Virus dans dossier roaming

donc voila alors j'ai fait tous ce que tu ma demander et voila les résultats

rapport d'usb fix:






############################## | UsbFix 7.041 | [Suppression]

Utilisateur: darty (Administrateur) # DARTY-HP [Hewlett-Packard p6610fr-m]
Mis à jour le 24/02/2011 par TeamXscript
Lancé à 23:25:04 | 09/03/2011
Site Web: http://www.teamxscript.org
Un fichier non reconnu ? : http://www.teamxscript.org/Upload.php
Contact: TeamXscript.ElDesaparecido@gmail.com

CPU: Pentium(R) Dual-Core CPU E5500 @ 2.80GHz
CPU 2: Pentium(R) Dual-Core CPU E5500 @ 2.80GHz
Microsoft Windows 7 Édition Familiale Premium (6.1.7600 64-Bit) #
Internet Explorer 8.0.7600.16385

Pare-feu Windows: Désactivé /!\
RAM -> 4095 Mo
C:\ (%systemdrive%) -> Disque fixe # 452 Go (356 Go libre(s) - 79%) [OS] # NTFS
D:\ -> Disque fixe # 13 Go (2 Go libre(s) - 12%) [HP_RECOVERY] # NTFS
E:\ -> CD-ROM
J:\ -> CD-ROM
K:\ -> Disque fixe # 932 Go (859 Go libre(s) - 92%) [1ERWE1000] # NTFS

################## | Éléments infectieux |


Supprimé! C:\Users\darty\AppData\Roaming\14925.exe
Supprimé! C:\Users\darty\AppData\Roaming\22275.exe
Supprimé! C:\Users\darty\AppData\Roaming\2559.exe
Supprimé! C:\Users\darty\AppData\Roaming\42330.exe
Supprimé! C:\Users\darty\AppData\Roaming\43475.exe
Supprimé! C:\Users\darty\AppData\Roaming\46066.exe
Supprimé! C:\Users\darty\AppData\Roaming\48306.exe
Supprimé! C:\Users\darty\AppData\Roaming\57076.exe
Supprimé! C:\Users\darty\AppData\Roaming\65734898_11162300_cryptedmshack.exe
Supprimé! C:\Users\darty\AppData\Roaming\66698.exe
Supprimé! C:\Users\darty\AppData\Roaming\67426.exe
Supprimé! C:\Users\darty\AppData\Roaming\75474.exe
Supprimé! C:\Users\darty\AppData\Roaming\92201.exe
Supprimé! C:\Users\darty\AppData\Roaming\data.dat
Supprimé! C:\Users\darty\AppData\Roaming\Microsoft\lsass.exe
Supprimé! C:\Users\darty\AppData\Roaming\svchost.exe
Supprimé! C:\Users\darty\AppData\Roaming\winlogon.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\13650.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\13684.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\13791.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\14456.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\16564.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\16669.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\17581.EXE
Supprimé! C:\Users\darty\AppData\Local\Temp\19331.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\21719.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\21907.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\22022.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\22949.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\24267.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\2447.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\24737.EXE
Supprimé! C:\Users\darty\AppData\Local\Temp\3102.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\31706.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\34980.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\35667.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\36455.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\37552.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\38185.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\3856.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\39395.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\39724.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\4074.EXE
Supprimé! C:\Users\darty\AppData\Local\Temp\41495.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\42155.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\42415.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\52294.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\55224.EXE
Supprimé! C:\Users\darty\AppData\Local\Temp\56862.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\62655.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\64023.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\65304.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\66089.EXE
Supprimé! C:\Users\darty\AppData\Local\Temp\67674.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\68229.exe
Supprimé! C:\Users\darty\AppData\Local\Temp\68625.EXE
Supprimé! C:\Users\darty\AppData\Local\Temp\69151.exe






voisi le report de ad-remover:






======= RAPPORT D'AD-REMOVER 2.0.0.2,F | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par TeamXscript le 01/03/11
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
Site web: http://www.teamxscript.org

C:\Program Files (x86)\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 23:33:38 le 09/03/2011, Mode normal

Microsoft Windows 7 Édition Familiale Premium (X64)
darty@DARTY-HP (Hewlett-Packard p6610fr-m)

============== ACTION(S) ==============


Dossier supprimé: C:\Users\darty\AppData\LocalLow\Conduit
Dossier supprimé: C:\Users\darty\AppData\LocalLow\PriceGong

(!) -- Fichiers temporaires supprimés.


Clé supprimée: HKLM\Software\Conduit
Clé supprimée: HKCU\Software\AppDataLow\Software\PriceGong

Valeur supprimée: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{30F9B915-B755-4826-820B-08FBA6BD249D}


============== SCAN ADDITIONNEL ==============

-- C:\Users\darty\AppData\Roaming\Mozilla\FireFox\Profiles\rfxkrozb.default --
Prefs.js - browser.download.lastDir, C:\\Users\\darty\\Downloads\\Eminem Discography (2010)\\2008-Global Warning
Prefs.js - browser.startup.homepage_override.mstone, rv:1.9.2.13

========================================

**** Internet Explorer Version [8.0.7600.16385] ****

HKCU_Main|Default_Page_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKCU_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU_Main|Search bar - hxxp://go.microsoft.com/fwlink/?linkid=54896
HKCU_Main|Start Page - hxxp://fr.msn.com/
HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Search bar - hxxp://search.msn.com/spbasic.htm
HKLM_Main|Search Page - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Start Page - hxxp://fr.msn.com/
HKCU_URLSearchHooks|{05eeb91a-aef7-4f8a-978f-fb83e7b03f8e} (x)
HKCU_SearchScopes\{C8AC55BE-9CE0-4E98-A450-C4D36B8105CC} - "Wikipedia" (hxxp://fr.wikipedia.org/wiki/Special:Search?search={searchTerms})
HKLM_SearchScopes\{C8AC55BE-9CE0-4E98-A450-C4D36B8105CC} - "Wikipedia" (hxxp://fr.wikipedia.org/wiki/Special:Search?search={searchTerms})
HKCU_Toolbar\WebBrowser|{05EEB91A-AEF7-4F8A-978F-FB83E7B03F8E} (x)
HKLM_Toolbar|{8dcb7100-df86-4384-8842-8fa844297b3f} (c:\Program Files (x86)\MSN Toolbar\Platform\6.3.2380.0\npwinext.dll)
HKLM_ElevationPolicy\{07d873dc-b9b9-44f5-af0b-fb59fa54fb7a} - C:\Windows\SysWOW64\wpcer.exe (x)
HKLM_ElevationPolicy\{0a402d70-1f10-4ae7-bec9-286a98240695} - C:\Windows\SysWOW64\winfxdocobj.exe (x)
HKLM_ElevationPolicy\{5F17E524-3447-4c7d-8E5F-4EFF31CDE3B7} - C:\Program Files (x86)\DivX\DivX Plus Web Player\DDMService.exe (DivX, LLC)
HKLM_ElevationPolicy\{64903E32-AE0B-408D-909C-09A08791F28D} - C:\Program Files (x86)\DivX\DivX Plus Web Player\dwpBroker.exe (?)
HKLM_ElevationPolicy\{70f641fd-9ffc-4d5b-a4dc-962af4ed7999} - C:\Program Files (x86)\Internet Explorer\iedw.exe (x)
HKLM_ElevationPolicy\{B2321D2F-1154-4d97-AD3E-2FE0BAE2897B} - C:\Program Files (x86)\SFR\Kit\9launch.exe (SFR)
HKLM_ElevationPolicy\{B43A0C1E-B63F-4691-B68F-CD807A45DA01} - C:\Windows\system32\TSWbPrxy.exe (x)
HKLM_ElevationPolicy\{D802E3EF-2513-4661-972E-BAD737EFBA88} - C:\Program Files (x86)\DivX\DivX OVS Helper\OVSHelperBroker.exe (DivX, LLC.)
HKLM_Extensions\{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - "?" (?)
BHO\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8} - "Objet d'aide à la navigation SFR" (C:\Program Files (x86)\SFR\Kit\SFRNavErrorHelper.dll)
BHO\{326E768D-4182-46FD-9C16-1449A49795F4} - "DivX Plus Web Player HTML5 <video>" (C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll)
BHO\{593DDEC6-7468-4cdd-90E1-42DADAA222E9} - "DivX HiQ" (C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll)
BHO\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - "Search Helper" (C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll)

========================================

C:\Program Files (x86)\Ad-Remover\Quarantine: 29 Fichier(s)
C:\Program Files (x86)\Ad-Remover\Backup: 15 Fichier(s)

C:\Ad-Report-CLEAN[1].txt - 09/03/2011 23:33:42 (4175 Octet(s))

Fin à: 23:34:28, 09/03/2011

============== E.O.F ==============






malwarebytes:





Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Version de la base de données: 6005

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

10/03/2011 00:10:28
mbam-log-2011-03-10 (00-10-28).txt

Type d'examen: Examen complet (C:\|D:\|K:\|)
Elément(s) analysé(s): 316342
Temps écoulé: 27 minute(s), 29 seconde(s)

Processus mémoire infecté(s): 12
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 11
Valeur(s) du Registre infectée(s): 12
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 80

Processus mémoire infecté(s):
c:\Users\darty\AppData\Roaming\j1uwtx58pz.exe (Heuristics.Shuriken) -> 2348 -> Unloaded process successfully.
c:\Users\darty\AppData\Roaming\microsoft\svchost.exe (Trojan.Agent) -> 2440 -> Unloaded process successfully.
c:\Users\darty\AppData\Roaming\directory\Chrome.exe (Trojan.Agent) -> 2472 -> Unloaded process successfully.
c:\Users\darty\AppData\Roaming\directory\Chrome.exe (Trojan.Agent) -> 2516 -> Unloaded process successfully.
c:\Users\darty\AppData\Roaming\njhan2ldgx.exe (Trojan.Agent.Gen) -> 2692 -> Unloaded process successfully.
c:\Users\darty\AppData\Roaming\PE.exe (Heuristics.Shuriken) -> 3820 -> Unloaded process successfully.
c:\Users\darty\AppData\Roaming\WinHost.exe (Backdoor.Bot) -> 4308 -> Unloaded process successfully.
c:\Users\darty\AppData\Roaming\microsoft\lsass.exe (Backdoor.IRCBot) -> 2564 -> Unloaded process successfully.
c:\Users\darty\AppData\Roaming\75474.exe (Rogue.Agent.Gen) -> 4544 -> Unloaded process successfully.
c:\Users\darty\AppData\Roaming\bot.exe (Backdoor.Agent.Gen) -> 4464 -> Unloaded process successfully.
c:\Users\darty\AppData\Roaming\svchost.exe (Trojan.Agent) -> 2392 -> Unloaded process successfully.
c:\Users\darty\AppData\Roaming\winlogon_36.exe (Rogue.MSE) -> 2748 -> Unloaded process successfully.

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{9F809DDC-2AA2-AD9C-DAEB-BFB57D2BB6AA} (Heuristics.Shuriken) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{9F809DDC-2AA2-AD9C-DAEB-BFB57D2BB6AA} (Heuristics.Shuriken) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{E9DCCB7A-5A4C-AD5B-5BDF-ADF11C0BAE7E} (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{E9DCCB7A-5A4C-AD5B-5BDF-ADF11C0BAE7E} (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{FA0D2F7B-6C5A-BDCD-C0FD-4CECEE9F0EFB} (Heuristics.Shuriken) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{FA0D2F7B-6C5A-BDCD-C0FD-4CECEE9F0EFB} (Heuristics.Shuriken) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{FFCA8FFE-37FA-9BF5-DA4B-C7C40B24A6A7} (Backdoor.Agent.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{FFCA8FFE-37FA-9BF5-DA4B-C7C40B24A6A7} (Backdoor.Agent.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\VB and VBA Program Settings\Microwsoft (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\VB and VBA Program Settings\SrvID (Malware.Trace) -> Delete on reboot.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java (Heuristics.Shuriken) -> Value: java -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost.exe (Trojan.Agent) -> Value: svchost.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Chrome (Trojan.Agent) -> Value: Chrome -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WINDOWSDEFENDER (Trojan.Agent.Gen) -> Value: WINDOWSDEFENDER -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Win defender (Heuristics.Shuriken) -> Value: Win defender -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinHost (Backdoor.Bot) -> Value: WinHost -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry Driver (Backdoor.IRCBot) -> Value: Registry Driver -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java.exe (Trojan.Agent) -> Value: java.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogin (Backdoor.Agent.Gen) -> Value: Winlogin -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Service Host (Trojan.Agent) -> Value: Windows Service Host -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update (Backdoor.IRCBot) -> Value: Windows Update -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Security Essentials (Rogue.MSE) -> Value: Microsoft Security Essentials -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
c:\Users\darty\AppData\Roaming\Svchost (Backdoor.Agent) -> Quarantined and deleted successfully.
c:\cleansweep.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
c:\Users\darty\AppData\Roaming\j1uwtx58pz.exe (Heuristics.Shuriken) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\microsoft\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\directory\Chrome.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\njhan2ldgx.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\PE.exe (Heuristics.Shuriken) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\WinHost.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\Users\darty\AppData\Local\Temp\10924.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\Users\darty\AppData\Local\Temp\10969.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\Users\darty\AppData\Local\Temp\11527.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\Users\darty\AppData\Local\Temp\13441.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\Users\darty\AppData\Local\Temp\13684.exe.vir (Trojan.Ransom) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\Users\darty\AppData\Local\Temp\13791.exe.vir (Trojan.MSIL) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\Users\darty\AppData\Local\Temp\14456.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\Users\darty\AppData\Local\Temp\16564.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\Users\darty\AppData\Local\Temp\16669.exe.vir (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\Users\darty\AppData\Local\Temp\19331.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\Users\darty\AppData\Local\Temp\21719.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\Users\darty\AppData\Local\Temp\3102.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\Users\darty\AppData\Local\Temp\31706.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\Users\darty\AppData\Local\Temp\37552.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\Users\darty\AppData\Local\Temp\41495.exe.vir (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\Users\darty\AppData\Local\Temp\42155.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\Users\darty\AppData\Local\Temp\42415.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\Users\darty\AppData\Local\Temp\56862.exe.vir (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\Users\darty\AppData\Local\Temp\64023.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\Users\darty\AppData\Local\Temp\67674.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\Users\darty\AppData\Local\Temp\68229.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\Users\darty\AppData\Local\Temp\69151.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\Users\darty\AppData\Local\Temp\7054.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\Users\darty\AppData\Roaming\13791.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\Users\darty\AppData\Roaming\32511.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\Users\darty\AppData\Roaming\dll\svchost.exe.vir (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\Users\darty\AppData\Roaming\microsoft\run.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\Users\darty\AppData\Roaming\microsoft\svchost.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\27O7T06U\fudfordakmeng[1].exe (Heuristics.Shuriken) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\27O7T06U\Java[1].exe (Trojan.Ransom) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\27O7T06U\morph_bec0b8d187[1].exe (Heuristics.Shuriken) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\2RQQR3F8\test[1].exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\2RQQR3F8\win defender[1].exe (Heuristics.Shuriken) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\5YTDND43\bs_bot_crypted[1].exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\5YTDND43\roxxybot[1].exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\5YTDND43\server[1].exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\5YTDND43\services64[2].exe (Heuristics.Shuriken) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\X7NUHG91\fudddoser[1].exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\X7NUHG91\fud[1].exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\X7NUHG91\workfriend[1].exe (Heuristics.Shuriken) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Local\Temp\36588.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Local\Temp\98109.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\main.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\server2-crypt.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\services64.exe (Heuristics.Shuriken) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\windowsdef.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\@off@\filename.exe (Heuristics.Shuriken) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\@off@\winlogon.exe (Heuristics.Shuriken) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\Svchost\server.exe (PWS.Fignotok) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\Svchost\Svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\windir\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\windir\winlogon.exe (Backdoor.Agent) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\data.dat (Stolen.Data) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\microsoft\lsass.exe (Backdoor.IRCBot) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\server.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\windefender.exe (Trojan.Keylogger) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\winlogon.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\cleansweep.exe\cleansweep.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\14925.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\22275.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\42330.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\43475.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\46066.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\48306.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\57076.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\66698.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\67426.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\75474.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\92201.exe (Rogue.Agent.Gen) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\bot.exe (Backdoor.Agent.Gen) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\System\windows update.exe (Backdoor.IRCBot) -> Quarantined and deleted successfully.
c:\Users\darty\AppData\Roaming\winlogon_36.exe (Rogue.MSE) -> Quarantined and deleted successfully.
c:\cleansweep.exe\config.bin (Trojan.Agent) -> Quarantined and deleted successfully.



kill'em:

list'em.txt: http://www.cijoint.fr/cjlink.php?file=cj201103/ciju8maU4f.txt

more.txt: il n'y en a pas

et pour finir le scan zhpdiag:





Rapport de ZHPDiag v1.27.1630 par Nicolas Coolman, Update du 08/03/2011
Run by darty at 3/10/2011 11:06:17 AM
Web site : http://www.premiumorange.com/zeb-help-process/zhpdiag.html
Contact : nicolascoolman@yahoo.fr

---\\ Web Browser
MSIE: Internet Explorer v8.0.7600.16385

---\\ System Information
Windows 7 Home Premium Edition, 64-bit (Build 7600)
Processor: Intel64 Family 6 Model 23 Stepping 10, GenuineIntel
Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 4095.2 MB (54% free)
System Restore: Activé (Enable)
System drive C: has 352 GB (77%) free of 452 GB

---\\ Logged in mode
Computer Name: DARTY-HP
User Name: darty
All Users Names: darty, Administrateur,
Unselected Option: O45,O61,O62,O65,O66,O82
Logged in as Administrator

---\\ Environnement Variables
%AppData%=C:\Users\darty\AppData\Roaming
%LocalAppData%=C:\Users\darty\AppData\Local
%StartMenu%=C:\Users\darty\AppData\Roaming\Microsoft\Windows\Start Menu

---\\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 352 Go of 452 Go)
D:\ Hard drive, Flash drive, Thumb drive (Free 2 Go of 13 Go)
E:\ CD-ROM drive (Not Inserted)
F:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
G:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
H:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
I:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
J:\ CD-ROM drive (Not Inserted)


---\\ Security Center & Tools Informations
[HKLM\SOFTWARE\Microsoft\Security Center] AntiSpywareOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] UpdatesDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] UacDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiSpywareOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] UpdatesDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] UacDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] NoActiveDesktopChanges: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoFolderOptions: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] DisableTaskMgr: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] DisableRegistryTools: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] NoDispScrSavPage: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN] CheckedValue: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowSearch: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] CheckedValue: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: OK


---\\ Recherche particulière de fichiers génériques
[MD5.9AAAEC8DAC27AA17B053E6352AD233AE] - (.Microsoft Corporation - Explorateur Windows.) (.10/16/2010 9:31:57 PM.) -- C:\Windows\Explorer.exe [2870272]
[MD5.B5C5DCAD3899512020D135600129D665] - (.Microsoft Corporation - Application de démarrage de Windows.) (.7/14/2009 2:14:45 AM.) -- C:\Windows\System32\Wininit.exe [96256]
[MD5.78B9ADA2BC8946AF7B17678E0D07A773] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.12/21/2010 6:38:22 AM.) -- C:\Windows\System32\wininet.dll [981504]


---\\ Processus lancés
[MD5.554A50B5310E702029D3A675459108FF] - (.Hewlett-Packard - hpsysdrv.) -- C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe [62768]
[MD5.63A648C5FEB5DE641E1174ACB6CF78C6] - (.Pas de propriétaire - SmartMenu.) -- C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe [568888]
[MD5.AF015952AC1A4F628717B2694BAEFB42] - (...) -- C:\Users\darty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1063.exe [528384]
[MD5.93966313185F05CEDE4B511ADDA1A5F2] - (.YVZLOFQEZ - BROMNSQTF.) -- C:\Users\darty\AppData\Roaming\Giblon\explorerxe.exe [3289088]
[MD5.1B5E6D698B7AC40B4CDFFBB46E6E041A] - (.OTTLBJRNE - Pas de description.) -- C:\Users\darty\AppData\Roaming\winaccount\winaccount.exe [1503232]
[MD5.166449EB4DC35959597EE8B0AF190595] - (...) -- C:\Users\darty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\14925.exe [630784]
[MD5.4E763272436B026AE6DBF24E24D95BCA] - (.YBXPDUOLQ - LETGWRSPE.) -- C:\Users\darty\AppData\Roaming\Giblonhx\explorerxx.exe [595968]
[MD5.53A12064AB687155617559F79468F460] - (...) -- C:\Users\darty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\22022.exe [864256]
[MD5.03DAAA0BEF39DB71D59D247D3992AD3D] - (.DVRMBGATR - ESJHKDWVC.) -- C:\Users\darty\AppData\Roaming\jusched121.exe [401920]
[MD5.166449EB4DC35959597EE8B0AF190595] - (...) -- C:\Users\darty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\22275.exe [630784]
[MD5.5516C26A6AF8EB4E2CAB48EC98A74398] - (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe [54576]
[MD5.166449EB4DC35959597EE8B0AF190595] - (...) -- C:\Users\darty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2559.exe [630784]
[MD5.166449EB4DC35959597EE8B0AF190595] - (...) -- C:\Users\darty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\42330.exe [630784]
[MD5.166449EB4DC35959597EE8B0AF190595] - (...) -- C:\Users\darty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\43475.exe [630784]
[MD5.166449EB4DC35959597EE8B0AF190595] - (...) -- C:\Users\darty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\46066.exe [630784]
[MD5.166449EB4DC35959597EE8B0AF190595] - (...) -- C:\Users\darty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\48306.exe [630784]
[MD5.166449EB4DC35959597EE8B0AF190595] - (...) -- C:\Users\darty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\57076.exe [630784]
[MD5.C195458CED2B3D20337F9817D735F325] - (...) -- C:\Users\darty\AppData\Roaming\svchost.exe [16384]
[MD5.3286581AA3203FDE8CCA4447CCB12865] - (...) -- C:\Users\darty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\64558.exe [528384]
[MD5.6D1BC3E20A8A3FE2BBB0113E2BE23F93] - (...) -- C:\Users\darty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\65734898_11162300_cryptedmshack.exe [479232]
[MD5.166449EB4DC35959597EE8B0AF190595] - (...) -- C:\Users\darty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\66698.exe [630784]
[MD5.166449EB4DC35959597EE8B0AF190595] - (...) -- C:\Users\darty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\67426.exe [630784]
[MD5.3286581AA3203FDE8CCA4447CCB12865] - (...) -- C:\Users\darty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\69192.exe [528384]
[MD5.3286581AA3203FDE8CCA4447CCB12865] - (...) -- C:\Users\darty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\73164.exe [528384]
[MD5.F3DEAA1F2FCF70FAF6DE3757CA343FA5] - (.Apple Inc. - iTunesHelper.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe [421160]
[MD5.93DB1FF92B03D24738A71E6E4992DFD3] - (.Sun Microsystems, Inc. - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248552]
[MD5.AEEC0405A1C587562275AB20CC6E3521] - (.Microsoft Corporation - Visual Basic Command Line Compiler.) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe [1169224]
[MD5.166449EB4DC35959597EE8B0AF190595] - (...) -- C:\Users\darty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\75474.exe [630784]
[MD5.9099462DE4CB8AFA9FD66832B8EFE00F] - (.LogMeIn Inc. - Hamachi2 Client Application.) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [1910152]
[MD5.166449EB4DC35959597EE8B0AF190595] - (...) -- C:\Users\darty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\92201.exe [630784]
[MD5.FC2D03603618AEE0106F2D3D0B21D1D9] - (.Pas de propriétaire - DivX Update.) -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1230704]
[MD5.9D5E8B45BD348DF0882C69EED0E83111] - (.Avira GmbH - Antivirus System Tray Tool.) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [281768]
[MD5.4F2BDCCBFADFE9989F24FE781CABC4E0] - (.Opera Software - Opera Internet Browser.) -- C:\Program Files (x86)\Opera\Opera.exe [943472]
[MD5.D8737C6BA5D3BF3B44C95CBD37F0400F] - (...) -- C:\Program Files (x86)\List_Kill'em\List_Kill'em.exe [305681]
[MD5.761926D007A7E79ADEFB6752B119FDE8] - (.BitTorrent, Inc. - µTorrent.) -- C:\Program Files (x86)\uTorrent\uTorrent.exe [396152]
[MD5.55E44B443B543AEBD005DC54D3D1D6A4] - (.gcQlbSgqZZMya - gcQlbSgqZZMya.) -- C:\Users\darty\AppData\Local\Temp\69913.exe [543226]
[MD5.1511EDDDFEF3A0E2122711AA15D0322C] - (.Nicolas Coolman - Diagnostic Tool.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [632320]


---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/
R0 - HKUS\S-1-5-21-3896400582-404818384-2340434031-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.microsoft.com/fr-fr/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.microsoft.com/fr-fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.microsoft.com/fr-fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.microsoft.com/fr-fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk
R3 - URLSearchHook: Microsoft Url Search Hook [64Bits] - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Microsoft Corporation - Navigateur Internet.) (8.00.7600.16385 (win7_rtm.090713-1255)) -- C:\Windows\System32\ieframe.dll
R3 - URLSearchHook: (no name) [64Bits] - {05eeb91a-aef7-4f8a-978f-fb83e7b03f8e} Clé orpheline
R4 - HKLM\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,EnabledV8 = 1


---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll


---\\ Modification d'une valeur Ini (Changed inifile value, mapped to Registry) (F2)
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: VMApplet=C:\WINDOWS\system32\SystemPropertiesPerformance.exe


---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: Windows Live ID Sign-in Helper [64Bits] - {9030D464-4C02-4ABF-8ECC-5164760863C6} . (.Microsoft Corp. - Microsoft® Windows Live ID Login Helper.) -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll


---\\ Applications démarrées par registre & par dossier (O4)
O4 - HKLM\..\Run: [hpsysdrv] . (.Hewlett-Packard - hpsysdrv.) -- c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe
O4 - HKLM\..\Run: [SmartMenu] . (.Pas de propriétaire - SmartMenu.) -- C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
O4 - HKCU\..\Run: [Key Name] C:\Users\darty\AppData\Roaming\install\winlogon.exe (.not file.)
O4 - HKCU\..\Run: [exxx] . (.YBXPDUOLQ - LETGWRSPE.) -- C:\Users\darty\AppData\Roaming\Giblonhx\explorerxx.exe
O4 - HKCU\..\Run: [WinDefender] C:\Users\darty\AppData\Roaming\Java\javatemp.exe (.not file.)
O4 - HKCU\..\Run: [Giblon] . (.YVZLOFQEZ - BROMNSQTF.) -- C:\Users\darty\AppData\Roaming\Giblon\explorerxe.exe
O4 - HKCU\..\Run: [3745638] . (.DVRMBGATR - ESJHKDWVC.) -- C:\Users\darty\AppData\Roaming\jusched121.exe
O4 - HKCU\..\Run: [WindowsGUI] . (.OTTLBJRNE - Pas de description.) -- C:\Users\darty\AppData\Roaming\winaccount\winaccount.exe
O4 - HKCU\..\Run: [13rqer] C:\Users\darty\AppData\Local\Temp\38185.exe (.not file.)
O4 - HKCU\..\Run: [java.exe] . (...) -- C:\Users\darty\AppData\Roaming\server.exe
O4 - HKCU\..\Run: [javacomccpp] . (.gcQlbSgqZZMya - gcQlbSgqZZMya.) -- C:\Users\darty\AppData\Roaming\BSPEV60.exe
O4 - HKLM\..\Wow6432Node\Run: [PDF Complete] . (.PDF Complete Inc - Sentry for PDF.) -- C:\Program Files (x86)\PDF Complete\pdfsty.exe
O4 - HKLM\..\Wow6432Node\Run: [HP Software Update] . (.Hewlett-Packard - hpwuSchd Application.) -- c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Wow6432Node\Run: [Easybits Recovery] . (.EasyBits Software AS - Pas de description.) -- C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
O4 - HKLM\..\Wow6432Node\Run: [Microsoft Default Manager] . (.Microsoft Corporation - Microsoft Default Manager.) -- C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe
O4 - HKLM\..\Wow6432Node\Run: [QuickTime Task] . (.Apple Inc. - QuickTime Task.) -- C:\Program Files (x86)\QuickTime\QTTask.exe
O4 - HKLM\..\Wow6432Node\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe
O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Sun Microsystems, Inc. - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
O4 - HKLM\..\Wow6432Node\Run: [LogMeIn Hamachi Ui] . (.LogMeIn Inc. - Hamachi2 Client Application.) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
O4 - HKLM\..\Wow6432Node\Run: [DivXUpdate] . (.Pas de propriétaire - DivX Update.) -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
O4 - HKLM\..\Wow6432Node\Run: [avgnt] . (.Avira GmbH - Antivirus System Tray Tool.) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-21-3896400582-404818384-2340434031-1000\..\Run: [Key Name] C:\Users\darty\AppData\Roaming\install\winlogon.exe (.not file.)
O4 - HKUS\S-1-5-21-3896400582-404818384-2340434031-1000\..\Run: [exxx] . (.YBXPDUOLQ - LETGWRSPE.) -- C:\Users\darty\AppData\Roaming\Giblonhx\explorerxx.exe
O4 - HKUS\S-1-5-21-3896400582-404818384-2340434031-1000\..\Run: [WinDefender] C:\Users\darty\AppData\Roaming\Java\javatemp.exe (.not file.)
O4 - HKUS\S-1-5-21-3896400582-404818384-2340434031-1000\..\Run: [Giblon] . (.YVZLOFQEZ - BROMNSQTF.) -- C:\Users\darty\AppData\Roaming\Giblon\explorerxe.exe
O4 - HKUS\S-1-5-21-3896400582-404818384-2340434031-1000\..\Run: [3745638] . (.DVRMBGATR - ESJHKDWVC.) -- C:\Users\darty\AppData\Roaming\jusched121.exe
O4 - HKUS\S-1-5-21-3896400582-404818384-2340434031-1000\..\Run: [WindowsGUI] . (.OTTLBJRNE - Pas de description.) -- C:\Users\darty\AppData\Roaming\winaccount\winaccount.exe
O4 - HKUS\S-1-5-21-3896400582-404818384-2340434031-1000\..\Run: [13rqer] C:\Users\darty\AppData\Local\Temp\38185.exe (.not file.)
O4 - HKUS\S-1-5-21-3896400582-404818384-2340434031-1000\..\Run: [java.exe] . (...) -- C:\Users\darty\AppData\Roaming\server.exe
O4 - HKUS\S-1-5-21-3896400582-404818384-2340434031-1000\..\Run: [javacomccpp] . (.gcQlbSgqZZMya - gcQlbSgqZZMya.) -- C:\Users\darty\AppData\Roaming\BSPEV60.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (.not file.)
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (.not file.)


---\\ Autres liens utilisateurs (O4)
O4 - Global Startup: C:\Users\darty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk . (.Microsoft Corporation.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - Global Startup: C:\Users\darty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk . (.Microsoft Corporation.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - Global Startup: C:\Users\darty\Desktop\AD-R.lnk . (...) -- C:\Program Files (x86)\Ad-Remover\main.exe
O4 - Global Startup: C:\Users\darty\Desktop\DivX Movies.lnk . (...) -- C:\Users\darty\Videos\DivX Movies
O4 - Global Startup: C:\Users\darty\Desktop\List_Kill'em.lnk . (...) -- C:\PROGRA~1\List_Kill'em\List_Kill'em.exe (.not file.)
O4 - Global Startup: C:\Users\darty\Desktop\Spybot - Search & Destroy.lnk . (.Safer Networking Limited.) -- C:\Program Files (x86)\Spybot - Search & Destroy\SpybotSD.exe
O4 - Global Startup: C:\Users\darty\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk . (.Microsoft Corporation.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe


---\\ Winsock hijacker (Layered Service Provider) (O10)
O10 - WLSP:\000000000001\Winsock LSP File . (.Microsoft Corporation - Network Location Awareness 2.) -- C:\Windows\system32\NLAapi.dll
O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - Fournisseur de service Sockets 2.0 de Microsoft Windows.) -- C:\Windows\system32\mswsock.dll
O10 - WLSP:\000000000003\Winsock LSP File . (.Microsoft Corporation - LDAP RnR Provider DLL.) -- C:\Windows\system32\winrnr.dll
O10 - WLSP:\000000000004\Winsock LSP File . (.Microsoft Corporation - Fournisseur Shim d'affectation de noms de messagerie.) -- C:\Windows\system32\napinsp.dll
O10 - WLSP:\000000000005\Winsock LSP File . (.Microsoft Corporation - Fournisseur d'espace de noms PNRP.) -- C:\Windows\system32\pnrpnsp.dll
O10 - WLSP:\000000000006\Winsock LSP File . (.Microsoft Corporation - Fournisseur d'espace de noms PNRP.) -- C:\Windows\system32\pnrpnsp.dll
O10 - WLSP:\000000000007\Winsock LSP File . (.Apple Inc. - Bonjour Namespace Provider.) -- C:\Program Files (x86)\Bonjour\mdnsNSP.dll
O10 - WLSP:\000000000008\Winsock LSP File . (.Microsoft Corp. - Microsoft® Windows Live ID Namespace Provider.) -- C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
O10 - WLSP:\000000000009\Winsock LSP File . (.Microsoft Corp. - Microsoft® Windows Live ID Namespace Provider.) -- C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL


---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{64AB0ECB-5E90-444A-83BB-F6D8566A7FC2}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{64AB0ECB-5E90-444A-83BB-F6D8566A7FC2}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{64AB0ECB-5E90-444A-83BB-F6D8566A7FC2}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{A29579E7-571F-408E-9125-89455C8AFC34}: DhcpDomain = sgt.automation.net
O17 - HKLM\System\CS1\Services\Tcpip\..\{A29579E7-571F-408E-9125-89455C8AFC34}: DhcpDomain = sgt.automation.net
O17 - HKLM\System\CS2\Services\Tcpip\..\{A29579E7-571F-408E-9125-89455C8AFC34}: DhcpDomain = sgt.automation.net
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1


---\\ Clé de Registre autorun ShellServiceObjectDelayLoad (SSO/SSODL) (O21)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.


---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: (AntiVirSchedulerService) . (.Avira GmbH - Antivirus Scheduler.) - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: (AntiVirService) . (.Avira GmbH - Antivirus On-Access Service.) - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: (Apple Mobile Device) . (.Apple Inc. - MobileDeviceService.) - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: (Bonjour Service) . (.Apple Inc. - Bonjour Service.) - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: (ezSharedSvc) . (.EasyBits Software AS - Shared EasyBits services for Windows.) - C:\Windows\System32\ezSharedSvcHost.exe
O23 - Service: (GameConsoleService) . (.WildTangent, Inc. - GameConsoleService.) - C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) . (.LogMeIn Inc. - Hamachi2 Client Tunneling Engine.) - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: (HP Health Check Service) . (.Hewlett-Packard Company - HP Support Assistant.) - C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: (HPDrvMntSvc.exe) . (.Hewlett-Packard Company - HP Quick Synchronization Service.) - C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
O23 - Service: (hpqwmiex) . (.Hewlett-Packard Company - hpqwmiex Module.) - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: (iPod Service) . (.Apple Inc. - iPodService Module (64-bit).) - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: (LightScribeService) . (.Hewlett-Packard Company - LightScribe Service.) - c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
O23 - Service: (nvsvc) . (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 266.5.) - C:\Windows\system32\nvvsvc.exe
O23 - Service: (pdfcDispatcher) . (.PDF Complete Inc - Dispatcher.) - C:\Program Files (x86)\PDF Complete\pdfsvc.exe
O23 - Service: (Stereo Service) . (.NVIDIA Corporation - Stereo Vision Control Panel API Server.) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: (wlidsvc) . (.Microsoft Corp. - Microsoft® Windows Live ID Service.) - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.exe


---\\ Enumération Active Desktop & MHTML Editor (O24)
O24 - Default MHTML Editor: Last - .(...) - (.not file.)


---\\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\HPCeeScheduleFordarty.job
[MD5.BEAEC745256D3158495FEE10BA673E7C] [APT] [HPCeeScheduleFordarty] (.Hewlett-Packard.) -- C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
[MD5.7A5DD3F26DA79178894E44E7618A8ECF] [APT] [RMCreator] (.CyberLink.) -- C:\Program Files (x86)\Hewlett-Packard\Recovery\Reminder.exe
[MD5.187E0D2AB859AD03393DDD731076BE81] [APT] [AppleSoftwareUpdate] (.Apple Inc..) -- C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe
[MD5.FDC7C934ADB8C3B51A3C21781B608673] [APT] [PC Health Analysis] (.Hewlett-Packard Company.) -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
[MD5.FDC7C934ADB8C3B51A3C21781B608673] [APT] [PC Tuneup] (.Hewlett-Packard Company.) -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe


---\\ Pilotes lancés au démarrage (O41)
O41 - Driver: C:\Windows\system32\drivers\afd.sys (AFD) . (.Microsoft Corporation - Ancillary Function Driver for WinSock.) - C:\Windows\system32\drivers\afd.sys
O41 - Driver: (avipbb) . (.Avira GmbH - Avira Driver for Security Enhancement.) - C:\Windows\System32\DRIVERS\avipbb.sys
O41 - Driver: (blbdrive) . (.Microsoft Corporation - BLB Drive Driver.) - C:\Windows\System32\DRIVERS\blbdrive.sys
O41 - Driver: (cdrom) . (.Microsoft Corporation - SCSI CD-ROM Driver.) - C:\Windows\System32\DRIVERS\cdrom.sys
O41 - Driver: C:\Windows\system32\drivers\dfsc.sys (DfsC) . (.Microsoft Corporation - DFS Namespace Client Driver.) - C:\Windows\System32\Drivers\dfsc.sys
O41 - Driver: C:\Windows\system32\drivers\discache.sys (discache) . (.Microsoft Corporation - System Indexer/Cache Driver.) - C:\Windows\System32\drivers\discache.sys
O41 - Driver: (dtsoftbus01) . (.DT Soft Ltd - DAEMON Tools Virtual Bus Driver.) - C:\Windows\System32\DRIVERS\dtsoftbus01.sys
O41 - Driver: (mssmbios) . (.Microsoft Corporation - System Management BIOS Driver.) - C:\Windows\System32\DRIVERS\mssmbios.sys
O41 - Driver: (NetBIOS) . (.Microsoft Corporation - NetBIOS interface driver.) - C:\Windows\System32\DRIVERS\netbios.sys
O41 - Driver: C:\Windows\system32\drivers\netbt.sys (NetBT) . (.Microsoft Corporation - MBT Transport driver.) - C:\Windows\System32\DRIVERS\netbt.sys
O41 - Driver: C:\Windows\system32\drivers\nsiproxy.sys (nsiproxy) . (.Microsoft Corporation - NSI Proxy.) - C:\Windows\System32\drivers\nsiproxy.sys
O41 - Driver: C:\Windows\system32\drivers\pacer.sys (Psched) . (.Microsoft Corporation - Planificateur de paquets QoS.) - C:\Windows\System32\DRIVERS\pacer.sys
O41 - Driver: C:\Windows\system32\wkssvc.dll (rdbss) . (.Microsoft Corporation - Pilote du sous-système de mise en mémoire t.) - C:\Windows\System32\DRIVERS\rdbss.sys
O41 - Driver: C:\Windows\system32\DRIVERS\RDPCDD.sys (RDPCDD) . (.Microsoft Corporation - RDP Miniport.) - C:\Windows\System32\DRIVERS\RDPCDD.sys
O41 - Driver: C:\Windows\system32\drivers\RDPENCDD.sys (RDPENCDD) . (.Microsoft Corporation - RDP Encoder Miniport.) - C:\Windows\System32\drivers\rdpencdd.sys
O41 - Driver: C:\Windows\system32\drivers\RdpRefMp.sys (RDPREFMP) . (.Microsoft Corporation - RDP Reflector Driver Miniport.) - C:\Windows\System32\drivers\rdprefmp.sys
O41 - Driver: C:\Windows\system32\tcpipcfg.dll (tdx) . (.Microsoft Corporation - TDI Translation Driver.) - C:\Windows\System32\DRIVERS\tdx.sys
O41 - Driver: (TermDD) . (.Microsoft Corporation - Remote Desktop Server Driver.) - C:\Windows\System32\DRIVERS\termdd.sys
O41 - Driver: (VgaSave) . (.Microsoft Corporation - VGA/Super VGA Video Driver.) - C:\Windows\system32\drivers\vga.sys
O41 - Driver: (vwififlt) . (.Microsoft Corporation - Virtual WiFi Filter Driver.) - C:\Windows\System32\DRIVERS\vwififlt.sys
O41 - Driver: C:\Windows\system32\rascfg.dll (Wanarpv6) . (.Microsoft Corporation - MS Remote Access and Routing ARP Driver.) - C:\Windows\System32\DRIVERS\wanarp.sys
O41 - Driver: (WfpLwf) . (.Microsoft Corporation - WFP NDIS 6.20 Lightweight Filter Driver.) - C:\Windows\System32\DRIVERS\wfplwf.sys


---\\ Logiciels installés (O42)
O42 - Logiciel: ActiveCheck component for HP Active Support Library - (.Hewlett-Packard.) [HKLM][64Bits] -- {254C37AA-6B72-4300-84F6-98A82419187E}
O42 - Logiciel: Adobe Flash Player 10 ActiveX - (.Adobe Systems Incorporated.) [HKLM][64Bits] -- Adobe Flash Player ActiveX
O42 - Logiciel: Adobe Flash Player 10 Plugin - (.Adobe Systems Incorporated.) [HKLM][64Bits] -- Adobe Flash Player Plugin
O42 - Logiciel: Agatha Christie - Death on the Nile - (.WildTangent.) [HKLM][64Bits] -- WT087420
O42 - Logiciel: Apple Application Support - (.Apple Inc..) [HKLM][64Bits] -- {EE6097DD-05F4-4178-9719-D3170BF098E8}
O42 - Logiciel: Apple Mobile Device Support - (.Apple Inc..) [HKLM] -- {E5C95CA5-4565-4B9D-97ED-05088D775614}
O42 - Logiciel: Apple Software Update - (.Apple Inc..) [HKLM][64Bits] -- {C41300B9-185D-475E-BFEC-39EF732F19B1}
O42 - Logiciel: Avira AntiVir Personal - Free Antivirus - (.Avira GmbH.) [HKLM][64Bits] -- Avira AntiVir Desktop
O42 - Logiciel: Barre d'outils Bing - (.Microsoft Corporation.) [HKLM][64Bits] -- {08234a0d-cf39-4dca-99f0-0c5cb496da81}
O42 - Logiciel: Bejeweled 2 Deluxe - (.WildTangent.) [HKLM][64Bits] -- WT087428
O42 - Logiciel: Bing Bar Platform - (.Microsoft Corporation.) [HKLM][64Bits] -- {B86C9440-82D7-423C-9FEC-6CB3092D1AA4}
O42 - Logiciel: Bonjour - (.Apple Inc..) [HKLM] -- {E4F5E48E-7155-4CF9-88CD-7F377EC9AC54}
O42 - Logiciel: Chuzzle Deluxe - (.WildTangent.) [HKLM][64Bits] -- WT087453
O42 - Logiciel: Complément Messenger - (.Microsoft Corporation.) [HKLM][64Bits] -- {6E5324C1-84FC-4F76-9A3A-C65E07F80EE6}
O42 - Logiciel: Configuration DivX - (.DivX, LLC.) [HKLM][64Bits] -- DivX Setup.divx.com
O42 - Logiciel: Contrôle ActiveX Windows Live Mesh pour connexions à distance - (.Microsoft Corporation.) [HKLM][64Bits] -- {55D003F4-9599-44BF-BA9E-95D060730DD3}
O42 - Logiciel: CyberLink DVD Suite Deluxe - (.CyberLink Corp..) [HKLM][64Bits] -- InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}
O42 - Logiciel: CyberLink DVD Suite Deluxe - (.CyberLink Corp..) [HKLM][64Bits] -- {1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}
O42 - Logiciel: D3DX10 - (.Microsoft.) [HKLM][64Bits] -- {E09C4DB7-630C-4F06-A631-8EA7239923AF}
O42 - Logiciel: DAEMON Tools Lite - (.DT Soft Ltd.) [HKLM][64Bits] -- DAEMON Tools Lite
O42 - Logiciel: DVD Menu Pack for HP MediaSmart Video - (.Hewlett-Packard.) [HKLM][64Bits] -- InstallShield_{FB4BB287-37F9-4E27-9C4D-2D3882E08EFF}
O42 - Logiciel: DVD Menu Pack for HP MediaSmart Video - (.Hewlett-Packard.) [HKLM][64Bits] -- {FB4BB287-37F9-4E27-9C4D-2D3882E08EFF}
O42 - Logiciel: Diner Dash 2 Restaurant Rescue - (.WildTangent.) [HKLM][64Bits] -- WT087536
O42 - Logiciel: FATE - (.WildTangent.) [HKLM][64Bits] -- WT087361
O42 - Logiciel: Fallout 3 - (.Bethesda Softworks.) [HKLM][64Bits] -- {974C4B12-4D02-4879-85E0-61C95CC63E9E}
O42 - Logiciel: Fallout 3 - Complete DLC Pack - (.Pas de propriétaire.) [HKCU] -- Fallout 3 - Complete DLC Pack
O42 - Logiciel: Galerie de photos Windows Live - (.Microsoft Corporation.) [HKLM][64Bits] -- {488F0347-C4A7-4374-91A7-30818BEDA710}
O42 - Logiciel: Google SketchUp 8 - (.Google, Inc..) [HKLM][64Bits] -- {C4E1603B-E550-4A14-8F53-4E989849D1B4}
O42 - Logiciel: HP Advisor - (.Hewlett-Packard.) [HKLM][64Bits] -- {40FB8D7C-6FF8-4AF2-BC8B-0B1DB32AF04B}
O42 - Logiciel: HP Customer Experience Enhancements - (.Hewlett-Packard.) [HKLM][64Bits] -- {07FA4960-B038-49EB-891B-9F95930AA544}
O42 - Logiciel: HP Game Console - (.WildTangent.) [HKLM][64Bits] -- My HP Game Console
O42 - Logiciel: HP Games - (.WildTangent.) [HKLM][64Bits] -- WildTangent hp Master Uninstall
O42 - Logiciel: HP MediaSmart DVD - (.Hewlett-Packard.) [HKLM][64Bits] -- InstallShield_{DCCAD079-F92C-44DA-B258-624FC6517A5A}
O42 - Logiciel: HP MediaSmart DVD - (.Hewlett-Packard.) [HKLM][64Bits] -- {DCCAD079-F92C-44DA-B258-624FC6517A5A}
O42 - Logiciel: HP MediaSmart Music - (.Hewlett-Packard.) [HKLM][64Bits] -- InstallShield_{91A34181-9FAD-43AB-A35F-E7A8945B7E1C}
O42 - Logiciel: HP MediaSmart Music - (.Hewlett-Packard.) [HKLM][64Bits] -- {91A34181-9FAD-43AB-A35F-E7A8945B7E1C}
O42 - Logiciel: HP MediaSmart Photo - (.Hewlett-Packard.) [HKLM][64Bits] -- InstallShield_{6DAF8CDC-9B04-413B-A0F2-BCC13CF8A5BF}
O42 - Logiciel: HP MediaSmart Photo - (.Hewlett-Packard.) [HKLM][64Bits] -- {6DAF8CDC-9B04-413B-A0F2-BCC13CF8A5BF}
O42 - Logiciel: HP MediaSmart SmartMenu - (.Hewlett-Packard.) [HKLM] -- {5B08AF35-B699-4A44-BB89-3E51E70611E8}
O42 - Logiciel: HP MediaSmart Video - (.Hewlett-Packard.) [HKLM][64Bits] -- InstallShield_{D12E3E7F-1B13-4933-A915-16C7DD37A095}
O42 - Logiciel: HP MediaSmart Video - (.Hewlett-Packard.) [HKLM][64Bits] -- {D12E3E7F-1B13-4933-A915-16C7DD37A095}
O42 - Logiciel: HP Setup - (.Hewlett-Packard.) [HKLM][64Bits] -- {72D90DB3-A16A-4545-B555-868471101833}
O42 - Logiciel: HP Support Assistant - (.Hewlett-Packard Company.) [HKLM][64Bits] -- {08DB3902-2CE0-474D-BCE3-0177766CE9F1}
O42 - Logiciel: HP Update - (.Hewlett-Packard.) [HKLM][64Bits] -- {DE77FE3F-A33D-499A-87AD-5FC406617B40}
O42 - Logiciel: HP Vision Hardware Diagnostics - (.Hewlett-Packard.) [HKLM] -- {D79A02E9-6713-4335-9668-AAC7474C0C0E}
O42 - Logiciel: HPAsset component for HP Active Support Library - (.Hewlett-Packard.) [HKLM][64Bits] -- {669D4A35-146B-4314-89F1-1AC3D7B88367}
O42 - Logiciel: Insaniquarium Deluxe - (.WildTangent.) [HKLM][64Bits] -- WT087480
O42 - Logiciel: Java(TM) 6 Update 24 - (.Oracle.) [HKLM][64Bits] -- {26A24AE4-039D-4CA4-87B4-2F83216022FF}
O42 - Logiciel: Jewel Quest II - (.WildTangent.) [HKLM][64Bits] -- WT087485
O42 - Logiciel: Jewel Quest Solitaire - (.WildTangent.) [HKLM][64Bits] -- WT087490
O42 - Logiciel: John Deere Drive Green - (.WildTangent.) [HKLM][64Bits] -- WT087380
O42 - Logiciel: Junk Mail filter update - (.Microsoft Corporation.) [HKLM][64Bits] -- {1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}
O42 - Logiciel: LabelPrint - (.CyberLink Corp..) [HKLM][64Bits] -- InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}
O42 - Logiciel: LabelPrint - (.CyberLink Corp..) [HKLM][64Bits] -- {C59C179C-668D-49A9-B6EA-0121CCFC1243}
O42 - Logiciel: LightScribe System Software - (.LightScribe.) [HKLM][64Bits] -- {46BA053F-57B3-4153-BDB6-D37EEC8B12D7}
O42 - Logiciel: LogMeIn Hamachi - (.LogMeIn, Inc..) [HKLM][64Bits] -- LogMeIn Hamachi
O42 - Logiciel: LogMeIn Hamachi - (.LogMeIn, Inc..) [HKLM][64Bits] -- {CE4A3D0F-D1B0-47D1-BF99-3E957C548D12}
O42 - Logiciel: Logiciel d'archivage WinRAR - (.Pas de propriétaire.) [HKLM][64Bits] -- WinRAR archiver
O42 - Logiciel: MSVCRT - (.Microsoft.) [HKLM][64Bits] -- {8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}
O42 - Logiciel: MSVCRT_amd64 - (.Microsoft.) [HKLM][64Bits] -- {D0B44725-3666-492D-BEF6-587A14BD9BD9}
O42 - Logiciel: MSXML 4.0 SP2 (KB954430) - (.Microsoft Corporation.) [HKLM][64Bits] -- {86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
O42 - Logiciel: MSXML 4.0 SP2 (KB973688) - (.Microsoft Corporation.) [HKLM][64Bits] -- {F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
O42 - Logiciel: Magic Desktop - (.EasyBits Software AS.) [HKLM][64Bits] -- EasyBits Magic Desktop
O42 - Logiciel: Malwarebytes' Anti-Malware - (.Malwarebytes Corporation.) [HKLM][64Bits] -- Malwarebytes' Anti-Malware_is1
O42 - Logiciel: Mesh Runtime - (.Microsoft Corporation.) [HKLM][64Bits] -- {8C6D6116-B724-4810-8F2D-D047E6B7D68E}
O42 - Logiciel: Microsoft .NET Framework 4 Client Profile - (.Microsoft Corporation.) [HKLM] -- Microsoft .NET Framework 4 Client Profile
O42 - Logiciel: Microsoft .NET Framework 4 Client Profile - (.Microsoft Corporation.) [HKLM] -- {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}
O42 - Logiciel: Microsoft .NET Framework 4 Client Profile FRA Language Pack - (.Microsoft Corporation.) [HKLM] -- {4B5F58F7-C7D1-3CE3-9B37-B657F0852643}
O42 - Logiciel: Microsoft Default Manager - (.Microsoft Corporation.) [HKLM][64Bits] -- {1CAC7A41-583B-4483-9FA5-3E5465AFF8C2}
O42 - Logiciel: Microsoft Games for Windows - LIVE - (.Microsoft Corporation.) [HKLM][64Bits] -- {86A4C6D9-29EE-4719-AFA1-BA3341862B83}
O42 - Logiciel: Microsoft Games for Windows - LIVE Redistributable - (.Microsoft Corporation.) [HKLM][64Bits] -- {1FDA5A37-B22D-43FF-B582-B8964050DC13}
O42 - Logiciel: Microsoft Office 2010 - (.Microsoft Corporation.) [HKLM][64Bits] -- {95140000-0070-0000-0000-0000000FF1CE}
O42 - Logiciel: Microsoft SQL Server 2005 Compact Edition [ENU] - (.Microsoft Corporation.) [HKLM][64Bits] -- {F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
O42 - Logiciel: Microsoft Search Enhancement Pack - (.Microsoft Corporation.) [HKLM][64Bits] -- {928B06E4-DDAA-476A-926A-641620326327}
O42 - Logiciel: Microsoft Silverlight - (.Microsoft Corporation.) [HKLM][64Bits] -- {89

merci de m'avoir répondu donc voisi le lien que tu ma demander: https://pjjoint.malekal.com/files.php?read=b1469eeff2711

j'ai fait un scan antivir et voisi le rapport:

Avira AntiVir Personal
Date de création du fichier de rapport : mercredi 9 mars 2011 13:58

La recherche porte sur 2474363 souches de virus.

Le programme fonctionne en version intégrale illimitée.
Les services en ligne sont disponibles.

Détenteur de la licence : Avira AntiVir Personal - FREE Antivirus
Numéro de série : 0000149996-ADJIE-0000001
Plateforme : Windows 7 x64
Version de Windows : (plain) [6.1.7600]
Mode Boot : Démarré normalement
Identifiant : darty
Nom de l'ordinateur : DARTY-HP

Informations de version :
BUILD.DAT : 10.0.0.110 Bytes 04/02/2011 13:16:00
AVSCAN.EXE : 10.0.3.5 435368 Bytes 21/01/2011 08:51:48
AVSCAN.DLL : 10.0.3.0 56168 Bytes 21/01/2011 08:52:12
LUKE.DLL : 10.0.3.2 104296 Bytes 21/01/2011 08:52:01
LUKERES.DLL : 10.0.0.0 13672 Bytes 21/01/2011 08:52:13
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06/11/2009 08:05:36
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14/12/2010 08:52:09
VBASE002.VDF : 7.11.3.0 1950720 Bytes 09/02/2011 11:29:19
VBASE003.VDF : 7.11.3.1 2048 Bytes 09/02/2011 11:29:19
VBASE004.VDF : 7.11.3.2 2048 Bytes 09/02/2011 11:29:19
VBASE005.VDF : 7.11.3.3 2048 Bytes 09/02/2011 11:29:19
VBASE006.VDF : 7.11.3.4 2048 Bytes 09/02/2011 11:29:19
VBASE007.VDF : 7.11.3.5 2048 Bytes 09/02/2011 11:29:19
VBASE008.VDF : 7.11.3.6 2048 Bytes 09/02/2011 11:29:19
VBASE009.VDF : 7.11.3.7 2048 Bytes 09/02/2011 11:29:19
VBASE010.VDF : 7.11.3.8 2048 Bytes 09/02/2011 11:29:19
VBASE011.VDF : 7.11.3.9 2048 Bytes 09/02/2011 11:29:19
VBASE012.VDF : 7.11.3.10 2048 Bytes 09/02/2011 11:29:20
VBASE013.VDF : 7.11.3.59 157184 Bytes 14/02/2011 11:29:20
VBASE014.VDF : 7.11.3.97 120320 Bytes 16/02/2011 11:29:20
VBASE015.VDF : 7.11.3.148 128000 Bytes 19/02/2011 11:29:20
VBASE016.VDF : 7.11.3.183 140288 Bytes 22/02/2011 11:29:21
VBASE017.VDF : 7.11.3.216 124416 Bytes 24/02/2011 11:29:21
VBASE018.VDF : 7.11.3.251 159232 Bytes 28/02/2011 11:29:21
VBASE019.VDF : 7.11.4.33 148992 Bytes 02/03/2011 11:29:21
VBASE020.VDF : 7.11.4.73 150016 Bytes 06/03/2011 11:49:11
VBASE021.VDF : 7.11.4.108 122880 Bytes 08/03/2011 23:58:03
VBASE022.VDF : 7.11.4.109 2048 Bytes 08/03/2011 23:58:03
VBASE023.VDF : 7.11.4.110 2048 Bytes 08/03/2011 23:58:03
VBASE024.VDF : 7.11.4.111 2048 Bytes 08/03/2011 23:58:03
VBASE025.VDF : 7.11.4.112 2048 Bytes 08/03/2011 23:58:03
VBASE026.VDF : 7.11.4.113 2048 Bytes 08/03/2011 23:58:03
VBASE027.VDF : 7.11.4.114 2048 Bytes 08/03/2011 23:58:03
VBASE028.VDF : 7.11.4.115 2048 Bytes 08/03/2011 23:58:03
VBASE029.VDF : 7.11.4.116 2048 Bytes 08/03/2011 23:58:03
VBASE030.VDF : 7.11.4.117 2048 Bytes 08/03/2011 23:58:03
VBASE031.VDF : 7.11.4.125 36864 Bytes 08/03/2011 23:58:03
Version du moteur : 8.2.4.180
AEVDF.DLL : 8.1.2.1 106868 Bytes 21/01/2011 08:51:41
AESCRIPT.DLL : 8.1.3.56 1261945 Bytes 08/03/2011 23:58:07
AESCN.DLL : 8.1.7.2 127349 Bytes 21/01/2011 08:51:40
AESBX.DLL : 8.1.3.2 254324 Bytes 21/01/2011 08:51:40
AERDL.DLL : 8.1.9.2 635252 Bytes 21/01/2011 08:51:40
AEPACK.DLL : 8.2.4.11 520566 Bytes 05/03/2011 11:29:26
AEOFFICE.DLL : 8.1.1.17 205177 Bytes 08/03/2011 23:58:06
AEHEUR.DLL : 8.1.2.83 3338613 Bytes 08/03/2011 23:58:06
AEHELP.DLL : 8.1.16.1 246134 Bytes 05/03/2011 11:29:23
AEGEN.DLL : 8.1.5.2 397683 Bytes 20/01/2011 12:12:15
AEEMU.DLL : 8.1.3.0 393589 Bytes 21/01/2011 08:51:29
AECORE.DLL : 8.1.19.2 196983 Bytes 20/01/2011 12:12:15
AEBB.DLL : 8.1.1.0 53618 Bytes 21/01/2011 08:51:28
AVWINLL.DLL : 10.0.0.0 19304 Bytes 21/01/2011 08:51:49
AVPREF.DLL : 10.0.0.0 44904 Bytes 21/01/2011 08:51:47
AVREP.DLL : 10.0.0.8 62209 Bytes 17/06/2010 13:27:52
AVREG.DLL : 10.0.3.2 53096 Bytes 21/01/2011 08:51:48
AVSCPLR.DLL : 10.0.3.2 84328 Bytes 21/01/2011 08:51:49
AVARKT.DLL : 10.0.22.6 231784 Bytes 21/01/2011 08:51:42
AVEVTLOG.DLL : 10.0.0.8 203112 Bytes 21/01/2011 08:51:45
SQLITE3.DLL : 3.6.19.0 355688 Bytes 17/06/2010 13:28:02
AVSMTP.DLL : 10.0.0.17 63848 Bytes 21/01/2011 08:51:49
NETNT.DLL : 10.0.0.0 11624 Bytes 17/06/2010 13:28:01
RCIMAGE.DLL : 10.0.0.26 2550120 Bytes 10/02/2010 23:23:03
RCTEXT.DLL : 10.0.58.0 99688 Bytes 21/01/2011 08:52:13

Configuration pour la recherche actuelle :
Nom de la tâche...............................: Contrôle intégral du système
Fichier de configuration......................: C:\Program Files (x86)\Avira\AntiVir Desktop\sysscan.avp
Documentation.................................: bas
Action principale.............................: interactif
Action secondaire.............................: ignorer
Recherche sur les secteurs d'amorçage maître..: marche
Recherche sur les secteurs d'amorçage.........: marche
Secteurs d'amorçage...........................: C:, D:,
Recherche dans les programmes actifs..........: marche
Programmes en cours étendus...................: marche
Recherche en cours sur l'enregistrement.......: marche
Recherche de Rootkits.........................: marche
Contrôle d'intégrité de fichiers système......: arrêt
Fichier mode de recherche.....................: Tous les fichiers
Recherche sur les archives....................: marche
Limiter la profondeur de récursivité..........: 20
Archive Smart Extensions......................: marche
Heuristique de macrovirus.....................: marche
Heuristique fichier...........................: moyen

Début de la recherche : mercredi 9 mars 2011 13:58

La recherche d'objets cachés commence.
C:\Program Files\Common Files\Microsoft Shared\Windows Live
C:\Program Files\Common Files\Microsoft Shared\Windows Live
[REMARQUE] L'entrée d'enregistrement n'est pas visible.
HKEY_LOCAL_MACHINE\Software\Microsoft\MediaPlayer\Player\Extensions\MUIDescriptions\8
[REMARQUE] L'entrée d'enregistrement n'est pas visible.
HKEY_LOCAL_MACHINE\Software\Microsoft\MediaPlayer\Player\Extensions\MUIDescriptions\10
[REMARQUE] L'entrée d'enregistrement n'est pas visible.
HKEY_LOCAL_MACHINE\Software\Microsoft\MediaPlayer\Player\Extensions\MUIDescriptions\11
[REMARQUE] L'entrée d'enregistrement n'est pas visible.
HKEY_LOCAL_MACHINE\Software\Microsoft\MediaPlayer\Player\Extensions\MUIDescriptions\12
[REMARQUE] L'entrée d'enregistrement n'est pas visible.
HKEY_LOCAL_MACHINE\Software\Microsoft\MediaPlayer\Player\Extensions\MUIDescriptions\13
[REMARQUE] L'entrée d'enregistrement n'est pas visible.
HKEY_LOCAL_MACHINE\Software\Microsoft\MediaPlayer\Player\Extensions\MUIDescriptions\7
[REMARQUE] L'entrée d'enregistrement n'est pas visible.
HKEY_LOCAL_MACHINE\Software\Microsoft\MediaPlayer\Player\Extensions\MUIDescriptions\9
[REMARQUE] L'entrée d'enregistrement n'est pas visible.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Applets\SysTray\BattMeter\Flyout\381b4222-f694-41f0-9685-ff5bb260df2e
[REMARQUE] L'entrée d'enregistrement n'est pas visible.
HKEY_LOCAL_MACHINE\System\ControlSet002\Control\Nsi\{eb004a11-9b1a-11d4-9123-0050047759bc}\10\0000000800008300
[REMARQUE] L'entrée d'enregistrement n'est pas visible.
c:\users\darty\appdata\roaming\57076.exe
c:\users\darty\appdata\roaming\57076.exe
[REMARQUE] Le processus n'est pas visible.
c:\users\darty\appdata\roaming\65734898_11162300_cryptedmshack.exe
c:\users\darty\appdata\roaming\65734898_11162300_cryptedmshack.exe
[REMARQUE] Le processus n'est pas visible.
c:\users\darty\appdata\roaming\75474.exe
c:\users\darty\appdata\roaming\75474.exe
[REMARQUE] Le processus n'est pas visible.
c:\users\darty\appdata\roaming\46066.exe
c:\users\darty\appdata\roaming\46066.exe
[REMARQUE] Le processus n'est pas visible.
c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
[REMARQUE] Le processus n'est pas visible.
c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
c:\users\darty\appdata\roaming\42330.exe
c:\users\darty\appdata\roaming\42330.exe
[REMARQUE] Le processus n'est pas visible.
c:\users\darty\appdata\roaming\92201.exe
c:\users\darty\appdata\roaming\92201.exe
[REMARQUE] Le processus n'est pas visible.
c:\users\darty\appdata\roaming\67426.exe
c:\users\darty\appdata\roaming\67426.exe
[REMARQUE] Le processus n'est pas visible.
c:\users\darty\appdata\roaming\22275.exe
c:\users\darty\appdata\roaming\22275.exe
[REMARQUE] Le processus n'est pas visible.
c:\users\darty\appdata\roaming\43475.exe
c:\users\darty\appdata\roaming\43475.exe
[REMARQUE] Le processus n'est pas visible.
c:\users\darty\appdata\roaming\14925.exe
c:\users\darty\appdata\roaming\14925.exe
[REMARQUE] Le processus n'est pas visible.
c:\users\darty\appdata\roaming\48306.exe
c:\users\darty\appdata\roaming\48306.exe
[REMARQUE] Le processus n'est pas visible.
c:\users\darty\appdata\roaming\66698.exe
c:\users\darty\appdata\roaming\66698.exe
[REMARQUE] Le processus n'est pas visible.
c:\windows\syswow64\cmd.exe
c:\windows\syswow64\cmd.exe
[REMARQUE] Le processus n'est pas visible.

La recherche sur les processus démarrés commence :
Processus de recherche 'avscan.exe' - '75' module(s) sont contrôlés
Processus de recherche 'avcenter.exe' - '102' module(s) sont contrôlés
Processus de recherche 'opera.exe' - '111' module(s) sont contrôlés
Processus de recherche 'Opera.exe' - '59' module(s) sont contrôlés
Processus de recherche '2559.exe' - '43' module(s) sont contrôlés
Processus de recherche 'vbc.exe' - '43' module(s) sont contrôlés
Processus de recherche 'vbc.exe' - '43' module(s) sont contrôlés
Processus de recherche 'avgnt.exe' - '56' module(s) sont contrôlés
Processus de recherche 'DivXUpdate.exe' - '74' module(s) sont contrôlés
Processus de recherche 'hamachi-2-ui.exe' - '35' module(s) sont contrôlés
Processus de recherche 'jusched.exe' - '26' module(s) sont contrôlés
Processus de recherche 'iTunesHelper.exe' - '74' module(s) sont contrôlés
Processus de recherche 'lsass.exe' - '44' module(s) sont contrôlés
Processus de recherche 'explorerxx.exe' - '29' module(s) sont contrôlés
Processus de recherche 'winlogon_36.exe' - '41' module(s) sont contrôlés
Processus de recherche 'DarkEYE.exe' - '45' module(s) sont contrôlés
Processus de recherche 'explorerxe.exe' - '29' module(s) sont contrôlés
Processus de recherche 'explorerxe.exe' - '45' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '44' module(s) sont contrôlés
Processus de recherche 'javatemp.exe' - '29' module(s) sont contrôlés
Processus de recherche 'javatemp.exe' - '43' module(s) sont contrôlés
Processus de recherche 'winlogon.exe' - '28' module(s) sont contrôlés
Processus de recherche '92201.exe' - '39' module(s) sont contrôlés
Processus de recherche '75474.exe' - '39' module(s) sont contrôlés
Processus de recherche '73164.exe' - '39' module(s) sont contrôlés
Processus de recherche '69192.exe' - '39' module(s) sont contrôlés
Processus de recherche '67426.exe' - '39' module(s) sont contrôlés
Processus de recherche 'hpwuschd2.exe' - '20' module(s) sont contrôlés
Processus de recherche '66698.exe' - '39' module(s) sont contrôlés
Processus de recherche 'jusched121.exe' - '29' module(s) sont contrôlés
Processus de recherche '65734898_11162300_cryptedmshack.exe' - '39' module(s) sont contrôlés
Processus de recherche '64558.exe' - '39' module(s) sont contrôlés
Processus de recherche '57076.exe' - '39' module(s) sont contrôlés
Processus de recherche '48306.exe' - '39' module(s) sont contrôlés
Processus de recherche '46066.exe' - '39' module(s) sont contrôlés
Processus de recherche '43475.exe' - '39' module(s) sont contrôlés
Processus de recherche '42330.exe' - '39' module(s) sont contrôlés
Processus de recherche '2559.exe' - '39' module(s) sont contrôlés
Processus de recherche '22275.exe' - '39' module(s) sont contrôlés
Processus de recherche '14925.exe' - '39' module(s) sont contrôlés
Processus de recherche '1063.exe' - '39' module(s) sont contrôlés
Processus de recherche 'SmartMenu.exe' - '62' module(s) sont contrôlés
Processus de recherche 'hpsysdrv.exe' - '18' module(s) sont contrôlés

La recherche sur les secteurs d'amorçage maître commence :


Secteur d'amorçage maître HD0
[INFO] Aucun virus trouvé !
[INFO] Veuillez relancer la recherche avec les droits d'administrateur
Secteur d'amorçage maître HD1
[INFO] Aucun virus trouvé !
Secteur d'amorçage maître HD2
[INFO] Aucun virus trouvé !
Secteur d'amorçage maître HD3
[INFO] Aucun virus trouvé !
Secteur d'amorçage maître HD4
[INFO] Aucun virus trouvé !

La recherche sur les secteurs d'amorçage commence :
Secteur d'amorçage 'C:\'
[INFO] Aucun virus trouvé !
[INFO] Veuillez relancer la recherche avec les droits d'administrateur
Secteur d'amorçage 'D:\'
[INFO] Aucun virus trouvé !
[INFO] Veuillez relancer la recherche avec les droits d'administrateur

La recherche sur les renvois aux fichiers exécutables (registre) commence :
Le registre a été contrôlé ( '147' fichiers).


La recherche sur les fichiers sélectionnés commence :

Recherche débutant dans 'C:\' <OS>
C:\Users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QJAKY7Q6\svchost[1].exe
[RESULTAT] Contient le modèle de détection du ver WORM/MSIL.Arcdo.aea
C:\Users\darty\AppData\Local\Temp\44638.exe
[RESULTAT] Contient le modèle de détection du ver WORM/MSIL.Arcdo.aea
C:\Users\darty\AppData\Local\Temp\94502.exe
[RESULTAT] Contient le modèle de détection du ver WORM/MSIL.Arcdo.aea
Recherche débutant dans 'D:\' <HP_RECOVERY>

Début de la désinfection :
C:\Users\darty\AppData\Local\Temp\94502.exe
[RESULTAT] Contient le modèle de détection du ver WORM/MSIL.Arcdo.aea
[REMARQUE] Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '484c275a.qua' !
C:\Users\darty\AppData\Local\Temp\44638.exe
[RESULTAT] Contient le modèle de détection du ver WORM/MSIL.Arcdo.aea
[REMARQUE] Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '50da08fd.qua' !
C:\Users\darty\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QJAKY7Q6\svchost[1].exe
[RESULTAT] Contient le modèle de détection du ver WORM/MSIL.Arcdo.aea
[REMARQUE] Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '02f255d7.qua' !


Fin de la recherche : mercredi 9 mars 2011 14:42
Temps nécessaire: 37:01 Minute(s)

La recherche a été effectuée intégralement

34823 Les répertoires ont été contrôlés
442150 Des fichiers ont été contrôlés
3 Des virus ou programmes indésirables ont été trouvés
0 Des fichiers ont été classés comme suspects
0 Des fichiers ont été supprimés
0 Des virus ou programmes indésirables ont été réparés
3 Les fichiers ont été déplacés dans la quarantaine
0 Les fichiers ont été renommés
0 Impossible de scanner des fichiers
442147 Fichiers non infectés
2513 Les archives ont été contrôlées
0 Avertissements
3 Consignes
461542 Des objets ont été contrôlés lors du Rootkitscan
25 Des objets cachés ont été trouvés
merci de m'avoir répondu sur mon dernier post et merci a tous ceux qui vont m'aider

Hello

tu peux lui faire passer RogueKiller juste pour voir un truc?

Okey ça roule :]

Petit up :]
J'espère que tu vas pas abandonner :P

up !!

Down! :))

Cours de danse matinale.
Aîe !

Nomého ! :]