dll
[07/11/2007 - 09:03:18 | A | 75792] C:\install.res.2052.dll
[07/11/2007 - 09:03:18 | A | 96272] C:\install.res.3082.dll
[25/11/2007 - 12:56:46 | D ] C:\InterVideo
[25/11/2007 - 16:07:45 | RASH | 0] C:\IO.SYS
[02/12/2008 - 12:42:10 | D ] C:\KPCMS
[27/03/2008 - 22:26:36 | D ] C:\Macromedia
[23/09/2008 - 18:09:30 | D ] C:\Microsoft
[25/11/2007 - 16:07:45 | RASH | 0] C:\MSDOS.SYS
[05/06/2010 - 18:02:19 | AD ] C:\Navilog1
[27/02/2009 - 23:35:55 | D ] C:\Nostale(FR)
[01/12/2007 - 18:29:43 | RD ] C:\Outlook Express
[06/06/2010 - 12:17:41 | ASH | 2459709440] C:\pagefile.sys
[11/04/2008 - 18:52:21 | D ] C:\PDFcreator
[01/09/2008 - 13:58:59 | D ] C:\PerfLogs
[05/06/2010 - 18:00:39 | RD ] C:\Program Files
[01/06/2010 - 21:25:30 | HD ] C:\ProgramData
[02/12/2008 - 12:46:31 | D ] C:\PSFONTS
[22/06/2008 - 21:41:17 | D ] C:\QuickTime
[24/03/2010 - 18:37:16 | D ] C:\RomStation
[04/06/2010 - 20:29:10 | D ] C:\rsit
[11/04/2008 - 18:19:46 | D ] C:\Setup
[05/06/2010 - 11:23:54 | SHD ] C:\System Volume Information
[06/06/2010 - 12:51:35 | D ] C:\UsbFix
[06/06/2010 - 12:51:47 | A | 4952] C:\Usbfix.txt
[27/03/2008 - 22:00:02 | RD ] C:\Users
[07/11/2007 - 09:00:40 | A | 5686] C:\vcredist.bmp
[07/11/2007 - 09:09:22 | A | 1442522] C:\VC_RED.cab
[07/11/2007 - 09:12:28 | A | 232960] C:\VC_RED.MSI
[25/11/2007 - 00:19:18 | D ] C:\VirtualDJ
[30/05/2010 - 19:44:27 | D ] C:\Windows
[16/12/2008 - 15:05:17 | D ] C:\WTablet
[25/11/2007 - 20:04:22 | D ] C:\~QTWTMP.TMP
[17/11/2007 - 01:37:54 | SHD ] D:\$RECYCLE.BIN
[04/10/2006 - 01:02:44 | SH | 438328] D:\boo.mgr
[02/06/2007 - 09:50:25 | RSHD ] D:\boot
[02/11/2006 - 01:53:58 | SH | 438840] D:\bootmgr
[13/10/2006 - 16:00:52 | SH | 1322] D:\Desktop.ini
[02/06/2007 - 09:50:26 | RSHD ] D:\hp
[16/11/2007 - 21:43:25 | ASH | 22] D:\HPCD.sys
[16/11/2007 - 20:52:31 | SH | 189] D:\MASTER.LOG
[16/11/2007 - 21:43:25 | RSHD ] D:\PRELOAD
[10/09/2002 - 14:58:12 | SH | 181616] D:\Protect.ed
[16/11/2007 - 20:26:47 | RSH | 26] D:\RCBoot.sys
[02/06/2007 - 09:50:25 | RD ] D:\RECOVERY
[02/06/2007 - 09:50:24 | SH | 44] D:\RESTORE.INI
[02/06/2007 - 09:50:26 | RSHD ] D:\SOURCES
[21/06/2007 - 15:06:30 | SHD ] D:\System Volume Information
[07/02/2007 - 15:56:24 | SH | 34] D:\SystemRecovery.txt
[02/06/2007 - 09:50:26 | RSHD ] D:\Windows
################## | Vaccin |
C:\Autorun.inf -> Dossier créé par UsbFix (El Desaparecido & C_XX)
D:\Autorun.inf -> Dossier créé par UsbFix (El Desaparecido & C_XX)
################## | Upload |
Veuillez envoyer le fichier: \UsbFix_Upload_Me_ETOILENOIRE.zip
https://www.ionos.fr/?affiliate_id=77097
Merci de votre contribution.
################## | E.O.F |
Bonsoir Karel
C:\Users\crash\AppData\Local\Temp\ycevnl.exe
C:\Users\crash\AppData\Local\Temp\avp32.exe
O2 - BHO: Mirar - {2DEF3673-4482-4E0F-8CC9-76EF0658FD5D} - (no file)
O3 - Toolbar: Mirar - {2DEF3672-4482-4E0F-8CC9-76EF0658FD5D} - (no file)
O4 - HKUS\S-1-5-21-3558322921-953729961-3474319535-1002\..\Run: [kfcrn] c:\users\crash\appdata\local\kfcrn.exe kfcrn (User 'crash')
O4 - HKUS\S-1-5-21-3558322921-953729961-3474319535-1002\..\Run: [hsfe8owijfisjhgs7ye39gjsoighsd7y3eu] C:\Users\crash\AppData\Local\Temp\ycevnl.exe (User 'crash')
O4 - HKUS\S-1-5-21-3558322921-953729961-3474319535-1002\..\Run: [hsfg9w8gujsokgahi8gysgnsdgefshyjy] C:\Users\crash\AppData\Local\Temp\avp32.exe (User 'crash')
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2DEF3673-4482-4E0F-8CC9-76EF0658FD5D}]
Mirar
Il y a encore toutes ces infections à nettoyer
{1c491116-c175-45e1-a570-6fb14fea8b7b} - PHPNukeFR Toolbar - C:\Program Files\PHPNukeFR\tbPHPN.dll []
Toolbar à virer, car elle est douteuse
2010-05-28 22:43:49 ----D---- C:\32788R22FWJFW
Dossier qui me parait suspect
C:\Users\crash\AppData\Local\Temp\ycevnl.exe
C:\Users\crash\AppData\Local\Temp\avp32.exe
O2 - BHO: Mirar - {2DEF3673-4482-4E0F-8CC9-76EF0658FD5D} - (no file)
O3 - Toolbar: Mirar - {2DEF3672-4482-4E0F-8CC9-76EF0658FD5D} - (no file)
O4 - HKUS\S-1-5-21-3558322921-953729961-3474319535-1002\..\Run: [kfcrn] c:\users\crash\appdata\local\kfcrn.exe kfcrn (User 'crash')
O4 - HKUS\S-1-5-21-3558322921-953729961-3474319535-1002\..\Run: [hsfe8owijfisjhgs7ye39gjsoighsd7y3eu] C:\Users\crash\AppData\Local\Temp\ycevnl.exe (User 'crash')
O4 - HKUS\S-1-5-21-3558322921-953729961-3474319535-1002\..\Run: [hsfg9w8gujsokgahi8gysgnsdgefshyjy] C:\Users\crash\AppData\Local\Temp\avp32.exe (User 'crash')
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2DEF3673-4482-4E0F-8CC9-76EF0658FD5D}]
Mirar
Il y a encore toutes ces infections à nettoyer
{1c491116-c175-45e1-a570-6fb14fea8b7b} - PHPNukeFR Toolbar - C:\Program Files\PHPNukeFR\tbPHPN.dll []
Toolbar à virer, car elle est douteuse
2010-05-28 22:43:49 ----D---- C:\32788R22FWJFW
Dossier qui me parait suspect