Infection avec anitmalware doctor

Bonsoir,

Tu peux me poster le rapport ici .

merci pour ton aide!

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Version de la base de données: 5953

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

04/03/2011 22:55:23
mbam-log-2011-03-04 (22-55-23).txt

Type d'examen: Examen complet (C:\|D:\|)
Elément(s) analysé(s): 291074
Temps écoulé: 2 heure(s), 53 minute(s), 51 seconde(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 38
Valeur(s) du Registre infectée(s): 10
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 23
Fichier(s) infecté(s): 32

Processus mémoire infecté(s):
c:\Users\Sarah\AppData\Roaming\e6ec276b6827580a3885be55a04e86f9\agibck70dl.exe (Trojan.FakeAlert) -> 5552 -> Unloaded process successfully.

Module(s) mémoire infecté(s):
c:\Users\Sarah\AppData\Local\ilacort.dll (Trojan.Agent.U) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Antimalware Doctor (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1602F07D-8BF3-4c08-BDD6-DDDB1C48AEDC} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{C55CA95C-324B-451c-B2D2-6E895AA75FEC} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{30B15818-E110-4527-9C05-46ACE5A3460D} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ClickPotatoLiteAX.info.1 (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ClickPotatoLiteAX.info (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1602F07D-8BF3-4C08-BDD6-DDDB1C48AEDC} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7A3D6D17-9DD5-4C60-8076-D1784DABAF8C} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{814BAA91-DC22-4350-87D6-0C86E93F7F08} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{419EDA30-6DFF-432C-B534-E15D899ABEE4} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\MenuButtonIE.ButtonIE.1 (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\MenuButtonIE.ButtonIE (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{AC6D819E-AA8F-4418-A3BB-D165C1B18BB5} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ClickPotatoLiteAX.UserProfiles.1 (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ClickPotatoLiteAX.UserProfiles (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{AC6D819E-AA8F-4418-A3BB-D165C1B18BB5} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} (PUP.Dealio) -> Not selected for removal.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} (PUP.Dealio) -> Not selected for removal.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} (PUP.Dealio) -> Not selected for removal.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B58926D6-CFB0-45D2-9C28-4B5A0F0368AE} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B58926D6-CFB0-45D2-9C28-4B5A0F0368AE} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7} (Adware.Softomate) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{69725738-CD68-4f36-8D02-8C43722EE5DA} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{89F88394-3828-4d03-A0CF-8203604C3DA6} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D4233F04-1789-483c-A137-731E8F113DD5} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuestBrowse (Adware.QuestBrowse) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\MenuButtonIE.DLL (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\ShopperReports3 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Antimalware Doctor Inc (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\clickpotatolitesa (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Winsudate (Adware.GibMedia) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\ClickPotatoLite (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\QuestBrowse (Adware.QuestBrowse) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\ShopperReports3 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ClickPotatoLiteSA (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Live-Player (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShopperReportsSA (Adware.ShopperReports) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\agibck70dl.exe (Trojan.FakeAlert) -> Value: agibck70dl.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\PDFFORGE TOOLBAR\SEARCHSETTINGS.DLL (PUP.Dealio) -> Value: SEARCHSETTINGS.DLL -> Not selected for removal.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} (PUP.Dealio) -> Value: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} -> Not selected for removal.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} (PUP.Dealio) -> Value: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} -> Not selected for removal.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinUsr (Adware.Gibmedia) -> Value: WinUsr -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Qbakakokupu (Trojan.Agent.U) -> Value: Qbakakokupu -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\ShopperReports 3.1.22.0 (Adware.HotBar) -> Value: ShopperReports 3.1.22.0 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\SRS_IT_E8790470B2765B5233A999 (Malware.Trace) -> Value: SRS_IT_E8790470B2765B5233A999 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions\ClickPotatoLite@ClickPotatoLite.com (Adware.ClickPotato) -> Value: ClickPotatoLite@ClickPotatoLite.com -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions\ShopperReports@ShopperReports.com (ShopperReports) -> Value: ShopperReports@ShopperReports.com -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
c:\programdata\2aca5cc3-0f83-453d-a079-1076fe1a8b65 (Adware.Seekmo) -> Quarantined and deleted successfully.
c:\programdata\clickpotatolitesa (Adware.ClickPotato) -> Quarantined and deleted successfully.
c:\Users\Sarah\AppData\Roaming\clickpotatolite (Adware.ClickPotato) -> Delete on reboot.
c:\Users\Sarah\AppData\Roaming\shopperreports3 (Adware.ShopperReports) -> Delete on reboot.
c:\program files\clickpotatolite (Adware.ClickPotato) -> Quarantined and deleted successfully.
c:\program files\clickpotatolite\bin (Adware.ClickPotato) -> Quarantined and deleted successfully.
c:\program files\clickpotatolite\bin\10.0.646.0 (Adware.ClickPotato) -> Quarantined and deleted successfully.
c:\program files\clickpotatolite\bin\10.0.646.0\firefox (Adware.ClickPotato) -> Quarantined and deleted successfully.
c:\program files\clickpotatolite\bin\10.0.646.0\firefox\extensions (Adware.ClickPotato) -> Quarantined and deleted successfully.
c:\program files\clickpotatolite\bin\10.0.646.0\firefox\extensions\plugins (Adware.ClickPotato) -> Quarantined and deleted successfully.
c:\program files\clickpotatolite\bin\10.0.659.0 (Adware.ClickPotato) -> Quarantined and deleted successfully.
c:\program files\clickpotatolite\bin\10.0.659.0\firefox (Adware.ClickPotato) -> Quarantined and deleted successfully.
c:\program files\clickpotatolite\bin\10.0.659.0\firefox\extensions (Adware.ClickPotato) -> Quarantined and deleted successfully.
c:\program files\clickpotatolite\bin\10.0.659.0\firefox\extensions\plugins (Adware.ClickPotato) -> Quarantined and deleted successfully.
c:\Users\Sarah\AppData\Roaming\microsoft\Windows\start menu\Programs\antimalware doctor (Rogue.AntiMalwareDoctor) -> Quarantined and deleted successfully.
c:\programdata\microsoft\Windows\start menu\Programs\clickpotato (Adware.ClickPotato) -> Quarantined and deleted successfully.
c:\programdata\microsoft\Windows\start menu\Programs\shopperreports (Adware.ShopperReports) -> Quarantined and deleted successfully.
c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0} (Adware.QuestBrowse) -> Delete on reboot.
c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0}\chrome (Adware.QuestBrowse) -> Delete on reboot.
c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0}\defaults (Adware.QuestBrowse) -> Quarantined and deleted successfully.
c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0}\defaults\preferences (Adware.QuestBrowse) -> Quarantined and deleted successfully.
c:\program files\questbrwsearch (Adware.QuestBrowse) -> Quarantined and deleted successfully.
c:\programdata\questbrwsearch (Adware.QuestBrowse) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
c:\Users\Sarah\AppData\Roaming\e6ec276b6827580a3885be55a04e86f9\agibck70dl.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\program files\pdfforge toolbar\searchsettings.dll (PUP.Dealio) -> Not selected for removal.
c:\program files\questbrwsearch\uninstall.exe (Adware.QuestBrowse) -> Quarantined and deleted successfully.
c:\Users\Sarah\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\QZY61GGG\micro70ntg[1].exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\Sarah\AppData\Local\Temp\err.log6494243 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\Sarah\AppData\Local\Temp\esxnmarocw.exe (Adware.Agent) -> Quarantined and deleted successfully.
c:\Users\Sarah\downloads\xvid_setup1.2.2-win32.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\Users\Sarah\AppData\Roaming\microsoft\internet explorer\quick launch\antimalware doctor.lnk (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
c:\Users\Sarah\AppData\Roaming\microsoft\Windows\start menu\antimalware doctor.lnk (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
c:\Users\Sarah\AppData\Roaming\microsoft\Windows\start menu\Programs\Startup\antimalware doctor.lnk (Rogue.AntiMalwareDoctor) -> Quarantined and deleted successfully.
c:\Users\Sarah\local settings\application data\vkbpfn_nav.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
c:\Users\Sarah\local settings\application data\vkbpfn_navps.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
c:\Users\Sarah\AppData\Local\ilacort.dll (Trojan.Agent.U) -> Delete on reboot.
c:\programdata\clickpotatolitesa\clickpotatolitesa.dat (Adware.ClickPotato) -> Quarantined and deleted successfully.
c:\programdata\clickpotatolitesa\clickpotatolitesaabout.mht (Adware.ClickPotato) -> Quarantined and deleted successfully.
c:\programdata\clickpotatolitesa\clickpotatolitesaau.dat (Adware.ClickPotato) -> Quarantined and deleted successfully.
c:\programdata\clickpotatolitesa\clickpotatolitesaeula.mht (Adware.ClickPotato) -> Quarantined and deleted successfully.
c:\programdata\clickpotatolitesa\clickpotatolitesa_kyf.dat (Adware.ClickPotato) -> Quarantined and deleted successfully.
c:\program files\clickpotatolite\bin\10.0.646.0\firefox\extensions\install.rdf (Adware.ClickPotato) -> Quarantined and deleted successfully.
c:\program files\clickpotatolite\bin\10.0.659.0\firefox\extensions\install.rdf (Adware.ClickPotato) -> Quarantined and deleted successfully.
c:\Users\Sarah\AppData\Roaming\microsoft\Windows\start menu\Programs\antimalware doctor\antimalware doctor.lnk (Rogue.AntiMalwareDoctor) -> Quarantined and deleted successfully.
c:\Users\Sarah\AppData\Roaming\microsoft\Windows\start menu\Programs\antimalware doctor\uninstall.lnk (Rogue.AntiMalwareDoctor) -> Quarantined and deleted successfully.
c:\programdata\microsoft\Windows\start menu\Programs\clickpotato\About Us.lnk (Adware.ClickPotato) -> Quarantined and deleted successfully.
c:\programdata\microsoft\Windows\start menu\Programs\clickpotato\clickpotato customer support.lnk (Adware.ClickPotato) -> Quarantined and deleted successfully.
c:\programdata\microsoft\Windows\start menu\Programs\clickpotato\clickpotato uninstall instructions.lnk (Adware.ClickPotato) -> Quarantined and deleted successfully.
c:\programdata\microsoft\Windows\start menu\Programs\shopperreports\About Us.lnk (Adware.ShopperReports) -> Quarantined and deleted successfully.
c:\programdata\microsoft\Windows\start menu\Programs\shopperreports\customer support.lnk (Adware.ShopperReports) -> Quarantined and deleted successfully.
c:\programdata\microsoft\Windows\start menu\Programs\shopperreports\shopperreports uninstall instructions.lnk (Adware.ShopperReports) -> Quarantined and deleted successfully.
c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0}\chrome.manifest (Adware.QuestBrowse) -> Quarantined and deleted successfully.
c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0}\install.rdf (Adware.QuestBrowse) -> Quarantined and deleted successfully.
c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0}\chrome\questbrowse.jar (Adware.QuestBrowse) -> Delete on reboot.
c:\program files\mozilla firefox\extensions\{d9adb0a8-7bfb-498d-9880-ee78a81ccfa0}\defaults\preferences\prefs.js (Adware.QuestBrowse) -> Quarantined and deleted successfully.

Télécharge ZhpDiag de Nicolas Coolman .

Une fois le téléchargement achevé, double clique sur ZHPDiag.exe(clic droit ,"éxécuter en tant qu'administrateur" pour Vista/7).

Une fois installé le programme s'ouvre automatiquement .

Clique sur la loupe pour lancer l'analyse.

A la fin de l'analyse, clique sur la "disquette" (enregistrer sous..) .

Rend toi sur ce site : http://www.cijoint.fr/index.php

Clique sur parcourir et sélectionne le fichier ZhpDiag.txt (Une aide au cas ou])

Un lien va etre créer ,poste ce lien dans ta prochaine réponse.

MERCI
J'ai un problème avc le logiciel ZhPDiag.exe

Impossible d'exécuter le fichier:
C:\Program Files\ZHPDiag\ZHPDiag.exe
CreateProcess a échoué; code 740.
L'opération demandé nécessite une élévation

Que dois-je faire alors?

Il faut le lancer "en tant qu'administrateur" .

http://www.cijoint.fr/cjlink.php?file=cj201103/cij2U1ur9q.txt

Ton pc est encore bien infecté ,on a du boulot sur la planche :

* Télécharge sur le bureau RogueKiller (par tigzy)
* Quitte tous tes programmes en cours
* Lance le.
* Lorsque demandé, tape 2 et valide
* Un rapport (RKreport.txt) a du se créer à côté de l'exécutable, colle son contenu dans la réponse
* Si le programme a été bloqué, ne pas hésiter a essayer plusieurs fois.

RogueKiller V4.1.0 par Tigzy
contact sur https://www.luanagames.com/index.fr.html
mail: tigzyRK<at>gmail<dot>com
Remontees: https://www.luanagames.com/index.fr.html

Systeme d'exploitation: Windows Vista (6.0.6001 Service Pack 1) 32 bits version
Demarrage : Mode normal
Utilisateur: Sarah [Droits d'admin]
Mode: Suppression -- Date : 06/03/2011 10:31:40

Processus malicieux: 1
[APPDT/TMP/DESKTOP] vkbpfn.exe -- c:\users\sarah\appdata\local\vkbpfn.exe -> KILLED

Entrees de registre: 2
[APPDT/TMP/DESKTOP] HKCU\[...]\Run : vkbpfn ("c:\users\sarah\appdata\local\vkbpfn.exe" vkbpfn) -> DELETED
[APPDT/TMP/DESKTOP] HKCU\[...]\Run : Qbakakokupu (rundll32.exe "C:\Users\Sarah\AppData\Local\ilacort.dll",Startup) -> DELETED

Fichier HOSTS:
127.0.0.1 localhost
::1 localhost

Termine

Télécharges AD-Remover sur ton bureau :

/!\ Déconnectes toi et fermes toutes applications en cours

? Double clique sur le programme d'installation , et installe le dans son emplacement par défaut. ( C:\Program files )
? Double clique sur l'icône Ad-removersituée sur ton bureau
? Au menu principal choisi l'option "Nettoyer"
? Postes le rapport qui apparait à la fin .

( le rapport est sauvegardé aussi sous C:\Ad-report(date).log )

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Excuse moi pour la réponse tardive...

======= RAPPORT D'AD-REMOVER 2.0.0.2,F | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par TeamXscript le 01/03/11
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
Site web: http://www.teamxscript.org

C:\Program Files\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 15:44:17 le 08/03/2011, Mode normal

Microsoft® Windows Vista(TM) Édition Familiale Premium Service Pack 1 (X86)
Sarah@PC-DE-SARAH (Acer Aspire 5715Z)

============== ACTION(S) ==============

Fichier supprimé: C:\Users\Sarah\AppData\Local\sfzealxl.bat
Fichier supprimé: C:\Windows\system32\Tasks\Scheduled Update for Ask Toolbar
Dossier supprimé: C:\Users\Sarah\AppData\Roaming\Mozilla\FireFox\Profiles\2isswj7f.default\extensions\toolbar@ask.com
Fichier supprimé: C:\Users\Sarah\AppData\Roaming\Mozilla\FireFox\Profiles\2isswj7f.default\searchplugins\askcom.xml
Dossier supprimé: C:\Program Files\Ask.com
Dossier supprimé: C:\Users\Sarah\AppData\Local\AskToolbar
Dossier supprimé: C:\Users\Sarah\AppData\LocalLow\AskToolbar
Dossier supprimé: C:\Users\Sarah\AppData\Roaming\live-player
Dossier supprimé: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\live-player
Dossier supprimé: C:\Program Files\live-player
Dossier supprimé: C:\Users\Sarah\AppData\LocalLow\pdfforge
Dossier supprimé: C:\Program Files\pdfforge Toolbar
Dossier supprimé: C:\Users\Sarah\AppData\LocalLow\PriceGong
Dossier supprimé: C:\Users\Sarah\AppData\Roaming\Search Settings
Dossier supprimé: C:\Users\Sarah\AppData\LocalLow\Search Settings
Dossier supprimé: C:\Users\Sarah\AppData\Roaming\OfferBox
Dossier supprimé: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OfferBox
Dossier supprimé: C:\Program Files\OfferBox
Dossier supprimé: C:\Program Files\OfferBoxSearch
Dossier supprimé: C:\Program Files\CrazyLoader
Fichier supprimé: C:\Users\Sarah\AppData\Local\vkbpfn_navps.dat
Fichier supprimé: C:\Users\Sarah\AppData\Local\vkbpfn.dat
Fichier supprimé: C:\Users\Sarah\AppData\Local\vkbpfn.exe

(!) -- Fichiers temporaires supprimés.

-- Fichier ouvert: C:\Users\Sarah\AppData\Roaming\Mozilla\FireFox\Profiles\2isswj7f.default\Prefs.js --
Ligne supprimée: user_pref("browser.search.defaultengine", "Ask.com");
Ligne supprimée: user_pref("browser.search.defaultenginename", "Ask.com");
Ligne supprimée: user_pref("browser.search.order.1", "Ask.com");
Ligne supprimée: user_pref("extensions.asktb.cbid", "OF");
Ligne supprimée: user_pref("extensions.asktb.default-channel-url-mask", "hxxp://fr.ask.com/web?q={query}&o={o}&l={l}&...
Ligne supprimée: user_pref("extensions.asktb.fresh-install", false);
Ligne supprimée: user_pref("extensions.asktb.l", "dis");
Ligne supprimée: user_pref("extensions.asktb.last-config-req", "1299487869671");
Ligne supprimée: user_pref("extensions.asktb.locale", "fr_FR");
Ligne supprimée: user_pref("extensions.asktb.o", "16050");
Ligne supprimée: user_pref("extensions.asktb.overlay-reloaded-using-restart", true);
Ligne supprimée: user_pref("extensions.asktb.qsrc", "2871");
Ligne supprimée: user_pref("extensions.asktb.r", "3");
Ligne supprimée: user_pref("extensions.asktb.to", "16105");
Ligne supprimée: user_pref("extensions.enabledItems", "{B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.3,{20a82645-c095-46ed...
Ligne supprimée: user_pref("extensions.wrc.SearchRules.ask.com.style", ".WRCN {display:none} #yui-main .tsrc_vnru .ti...
Ligne supprimée: user_pref("extensions.wrc.SearchRules.ask.com.url", "^hxxp(s)?\\:\\/\\/(.+\\.)?ask\\.com\\/.*");
Ligne supprimée: user_pref("extensions.wrc.SearchRules.baidu.com.style", ".WRCN {display:none} .result .f .WRCN {disp...
Ligne supprimée: user_pref("extensions.wrc.SearchRules.baidu.com.url", "^hxxp\\:\\/\\/www\\.baidu\\.com\\/.*");
Ligne supprimée: user_pref("keyword.URL", "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=LMW2&o=16050&locale=...
-- Fichier Fermé --

Clé supprimée: HKLM\Software\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Clé supprimée: HKLM\Software\Classes\CLSID\{6DF77AA3-27AF-46f2-A1DA-B569AC6BEEFF}
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6DF77AA3-27AF-46f2-A1DA-B569AC6BEEFF}
Clé supprimée: HKLM\Software\Classes\CLSID\{6F6C45E4-E231-4F0F-8CD8-AA5770303EAA}
Clé supprimée: HKLM\Software\Classes\Interface\{6F6C45E4-E231-4F0F-8CD8-AA5770303EAA}
Clé supprimée: HKLM\Software\Classes\CLSID\{86460CE5-46A0-4543-B8FE-2D2AE182A2FE}
Clé supprimée: HKLM\Software\Classes\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}
Clé supprimée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B922D405-6D13-4A2B-AE89-08A030DA4402}
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}
Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B922D405-6D13-4A2B-AE89-08A030DA4402}
Clé supprimée: HKLM\Software\Classes\CLSID\{C5F65718-341D-4e7d-9842-FCB9CC89527E}
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C5F65718-341D-4e7d-9842-FCB9CC89527E}
Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C5F65718-341D-4e7d-9842-FCB9CC89527E}
Clé supprimée: HKLM\Software\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Clé supprimée: HKLM\Software\Classes\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
Clé supprimée: HKLM\Software\Classes\Interface\{115CCBAE-27B0-47C3-BA42-BAB708424393}
Clé supprimée: HKLM\Software\Classes\Interface\{471E3998-588E-41D5-A874-FA11C44B70DE}
Clé supprimée: HKLM\Software\Classes\Interface\{618AAD04-921F-44C2-BE38-C0818AF69861}
Clé supprimée: HKLM\Software\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Clé supprimée: HKLM\Software\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Clé supprimée: HKLM\Software\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Clé supprimée: HKLM\Software\Classes\Interface\{B5D2ED96-62F9-4C2C-956D-E425B1F67337}
Clé supprimée: HKLM\Software\Classes\Interface\{D3A412E8-1E4B-47D2-9B12-F88291F5AFBB}
Clé supprimée: HKLM\Software\Classes\Interface\{D4E856E7-C034-49BA-BFEF-B785F3CBD7BA}
Clé supprimée: HKLM\Software\Classes\Interface\{DB7A9C36-6C85-48BE-BA8D-151B6B144BE0}
Clé supprimée: HKLM\Software\Classes\Interface\{F77F3DFC-F5DC-4316-AB50-B50B16F2BEF4}
Clé supprimée: HKLM\Software\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Clé supprimée: HKLM\Software\Classes\TypeLib\{63AF3145-D2DC-4F1D-BB3A-3AAD9FEC3430}
Clé supprimée: HKLM\Software\Classes\TypeLib\{D530F69A-EB2D-4EC6-BD37-E123AEFCA011}
Clé supprimée: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\sfzealxl
Clé supprimée: HKLM\Software\Classes\Crazyloader.Spointer
Clé supprimée: HKLM\Software\Classes\Crazyloader.Spointer.1
Clé supprimée: HKLM\Software\Classes\Crazyloader.SpointerCtrl
Clé supprimée: HKLM\Software\Classes\Crazyloader.SpointerCtrl.1
Clé supprimée: HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd
Clé supprimée: HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd.1
Clé supprimée: HKLM\Software\Classes\AppID\GenericAskToolbar.DLL
Clé supprimée: HKLM\Software\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Clé supprimée: HKLM\Software\Conduit
Clé supprimée: HKLM\Software\Freeze.com
Clé supprimée: HKLM\Software\Live-Player
Clé supprimée: HKLM\Software\pdfforge
Clé supprimée: HKLM\Software\Search Settings
Clé supprimée: HKCU\Software\OfferBox
Clé supprimée: HKCU\Software\Spointer
Clé supprimée: HKCU\Software\Ask.com
Clé supprimée: HKCU\Software\AskToolbar
Clé supprimée: HKCU\Software\fcn
Clé supprimée: HKCU\Software\Live-Player
Clé supprimée: HKCU\Software\Search Settings
Clé supprimée: HKCU\Software\AppDataLow\AskToolbarInfo
Clé supprimée: HKCU\Software\AppDataLow\Software\AskToolbar
Clé supprimée: HKCU\Software\AppDataLow\Software\pdfforge
Clé supprimée: HKCU\Software\AppDataLow\Software\PriceGong
Clé supprimée: HKLM\Software\Classes\Installer\Products\5B4758C25396ECF468E04F8E063287FF
Clé supprimée: HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Clé supprimée: HKLM\Software\Classes\Installer\Products\B8CF0B8BB96E5124FAA1B4FD2FD097B4
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\5B4758C25396ECF468E04F8E063287FF
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\B8CF0B8BB96E5124FAA1B4FD2FD097B4
Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}
Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Clé supprimée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Clé supprimée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DBA4B812-2415-4000-AFCB-56F53E668DC5}
Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\CrazyLoader
Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{2C8574B5-6935-4FCE-860E-F4E8602378FF}
Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{B8B0FC8B-E69B-4215-AF1A-4BDFF20D794B}
Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\QuestBrowse
Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ClickpotatoliteSA
Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Live-Player
Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ShopperReportsSA
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\CrazyLoader
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{2C8574B5-6935-4FCE-860E-F4E8602378FF}
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{B8B0FC8B-E69B-4215-AF1A-4BDFF20D794B}
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Search Settings
Erreur suppression clé: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar

Valeur supprimée: HKCU\Software\Mozilla\Firefox\Extensions|offerboxffx@offerbox.com
Valeur supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Run|SearchSettings
Valeur supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Run|OfferBox
Valeur supprimée: HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks|{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
Valeur supprimée: HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks|{00000000-6E41-4FD3-8538-502F5495E5FC}
Valeur supprimée: HKLM\Software\Microsoft\Internet Explorer\Toolbar|{D4027C7F-154A-4066-A1AD-4243D8127440}
Valeur supprimée: HKLM\Software\Microsoft\Internet Explorer\Toolbar|{B922D405-6D13-4A2B-AE89-08A030DA4402}
Valeur supprimée: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{D4027C7F-154A-4066-A1AD-4243D8127440}
Valeur supprimée: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{D0523BB4-21E7-11DD-9AB7-415B56D89593}

============== SCAN ADDITIONNEL ==============

**** Mozilla Firefox Version [3.6.15 (fr)] ****

HKCU_MozillaPlugins\@stonetrip.com/ShiVaWebPlayer,version=1.8.1.0 (x)
HKLM_Extensions|crazyloader@spointer.com - C:\Program Files\CrazyLoader\spointer\extensions\crazyloader@spointer.com (x)
HKLM_Extensions|{B7082FAA-CB62-4872-9106-E42DD88EDE45} - C:\Program Files\McAfee\SiteAdvisor

-- C:\Users\Sarah\AppData\Roaming\Mozilla\FireFox\Profiles\2isswj7f.default --
Prefs.js - browser.download.lastDir, C:\\Users\\Sarah\\Desktop
Prefs.js - browser.search.selectedEngine, Google
Prefs.js - browser.startup.homepage_override.mstone, rv:1.9.2.15

========================================

**** Internet Explorer Version [7.0.6001.18000] ****

HKCU_Main|Default_Page_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKCU_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU_Main|Search bar - hxxp://go.microsoft.com/fwlink/?linkid=54896
HKCU_Main|Start Page - hxxp://fr.msn.com/
HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Search bar - hxxp://search.msn.com/spbasic.htm
HKLM_Main|Search Page - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Start Page - hxxp://fr.msn.com/
HKCU_URLSearchHooks|{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - "McAfee SiteAdvisor Toolbar" (c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll)
HKCU_SearchScopes\{89566CD9-F413-0460-BD99-8AE6980911A3} - "MyStart" (hxxp://www.mystart101.com/web/{searchTerms}/1)
HKCU_SearchScopes\{99088cc3-8be2-40fc-832f-cde3783069a1} - "Searcheo" (hxxp://www.searcheo.fr/recherche?search&q={searchTerms})
HKCU_Toolbar\ShellBrowser|{5CBE3B7C-1E47-477E-A7DD-396DB0476E29} (C:\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll)
HKLM_Toolbar|{5CBE3B7C-1E47-477e-A7DD-396DB0476E29} (C:\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll)
HKLM_Toolbar|{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} (c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll)
HKLM_Toolbar|{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} (C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll)
HKLM_ElevationPolicy\6b765081-e386-4338-9bda-518a6284520e - C:\Program Files\myBabylon_English4\myBabylon_English4ToolbarHelper.exe (x)
HKLM_ElevationPolicy\{074A2810-2D22-493e-8BD5-3CF8FE918E67} - C:\Program Files\McAfee\MSK\MskAgent.exe (McAfee, Inc.)
HKLM_ElevationPolicy\{A6E2003F-95C5-4591-BA9A-0093080FDB5C} - C:\Program Files\Common Files\Oberon Media\OberonBroker\1.0.0.63\OberonBroker.exe (?)
HKLM_ElevationPolicy\{DAABE21E-DB8C-49b8-9511-9E6547ECBC5F} - c:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
HKLM_ElevationPolicy\{ECEC282B-90B3-4c94-A3EA-70D053103AC3} - %ProgramFiles(x86)%\McAfee\MSK\MskAgent.exe (x)
HKLM_Extensions\{5067A26B-1337-4436-8AFE-EE169C2DA79F} - "?" (?)
HKLM_Extensions\{53F6FCCD-9E22-4d71-86EA-6E43136192AB} - "?" (?)
HKLM_Extensions\{58ECB495-38F0-49cb-A538-10282ABF65E7} - "Livre de reliures HP" (C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll,207)
HKLM_Extensions\{700259D7-1666-479a-93B1-3250410481E8} - "Sélection intelligente HP" (C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll,209)
HKLM_Extensions\{925DAB62-F9AC-4221-806A-057BFB1014AA} - "PC Confidential" (C:\Program Files\Winferno\PC Confidential\PCConfidential.exe,101)
BHO\{053F9267-DC04-4294-A72C-58F732D338C0} - "HP Print Clips" (C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll)
BHO\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - "Adobe PDF Reader Link Helper" (C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll)
BHO\{377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - "McAfee Phishing Filter" (c:\PROGRA~1\mcafee\msk\mcapbho.dll)
BHO\{4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - "Windows Live Family Safety Browser Helper Class" (C:\Program Files\Windows Live\Family Safety\fssbho.dll)
BHO\{5C255C8A-E604-49b4-9D64-90988571CECB} (?)
BHO\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - "Search Helper" (C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll)
BHO\{7DB2D5A0-7241-4E79-B68D-6309F01C5231} - "scriptproxy" (C:\Program Files\McAfee\VirusScan\scriptsn.dll)
BHO\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - "avast! WebRep" (C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll)
BHO\{B164E929-A1B6-4A06-B104-2CD0E90A88FF} - "McAfee SiteAdvisor BHO" (c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll)

========================================

C:\Program Files\Ad-Remover\Quarantine: 604 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 16 Fichier(s)

C:\Ad-Report-CLEAN[1].txt - 08/03/2011 15:44:21 (16813 Octet(s))

Fin à: 15:48:11, 08/03/2011

============== E.O.F ==============

Recolle moi un nouveau log ZhpDiag pour voir l'évolution .

http://www.cijoint.fr/cjlink.php?file=cj201103/cijWDob0DY.txt

Télécharge OTM de OldTimer sur ton Bureau en cliquant sur ce lien :

http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/

Double-clique sur OTMoveIt3.exe pour le lancer.

Copie la liste qui se trouve en gras ci-dessous,

et colle-la dans le cadre de gauche de OTMoveIt : "Paste instructions for item to be moved".

:files
C:\Windows\Tasks\RegPowerClean.job
C:\Users\Sarah\AppData\Local\dzpuk.exe
C:\Windows\Tasks\RPCReminder.job
C:\Program Files\Winferno

:commands
[emptytemp]
[start explorer]
[reboot]

Clique sur "MoveIt!" pour lancer la suppression.

Le résultat apparaitra dans le cadre "Results".

Clique sur "Exit" pour fermer.

Poste le rapport situé dans C:\_OTMoveIt\MovedFiles sous le nom xxxxxx_xxxxxxxxxx.log .

Il te sera peut-être demander de redémarrer le pc pour achever la suppression. Si c'est le cas accepte par Yes.

qd je fais cette manip le logiciel plante (j'ai essayé 3 fois) il ne répond plus
Dans la colonne Paste instructions for item to be moved" il reste écrit [emptytemp]
[start explorer]
[reboot]

mais le logiciel bloque.

On va essayer autrement :

Déconnecte toi d'Internet et ferme toutes les applications ouvertes.

1/Double Clique sur l'icone ZhpFix .

2/ZhpFix va s'ouvrir ,clique sur "importer un rapport ZhpDiag" puis "ok" .

3/Laisse travailler l'outil.

4/Coche ces cases (et pas d'autres !):

O39 - APT:Automatic Planified Task - C:\Windows\Tasks\RegPowerClean.job
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\RPCReminder.job
[MD5.00000000000000000000000000000000] [APT] [RegPowerClean] (.Pas de propriétaire.) -- C:\Program Files\Winferno\RegistryPowerCleaner\RegPowerClean.exe (.not file.) (Rogue.RegistryPowerCleaner)
[MD5.45CE845083D072B8656C34377650B3DA] [APT] [RPCReminder] (.Winferno Software.) -- C:\Program Files\Winferno\RegistryPowerCleaner\RPCReminder.exe
O42 - Logiciel: SpyHunter - (.Enigma Software Group USA, LLC.) [HKLM] -- {41EBC322-660F-4D16-A0DF-53147210CBDB}
O69 - SBI: SearchScopes [HKCU] {99088cc3-8be2-40fc-832f-cde3783069a1} - (Searcheo) - http://www.searcheo.fr
O4 - HKLM\..\Run: [eRecoveryService] Clé orpheline
O4 - Global Startup: C:\Users\Sarah\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Vos Allocations.lnk - Clé orpheline
O24 - Default MHTML Editor: Last - .(...) - (.not file.)
[MD5.00000000000000000000000000000000] [APT] [{2F32117F-E7CB-4CF1-A608-C3E64D365161}] (.Pas de propriétaire.) -- C:\Users\Sarah\AppData\Roaming\E6EC276B6827580A3885BE55A04E86F9\agibck70dl.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [{C8CA6D81-D1AF-44C3-94F2-42B93AA14DB7}] (.Pas de propriétaire.) -- C:\Program Files\My.Freeze.com Toolbar\settings_uninstall_app.exe (.not file.)
O51 - MPSK:{6ca882d7-ec45-11dd-b110-001eec4a29c5}\AutoRun\command. (.Pas de propriétaire - Pas de description.) -- G:\kav6.0.1.411en (.not file.)
O51 - MPSK:{90b545f2-2d7e-11df-843d-001eec4a29c5}\AutoRun\command - Clé orpheline
[MD5.F4B0D605EBB379D0E0BE39B04653523E] [SPRF] (.Pas de propriétaire - Pas de description.) -- C:\Users\Sarah\AppData\Local\dzpuk.exe [552960]

5/Pour finir clique sur "Nettoyer" .

6/colle le rapport obtenu .
***Membre Contributeur Sécurité***

Rapport de ZHPFix 1.12.3257 par Nicolas Coolman, Update du 05/03/2011
Fichier d'export Registre : C:\ZHPExportRegistry-09-03-2011-22-46-17.txt
Run by Sarah at 09/03/2011 22:46:17
Windows Vista Home Premium Edition, 32-bit Service Pack 1 (Build 6001)
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html
Contact : nicolascoolman@yahoo.fr

========== Clé(s) du Registre ==========
O42 - Logiciel: SpyHunter - (.Enigma Software Group USA, LLC.) [HKLM] -- {41EBC322-660F-4D16-A0DF-53147210CBDB} => Clé supprimée avec succès
O51 - MPSK:{6ca882d7-ec45-11dd-b110-001eec4a29c5}\AutoRun\command. (.Pas de propriétaire - Pas de description.) -- G:\kav6.0.1.411en (.not file.) => Clé supprimée avec succès
O51 - MPSK:{90b545f2-2d7e-11df-843d-001eec4a29c5}\AutoRun\command - Clé orpheline => Clé supprimée avec succès
O69 - SBI: SearchScopes [HKCU] {99088cc3-8be2-40fc-832f-cde3783069a1} - (Searcheo) - http://www.searcheo.fr => Clé supprimée avec succès

========== Valeur(s) du Registre ==========
O4 - HKLM\..\Run: [eRecoveryService] Clé orpheline => Valeur supprimée avec succès
O24 - Default MHTML Editor: Last - .(...) - (.not file.) => Valeur absente

========== Fichier(s) ==========
c:\users\sarah\appdata\roaming\microsoft\internet explorer\quick launch\vos allocations.lnk => Supprimé et mis en quarantaine
c:\windows\tasks\regpowerclean.job => Fichier absent
c:\windows\tasks\rpcreminder.job => Fichier absent
c:\program files\winferno\registrypowercleaner\regpowerclean.exe (.not file.) => Fichier absent
c:\program files\winferno\registrypowercleaner\rpcreminder.exe => Fichier absent
c:\users\sarah\appdata\roaming\e6ec276b6827580a3885be55a04e86f9\agibck70dl.exe (.not file.) => Fichier absent
c:\program files\my.freeze.com toolbar\settings_uninstall_app.exe (.not file.) => Fichier absent

========== Tache planifiée ==========
Task : RegPowerClean => Tâche supprimée avec succès
Task : RegPowerClean => Tâche supprimée avec succès
Task : RPCReminder => Tâche supprimée avec succès
Task : RPCReminder => Tâche supprimée avec succès
Task : {2F32117F-E7CB-4CF1-A608-C3E64D365161} => Tâche supprimée avec succès
Task : {C8CA6D81-D1AF-44C3-94F2-42B93AA14DB7} => Tâche supprimée avec succès

========== Récapitulatif ==========
4 : Clé(s) du Registre
2 : Valeur(s) du Registre
7 : Fichier(s)
6 : Tache planifiée

End of the scan

* Telecharge et install UsbFix par El Desaparecido , C_XX & Chimay8

(!) Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d avoir été infectés sans les ouvrir

* Fais un clic droit sur le raccourci UsbFix présent sur ton bureau et choisis "éxécuter en tant qu'administrateur" .

* Au menu principal choisis l'option " F " pour français et tape sur [entrée] .

* Au second menu Choisis l'option " 2 " (suppression) et tape sur [entrée]

* Laisse travailler l outil.

* Ensuite post le rapport UsbFix.txt qui apparaitra.

* Note : Le rapport UsbFix.txt est sauvegardé à la racine du disque. ( C:\UsbFix.txt )

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

* Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

############################## | UsbFix 7.041 | [Suppression]

Utilisateur: Sarah (Administrateur) # PC-DE-SARAH [Acer Aspire 5715Z]
Mis à jour le 24/02/2011 par TeamXscript
Lancé à 23:11:46 | 09/03/2011
Site Web: http://www.teamxscript.org
Un fichier non reconnu ? : http://www.teamxscript.org/Upload.php
Contact: TeamXscript.ElDesaparecido@gmail.com

CPU: Intel(R) Pentium(R) Dual CPU T2390 @ 1.86GHz
CPU 2: Intel(R) Pentium(R) Dual CPU T2390 @ 1.86GHz
Microsoft® Windows Vista(TM) Édition Familiale Premium (6.0.6001 32-Bit) # Service Pack 1
Internet Explorer 7.0.6001.18000

Pare-feu Windows: Activé
RAM -> 3061 Mo
C:\ (%systemdrive%) -> Disque fixe # 111 Go (33 Go libre(s) - 29%) [ACER] # NTFS
D:\ -> Disque fixe # 110 Go (94 Go libre(s) - 86%) [DATA] # NTFS
E:\ -> CD-ROM
F:\ -> Disque amovible # 2 Go (1 Go libre(s) - 70%) [] # FAT32

################## | Éléments infectieux |

Supprimé! C:\Windows\system32\autorun.inf
Supprimé! C:\$RECYCLE.BIN\S-1-5-18
Supprimé! C:\$RECYCLE.BIN\S-1-5-21-2531858004-3606774942-797825394-1000
Supprimé! C:\$RECYCLE.BIN\S-1-5-21-2531858004-3606774942-797825394-500
Supprimé! D:\$RECYCLE.BIN\S-1-5-18
Supprimé! D:\$RECYCLE.BIN\S-1-5-21-2531858004-3606774942-797825394-1000
Supprimé! D:\$RECYCLE.BIN\S-1-5-21-2531858004-3606774942-797825394-500
Supprimé! F:\filesystem
Supprimé! F:\ime
Supprimé! F:\STOBOM
Supprimé! F:\msvcr71.dll

################## | Registre |

Supprimé! HKLM\software\microsoft\windows nt\currentversion\winlogon|Taskman

################## | Mountpoints2 |

Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{4f318f10-cea3-11de-a953-b0a51d2a31fc}
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{6923cfee-0408-11df-ad88-a14c3ab8157f}
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{6ca882d5-ec45-11dd-b110-001eec4a29c5}
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{8a8688fc-6984-11df-ab3f-001eec4a29c5}
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{90b545f5-2d7e-11df-843d-001eec4a29c5}
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{dd399f0e-ac7e-11df-9621-001eec4a29c5}

################## | Listing |

[09/03/2011 - 23:15:49 | SHD ] C:\$RECYCLE.BIN
[08/09/2008 - 17:14:41 | D ] C:\Acer
[08/03/2011 - 15:48:12 | N | 16953] C:\Ad-Report-CLEAN[1].txt
[18/09/2006 - 22:43:36 | N | 24] C:\autoexec.bat
[04/11/2009 - 23:04:15 | D ] C:\BigFishGamesCache
[21/03/2008 - 05:26:07 | N | 703198] C:\bknowsetup.log
[20/03/2008 - 13:35:02 | D ] C:\Book
[20/03/2008 - 21:13:29 | D ] C:\Boot
[21/01/2008 - 03:24:42 | RASH | 333203] C:\bootmgr
[20/03/2008 - 21:13:30 | N | 8192] C:\BOOTSECT.BAK
[09/03/2011 - 16:45:25 | D ] C:\Config.Msi
[18/09/2006 - 22:43:37 | N | 10] C:\config.sys
[27/11/2009 - 17:53:42 | D ] C:\ConvertTemp
[08/09/2008 - 17:13:46 | D ] C:\Convesoft
[02/11/2006 - 14:02:03 | SHD ] C:\Documents and Settings
[20/03/2008 - 21:12:10 | D ] C:\DRV
[08/09/2008 - 19:56:43 | D ] C:\EGIS_Drive
[03/03/2010 - 19:07:20 | D ] C:\Games
[09/03/2011 - 16:58:56 | ASH | 3210723328] C:\hiberfil.sys
[20/03/2008 - 13:33:04 | D ] C:\Intel
[18/09/2009 - 13:57:02 | N | 0] C:\IO.SYS
[16/08/2005 - 07:49:12 | N | 40960] C:\junction.exe
[13/09/2007 - 10:56:16 | N | 512] C:\MDR.iss
[18/09/2009 - 13:57:02 | N | 0] C:\MSDOS.SYS
[20/03/2008 - 13:48:33 | RHD ] C:\MSOCache
[09/03/2011 - 16:58:53 | ASH | 3524517888] C:\pagefile.sys
[21/01/2008 - 03:32:31 | D ] C:\PerfLogs
[05/03/2011 - 15:11:38 | N | 512] C:\PhysicalDisk0_MBR.bin
[09/03/2011 - 16:32:04 | D ] C:\Program Files
[04/03/2011 - 22:55:22 | HD ] C:\ProgramData
[28/05/2008 - 02:41:26 | N | 477] C:\RHDSetup.log
[04/03/2011 - 19:51:25 | N | 370] C:\rkill.log
[04/03/2011 - 18:23:48 | D ] C:\sh4ldr
[08/03/2011 - 18:06:59 | SHD ] C:\System Volume Information
[21/07/2010 - 20:23:25 | N | 3] C:\t.tmp
[04/03/2011 - 15:53:22 | D ] C:\Temp
[09/03/2011 - 23:16:19 | D ] C:\UsbFix
[09/03/2011 - 23:11:56 | A | 3895] C:\UsbFix.txt
[08/09/2008 - 17:12:53 | D ] C:\Users
[09/03/2011 - 16:20:01 | D ] C:\Windows
[09/03/2011 - 22:46:18 | N | 16246] C:\ZHPExportRegistry-09-03-2011-22-46-17.txt
[09/03/2011 - 16:18:54 | D ] C:\_OTM
[09/03/2011 - 23:15:49 | SHD ] D:\$RECYCLE.BIN
[05/03/2011 - 15:11:19 | D ] D:\D
[19/01/2009 - 14:01:41 | N | 179] D:\Disque amovible (F) - Raccourci.lnk
[08/09/2008 - 19:58:02 | D ] D:\erData
[28/05/2008 - 02:30:06 | SHD ] D:\System Volume Information
[08/03/2011 - 14:38:06 | N | 11084] F:\BOYS.nbp
[13/09/2008 - 14:34:34 | D ] F:\TT 4
[10/04/2009 - 10:32:22 | D ] F:\MEMOIRE
[05/09/2008 - 18:08:36 | D ] F:\musik
[05/09/2008 - 16:50:16 | D ] F:\pho
[06/05/2009 - 09:53:32 | D ] F:\relais
[17/01/2010 - 10:35:44 | N | 132] F:\.~lock.Sans nom 1.doc#
[09/09/2008 - 10:36:36 | N | 35840] F:\BUT DU JEU.doc
[06/01/2010 - 16:24:52 | N | 1745037] F:\Install.exe
[02/01/2010 - 19:50:32 | N | 113611] F:\Rapport d'activités professionnelles.pptx
[24/02/2010 - 17:55:32 | D ] F:\Ski Font Romeu
[12/09/2008 - 15:47:36 | N | 122368] F:\PLANNING 1 2009E.xls
[03/01/2010 - 12:08:26 | N | 445440] F:\Rapport d'activités professionnelles.ppt
[17/03/2010 - 11:14:30 | D ] F:\programmes
[11/09/2010 - 09:44:28 | D ] F:\aide apsa
[28/09/2010 - 17:03:52 | N | 13652] F:\listing cross 2010.xlsx
[19/11/2008 - 12:43:06 | N | 46080] F:\baremes athle.xls
[19/05/2009 - 09:45:58 | D ] F:\C2i2e
[19/04/2007 - 08:06:14 | N | 102912] F:\projet de cycle modèle.doc
[30/10/2008 - 13:50:54 | N | 46080] F:\ACROSPORT[1].doc
[04/10/2009 - 14:45:56 | N | 28160] F:\DEVOIR Supplémentaire Retenue.doc
[10/11/2009 - 11:39:18 | N | 24064] F:\DEVOIR Supplémentaire Retenue - Correction.doc
[08/10/2009 - 14:28:10 | N | 14657] F:\listing élèves.xlsx
[13/10/2009 - 10:17:20 | N | 165] F:\~$listing élèves.xlsx
[19/10/2008 - 19:01:52 | D ] F:\lezat 2008 divers lecon doc
[29/10/2009 - 10:09:06 | D ] F:\aide judo christ
[24/10/2009 - 10:11:04 | D ] F:\aide rugby
[31/10/2008 - 16:19:38 | D ] F:\rugby aide
[24/10/2009 - 10:12:48 | D ] F:\aide gym
[24/10/2009 - 10:14:44 | D ] F:\aide durée
[16/10/2009 - 14:12:46 | D ] F:\La courneuve
[12/10/2009 - 09:48:04 | D ] F:\fiches compétences nvo Prog
[06/09/2009 - 17:41:14 | D ] F:\PLC2 Lézat
[09/09/2009 - 19:56:22 | N | 25088] F:\Calcul distance en fonction VMA et temps.xls
[04/11/2009 - 22:24:26 | N | 34304] F:\gestion tournoi par 4.doc
[11/11/2009 - 17:14:24 | N | 61952] F:\EVAL comportement.doc

################## | Vaccin |

C:\Autorun.inf -> Vaccin créé par UsbFix (TeamXscript)
D:\Autorun.inf -> Vaccin créé par UsbFix (TeamXscript)
F:\Autorun.inf -> Vaccin créé par UsbFix (TeamXscript)

################## | E.O.F |

Comment va le pc ?

et bien je pense bien!
Merci en tout cas