Virus security tool

Bonjour

On va faire une analyse de ton systéme.

* Télécharge ftp://zebulon.fr/ZHPDiag.exe ZHPDiag ( de Nicolas coolman ).
ou
http://www.premiumorange.com/zeb-help-process/zhpdiag.html (En bas de page).

***********************
/!\Utilisateurs de Vista et Windows 7 : Clique droit sur le logo de ZHPDiag.exe, " exécuter en tant qu'Administrateur /!\
* Laisse toi guider lors de l'installation
* Il se lancera automatiquement à la fin de l'installation
* Clique sur l'icône représentant une loupe (« Lancer le diagnostic »)
* Enregistre le rapport sur ton Bureau à l'aide de l'icône représentant une disquette
* Héberge le rapport ZHPDiag.txt sur le site cijoint.fr, puis copie/colle le lien fournit dans ta prochaine réponse sur le forum

http://www.cijoint.fr/cjlink.php?file=cj201009/cij2CdtdyM.txt

voila merci de t'occuper de mon "cas" .

Plusieurs infections mais on va traiter en prioriter Secutity tool.

A faire dans l'ordre.

1/ Copie/colle les lignes suivantes et place les dans ZHPFix :
2/Lance ZHPFix (soit via le raccourci sur ton Bureau, soit via ZHPDiag)
3/Clique sur l'icone représentant la lettre H (« coller les lignes Helper »)

----------------------------------------------------------
O4 - HKCU\..\RunOnce: [05760384] . (.Pas de propriétaire - Pas de description.) -- C:\Users\AnneCharlotte\AppData\Local\05760384.exe
O4 - HKUS\S-1-5-21-4113307719-3819087802-1800406623-1000\..\RunOnce: [05760384] . (.Pas de propriétaire - Pas de description.) -- C:\Users\AnneCharlotte\AppData\Local\05760384.exe
O4 - Global Startup: C:\Users\AnneCharlotte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Security Tool.lnk . (.Pas de propriétaire.) --
O9 - Extra button: Quick-Launch Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} . (.Pas de propriétaire - Pas de description.) -- c:\Program Files (x86)\Acer Bio Protection\IETag.ico

----------------------------------------------------------
* Clique sur"ok" (Tu dois avoir seulement les lignes copiées sur le forum)
* Clique sur « Tous », puis sur « Nettoyer »
* Copie/colle la totalité du rapport dans ta prochaine réponse
=========================================================
* rends toi sur ce site : https://www.virustotal.com/gui/
==>Analyse ce fichier:
------------------------------------------------------------------------------------------
C:\ProgramData\QueryExplorer\queryexplorer117.exe

------------------------------------------------------------------------------------------
* Cliquez sur Parcourir... :
* Sélectionnez le fichier que vous voulez analyser et cliquez sur Ouvrir :
* Cliquez ensuite sur Envoyez le fichier : s'il a déjà été analysé, demande une nouvelle analyse.
* Fais un copier/coller du rapport sur le forum.
=======================================================
Télécharge Ad-Remover sur ton bureau:
http://pagesperso-orange.fr/NosTools/C_XX/AD-R.exe
https://www.androidworld.fr/

/!\ Ferme toutes tes applications ouvertes. /!\

* Désactive la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner la procédure de recherche et de nettoyage de l'outil.

Double clique sur le fichier que tu viens de télécharger, à l'écran qui apparait, clique sur
"Nettoyer".
Laisse travailler l'outil.
Poste le rapport qui s'affiche à l'écran quand l'analyse est terminée.
Si le rapport n'apparait pas il se trouve à cet emplacement :C:\Ad-Report-CLEAN[1].txt

Le cerveau a des capacités tellement étonnantes qu'aujourd'hui pratiquement tout le monde en a un.

Rapport de ZHPFix 1.12.3202 par Nicolas Coolman, Update du 26/09/2010
Fichier d'export Registre : C:\ZHPExportRegistry-27-09-2010-19-59-06.txt
Run by AnneCharlotte at 27/09/2010 19:59:06
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html
Contact : nicolascoolman@yahoo.fr

========== Clé(s) du Registre ==========
O9 - Extra button: Quick-Launch Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} . (.Pas de propriétaire - Pas de description.) -- c:\Program Files (x86)\Acer Bio Protection\IETag.ico => Infection BT (Favadd.Troj) => Clé supprimée avec succès

========== Valeur(s) du Registre ==========
O4 - HKCU\..\RunOnce: [05760384] . (.Pas de propriétaire - Pas de description.) -- C:\Users\AnneCharlotte\AppData\Local\05760384.exe => Valeur supprimée avec succès
O4 - HKUS\S-1-5-21-4113307719-3819087802-1800406623-1000\..\RunOnce: [05760384] . (.Pas de propriétaire - Pas de description.) -- C:\Users\AnneCharlotte\AppData\Local\05760384.exe => Valeur absente

========== Fichier(s) ==========
c:\users\annecharlotte\appdata\local\05760384.exe => Supprimé et mis en quarantaine
c:\users\annecharlotte\appdata\roaming\microsoft\windows\start menu\programs\security tool.lnk . (.pas de propriétaire.) -- => Supprimé et mis en quarantaine

========== Récapitulatif ==========
1 : Clé(s) du Registre
2 : Valeur(s) du Registre
2 : Fichier(s)

End of the scan

0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.
File name: AD851F24184AFA14E1AC00FBCB686500C7983DFC.exe
Submission date: 2010-09-25 21:45:45 (UTC)
Current status: finished
Result: 1 /42 (2.4%)
VT Community

not reviewed
Safety score: -
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2010.09.25.00 2010.09.24 -
AntiVir 7.10.12.30 2010.09.24 -
Antiy-AVL 2.0.3.7 2010.09.25 -
Authentium 5.2.0.5 2010.09.25 -
Avast 4.8.1351.0 2010.09.25 -
Avast5 5.0.594.0 2010.09.25 -
AVG 9.0.0.851 2010.09.25 -
BitDefender 7.2 2010.09.25 -
CAT-QuickHeal 11.00 2010.09.24 -
ClamAV 0.96.2.0-git 2010.09.25 -
Comodo 6198 2010.09.25 -
DrWeb 5.0.2.03300 2010.09.25 -
eSafe 7.0.17.0 2010.09.21 -
eTrust-Vet 36.1.7875 2010.09.25 -
F-Prot 4.6.2.117 2010.09.25 -
F-Secure 9.0.15370.0 2010.09.25 -
Fortinet 4.1.143.0 2010.09.25 -
GData 21 2010.09.25 -
Ikarus T3.1.1.88.0 2010.09.25 -
Jiangmin 13.0.900 2010.09.25 -
K7AntiVirus 9.63.2608 2010.09.25 -
Kaspersky 7.0.0.125 2010.09.25 -
McAfee 5.400.0.1158 2010.09.25 -
McAfee-GW-Edition 2010.1C 2010.09.25 -
Microsoft 1.6201 2010.09.25 -
NOD32 5479 2010.09.25 -
Norman 6.06.06 2010.09.25 -
nProtect 2010-09-25.01 2010.09.25 -
Panda 10.0.2.7 2010.09.25 -
PCTools 7.0.3.5 2010.09.25 -
Prevx 3.0 2010.09.25 Low Risk Adware
Rising 22.66.04.00 2010.09.25 -
Sophos 4.58.0 2010.09.25 -
Sunbelt 6928 2010.09.25 -
SUPERAntiSpyware 4.40.0.1006 2010.09.25 -
Symantec 20101.1.1.7 2010.09.25 -
TheHacker 6.7.0.0.034 2010.09.25 -
TrendMicro 9.120.0.1004 2010.09.25 -
TrendMicro-HouseCall 9.120.0.1004 2010.09.25 -
VBA32 3.12.14.1 2010.09.24 -
ViRobot 2010.9.25.4060 2010.09.25 -
VirusBuster 12.65.25.0 2010.09.24 -
Additional informationShow all
MD5 : 34094e0d9a353ccc26f6b215709e9939
SHA1 : 50df11c0caf05763661661922c1c104732dbd795
SHA256: b8e74bb03527110f7be574a842b43cf7c92d111448c88d19fcee1effdc37aecf
ssdeep: 768:ohWMi2QFEq4cpUEz3ddmikLmIIic31YsnukjdOfprublt7qBj0C+dmDAdLL:o82qNpUEzNE
RmIUlY8OBSblUBj0WDAdH
File size : 57624 bytes
First seen: 2010-09-25 21:45:45
Last seen : 2010-09-25 21:45:45
Magic: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
TrID:
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: QueryExplorer.com
UTN-USERFirst-Object
signing date.: 4:24 PM 9/24/2010
verified.....: -

PEiD: -
PEInfo: PE structure information

[[ basic data ]]
entrypointaddress: 0x5EE2
timedatestamp....: 0x4C9CB4AA (Fri Sep 24 14:24:42 2010)
machinetype......: 0x14C (Intel I386)

[[ 3 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
.text, 0x1000, 0x8FC6, 0x9000, 6.56, 9936bfc64a9101649513ea5e80f3525f
.rdata, 0xA000, 0x189E, 0x2000, 3.91, 386295f0fb9d10ad27d66bf9252caea0
.data, 0xC000, 0x958, 0x1000, 1.03, 7b134a70dba4631542e6d3b359f42a21

[[ 1 import(s) ]]
kernel32.dll: GetProcAddress, LoadLibraryExA, lstrcmpA, CreateFileA, lstrcpyA, lstrlenA, RtlUnwind, RaiseException, GetSystemTimeAsFileTime, GetModuleHandleA, GetStartupInfoA, GetCommandLineA, GetVersionExA, HeapAlloc, SetUnhandledExceptionFilter, HeapFree, ExitProcess, TerminateProcess, GetCurrentProcess, WriteFile, GetStdHandle, GetModuleFileNameA, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetLastError, GetEnvironmentStringsW, SetHandleCount, GetFileType, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, HeapReAlloc, IsBadWritePtr, HeapSize, GetStringTypeA, MultiByteToWideChar, GetStringTypeW, GetACP, GetOEMCP, GetCPInfo, IsBadReadPtr, IsBadCodePtr, LoadLibraryA, InterlockedExchange, VirtualQuery, GetLocaleInfoA, VirtualProtect, GetSystemInfo, LCMapStringA, LCMapStringW, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId

Prevx Info:
http://info.prevx.com/aboutprogramtext.asp?PX5=AD851F24184AFA14E1AC00FBCB686500C7983DFC

VT Community

0
This file has never been reviewed by any VT Community member. Be the first one to comment on it!
VirusTotal Team

======= RAPPORT D'AD-REMOVER 2.0.0.1,F | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par C_XX le 16/09/10 à 13:30
Contact: AdRemover.contact[AT]gmail.com
Site web: http://www.teamxscript.org

C:\Program Files (x86)\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 20:07:15 le 27/09/2010, Mode sans echec

Microsoft Windows 7 Édition Familiale Premium (X64)
AnneCharlotte@ANNECHA-PC (Acer Aspire 7738)

============== ACTION(S) ==============

0,Dossier supprimé: C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
0,Dossier supprimé: C:\ProgramData\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
0,Dossier supprimé: C:\Program Files (x86)\Ask.com
0,Dossier supprimé: C:\Users\AnneCharlotte\AppData\Local\AskToolbar
0,Dossier supprimé: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClickPotato
0,Dossier supprimé: C:\Users\AnneCharlotte\AppData\Roaming\ClickPotatoLite
0,Dossier supprimé: C:\Program Files (x86)\ClickPotatoLite
0,Dossier supprimé: C:\ProgramData\ClickPotatoLiteSA
0,Dossier supprimé: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ShopperReports
0,Dossier supprimé: C:\Users\AnneCharlotte\AppData\Roaming\ShopperReports3
0,Dossier supprimé: C:\Program Files (x86)\ShopperReports3
3,Fichier supprimé: C:\Windows\Installer\1e69cd.msi
0,Fichier supprimé: C:\Program Files (x86)\Mozilla Firefox\plugins\npclntax_ClickPotatoLiteSA.dll

(!) -- Fichiers temporaires supprimés.

-- Fichier ouvert: C:\Users\AnneCharlotte\AppData\Roaming\Mozilla\FireFox\Profiles\vtzm3z4u.default\Prefs.js --
Ligne supprimée: user_pref("extensions.asktb.cbid", "HS");
Ligne supprimée: user_pref("extensions.asktb.default-channel-url-mask", "hxxp://www.ask.com/web?q={query}&o={o}&l={l}...
Ligne supprimée: user_pref("extensions.asktb.first-launch-url", "hxxp://help.adobe.com/fr_FR/Reader/9.0/index.html");
Ligne supprimée: user_pref("extensions.asktb.fresh-install", false);
Ligne supprimée: user_pref("extensions.asktb.l", "dis");
Ligne supprimée: user_pref("extensions.asktb.last-config-req", "1275200643657");
Ligne supprimée: user_pref("extensions.asktb.locale", "en_US");
Ligne supprimée: user_pref("extensions.asktb.o", "15753");
Ligne supprimée: user_pref("extensions.asktb.overlay-reloaded-using-restart", true);
Ligne supprimée: user_pref("extensions.asktb.qsrc", "2871");
Ligne supprimée: user_pref("extensions.asktb.r", "6");
Ligne supprimée: user_pref("extensions.asktb.to", "15885");
-- Fichier Fermé --

1,Clé supprimée: HKLM\Software\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{09325003-167C-483d-A4BA-8B3122ABB432}
3,Clé supprimée: HKLM\Software\Classes\AppID\{0D82ACD6-A652-4496-A298-2BDE705F4227}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{100EB1FD-D03E-47fd-81F3-EE91287F9465}
1,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{100EB1FD-D03E-47fd-81F3-EE91287F9465}
1,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{100EB1FD-D03E-47fd-81F3-EE91287F9465}
1,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{100EB1FD-D03E-47fd-81F3-EE91287F9465}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{20EA9658-6BC3-4599-A87D-6371FE9295FC}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{2721A8E5-BFDB-4562-9912-9E0531CA616C}
3,Clé supprimée: HKLM\Software\Classes\AppID\{7025E484-D4B0-441a-9F0B-69063BD679CE}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{396CFC12-932D-496b-A0A8-5D7201E105E1}
3,Clé supprimée: HKLM\Software\Classes\AppID\{A89256AD-EC17-4a83-BEF5-4B8BC4F39306}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{60DA826C-B1C6-4358-BDEC-4837CED45470}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{6DD76B7B-6423-4df0-9A07-84A6CAD973A0}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{74C22317-5B90-471f-9AD2-FEC049870A16}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{7F6CFB6A-9227-4bb8-B941-F2B067E76F51}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{A16AD1E9-F69A-45af-9462-B1C286708842}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{A7CDDCDC-BEEB-4685-A062-978F5E07CEEE}
1,Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\{A7CDDCDC-BEEB-4685-A062-978F5E07CEEE}
1,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7CDDCDC-BEEB-4685-A062-978F5E07CEEE}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{AB0EE208-DF60-4fa7-A617-C4269760033E}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{C1089F63-7AFC-4538-B0EB-BEA0F4225A57}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{C9CCBB35-D123-4a31-AFFC-9B2933132116}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{CC7BD6F1-565C-47ce-A5BB-9C935E77B59D}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{CFC16189-8A92-4a29-A940-60248385F426}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
1,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
1,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
1,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{DEE758B4-C3FB-4a5b-9939-848B9C77A2FB}
3,Clé supprimée: HKLM\Software\Classes\AppID\{8258B35C-05B8-4c0e-9525-9BCCC70F8F2D}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{E12AEAB6-7D12-4c07-8E36-5892EFB4DAFB}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{E2F2C137-A782-4fb5-81AF-086156F5EB0A}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{F1D06C9F-51F0-4476-BEDE-5DDF91BE304E}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{F3A32DF2-7413-4fb1-B575-1AC920A17B76}
1,Clé supprimée: HKLM\Software\Classes\Interface\{17BF1E05-C0E8-413C-BD1F-A481EEA3B8E9}
1,Clé supprimée: HKLM\Software\Classes\Interface\{30B15818-E110-4527-9C05-46ACE5A3460D}
1,Clé supprimée: HKLM\Software\Classes\Interface\{618AAD04-921F-44C2-BE38-C0818AF69861}
1,Clé supprimée: HKLM\Software\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
1,Clé supprimée: HKLM\Software\Classes\Interface\{83B2FE06-BA20-4F7D-96C6-6FC3A4E877D3}
1,Clé supprimée: HKLM\Software\Classes\Interface\{8AD9AD05-36BE-4E40-BA62-5422EB0D02FB}
1,Clé supprimée: HKLM\Software\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
1,Clé supprimée: HKLM\Software\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
1,Clé supprimée: HKLM\Software\Classes\Interface\{AEBF09E2-0C15-43C8-99BF-928C645D98A0}
1,Clé supprimée: HKLM\Software\Classes\Interface\{B32966A2-F7C2-4362-A6CF-399EC8B44110}
1,Clé supprimée: HKLM\Software\Classes\Interface\{B5D2ED96-62F9-4C2C-956D-E425B1F67337}
1,Clé supprimée: HKLM\Software\Classes\Interface\{D3A412E8-1E4B-47D2-9B12-F88291F5AFBB}
1,Clé supprimée: HKLM\Software\Classes\TypeLib\{02AED140-2B62-4B49-8B3B-179020CC39B9}
1,Clé supprimée: HKLM\Software\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
1,Clé supprimée: HKLM\Software\Classes\TypeLib\{573F4ABB-A1A2-44ED-9BA9-A8DAD40AAC46}
1,Clé supprimée: HKLM\Software\Classes\TypeLib\{5FE0CEAE-CB69-40AF-A323-40F94257DACB}
1,Clé supprimée: HKLM\Software\Classes\TypeLib\{ACC62306-9A63-4864-BD2F-C8825D2D7EA6}
1,Clé supprimée: HKLM\Software\Classes\TypeLib\{CDCA70D8-C6A6-49EE-9BED-7429D6C477A2}
1,Clé supprimée: HKLM\Software\Classes\TypeLib\{D136987F-E1C4-4CCC-A220-893DF03EC5DF}
1,Clé supprimée: HKLM\Software\Classes\TypeLib\{E343EDFC-1E6C-4CB5-AA29-E9C922641C80}
1,Clé supprimée: HKLM\Software\Classes\TypeLib\{F1A1892C-2A6C-4817-98B4-FF81443CBA20}
0,Clé supprimée: HKLM\Software\Classes\ClickPotatoLiteAx.Info
0,Clé supprimée: HKLM\Software\Classes\ClickPotatoLiteAx.Info.1
0,Clé supprimée: HKLM\Software\Classes\ClickPotatoLiteAX.UserProfiles
0,Clé supprimée: HKLM\Software\Classes\ClickPotatoLiteAX.UserProfiles.1
0,Clé supprimée: HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd
0,Clé supprimée: HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd.1
0,Clé supprimée: HKLM\Software\Classes\MenuButtonIE.ButtonIE
0,Clé supprimée: HKLM\Software\Classes\MenuButtonIE.ButtonIE.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.AsyncReporter
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.AsyncReporter.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.CntntDic
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.CntntDic.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.CntntDisp
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.CntntDisp.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.Dwnldr
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.Dwnldr.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.HbAx
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.HbAx.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.HbGuru
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.HbGuru.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.HbInfoBand
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.HbInfoBand.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.IEButton
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.IEButton.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.IEButtonA
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.IEButtonA.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.KOPFF
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.KOPFF.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.MozillaNvgtnTrpr
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.MozillaNvgtnTrpr.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.MozillaPSExecuter
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.MozillaPSExecuter.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.ReportData
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.ReportData.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.Reporter
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.Reporter.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.RprtCtrl
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.RprtCtrl.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.Scopes
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.Scopes.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.Stock
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.Stock.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.TriggerImmidiate
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.TriggerImmidiate.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.TriggerImmidiateOrRandomTS
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.TriggerImmidiateOrRandomTS.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.TriggerOnceInDay
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.TriggerOnceInDay.1
0,Clé supprimée: HKLM\Software\Classes\AppID\BRNstIE.DLL
0,Clé supprimée: HKLM\Software\Classes\AppID\CmndFF.DLL
0,Clé supprimée: HKLM\Software\Classes\AppID\GenericAskToolbar.DLL
1,Clé supprimée: HKLM\Software\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
0,Clé supprimée: HKLM\Software\Classes\AppID\MenuButtonIE.DLL
1,Clé supprimée: HKLM\Software\Classes\AppID\{11C27351-716B-4052-9361-E3B0A3F8221C}
0,Clé supprimée: HKLM\Software\Classes\AppID\mozillaps.dll
0,Clé supprimée: HKLM\Software\Classes\AppID\Pltfrm.DLL
0,Clé supprimée: HKLM\Software\ClickPotatoLite
0,Clé supprimée: HKLM\Software\ShopperReports3
0,Clé supprimée: HKCU\Software\Ask.com
0,Clé supprimée: HKCU\Software\AskToolbar
0,Clé supprimée: HKCU\Software\ClickPotatoLiteSA
0,Clé supprimée: HKCU\Software\ShopperReports3
0,Clé supprimée: HKCU\Software\AppDataLow\AskToolbarInfo
0,Clé supprimée: HKCU\Software\AppDataLow\Software\AskToolbar
0,Clé supprimée: HKCU\Software\AppDataLow\Software\ShopperReports3
3,Clé supprimée: HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
3,Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
3,Clé supprimée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
0,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
0,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\ShopperReportsSA
0,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C5428486-50A0-4A02-9D20-520B59A9F9B2}
0,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C5428486-50A0-4A02-9D20-520B59A9F9B3}
0,Clé supprimée: HKLM\Software\Microsoft\Internet Explorer\Extensions\{c5428486-50a0-4a02-9d20-520b59a9f9b2}
0,Clé supprimée: HKLM\Software\Microsoft\Internet Explorer\Extensions\{c5428486-50a0-4a02-9d20-520b59a9f9b3}

0,Valeur supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform|ShopperReports 3.0.491.0
0,Valeur supprimée: HKLM\Software\Mozilla\Firefox\Extensions|clickpotatolite@clickpotatolite.com
0,Valeur supprimée: HKLM\Software\Mozilla\Firefox\Extensions|Shopperreports@shopperreports.com
0,Valeur supprimée: HKLM\Software\Microsoft\Internet Explorer\Toolbar|{D4027C7F-154A-4066-A1AD-4243D8127440}
0,Valeur supprimée: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{D4027C7F-154A-4066-A1AD-4243D8127440}

============== SCAN ADDITIONNEL ==============

** Mozilla Firefox Version [3.6 (fr)] **

-- C:\Users\AnneCharlotte\AppData\Roaming\Mozilla\FireFox\Profiles\vtzm3z4u.default\Prefs.js --
browser.startup.homepage, hxxp://www.google.fr/
browser.startup.homepage_override.mstone, rv:1.9.2

========================================

** Internet Explorer Version [8.0.7600.16385] **

[HKCU\Software\Microsoft\Internet Explorer\Main]
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\Windows\system32\blank.htm
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/

[HKLM\Software\Microsoft\Internet Explorer\Main]
AutoHide: yes
Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\Windows\SysWOW64\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/

[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm

========================================

C:\Program Files (x86)\Ad-Remover\Quarantine: 45 Fichier(s)
C:\Program Files (x86)\Ad-Remover\Backup: 15 Fichier(s)

C:\Ad-Report-CLEAN[1].txt - 27/09/2010 (0 Octet(s))

Fin à: 20:10:35, 27/09/2010

============== E.O.F ==============

comment je peut les résoudre ceux la ? en tout cas merci de ton aide !!!

On a deja commencé :)

On continue la desinfection.

* Télécharge et installe : Malwarebyte's Anti-Malware
* (NB : S'il te manque"COMCTL32.OCX" lors de l'installe, alors télécharge le ici : https://www.malekal.com/tutorial-aboutbuster/
* A la fin de l'installation, veille à ce que l'option « mettre a jour Malwarebyte's Anti-Malware » soit cochée
* Lance MBAM et laisse les Mises à jour se télécharger (sinon fais les manuellement au lancement du programme)
* Puis va dans l'onglet "Recherche", coche "Exécuter un examen complet" puis "Rechercher"
* Sélectionne tes disques durs" puis clique sur "Lancer l'examen"
* A la fin du scan, clique sur Afficher les résultats
* Coche tous les éléments détectés puis clique sur Supprimer la sélection
* Enregistre le rapport
* S'il t'est demandé de redémarrer, clique sur Yes
* Poste le rapport de scan après la suppression ici.(poste le rapport, même si rien n'est détecté.)
* Si tu as besoin d'aide regarde ce tutorial
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4704

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

28/09/2010 07:27:08
mbam-log-2010-09-28 (07-27-08).txt

Type d'examen: Examen complet (C:\|D:\|)
Elément(s) analysé(s): 274009
Temps écoulé: 2 heure(s), 7 minute(s), 54 seconde(s)

Processus mémoire infecté(s): 2
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 31
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 6
Fichier(s) infecté(s): 25

Processus mémoire infecté(s):
C:\ProgramData\QueryExplorer\queryexplorer117.exe (Adware.QueryExplorer) -> Unloaded process successfully.
C:\Program Files (x86)\QueryExplorer\queryexplorer.exe (Adware.QueryExplorer) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
C:\Program Files (x86)\QueryExplorer\queryexplorer.dll (Adware.Agent.Gen) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\Interface\{21ba420e-161c-413a-b21e-4e42ae1f4226} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{419eda30-6dff-432c-b534-e15d899abee4} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{453db0c5-f41c-4d97-8dd6-cc72ecd5f699} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{4afc07d0-59bb-46b8-b097-1a46e88eef71} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{6511ce4c-4722-40d0-ad3d-4afa2f50978a} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{65a16874-2ed0-460e-a547-5fe2ec3a13a7} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{71e02280-5212-45c3-b174-4d5a35da254f} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{9bec9b38-bf39-4899-806e-a1c5dfeb60a2} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{b86d82bf-d39f-439a-a07c-43eddc6f6ea6} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{d8560ac2-21b5-4c1a-bdd4-bd12bc83b082} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{da6305b9-0869-4235-8c1d-533a65e639e5} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e25da6d6-c365-46cf-abaf-dc5893135d7a} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e6961c59-cfce-4ccd-b794-bc78db98413a} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f8b4ec8a-2407-4be0-aee2-0f430d65a90d} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1602f07d-8bf3-4c08-bdd6-dddb1c48aedc} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7a3d6d17-9dd5-4c60-8076-d1784dabaf8c} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ac6d819e-aa8f-4418-a3bb-d165c1b18bb5} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{814baa91-dc22-4350-87d6-0c86e93f7f08} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{c55ca95c-324b-451c-b2d2-6e895aa75fec} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b58926d6-cfb0-45d2-9c28-4b5a0f0368ae} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{b58926d6-cfb0-45d2-9c28-4b5a0f0368ae} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a078f691-9c07-4af2-bf43-35e79eecf8b7} (Adware.Softomate) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1602f07d-8bf3-4c08-bdd6-dddb1c48aedc} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{ac6d819e-aa8f-4418-a3bb-d165c1b18bb5} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{b58926d6-cfb0-45d2-9c28-4b5a0f0368ae} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{69725738-cd68-4f36-8d02-8c43722ee5da} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{89f88394-3828-4d03-a0cf-8203604c3da6} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{d4233f04-1789-483c-a137-731e8f113dd5} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\queryexplorer (Adware.QueryExplorer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\QueryExplorer (Adware.QueryExplorer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\QueryExplorer Service (Adware.QueryExplorer) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\srs_it_e8790573b2765b5331ad95 (Malware.Trace) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\ProgramData\QueryExplorer (Adware.QueryExplorer) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{27E679CC-6AAB-4B2A-BB87-096FE4178464} (Adware.QueryExplorer) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{27E679CC-6AAB-4B2A-BB87-096FE4178464}\chrome (Adware.QueryExplorer) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{27E679CC-6AAB-4B2A-BB87-096FE4178464}\defaults (Adware.QueryExplorer) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{27E679CC-6AAB-4B2A-BB87-096FE4178464}\defaults\preferences (Adware.QueryExplorer) -> Quarantined and deleted successfully.
C:\Program Files (x86)\QueryExplorer (Adware.QueryExplorer) -> Delete on reboot.

Fichier(s) infecté(s):
C:\Program Files (x86)\QueryExplorer\queryexplorer.dll (Adware.Agent.Gen) -> Delete on reboot.
C:\ProgramData\QueryExplorer\queryexplorer117.exe (Adware.QueryExplorer) -> Quarantined and deleted successfully.
C:\Program Files (x86)\QueryExplorer\queryexplorer.exe (Adware.QueryExplorer) -> Quarantined and deleted successfully.
C:\$Recycle.Bin\S-1-5-21-4113307719-3819087802-1800406623-1000\$ROQG75L.exe (Adware.Hotbar.Gen) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Ad-Remover\Quarantine\C\Program Files (x86)\ClickPotatoLite\bin\10.0.529.0\ClickPotatoLiteSA.exe.vir (Adware.ClickPotato) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Ad-Remover\Quarantine\C\Program Files (x86)\ClickPotatoLite\bin\10.0.529.0\ClickPotatoLiteSAAX.dll.vir (Adware.ClickPotato) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Ad-Remover\Quarantine\C\Program Files (x86)\ClickPotatoLite\bin\10.0.529.0\ClickPotatoLiteSABHO.dll.vir (Adware.ClickPotato) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Ad-Remover\Quarantine\C\Program Files (x86)\ClickPotatoLite\bin\10.0.529.0\ClickPotatoLiteSAHook.dll.vir (Adware.ClickPotato) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Ad-Remover\Quarantine\C\Program Files (x86)\ClickPotatoLite\bin\10.0.529.0\ClickPotatoLiteUninstaller.exe.vir (Adware.ClickPotato) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Ad-Remover\Quarantine\C\Program Files (x86)\ClickPotatoLite\bin\10.0.529.0\firefox\extensions\plugins\npclntax_ClickPotatoLiteSA.dll.vir (Adware.ClickPotato) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Ad-Remover\Quarantine\C\Program Files (x86)\Mozilla Firefox\plugins\npclntax_ClickPotatoLiteSA.dll.vir (Adware.ClickPotato) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Ad-Remover\Quarantine\C\Program Files (x86)\ShopperReports3\bin\3.0.491.0\BRNstIE.dll.vir (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Ad-Remover\Quarantine\C\Program Files (x86)\ShopperReports3\bin\3.0.491.0\CmndFF.dll.vir (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Ad-Remover\Quarantine\C\Program Files (x86)\ShopperReports3\bin\3.0.491.0\CntntCntr.dll.vir (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Ad-Remover\Quarantine\C\Program Files (x86)\ShopperReports3\bin\3.0.491.0\mozillaps.dll.vir (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Ad-Remover\Quarantine\C\Program Files (x86)\ShopperReports3\bin\3.0.491.0\Pltfrm.dll.vir (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Ad-Remover\Quarantine\C\Program Files (x86)\ShopperReports3\bin\3.0.491.0\ShopperReports.dll.vir (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Ad-Remover\Quarantine\C\Program Files (x86)\ShopperReports3\bin\3.0.491.0\ShopperReportsUninstaller.exe.vir (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Ad-Remover\Quarantine\C\Program Files (x86)\ShopperReports3\bin\3.0.491.0\firefox\firefoxtoolbar\extensions\components\BRNstFF.dll.vir (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Windows\Temp\QUE633B.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{27E679CC-6AAB-4B2A-BB87-096FE4178464}\chrome.manifest (Adware.QueryExplorer) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{27E679CC-6AAB-4B2A-BB87-096FE4178464}\install.rdf (Adware.QueryExplorer) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{27E679CC-6AAB-4B2A-BB87-096FE4178464}\chrome\queryexplorer.jar (Adware.QueryExplorer) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{27E679CC-6AAB-4B2A-BB87-096FE4178464}\defaults\preferences\prefs.js (Adware.QueryExplorer) -> Quarantined and deleted successfully.
C:\Program Files (x86)\QueryExplorer\uninstall.exe (Adware.QueryExplorer) -> Quarantined and deleted successfully.