Infection cheval de troie

Bonjour,

======= RAPPORT D'AD-REMOVER 2.0.0.2,B | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par TeamXscript le 11/11/10 à 11:40
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
Site web: http://www.teamxscript.org

C:\Program Files\Ad-remover\main.exe (SCAN [1]) -> Lancé à 01:14:26 le 04/12/2010, Mode normal

Microsoft® Windows Vista(TM) Édition Familiale Premium Service Pack 1 (X86)
samoela@PC-DE-SAMOELA (Hewlett-Packard HP Pavilion dv5 Notebook PC)

============== RECHERCHE ==============

Fichier trouvé: C:\Program Files\Mozilla FireFox\Components\AskHPRFF.js
Fichier trouvé: C:\Program Files\Mozilla FireFox\Components\AskSearch.js
Fichier trouvé: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Navigateur OfferBox.lnk
Dossier trouvé: C:\Users\samoela\AppData\Roaming\Mozilla\FireFox\Profiles\ar8qmefn.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
Fichier trouvé: C:\Users\samoela\AppData\Roaming\Mozilla\FireFox\Profiles\ar8qmefn.default\searchplugins\ask.xml
Fichier trouvé: C:\Users\samoela\AppData\Roaming\Mozilla\FireFox\Profiles\ar8qmefn.default\searchplugins\web-search.xml
Dossier trouvé: C:\Users\samoela\AppData\Local\Conduit
Dossier trouvé: C:\Users\samoela\AppData\LocalLow\Conduit
Dossier trouvé: C:\Program Files\Conduit
Dossier trouvé: C:\Users\samoela\AppData\LocalLow\ConduitEngine
Dossier trouvé: C:\Program Files\ConduitEngine
Dossier trouvé: C:\Users\samoela\AppData\LocalLow\Hotbar
Dossier trouvé: C:\Users\samoela\AppData\Local\live-player
Dossier trouvé: C:\Users\samoela\AppData\LocalLow\Smart-Shopper
Dossier trouvé: C:\Program Files\Trymedia
Dossier trouvé: C:\ProgramData\Viewpoint
Dossier trouvé: C:\Program Files\Viewpoint
Dossier trouvé: C:\Users\samoela\AppData\Roaming\WeatherDPA
Dossier trouvé: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WhenUSearch
Dossier trouvé: C:\Users\samoela\AppData\Roaming\OfferBox
Fichier trouvé: C:\Program Files\Mozilla Firefox\plugins\npclntax_HotbarSA.dll
Fichier trouvé: C:\Users\samoela\AppData\Local\ergdz.bat

Clé trouvée: HKLM\Software\Classes\CLSID\{03F998B2-0E00-11D3-A498-00104B6EB52E}
Clé trouvée: HKLM\Software\Classes\CLSID\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
Clé trouvée: HKLM\Software\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}
Clé trouvée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{30F9B915-B755-4826-820B-08FBA6BD249D}
Clé trouvée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}
Clé trouvée: HKLM\Software\Classes\CLSID\{4A7C84E2-E95C-43C6-8DD3-03ABCD0EB60E}
Clé trouvée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{4A7C84E2-E95C-43C6-8DD3-03ABCD0EB60E}
Clé trouvée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4A7C84E2-E95C-43C6-8DD3-03ABCD0EB60E}
Clé trouvée: HKLM\Software\Classes\CLSID\{4CF088BD-BE95-40A5-BE9B-677F8683EDEA}
Clé trouvée: HKLM\Software\Classes\CLSID\{622fd888-4e91-4d68-84d4-7262fd0811bf}
Clé trouvée: HKLM\Software\Classes\CLSID\{6FAC4823-815E-4361-836E-46D65ED2550B}
Clé trouvée: HKLM\Software\Classes\CLSID\{8BCB5337-EC01-4E38-840C-A964F174255B}
Clé trouvée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8BCB5337-EC01-4E38-840C-A964F174255B}
Clé trouvée: HKLM\Software\Classes\CLSID\{911F251E-34FD-465E-B6CE-DF00FF49A6BE}
Clé trouvée: HKLM\Software\Classes\CLSID\{b0de3308-5d5a-470d-81b9-634fc078393b}
Clé trouvée: HKLM\Software\Classes\CLSID\{C01E8C24-E0F0-4B69-BABE-F25FF3D4862D}
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C01E8C24-E0F0-4B69-BABE-F25FF3D4862D}
Clé trouvée: HKLM\Software\Classes\CLSID\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}
Clé trouvée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}
Clé trouvée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}
Clé trouvée: HKLM\Software\Classes\CLSID\{FE063DBB-4EC0-403e-8DD8-394C54984B2C}
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{FE063DBB-4EC0-403e-8DD8-394C54984B2C}
Clé trouvée: HKLM\Software\Classes\CLSID\{FE4F1649-8909-49C0-87BA-24D65120DB46}
Clé trouvée: HKLM\Software\Classes\Interface\{4634804A-F0B0-4A74-A550-FC0EEF8A4362}
Clé trouvée: HKLM\Software\Classes\Interface\{4C07EA4F-5F52-4222-B170-4CD9ED33BAEA}
Clé trouvée: HKLM\Software\Classes\Interface\{90F62EF7-58D1-4E8E-BB3E-CFB10BA9E47B}
Clé trouvée: HKLM\Software\Classes\Interface\{B2B92BC9-E149-4EE8-A93E-0B8CFB329808}
Clé trouvée: HKLM\Software\Classes\Interface\{C44FEFF4-EF0C-4CF7-83D0-92B4266A32B9}
Clé trouvée: HKLM\Software\Classes\Interface\{E79B1445-DFEA-4BEF-A786-E0C0F33C863B}
Clé trouvée: HKLM\Software\Classes\Interface\{F131923C-381D-4E4C-A472-4A17118FD742}
Clé trouvée: HKLM\Software\Classes\AskIBar.PopSwatterBarButton
Clé trouvée: HKLM\Software\Classes\AskIBar.PopSwatterBarButton.1
Clé trouvée: HKLM\Software\Classes\AskIBar.PopSwatterSettingsControl
Clé trouvée: HKLM\Software\Classes\AskIBar.PopSwatterSettingsControl.1
Clé trouvée: HKLM\Software\Classes\AskToolBar.SettingsPlugin
Clé trouvée: HKLM\Software\Classes\AskToolBar.SettingsPlugin.1
Clé trouvée: HKLM\Software\Classes\AxMetaStream.MetaStreamCtl
Clé trouvée: HKLM\Software\Classes\AxMetaStream.MetaStreamCtl.1
Clé trouvée: HKLM\Software\Classes\AxMetaStream.MetaStreamCtlSecondary
Clé trouvée: HKLM\Software\Classes\AxMetaStream.MetaStreamCtlSecondary.1
Clé trouvée: HKLM\Software\Classes\Optimizer.Interface.Demo
Clé trouvée: HKLM\Software\Classes\Optimizer.Interface.Demo.9.1
Clé trouvée: HKLM\Software\Classes\Toolbar.CT2643111
Clé trouvée: HKLM\Software\OfferBox
Clé trouvée: HKLM\Software\Conduit
Clé trouvée: HKLM\Software\conduitEngine
Clé trouvée: HKLM\Software\Freeze.com
Clé trouvée: HKLM\Software\MetaStream
Clé trouvée: HKLM\Software\Titan Poker
Clé trouvée: HKLM\Software\Viewpoint
Clé trouvée: HKCU\Software\OfferBox
Clé trouvée: HKCU\Software\Conduit
Clé trouvée: HKCU\Software\Freeze.com
Clé trouvée: HKCU\Software\Grand Virtual
Clé trouvée: HKCU\Software\hotbarsa
Clé trouvée: HKCU\Software\Titan Poker
Clé trouvée: HKCU\Software\AppDataLow\Toolbar
Clé trouvée: HKCU\Software\AppDataLow\AskBarDis
Clé trouvée: HKCU\Software\AppDataLow\Software\Conduit
Clé trouvée: HKCU\Software\AppDataLow\Software\conduitEngine
Clé trouvée: HKCU\Software\AppDataLow\Software\Hotbar
Clé trouvée: HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\HotbarOE
Clé trouvée: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{41427F18-E891-4297-BD8C-4BB0E8EAF99F}
Clé trouvée: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AD973649-F5FF-4266-BB1F-1201ADE9B42E}
Clé trouvée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C7D3DECB-368C-4F74-9697-DAD195D44EAD}
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\ViewpointMediaPlayer
Clé trouvée: HKLM\Software\Google\Chrome\Extensions\bjeikeheijdjdfjbmknpefojickbkmom
Clé trouvée: HKLM\Software\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E}
Clé trouvée: HKLM\Software\Microsoft\Active Setup\Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
Clé trouvée: HKLM\Software\Microsoft\Office\Outlook\Addins\HostOL.MailAnim
Clé trouvée: HKLM\Software\Microsoft\Office\Word\Addins\HostOL.MailAnim

Valeur trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform|Hotbar 10.2.236.0
Valeur trouvée: HKLM\Software\Mozilla\Firefox\Extensions|Hotbar@Hotbar.com
Valeur trouvée: HKLM\Software\Microsoft\Internet Explorer\Toolbar|{D0523BB4-21E7-11DD-9AB7-415B56D89593}
Valeur trouvée: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{FE063DB9-4EC0-403E-8DD8-394C54984B2C}
Valeur trouvée: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{3041D03E-FD4B-44E0-B742-2D9B88305F98}
Valeur trouvée: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{D0523BB4-21E7-11DD-9AB7-415B56D89593}

============== SCAN ADDITIONNEL ==============

** Mozilla Firefox Version [3.6.12 (fr)] **

-- C:\Users\samoela\AppData\Roaming\Mozilla\FireFox\Profiles\ar8qmefn.default\Prefs.js --
browser.download.dir, C:\\Users\\samoela\\Downloads
browser.download.lastDir, C:\\Users\\samoela\\Desktop
browser.search.defaultenginename, SweetIM Search
browser.search.defaulturl, hxxp://search.sweetim.com/search.asp?src=2&q=
browser.search.selectedEngine, Google
browser.startup.homepage, hxxp://www.yahoo.fr/
browser.startup.homepage_override.mstone, rv:1.9.2.12
keyword.URL, hxxp://search.sweetim.com/search.asp?src=2&q=
sweetim.toolbar.previous.browser.search.defaultenginename, Winamp Search
sweetim.toolbar.previous.browser.search.defaulturl, hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&in...
sweetim.toolbar.previous.browser.search.selectedEngine, Google
sweetim.toolbar.previous.browser.startup.homepage, hxxp://vshare.toolbarhome.com/?hp=df
sweetim.toolbar.previous.keyword.URL, hxxp://vshare.toolbarhome.com/search.aspx?srch=ku&q=

========================================

** Internet Explorer Version [8.0.6001.18975] **

[HKCU\Software\Microsoft\Internet Explorer\Main]
AutoHide: yes
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Enable Browser Extensions: yes
Search bar: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Show_ToolBar: yes
Start Page: hxxp://home.sweetim.com
Use Custom Search URL: 1
Use Search Asst: no

[HKLM\Software\Microsoft\Internet Explorer\Main]
AutoHide: yes
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Enable Browser Extensions: yes
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://home.sweetim.com
Use Search Asst: no

[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm

========================================

C:\Program Files\Ad-remover\Quarantine: 0 Fichier(s)
C:\Program Files\Ad-remover\Backup: 1 Fichier(s)

C:\Ad-Report-SCAN[1].txt - 04/12/2010 (10773 Octet(s))

Fin à: 01:15:18, 04/12/2010

============== E.O.F ==============