Fichiers disparus + "windows repair" me spam!Fermé

Question

Salut la compagnie,
je vous présente mon problème quelque peu embarrassant puisque n'ayant plus d'antivirus depuis 3 jours j'ai choppé virus sur virus ! J'ai su me débrouiller en faisant de petites recherches et en trouvant tel ou tel technique pour anéantir les deux premiers, celui-ci en revanche me pose une colle. 
En effet mes fichiers ont donc disparus, et même lorsque j'arrive à atteindre l'outil de restauration, lorsque je fais le last clique qui aurait dû tout me sauver, le fameux "suivant", la restau ne fonctionne pas et ne se déclenche pas malgré une courte attente qui me fait toujours un peu espérer. J'aurais alors besoin d'une aide efficace qui puisse remettre dans le droit chemin ce pc fou !
@Juju666 : J'ai pris l'initiative de fouiller un peu roguekiller, et j'ai finalement retrouvé mes fichier, seulement il semble que ce ne soit que de l'apparence puisque la restauration est toujours erronée et ne fonctionne pas !

Merci d'avance pour vos réponses, 
Quentin.

Configuration: Windows XP / Firefox 3.6.16

SnakeFurie · Answer

Re,
Bon il se trouve que ma restauration s'étant finalement remise à fonctionner et ce malgré un message d'erreur m'informant que celle-ci n'avait pas été effective et que dès lors rien n'aurait changé, je n'ai plus l'apparition du spam windows repair et mon pc à l'air de réagir du mieux qu'il puisse.
Cependant il me reste des doutes, le trojan est-il bien éradiquer ? Un clean du pc est-il toujours nécessaire ? Je pense tout de même que ce sujet peut se clore, merci quant à vous si précision il y a !
Bonne journée.

juju666 · Answer

salut, tu peux poster les rapports que roguekiller t as donné stp ?

SnakeFurie · Answer

Euhm je ne les ai plus je peux les refaire si tu veux. Bon puis des nouvelles puisque je ne peux pas me co à wow, preuve que le virus doit toujours être efficient, un clean suffit-il ? De plus j'ai toujours l'icône du raccourcis de windows repair et un spam IE me demandant d'arrêter le script.
Vaut-mieux que je clean mon pc ou que je réessaie de le restaurer ?

SnakeFurie · Answer

RogueKiller V4.3.6 par Tigzy contact sur https://www.luanagames.com/index.fr.html mail: tigzyRKgmailcom Remontees: https://www.luanagames.com/index.fr.html Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 3) 32 bits version Demarrage : Mode normal Utilisateur: test [Droits d'admin] Mode: Suppression -- Date : 02/04/2011 14:27:18 Processus malicieux: 0 Entrees de registre: 0 Fichier HOSTS: 127.0.0.1 localhost 192.246.40.62 etguidauth.evenbalance.com 127.0.0.1 localhost # loopback 213.239.219.83 l2authd.lineage2.com # m0o age 213.239.219.83 L2testauthd.lineage2.com #m0o age 127.0.0.1 www.007guard.com 127.0.0.1 007guard.com 127.0.0.1 008i.com 127.0.0.1 www.008k.com 127.0.0.1 008k.com 127.0.0.1 www.00hq.com 127.0.0.1 00hq.com 127.0.0.1 010402.com 127.0.0.1 www.032439.com 127.0.0.1 032439.com 127.0.0.1 www.0scan.com 127.0.0.1 0scan.com 127.0.0.1 www.1000gratisproben.com 127.0.0.1 1000gratisproben.com 127.0.0.1 www.1001namen.com [...] Termine : << RKreport[1].txt >> RKreport[1].txt

juju666 · Answer

Ok vu la suite:

DÉSACTIVE TON ANTIVIRUS ET TON PARE-FEU SI PRÉSENTS !!!!! (car l'outil est détecté a tort comme infection contenant un module qui sert à arrêter des processus , et un autre servant à prendre des droits dans le registre pour effectuer des suppressions)

&#9654 Télécharge ici :List_Kill'em de gen-hackman

et télécharge Pre_scan de gen-hackman

 et enregistre les sur ton bureau 

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "exécuter en tant que...." 

sur Pre_Scan.exe. Laisse le travailler et poste le contenu du rapport rapport.txt sur ton bureau ici directement.

Puis:

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "exécuter en tant que...." 

sur sur List_Kill'em_Instal.exe sur ton bureau pour lancer l'installation

Laisse coché :

&#9830 Exécuter List_Kill'em

une fois terminée , clic sur "terminer" 

lance-le via le raccourci apparu sur ton bureau comme précité au début 

choisis l'option Search

&#9654 laisse travailler l'outil

à l'apparition de la fenêtre blanche , c'est un peu long , c'est normal , il se peut que l'outil bloque anormalement longtemps arrivé à 95% , relance-le avec le raccourci sur le bureau sans l'arreter , puis clique sur le tout petit "X" en bas de la fenetre d'accueil du programme, ca le debloquera pour finir son scan 

&#9654 Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'écran "COMPLETED"

&#9654&#9654&#9654 NE LE POSTE PAS SUR LE FORUM 

Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/ 

&#9654 Clique sur Parcourir et cherche le fichier C:\List'em.txt 

&#9654 Clique sur Ouvrir. 

&#9654 Clique sur "Cliquez ici pour déposer le fichier". 

Un lien de cette forme : 

http://www.cijoint.fr/cjlink.php?file=265368/cijSKAP5fU.txt 

est ajouté dans la page. 

&#9654 Fais de même avec more.txt qui se trouve sur ton bureau

&#9654 Copie ces liens dans ta réponse.

SnakeFurie · Answer

Ton implication dans ce tuto fait plaisir à voir et à exécuter aussi :p ! Voici le lien du pre scan : http://www.cijoint.fr/cjlink.php?file=cj201104/cij0NkbCP0.txt  

Quant à list_kill'em il semble qu'il se bloque à Shell extensions, la barre étant à 5/10% et une fenêtre style invite de commandes s'est ouverte ! Que dois-je faire diraient omar et fred :p Je n'ai pas prévu la barre de raccourcis en plus :( 

EDIT : euh en fait il m'a dit recherche terminée et m'a copié deux autres .txt dont le more, est-elle bien terminée ?
Les deux autres liens :
- http://www.cijoint.fr/cjlink.php?file=cj201104/cijgh5OGVe.txt
- http://www.cijoint.fr/cjlink.php?file=cj201104/cijC1mYsXG.txt

SnakeFurie · Answer

Je viens de le refaire est ça me fait sensiblement la même chose ! Ma barre coince à un moment ( au debut ) et s'ouvre une Invite de commande. Est ce que c'est le bug dont tu parlais ? Je n'ai pas saisi la manière avec laquelle je pourrais empêcher ce bug, ha si j'ai une idée je vais tester en attendant !
Même en suivi à la lettre je n'arrive pas à placer list_kill'em en raccourcis

juju666 · Answer

Re 


si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "exécuter en tant que...." 

&#9654 Relance List_Kill'em,avec le raccourci sur ton bureau.

mais cette fois-ci :

&#9654 choisis l'Option Suppression

&#9654&#9654&#9654 Ne clique qu'une seule fois sur le bouton !!

laisse travailler l'outil.

en fin de scan la fenêtre se ferme , et tu as un rapport du nom de Kill'em.txt sur ton bureau ,

&#9654 colle le contenu dans ta réponse 

=====================================

&#9654 Télécharge Malwarebytes' Anti-Malware  et enregistre le sur ton bureau.  

&#9654 &#9654 Miroir 1 si inaccessible  

&#9654 &#9654 Miroir 2 si inaccessible 

&#9654 &#9654 /!\ Utilisateur de Vista et Windows 7 : Clique droit sur le logo de Malwarebytes' Anti-Malware, « exécuter en tant qu'Administrateur »  

&#9654 Double clique sur le fichier téléchargé pour lancer le processus d'installation.  
&#9654 Dans l'onglet "mise à jour", clique sur le bouton Recherche de mise à jour  
&#9654 si le pare-feu demande l'autorisation de se connecter pour Malwarebytes, accepte  
&#9654  Une fois la mise à jour terminée  
&#9654 rends-toi dans l'onglet Recherche 
&#9654 Sélectionne Exécuter un examen complet 
&#9654 Clique sur Rechercher  
&#9654 &#9654 Le scan démarre.  
&#9654 A la fin de l'analyse, un message s'affiche : L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.  
&#9654 Clique sur Ok pour poursuivre.  
&#9654 Si des malwares ont été détectés, cliques sur Afficher les résultats 
&#9654 Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection . Malwarebytes va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.  
&#9654 Malwarebytes va ouvrir le bloc-notes et y copier le rapport d'analyse. Copie/colle le ici (ctrl+a pour tout sélectionner, ctrl+c pour copier, ctrl+v pour coller) 

&#9654 &#9654  Il se peut que MBAM ait besoin de redémarrer le pc pour finaliser la suppression, donc pas de panique, redémarre ton pc !!!  
&#9654 Une fois le PC redémarré, rends toi dans l'onglet rapport/log  
&#9654 Tu clique dessus pour l'afficher, une fois affiché  
&#9654 Copie/colle le ici (ctrl+a pour tout sélectionner, ctrl+c pour copier, ctrl+v pour coller) 

Si tu as besoin d'aide regarde ce tutoriel :  
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/   

&#9654 &#9654 Si tu n'arrive pas à le mettre à jour, télécharge ce fichier

==============================

&#9654 Télécharger, sur le Bureau, MBRCheck (par a_d_13) en cliquant sur l'un de ces liens:

* http://www.geekstogo.com/forum/files/file/441-mbrcheck/
* https://download.bleepingcomputer.com/rootrepeal/MBRCheck.exe
* http://www.kernelmode.info/MBRCheck.exe

&#9654 Fermer tout et cliquer sur MBRCheck.exe

&#9654 &#9654 S'il te demande de taper "Y or N", tapes Y puis valider en tapant sur la touche entrée de ton clavier,
&#9654 &#9654 S'il te demande de taper sur la touche "entrée" seulement, fais le
&#9654 &#9654 S'il te demande 1, 2  ou 3, Appuie sur 2 

&#9654 Un rapport s'ouvre en fin de scan et sera automatiquement enregistré sur le Bureau. Il sera du type MBRCheck_AA.JJ.MM_hh.mm.ss.txt (i.e. MBRCheck_07.21.10_18.08.06.txt).

SnakeFurie · Answer

Voici les rapports : 

- Kill'em.txt
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Kill'em by g3n-h@ckm@n 2.1.3.7 ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

Mis à jour le 02/04/2011 | 12.50 par g3n-h@ckm@n
Utilisateur : test (Administrateurs)
Ordinateur : ACER-FE8B363750

Système d'exploitation : Microsoft Windows XP  (32 bits)

c:\ -> [Fixed] | [ACER] | Total : 73560 Mo | Free : 13500 Mo -> NTFS
d:\ -> [Fixed] | [ACERDATA] | Total : 74050 Mo | Free : 39510 Mo -> FAT32
e:\ -> [CDROM] | [CDRoot] | Total : 700 Mo | Free : 0 Mo -> CDFS
f:\ -> [Removable] | [] | Total : 0 Mo | Free : 0 Mo -> 
g:\ -> [Removable] | [] | Total : 0 Mo | Free : 0 Mo -> 
h:\ -> [Removable] | [] | Total : 0 Mo | Free : 0 Mo -> 
i:\ -> [Removable] | [] | Total : 0 Mo | Free : 0 Mo -> 
j:\ -> [CDROM] | [] | Total : 0 Mo | Free : 0 Mo -> 

Scan : 17:31:55 | 02/04/2011

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤ Winlogon ¤¤¤¤¤¤¤¤¤¤

[HKLM\..\..\Winlogon] | AutoRestartShell = 1
[HKLM\..\..\Winlogon] | Shell = Explorer.exe
[HKLM\..\..\Winlogon] | Userinit = C:\WINDOWS\system32\Userinit.exe,
[HKLM\..\..\Winlogon] | System = 
[HKLM\..\..\Winlogon] | PowerdownAfterShutdown = 1

¤¤¤¤¤¤¤¤¤¤ Internet Explorer ¤¤¤¤¤¤¤¤¤¤

[HKCU\..\..\Internet Explorer\Main] | Start Page=https://www.google.com/?gws_rd=ssl
[HKCU\..\..\Internet Explorer\Main] | Local Page=C:\WINDOWS\system32\blank.htm
[HKCU\..\..\Internet Explorer\Main] | Search Page=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

[HKLM\..\..\Internet Explorer\Main] | Start Page=http://go.microsoft.com/fwlink/?LinkId=69157
[HKLM\..\..\Internet Explorer\Main] | Local Page=C:\WINDOWS\system32\blank.htm
[HKLM\..\..\Internet Explorer\Main] | Default_Search_URL=http://go.microsoft.com/fwlink/?LinkId=54896
[HKLM\..\..\Internet Explorer\Main] | Default_Page_URL=http://go.microsoft.com/fwlink/?LinkId=69157
[HKLM\..\..\Internet Explorer\Main] | Search Page=http://go.microsoft.com/fwlink/?LinkId=54896

¤¤¤¤¤¤¤¤¤¤ IFEO ¤¤¤¤¤¤¤¤¤¤

Supprimé : [ctfmon.exe] -> C:\WINDOWS\system32\ctfmon_ez.exe
Supprimé : [Your Image File Name Here without a path] -> ntsd -d

¤¤¤¤¤¤¤¤¤¤ Mountpoints2 ¤¤¤¤¤¤¤¤¤¤

Supprimé : [HKCU\..\..\Mountpoints2\{af0cb1bb-c087-11de-86ea-0019212289b3}] -> command : J:\wdsync.exe

¤¤¤¤¤¤¤¤¤¤ Services ¤¤¤¤¤¤¤¤¤¤

[HKLM\..\..\Services\Ndisuio] | Start -> Aucune modification : 3 -> 3
[HKLM\..\..\Services\EapHost] | Start -> Modification apportée : 3 -> 2
[HKLM\..\..\Services\Wlansvc] | Start -> Modification apportée :  -> 2
[HKLM\..\..\Services\SharedAccess] | Start -> Aucune modification : 2 -> 2
[HKLM\..\..\Services\windefend] | Start -> Modification apportée :  -> 2
[HKLM\..\..\Services\wuauserv] | Start -> Aucune modification : 2 -> 2
[HKLM\..\..\Services\wscsvc] | Start -> Aucune modification : 2 -> 2

¤¤¤¤¤¤¤¤¤¤ Hosts ¤¤¤¤¤¤¤¤¤¤

127.0.0.1       localhost



¤¤¤¤¤¤¤¤¤¤ Supression Fichiers | Dossiers ¤¤¤¤¤¤¤¤¤¤

Mise en quarantaine :  C:\Program Files\Fichiers communs\FDEUnInstaller.exe

¤¤¤¤¤¤¤¤¤¤ Suppression Clés ¤¤¤¤¤¤¤¤¤¤


¤¤¤¤¤¤¤¤¤¤¤ Services néfastes ¤¤¤¤¤¤¤¤¤¤





¤¤¤¤¤¤¤¤¤¤ Suppression Valeurs ¤¤¤¤¤¤¤¤¤¤

Valeur Supprimée : [HKLM\..\..\Terminal Server\..\..\Run] | Firevall Administrating

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKLM\..\..\Security Center] | FirstRunDisabled = 1
[HKLM\..\..\Security Center] | AntiVirusDisableNotify = 1
[HKLM\..\..\Security Center] | FirewallDisableNotify = 1
[HKLM\..\..\Security Center] | UpdatesDisableNotify = 1
[HKLM\..\..\Security Center] | AntiVirusOverride = 0
[HKLM\..\..\Security Center] | FirewallOverride = 0


Fin : 17:40:55

¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤

SnakeFurie · Answer

-Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Version de la base de données: 6247

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

02/04/2011 18:56:19
mbam-log-2011-04-02 (18-56-19).txt

Type d'examen: Examen complet (C:\|D:\|)
Elément(s) analysé(s): 263217
Temps écoulé: 54 minute(s), 51 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 36
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 27
Fichier(s) infecté(s): 346

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{DADF9052-F5BF-3FF1-8A5C-D98297CC9C63} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\D.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\D (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DADF9052-F5BF-3FF1-8A5C-D98297CC9C63} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\{DADF9052-F5BF-3FF1-8A5C-D98297CC9C63} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{DADF9052-F5BF-3FF1-8A5C-D98297CC9C63} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{F2849503-9CF9-3B25-B6AD-2909189D708E} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{F51FEB8D-DB86-3741-97B8-FAB3D9F2441B} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2F9AD413-2E0B-4a85-BB2A-CF961238262A} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{A078F691-9C07-4AF2-BF43-35E79EECF8B7} (Adware.Softomate) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\HotbarWeather.WeatherController.1 (Adware.Softomate) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\HotbarWeather.WeatherController (Adware.Softomate) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7} (Adware.Softomate) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A078F691-9C07-4AF2-BF43-35E79EECF8B7} (Adware.Softomate) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{A3E67DAA-DA01-4da5-98BE-3088B554A11E} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\HotbarAX.UserProfiles.1 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\HotbarAX.UserProfiles (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A3E67DAA-DA01-4DA5-98BE-3088B554A11E} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{D95C7240-0282-4c01-93F5-673BCA03DA86} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\HotbarAX.Info.1 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\HotbarAX.Info (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D95C7240-0282-4C01-93F5-673BCA03DA86} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{40196867-19F8-7157-C097-ECAFF653C9AD} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{2AA2FBF8-9C76-4E97-A226-25C5F4AB6358} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{500BCA15-57A7-4EAF-8143-8C619470B13D} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C5428486-50A0-4A02-9D20-520B59A9F9B2} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C5428486-50A0-4A02-9D20-520B59A9F9B3} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{69725738-CD68-4f36-8D02-8C43722EE5DA} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Findbasic (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Z0 - AVI Converter (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\hotbarsa (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\IEBarProperties (Adware.Mirar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Findbasic (Adware.FindBasic) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Findbasic Service (Adware.FindBasic) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions\Hotbar@Hotbar.com (Adware.Hotbar) -> Value: Hotbar@Hotbar.com -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
c:\documents and settings\all users\application data\05061214 (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\50457156 (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\50467546 (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\documents and settings\all users\application data\findbasic (Adware.FindBasic) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\IESkins (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\HostOI (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\HostOI\dynamic (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\HostOL (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\HostOL\dynamic (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic\ustat (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\Weather (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\Weather\weatherdpa (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\Weather\weatherdpa\weather_xml (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\Weather\weather_xml (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\all users\application data\HotbarSA (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Quentin\application data\Seekmo (Adware.Seekmo) -> Quarantined and deleted successfully.
c:\program files\findbasic (Adware.FindBasic) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\Hotbar (Adware.Hotbar) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
c:\WINDOWS\system32\hh77648.dll (Trojan.BHO) -> Quarantined and deleted successfully.
c:\documents and settings	est\Bureau\générateur de clé cod4.exe (HackTool.Keygen) -> Quarantined and deleted successfully.
c:\documents and settings	est\Bureau\aviconvertersetup.exe (Adware.Agent) -> Quarantined and deleted successfully.
c:\documents and settings	est\local settings\Temp\0.4035568661807516.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings	est\local settings\Temp\0.4680436971395434.exe (Rogue.Installer) -> Quarantined and deleted successfully.
c:\documents and settings	estk_quarantine\cdeftcxscste.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\program files\mozilla firefox\plugins
pclntax_hotbarsa.dll (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\program files\findbasic\uninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.
c:\program files\foxtabaviconverter\uninstall\uninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{eada2b13-36ae-4518-a8c2-3d8b7d759571}\RP1249\A1017246.dll (Adware.Mirar) -> Quarantined and deleted successfully.
c:\system volume information\_restore{eada2b13-36ae-4518-a8c2-3d8b7d759571}\RP1251\A1021317.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.
c:\system volume information\_restore{eada2b13-36ae-4518-a8c2-3d8b7d759571}\RP1251\A1021316.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\system volume information\_restore{eada2b13-36ae-4518-a8c2-3d8b7d759571}\RP1251\A1021318.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{eada2b13-36ae-4518-a8c2-3d8b7d759571}\RP1251\A1021319.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\system volume information\_restore{eada2b13-36ae-4518-a8c2-3d8b7d759571}\RP1251\A1021320.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.
c:\system volume information\_restore{eada2b13-36ae-4518-a8c2-3d8b7d759571}\RP1253\A1024383.exe (Rogue.Installer.Gen) -> Quarantined and deleted successfully.
c:\system volume information\_restore{eada2b13-36ae-4518-a8c2-3d8b7d759571}\RP1253\A1024391.dll (Adware.Mirar) -> Quarantined and deleted successfully.
c:\system volume information\_restore{eada2b13-36ae-4518-a8c2-3d8b7d759571}\RP1254\A1026444.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\system volume information\_restore{eada2b13-36ae-4518-a8c2-3d8b7d759571}\RP1254\A1026445.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.
c:\system volume information\_restore{eada2b13-36ae-4518-a8c2-3d8b7d759571}\RP1254\A1026446.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{eada2b13-36ae-4518-a8c2-3d8b7d759571}\RP1254\A1026447.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\system volume information\_restore{eada2b13-36ae-4518-a8c2-3d8b7d759571}\RP1254\A1026448.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.
c:\system volume information\_restore{eada2b13-36ae-4518-a8c2-3d8b7d759571}\RP1276\A1032990.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\system volume information\_restore{eada2b13-36ae-4518-a8c2-3d8b7d759571}\RP1276\A1032994.dll (Trojan.BHO) -> Quarantined and deleted successfully.
c:\system volume information\_restore{eada2b13-36ae-4518-a8c2-3d8b7d759571}\RP1277\A1033728.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\system volume information\_restore{eada2b13-36ae-4518-a8c2-3d8b7d759571}\RP1277\A1033875.dll (Adware.Mirar) -> Quarantined and deleted successfully.
c:\WINDOWS\bricopacks\gant3 ocean shellpack\packfiles\116_calc.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
c:\WINDOWS\bricopacks\SysFiles\128_iexplore.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.
c:\WINDOWS\bricopacks\vista inspirat 2\packfiles\79_iexplore.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.
c:\WINDOWS\$ntservicepackuninstall$\iexplore.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\4578.dll (Adware.Mirar) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\ctfmon_ez.exe (Trojan.BHO) -> Quarantined and deleted successfully.
c:\documents and settings	est\local settings\Temp\ppddfcfux.exxe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\documents and settings	est\local settings\Temp\w32rim_mem.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings	est\local settings\Temp\wrfwe_di.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\Quentin\local settings\application data\cimoznbf_nav.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
c:\documents and settings\Quentin\local settings\application data\cimoznbf_navps.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
c:\documents and settings	est\local settings\Temp\dffuck.exe (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\all users\application data\findbasic\findbasic125.exe (Adware.FindBasic) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\50457156\userid.dat (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\50467546\userid.dat (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic\1.sdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic\1001886.sdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic\1383356.sdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic\1387231.sdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic\1404358.sdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic\1817352.sdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic\2883915.sdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic\3852296.sdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic\domains.txt (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\29547 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\1000023894 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\1000024063 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\1000024490 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\1000024944 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\1000026058 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\1000026997 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\1000033079 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\1000052045 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\1000052046 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\1000052678 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\1000068667 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\1000069613 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\1000080020 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\1000082926 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\1000083033 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\1000083145 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\1058 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\11891 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\1491 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\275654 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\29115 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\30854 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\403305 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\43184 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\44228 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\44271 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\461315 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\528757 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\53481 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\543041 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\54473 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\571472 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\576702 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\6558 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\65770 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\705183 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\705381 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\705401 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\738258 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\744884 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\744978 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\745107 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\81392 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\dynamic	ooltipxml\95825 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\ads.cdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\btntrans.idx (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\btntrans1.dat (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\business_promo.htm (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\buttondir.txt (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\components.cdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\cursors.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_bidz12.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_bidz13.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_bidz14.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_bidz15.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_bidz16.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_bidz17.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_bidz18.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_bidz19.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_bidz2.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_bidz20.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_bidz3.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_bidz4.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_bidz5.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_bidz6.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_bidz7.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_bidz8.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_categorize.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_comparison.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_em_profl_ca_flow_b_ieb.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_explorer-mails.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_explorer-people.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_favorites.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_games.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_hide.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_hotbarcom.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_hotmail.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_hsskin.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_jemster.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_jemsterie.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_jemsteruk.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_jobsearch.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default.cdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_511745-514279.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_bidz.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_bidz1.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_bidz10.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_new.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_premium.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_reun.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_ringtones.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_searchboxtrapper.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_searchfor.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_searchgo.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_weather.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_yellowpages.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\d_icons_buttons_1000.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\d_icons_buttons_2000.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\d_icons_buttons_3000.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\d_icons_buttons_bar.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\d_icons_buttons_bbar1.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\d_icons_buttons_logos.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\d_icons_buttons_other.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\d_icons_weather.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\editblbuttons.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\email-def-511724-548964.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_bidz11.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_bidz9.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\default_mails.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\email-def-511724-9595.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\ie_games_icon.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\email-t1-bg.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\gamesmenu.cdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\gamesmenu.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\hb_ie_menu.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\hotbar-premium-hotbar-premium.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\hotbar-premium.cdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\hotbar_promo.htm (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\icons2.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\ie_video.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\keywords.idx (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\keywords1.dat (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\layout.cdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\linkpathlegal.txt (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\more.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1
ew_games.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\progress.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\sales_buttons.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\sdfmodifier.xml (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\s_icons_buttons.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1	2_bg.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1	heweb.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1	op7.cdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1	op7_theweb.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1	sd_bg.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\1\weathericon.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\ads.cdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\btntrans.idx (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\btntrans1.dat (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\business_promo.htm (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\buttondir.txt (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\components.cdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\cursors.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_bidz12.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_bidz13.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_bidz14.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_bidz15.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_bidz16.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_bidz17.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_bidz18.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_bidz19.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_bidz2.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_bidz20.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_bidz3.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_bidz4.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_bidz5.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_bidz6.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_bidz7.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_bidz8.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_categorize.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_comparison.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_em_profl_ca_flow_b_ieb.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_explorer-mails.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_explorer-people.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_favorites.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_games.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_hide.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_hotbarcom.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_hotmail.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_hsskin.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_jemster.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_jemsterie.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_jemsteruk.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_jobsearch.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default.cdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_511745-514279.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_bidz.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_bidz1.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_bidz10.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_new.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_premium.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_reun.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_ringtones.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_searchboxtrapper.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_searchfor.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_searchgo.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_weather.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_yellowpages.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\d_icons_buttons_1000.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\d_icons_buttons_2000.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\d_icons_buttons_3000.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\d_icons_buttons_bar.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\d_icons_buttons_bbar1.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\d_icons_buttons_logos.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\d_icons_buttons_other.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\d_icons_weather.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\editblbuttons.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\email-def-511724-548964.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_bidz11.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_bidz9.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\default_mails.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\email-def-511724-9595.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\ie_games_icon.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\email-t1-bg.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\gamesmenu.cdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\gamesmenu.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\hb_ie_menu.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\hotbar-premium-hotbar-premium.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\hotbar-premium.cdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\hotbar_promo.htm (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\icons2.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\ie_video.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\keywords.idx (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\keywords1.dat (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\layout.cdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\linkpathlegal.txt (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\more.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2
ew_games.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\progress.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\sales_buttons.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\sdfmodifier.xml (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\s_icons_buttons.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2	2_bg.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2	heweb.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2	op7.cdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2	op7_theweb.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2	sd_bg.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\2\weathericon.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\ads.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\BtnTrans.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\btntrans1.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\business_promo.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\buttondir.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\editblbuttons.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\email-t1-bg.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\progress.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\sales_buttons.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\samplegroups2.txt (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\samplegroups2.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\sdfmodifier.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\s_icons_buttons.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad	2_bg.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad	op7.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad	sd_bg.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\weathericon.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\d_icons_buttons_2000.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\d_icons_buttons_3000.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\d_icons_buttons_bar.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\d_icons_buttons_bbar1.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\d_icons_buttons_logos.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\d_icons_buttons_other.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\ie_video.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\keywords.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\keywords1.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\layout.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\linkpathlegal.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\default.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\cursors.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\d_icons_buttons_1000.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\d_icons_weather.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\ie_games_icon.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\more.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\gamesmenu.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\hb_ie_menu.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\hotbar-premium.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\hotbar_promo.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\v3.5\Hotbar\static\DownLoad\icons2.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\Weather\history (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\Weather\searchweather.xml (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\Weather\weatherstartup.xml (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\Weather\weatherdpa\Links (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\Weather\weatherdpaadar-big.jpg (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\Weather\weatherdpaadar-small (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\Weather\weatherdpa\satellite-big.jpg (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\Weather\weatherdpa\satellite-small (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\Weather\weatherdpa\weatherpreferences (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\Weather\weatherdpa\weather_xml\Display (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\Weather\weatherdpa\weather_xml\Loading (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\Weather\weatherdpa\weather_xml\screen1 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\Weather\weatherdpa\weather_xml\screen2 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\Weather\weatherdpa\weather_xml\screen3 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\Weather\weatherdpa\weather_xml\soaperror (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\Weather\weather_xml\Default (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\Weather\weather_xml\Genera1 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings	est\application data\Hotbar\Weather\weather_xml\General (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\all users\application data\HotbarSA\HotbarSA.dat (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\all users\application data\HotbarSA\hotbarsaabout.mht (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\all users\application data\HotbarSA\hotbarsaau.dat (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\all users\application data\HotbarSA\hotbarsaeula.mht (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\all users\application data\HotbarSA\hotbarsa_kyf.dat (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\program files\findbasic\findbasic.exe (Adware.FindBasic) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\Hotbar\about hotbar.lnk (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\Hotbar\hotbar customer support center.lnk (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\Hotbar\hotbar games!.lnk (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\Hotbar\hotbar videos!.lnk (Adware.Hotbar) -> Quarantined and deleted s

SnakeFurie · Answer

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:			
Windows Version:		Windows XP Home Edition
Windows Information:		Service Pack 3 (build 2600)
Logical Drives Mask:		0x000003fc

Kernel Drivers (total 136):
  0x804D7000 \WINDOWS\system32
toskrnl.exe
  0x80700000 \WINDOWS\system32\hal.dll
  0xF7987000 \WINDOWS\system32\KDCOM.DLL
  0xF7897000 \WINDOWS\system32\BOOTVID.dll
  0xF75F7000 arlkiaji.sys
  0xF7443000 spga.sys
  0xF7989000 \WINDOWS\System32\Drivers\WMILIB.SYS
  0xF742B000 \WINDOWS\System32\Drivers\SCSIPORT.SYS
  0xF7868000 ACPI.sys
  0xF7607000 isapnp.sys
  0xF741A000 pci.sys
  0xF7A4F000 pciide.sys
  0xF7707000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
  0xF7617000 MountMgr.sys
  0xF7849000 ftdisk.sys
  0xF770F000 PartMgr.sys
  0xF7627000 VolSnap.sys
  0xF7402000 atapi.sys
  0xF7637000 disk.sys
  0xF7647000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
  0xF7829000 fltmgr.sys
  0xF7975000 sr.sys
  0xF7657000 PxHelp20.sys
  0xF795E000 KSecDD.sys
  0xF7B52000 Ntfs.sys
  0xF7A22000 NDIS.sys
  0xF7667000 uagp35.sys
  0xBA7ED000 sfvfs02.sys
  0xF7717000 sfhlp02.sys
  0xBA7DB000 sfdrv01.sys
  0xBA7C1000 Mup.sys
  0xF76A7000 \SystemRoot\system32\DRIVERS\intelppm.sys
  0xBA2AF000 \SystemRoot\system32\DRIVERS
v4_mini.sys
  0xBA29B000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
  0xF7546000 \SystemRoot\system32\DRIVERS\imapi.sys
  0xF77FF000 \SystemRoot\system32\drivers\Afc.sys
  0xF7947000 \SystemRoot\System32\Drivers\UBHelper.SYS
  0xF7536000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0xBA769000 \SystemRoot\system32\DRIVERSedbook.sys
  0xBA278000 \SystemRoot\system32\DRIVERS\ks.sys
  0xF7995000 \SystemRoot\system32\DRIVERS\NTIDrvr.sys
  0xF7767000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
  0xB9EFE000 \SystemRoot\system32\drivers\ALCXWDM.SYS
  0xB9EDA000 \SystemRoot\system32\drivers\portcls.sys
  0xBA759000 \SystemRoot\system32\drivers\drmk.sys
  0xF77C7000 \SystemRoot\system32\DRIVERS\usbohci.sys
  0xB9EB6000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0xF77F7000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0xF780F000 \SystemRoot\system32\DRIVERS\sisnic.sys
  0xB9E7F000 \SystemRoot\System32\Drivers\a57exb0w.SYS
  0xB9E3C000 \SystemRoot\System32\Drivers\a6w1bs06.SYS
  0xB9E2B000 \SystemRoot\system32\DRIVERS\serial.sys
  0xBA6C5000 \SystemRoot\system32\DRIVERS\serenum.sys
  0xB9E17000 \SystemRoot\system32\DRIVERS\parport.sys
  0xBA749000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0xBA6BD000 \SystemRoot\system32\DRIVERS\L8042Kbd.sys
  0xF777F000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0xF7A7D000 \SystemRoot\system32\DRIVERS\audstub.sys
  0xBA739000 \SystemRoot\system32\DRIVERSasl2tp.sys
  0xBA6B1000 \SystemRoot\system32\DRIVERS
distapi.sys
  0xB9E00000 \SystemRoot\system32\DRIVERS
diswan.sys
  0xBA729000 \SystemRoot\system32\DRIVERSaspppoe.sys
  0xBA719000 \SystemRoot\system32\DRIVERSaspptp.sys
  0xF77CF000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0xB9D4F000 \SystemRoot\system32\DRIVERS\psched.sys
  0xBA709000 \SystemRoot\system32\DRIVERS\msgpc.sys
  0xF7807000 \SystemRoot\system32\DRIVERS\ptilink.sys
  0xF781F000 \SystemRoot\system32\DRIVERSaspti.sys
  0xBA6F9000 \SystemRoot\system32\DRIVERS	ermdd.sys
  0xF774F000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0xF79A7000 \SystemRoot\system32\DRIVERS\swenum.sys
  0xB9CA1000 \SystemRoot\system32\DRIVERS\update.sys
  0xBA693000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0xBA6E9000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0xBA6D9000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0xF79B1000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0xF79B5000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0xF7A85000 \SystemRoot\System32\Drivers\Null.SYS
  0xF79B9000 \SystemRoot\System32\Drivers\Beep.SYS
  0xB9D0F000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0xB9CFF000 \SystemRoot\System32\drivers\vga.sys
  0xF79BD000 \SystemRoot\System32\Drivers\mnmdd.SYS
  0xF79C1000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0xF7747000 \SystemRoot\System32\Drivers\Msfs.SYS
  0xF775F000 \SystemRoot\System32\Drivers\Npfs.SYS
  0xBA78D000 \SystemRoot\system32\DRIVERSasacd.sys
  0xB7B1E000 \SystemRoot\system32\DRIVERS\ipsec.sys
  0xB7AC5000 \SystemRoot\system32\DRIVERS	cpip.sys
  0xF7697000 \SystemRoot\System32\Drivers\aswTdi.SYS
  0xB7A9F000 \SystemRoot\system32\DRIVERS\ipnat.sys
  0xF76B7000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0xB7A77000 \SystemRoot\system32\DRIVERS
etbt.sys
  0xB7A4B000 \SystemRoot\System32\drivers\afd.sys
  0xF76C7000 \SystemRoot\system32\DRIVERS
etbios.sys
  0xF77BF000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
  0xBA6C9000 \SystemRoot\system32\DRIVERS\srvkp.sys
  0xB7A20000 \SystemRoot\system32\DRIVERSdbss.sys
  0xB79B0000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0xF76D7000 \SystemRoot\System32\Drivers\Fips.SYS
  0xB78EF000 \SystemRoot\System32\Drivers\aswSP.SYS
  0xB9D2F000 \SystemRoot\System32\Drivers\Aavmker4.SYS
  0xF77B7000 \SystemRoot\System32\Drivers\LUsbFilt.Sys
  0xF75C6000 \SystemRoot\System32\Drivers\WDFLDR.SYS
  0xB77FC000 \SystemRoot\system32\DRIVERS\Wdf01000.sys
  0xB77D8000 \SystemRoot\System32\Drivers\Fastfat.SYS
  0xB7B5D000 \SystemRoot\system32\DRIVERS\hidusb.sys
  0xF75B6000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0xF7777000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys
  0xB7B55000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0xF7797000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys
  0xF75A6000 \SystemRoot\System32\Drivers\Cdfs.SYS
  0xB77C0000 \SystemRoot\System32\Drivers\dump_atapi.sys
  0xF79D7000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
  0xBF800000 \SystemRoot\System32\win32k.sys
  0xBA6B5000 \SystemRoot\System32\drivers\Dxapi.sys
  0xB7887000 \SystemRoot\System32\watchdog.sys
  0xBF000000 \SystemRoot\System32\drivers\dxg.sys
  0xF7AB5000 \SystemRoot\System32\drivers\dxgthk.sys
  0xBF012000 \SystemRoot\System32
v4_disp.dll
  0xBF464000 \SystemRoot\System32\ATMFD.DLL
  0xF77AF000 \SystemRoot\system32\DRIVERS\aswFsBlk.sys
  0xB5BDF000 \SystemRoot\system32\DRIVERS
wlnkipx.sys
  0xB6587000 \SystemRoot\system32\DRIVERS
wlnknb.sys
  0xB64C1000 \SystemRoot\system32\DRIVERS
disuio.sys
  0xB5C85000 \SystemRoot\system32\DRIVERS
wlnkspx.sys
  0xB5AB1000 \SystemRoot\System32\Drivers\aswMon2.SYS
  0xB590C000 \SystemRoot\system32\drivers\wdmaud.sys
  0xB7940000 \SystemRoot\system32\drivers\sysaudio.sys
  0xB58BE000 
  0xB5559000 \SystemRoot\system32\DRIVERS\atksgt.sys
  0xB54C8000 \SystemRoot\System32\Drivers\HTTP.sys
  0xB9D1F000 \SystemRoot\system32\DRIVERS\lirsgt.sys
  0xF79F5000 \??\C:\WINDOWS\system32\Drivers\Vcs.sys
  0xB5330000 \SystemRoot\system32\DRIVERS\srv.sys
  0x7C910000 \WINDOWS\system32
tdll.dll
  0x10000000 \Program Files\Alcohol Soft\Alcohol 120\Alcoholx.dll

Processes (total 30):
       0 System Idle Process
       4 System
     532 C:\WINDOWS\system32\smss.exe
     840 csrss.exe
     904 C:\WINDOWS\system32\winlogon.exe
     980 C:\WINDOWS\system32\services.exe
    1004 C:\WINDOWS\system32\lsass.exe
    1204 C:\WINDOWS\system32\svchost.exe
    1304 svchost.exe
    1400 C:\WINDOWS\system32\svchost.exe
    1540 svchost.exe
    1668 svchost.exe
    1748 C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    1944 C:\Program Files\Alwil Software\Avast4\ashServ.exe
    2016 C:\WINDOWS\explorer.exe
     628 C:\WINDOWS\system32\spoolsv.exe
    1156 C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    1484 C:\Program Files\iTunes\iTunesHelper.exe
    1592 C:\Program Files\Adobe\Reader 9.0\Readereader_sl.exe
    1716 C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe
    1960 C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    2028 C:\Program Files\Bonjour\mDNSResponder.exe
    1280 C:\WINDOWS\system32\svchost.exe
     828 C:\WINDOWS\system32\svchost.exe
     852 wdfmgr.exe
    1816 C:\WINDOWS\system32\wuauclt.exe
    2404 C:\Program Files\iPod\bin\iPodService.exe
    2608 C:\WINDOWS\system32\wscntfy.exe
    2668 alg.exe
    2952 C:\Documents and Settings	est\Bureau\MBRCheck.exe

\.\C: --> \.\PhysicalDrive0 at offset 0x00000001'384c7a00  (NTFS)
\.\D: --> \.\PhysicalDrive0 at offset 0x00000013'2e00be00  (FAT32)

PhysicalDrive0 Model Number: HDT722516DLA380, Rev: V43OA96A

      Size  Device Name          MBR Status
  --------------------------------------------
    153 GB  \.\PhysicalDrive0   Unknown MBR code
            SHA1: 6A37CCD118436B688B51F6BD4C2B47A895EBDF7F


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit: 
Options:
  [1] Dump the MBR of a physical disk to file.
  [2] Restore the MBR of a physical disk with a standard boot code.
  [3] Exit.

Enter your choice: Enter the physical disk number to fix (0-99, -1 to cancel):

SnakeFurie · Answer

Voilà j'espère que ça vous va! Qu'est ce que je fais à partir de là ? ^^
Encore merci pour tout déjà.

juju666 · Answer

non ça me plait pas encore :P

&#9654  Télécharge de AD-Remover sur ton Bureau. (Merci à C_XX) 

http://www.teamxscript.org/adremoverTelechargement.html ( Lien officiel ) 
OU 
https://www.androidworld.fr/ ( Miroir ) 

/!\ Ferme toutes applications en cours /!\ 

&#9654 Double-clique sur l'icône Ad-remover située sur ton Bureau. 
&#9654 Sur la page, clique sur le bouton « Nettoyer » 
&#9654 Confirme lancement du scan 
&#9654 Laisse travailler l'outil. 
&#9654 Poste le rapport qui apparaît à la fin. 

(Le rapport est sauvegardé aussi sous C:\Ad-Report-CLEAN[1].txt) 

(CTRL+A pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller)  

===========================

Relance mbrcheck. 
appuie sur Y et enter, puis 2 et enter. poste son rapport.

SnakeFurie · Answer

héhé ^^

voici pour AD : 
======= RAPPORT D'AD-REMOVER 2.0.0.2,F | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par TeamXscript le 01/03/11
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
Site web: http://www.teamxscript.org

C:\Program Files\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 20:28:26 le 02/04/2011, Mode normal

Microsoft Windows XP Édition familiale Service Pack 3 (X86) 
test@ACER-FE8B363750 ( ) 
 
============== ACTION(S) ==============


Fichier supprimé: C:\WINDOWS\system32\ConduitEngine.tmp
Fichier supprimé: C:\Documents and Settings	est\Application Data\Mozilla\FireFox\Profiles\942ftg2v.default\searchplugins\conduit.xml
Dossier supprimé: C:\Documents and Settings	est\Local Settings\Application Data\Conduit
Dossier supprimé: C:\Program Files\Conduit
Dossier supprimé: C:\Documents and Settings	est\Local Settings\Application Data\ConduitEngine
Dossier supprimé: C:\Program Files\ConduitEngine
Dossier supprimé: C:\Documents and Settings	est\Application Data\PriceGong
Dossier supprimé: C:\Documents and Settings	est\Application Data\VMNTOOLBAR
Dossier supprimé: C:\Program Files\VMNTOOLBAR

(!) -- Fichiers temporaires supprimés.


Clé supprimée: HKLM\Software\Classes\Interface\{BFE569F7-646C-4512-969B-9BE3E580D393}
Clé supprimée: HKLM\Software\Classes\Interface\{C8D424EF-CB21-49A0-8659-476FBAB0F8E8}
Clé supprimée: HKLM\Software\Classes\Interface\{D1063603-F045-475F-AFBC-8CBA7D5797FB}
Clé supprimée: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5521E7D8-972F-4751-AF30-E5558981A41D}
Clé supprimée: HKLM\Software\Classes\Toolbar.CT2102473
Clé supprimée: HKLM\Software\Classes\vmntoolbar.VMNTOOLBAR
Clé supprimée: HKLM\Software\Classes\vmntoolbar.VMNTOOLBARMenu Button
Clé supprimée: HKLM\Software\Classes\vmntoolbar.VMNTOOLBARToggle Button
Clé supprimée: HKLM\Software\Conduit
Clé supprimée: HKCU\Software\Conduit
Clé supprimée: HKCU\Software\vmntoolbar
Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Hotbar
Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Seekmo
Clé supprimée: HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\SeekmoSA
Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1F096B29-E9DA-4D64-8D63-936BE7762CC5}
Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2EB55F9F-CC93-45B7-B551-0CA40CEC791A}
Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Clé supprimée: HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{2EB55F9F-CC93-45B7-B551-0CA40CEC791A}
Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\DealAssistant
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\vmntoolbar

Valeur supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform|Hotbar 11.0.78.0
Valeur supprimée: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33}


============== SCAN ADDITIONNEL ==============

**** Mozilla Firefox Version [3.6.16 (fr)] ****

Plugins
pBitCometAgent.dll (BitComet)
Plugins
pdivx32.dll (DivX,Inc.)
Searchplugins\avg_igeared.xml (hxxp://search.avg.com/route/?d=4d976616&v=6.103.018.001&i=23&tp=chrome&q={searchTerms}&lng=fr&iy=b&ychte=fr/)
Searchplugins\babylon.xml (hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=320d180e0000000000000019212289b3&tlver=1.4.19.19&affID=17161/)
Searchplugins\findbasic125.xml (    hxxp://www.findbasic.com/?prt=FbasicNN&keywords={searchTerms})
Extensions\{258fe8b8-a13c-4b91-9a0c-c2d3cab8b990} (PHPNukeFR Toolbar)
Extensions\{C3F23840-B14B-4B61-AAEF-6BCC3621FA63} (Findbasic)
HKLM_Extensions|{1E73965B-8B48-48be-9C8D-68B920ABC1C4} - C:\Program Files\AVG\AVG10\Firefox4\
HKLM_Extensions|avg@igeared - C:\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared

-- C:\Documents and Settings	est\Application Data\Mozilla\FireFox\Profiles\942ftg2v.default --
Extensions\ffxtlbr@babylon.com (Babylon)
Extensions\{258fe8b8-a13c-4b91-9a0c-c2d3cab8b990} (PHPNukeFR Toolbar)
Extensions\{7694c49c-9fbd-11dc-8314-0800200c9a66} (Aquatint Black Gloss)
Extensions\{9f08cb5a-76b1-4bcf-aff9-90e1a5d60b1e} (Noia 2.0 (eXtreme))
Extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB} (BitComet Video Downloader)
Searchplugins\sumotorrentcom-search.xml (?)
Prefs.js - browser.download.lastDir, C:\Documents and Settings\test\Bureau
Prefs.js - browser.search.selectedEngine, Search the web (Babylon)
Prefs.js - browser.startup.homepage, hxxp://search.babylon.com/?babsrc=HP_ss&mntrId=320d180e0000000000000019212289b3&tlver=1.4.19.1...
Prefs.js - browser.startup.homepage_override.mstone, rv:1.9.2.16
Prefs.js - keyword.URL, hxxp://search.babylon.com/?babsrc=SP_ss&mntrId=320d180e0000000000000019212289b3&tlver=1.4.19.19&instlRef=ss...

========================================

**** Internet Explorer Version [6.0.2900.5512] ****

Plugins\NPUPano.dll (Ulead Systems, Inc.)
Plugins\PanoViewer.dll (?)
Plugins\UPjpeg.dll (?)
HKCU_Main|Default_Page_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKCU_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU_Main|Search bar - hxxp://go.microsoft.com/fwlink/?linkid=54896
HKCU_Main|Start Page - hxxp://fr.msn.com/
HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Search bar - hxxp://search.msn.com/spbasic.htm
HKLM_Main|Search Page - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Start Page - hxxp://fr.msn.com/
HKCU_URLSearchHooks|{258fe8b8-a13c-4b91-9a0c-c2d3cab8b990} - "PHPNukeFR Toolbar" (C:\Program Files\PHPNukeFR	bPHP1.dll)
HKCU_SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - "AVG Secure Search" (hxxp://search.avg.com/route/?d=4d976616&v=6.103.18.1&i=23&tp=chrome&q={searchTer...)
HKCU_Toolbar\ShellBrowser|{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} (x)
HKCU_Toolbar\WebBrowser|{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} (x)
HKCU_Toolbar\WebBrowser|{258FE8B8-A13C-4B91-9A0C-C2D3CAB8B990} (C:\Program Files\PHPNukeFR	bPHP1.dll)
HKCU_Toolbar\WebBrowser|{5521E7D8-972F-4751-AF30-E5558981A41D} (x)
HKLM_Toolbar|{E0E899AB-F487-11D5-8D29-0050BA6940E3} (x)
HKLM_Toolbar|{17939A30-18E2-471E-9D3A-56DD725F1215} (x)
HKLM_Toolbar|{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} (x)
HKLM_Toolbar|{258fe8b8-a13c-4b91-9a0c-c2d3cab8b990} (C:\Program Files\PHPNukeFR	bPHP1.dll)
HKLM_Toolbar|{98889811-442D-49dd-99D7-DC866BE87DBC} (C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarTlbr.dll)
HKLM_Toolbar|{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} (C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll)
HKLM_Toolbar|{CCC7A320-B3CA-4199-B1A6-9F516DD69829} (C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll)
HKLM_ElevationPolicy\${ELV_GUID} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe (Babylon Ltd.)
HKLM_ElevationPolicy\22ca2be7-233e-4d75-a427-6cd252b81577 - C:\Program Files\PHPNukeFR\PHPNukeFRToolbarHelper.exe (?)
HKLM_ElevationPolicy\46eef4c9-aff7-4ee8-88ee-0ccf5c640a1f - C:\Program Files\PHPNukeFR\PHPNukeFRToolbarHelper.exe (?)
HKLM_ElevationPolicy\d0d4fcf8-78ad-4c61-ad74-0340706e6f61 - C:\Program Files\PHPNukeFR\PHPNukeFRToolbarHelper.exe (?)
HKLM_ElevationPolicy\{44295CB8-D71B-11DA-8750-001185653D78} - c:\program files\google\googletoolbar3user.exe (?)
HKLM_ElevationPolicy\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe (?)
HKLM_Extensions\{D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - "BitComet" (C:\Program Files\BitComet	ools\BitCometBHO_1.4.4.13.dll,203)
HKLM_Extensions\{e2e2dd38-d088-4134-82b7-f2ba38496583} - "?" (?)
BHO\{258fe8b8-a13c-4b91-9a0c-c2d3cab8b990} - "PHPNukeFR Toolbar" (C:\Program Files\PHPNukeFR	bPHP1.dll)
BHO\{2EECD738-5844-4a99-B4B6-146BF802613B} - "CescrtHlpr Object" (C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\bh\BabylonToolbar.dll)
BHO\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - "BitComet Helper" (C:\Program Files\BitComet	ools\BitCometBHO_1.4.4.13.dll)
BHO\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - "avast! WebRep" (C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll)
BHO\{A3BC75A2-1F87-4686-AA43-5347D756017C} - "AVG Security Toolbar BHO" (C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll)

========================================

C:\Program Files\Ad-Remover\Quarantine: 97 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 13 Fichier(s)

C:\Ad-Report-CLEAN[1].txt - 02/04/2011 20:29:30 (7538 Octet(s)) 

Fin à: 20:30:27, 02/04/2011 
 
============== E.O.F ==============

SnakeFurie · Answer

Et voilà le reste !

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:			
Windows Version:		Windows XP Home Edition
Windows Information:		Service Pack 3 (build 2600)
Logical Drives Mask:		0x000003fc

Kernel Drivers (total 138):
  0x804D7000 \WINDOWS\system32
toskrnl.exe
  0x80700000 \WINDOWS\system32\hal.dll
  0xF7987000 \WINDOWS\system32\KDCOM.DLL
  0xF7897000 \WINDOWS\system32\BOOTVID.dll
  0xF74E3000 spsa.sys
  0xF7989000 \WINDOWS\System32\Drivers\WMILIB.SYS
  0xF74CB000 \WINDOWS\System32\Drivers\SCSIPORT.SYS
  0xF749C000 ACPI.sys
  0xF75F7000 isapnp.sys
  0xF7876000 pci.sys
  0xF7A4F000 pciide.sys
  0xF7707000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
  0xF7607000 MountMgr.sys
  0xF7857000 ftdisk.sys
  0xF770F000 PartMgr.sys
  0xF7617000 VolSnap.sys
  0xF783F000 atapi.sys
  0xF7627000 disk.sys
  0xF7637000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
  0xF7967000 fltmgr.sys
  0xF782D000 sr.sys
  0xF7647000 PxHelp20.sys
  0xF7950000 KSecDD.sys
  0xF7B52000 Ntfs.sys
  0xF7A22000 NDIS.sys
  0xF7657000 uagp35.sys
  0xF7A0F000 sfvfs02.sys
  0xF7717000 sfhlp02.sys
  0xF7B40000 sfdrv01.sys
  0xF7B26000 Mup.sys
  0xF771F000 avgrkx86.sys
  0xF7667000 AVGIDSEH.Sys
  0xF76B7000 \SystemRoot\system32\DRIVERS\intelppm.sys
  0xB90FA000 \SystemRoot\system32\DRIVERS
v4_mini.sys
  0xB90E6000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
  0xBA02C000 \SystemRoot\system32\DRIVERS\imapi.sys
  0xF774F000 \SystemRoot\system32\drivers\Afc.sys
  0xBA67E000 \SystemRoot\System32\Drivers\UBHelper.SYS
  0xBA01C000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0xBA00C000 \SystemRoot\system32\DRIVERSedbook.sys
  0xB90C3000 \SystemRoot\system32\DRIVERS\ks.sys
  0xF79DD000 \SystemRoot\system32\DRIVERS\NTIDrvr.sys
  0xF7757000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
  0xB8D21000 \SystemRoot\system32\drivers\ALCXWDM.SYS
  0xB8CFD000 \SystemRoot\system32\drivers\portcls.sys
  0xB9FDC000 \SystemRoot\system32\drivers\drmk.sys
  0xF775F000 \SystemRoot\system32\DRIVERS\usbohci.sys
  0xB8CD9000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0xF7767000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0xF776F000 \SystemRoot\system32\DRIVERS\sisnic.sys
  0xB8CA2000 \SystemRoot\System32\Drivers\a0yx9nx9.SYS
  0xB8A87000 \SystemRoot\System32\Drivers\aba9oqpn.SYS
  0xB8A76000 \SystemRoot\system32\DRIVERS\serial.sys
  0xB9D49000 \SystemRoot\system32\DRIVERS\serenum.sys
  0xB8A62000 \SystemRoot\system32\DRIVERS\parport.sys
  0xB9FCC000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0xB9D45000 \SystemRoot\system32\DRIVERS\L8042Kbd.sys
  0xF77E7000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0xF7ABE000 \SystemRoot\system32\DRIVERS\audstub.sys
  0xF743C000 \SystemRoot\system32\DRIVERSasl2tp.sys
  0xB9D41000 \SystemRoot\system32\DRIVERS
distapi.sys
  0xB8947000 \SystemRoot\system32\DRIVERS
diswan.sys
  0xF742C000 \SystemRoot\system32\DRIVERSaspppoe.sys
  0xF740C000 \SystemRoot\system32\DRIVERSaspptp.sys
  0xF77FF000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0xB891F000 \SystemRoot\system32\DRIVERS\psched.sys
  0xBA778000 \SystemRoot\system32\DRIVERS\msgpc.sys
  0xF777F000 \SystemRoot\system32\DRIVERS\ptilink.sys
  0xB9512000 \SystemRoot\system32\DRIVERSaspti.sys
  0xF7697000 \SystemRoot\system32\DRIVERS	ermdd.sys
  0xB950A000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0xF79F1000 \SystemRoot\system32\DRIVERS\swenum.sys
  0xB86EA000 \SystemRoot\system32\DRIVERS\update.sys
  0xF793B000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0xB587E000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0xB589E000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0xF79C7000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0xB58BE000 \SystemRoot\system32\DRIVERS\avgmfx86.sys
  0xF79CB000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0xB170C000 \SystemRoot\System32\Drivers\Null.SYS
  0xB7E79000 \SystemRoot\System32\Drivers\Beep.SYS
  0xB94CA000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0xF77EF000 \SystemRoot\System32\drivers\vga.sys
  0xB7E77000 \SystemRoot\System32\Drivers\mnmdd.SYS
  0xF79D5000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0xF77D7000 \SystemRoot\System32\Drivers\Msfs.SYS
  0xB515F000 \SystemRoot\System32\Drivers\Npfs.SYS
  0xB5FF6000 \SystemRoot\system32\DRIVERSasacd.sys
  0xAF4FF000 \SystemRoot\system32\DRIVERS\ipsec.sys
  0xAF4A6000 \SystemRoot\system32\DRIVERS	cpip.sys
  0xAF45E000 \SystemRoot\system32\DRIVERS\avgtdix.sys
  0xAF438000 \SystemRoot\system32\DRIVERS\ipnat.sys
  0xB58AE000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0xAF410000 \SystemRoot\system32\DRIVERS
etbt.sys
  0xAF3EE000 \SystemRoot\System32\drivers\afd.sys
  0xB588E000 \SystemRoot\system32\DRIVERS
etbios.sys
  0xB16D6000 \SystemRoot\system32\DRIVERS\srvkp.sys
  0xAF3C3000 \SystemRoot\system32\DRIVERSdbss.sys
  0xAF353000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0xB586E000 \SystemRoot\System32\Drivers\Fips.SYS
  0xAF317000 \SystemRoot\system32\DRIVERS\avgldx86.sys
  0xB553A000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
  0xB5532000 \SystemRoot\System32\Drivers\LUsbFilt.Sys
  0xBA738000 \SystemRoot\System32\Drivers\WDFLDR.SYS
  0xAF29C000 \SystemRoot\system32\DRIVERS\Wdf01000.sys
  0xBA7C0000 \SystemRoot\system32\DRIVERS\hidusb.sys
  0xF745C000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0xB86D2000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys
  0xB59DF000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0xB5B7F000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys
  0xAF278000 \SystemRoot\System32\Drivers\Fastfat.SYS
  0xB5259000 \SystemRoot\System32\Drivers\Cdfs.SYS
  0xAF260000 \SystemRoot\System32\Drivers\dump_atapi.sys
  0xB7636000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
  0xBF800000 \SystemRoot\System32\win32k.sys
  0xB2B30000 \SystemRoot\System32\drivers\Dxapi.sys
  0xB5847000 \SystemRoot\System32\watchdog.sys
  0xBF000000 \SystemRoot\System32\drivers\dxg.sys
  0xB1704000 \SystemRoot\System32\drivers\dxgthk.sys
  0xBF012000 \SystemRoot\System32
v4_disp.dll
  0xBF464000 \SystemRoot\System32\ATMFD.DLL
  0xAE019000 \SystemRoot\system32\DRIVERS
wlnkipx.sys
  0xB5C0F000 \SystemRoot\system32\DRIVERS
wlnknb.sys
  0xAE0BB000 \SystemRoot\system32\DRIVERS
disuio.sys
  0xB604F000 \SystemRoot\system32\DRIVERS
wlnkspx.sys
  0xAD6EC000 \SystemRoot\system32\drivers\wdmaud.sys
  0xB7E1B000 \SystemRoot\system32\drivers\sysaudio.sys
  0xAD69E000 \SystemRoot\system32\drivers\kmixer.sys
  0xAD65B000 \SystemRoot\system32\DRIVERS\atksgt.sys
  0xB58FE000 \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys
  0xAD5F2000 \SystemRoot\System32\Drivers\HTTP.sys
  0xB5137000 \SystemRoot\system32\DRIVERS\lirsgt.sys
  0xAD54A000 \SystemRoot\system32\DRIVERS\srv.sys
  0xB5B29000 \??\C:\WINDOWS\system32\Drivers\Vcs.sys
  0xB602F000 \SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys
  0xAD45A000 \SystemRoot\system32\DRIVERS\AVGIDSDriver.Sys
  0x7C910000 \WINDOWS\system32
tdll.dll
  0x10000000 \Program Files\Alcohol Soft\Alcohol 120\Alcoholx.dll

Processes (total 38):
       0 System Idle Process
       4 System
     648 C:\WINDOWS\system32\smss.exe
     712 C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
     776 C:\PROGRA~1\AVG\AVG10\avgrsx.exe
    1464 csrss.exe
    1492 C:\WINDOWS\system32\winlogon.exe
    1548 C:\WINDOWS\system32\services.exe
    1560 C:\WINDOWS\system32\lsass.exe
    1744 C:\WINDOWS\system32\svchost.exe
    1804 svchost.exe
    1880 C:\WINDOWS\system32\svchost.exe
    1944 svchost.exe
     200 svchost.exe
     552 C:\WINDOWS\system32\spoolsv.exe
     560 C:\WINDOWS\explorer.exe
    1856 C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    1904 C:\Program Files\AVG\AVG10\avgwdsvc.exe
    1932 C:\Program Files\Bonjour\mDNSResponder.exe
    1972 C:\WINDOWS\system32\svchost.exe
     768 C:\WINDOWS\system32\svchost.exe
     996 wdfmgr.exe
    1816 C:\WINDOWS\system32\wuauclt.exe
    1940 C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
    1392 C:\Program Files\iTunes\iTunesHelper.exe
     284 C:\Program Files\Adobe\Reader 9.0\Readereader_sl.exe
    1396 C:\Program Files\AVAST Software\Avast\AvastUI.exe
    1692 C:\Program Files\AVG\AVG10\avgtray.exe
    2512 C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
    2652 C:\Program Files\AVG\AVG10\avgnsx.exe
    2680 C:\Program Files\AVG\AVG10\avgemcx.exe
    3516 C:\Program Files\iPod\bin\iPodService.exe
    3616 C:\WINDOWS\system32\wscntfy.exe
    3676 alg.exe
    1640 wmiprvse.exe
    2100 C:\WINDOWS\system32
otepad.exe
     236 C:\Program Files\Mozilla Firefox\firefox.exe
     180 C:\Documents and Settings	est\Bureau\MBRCheck.exe

\.\C: --> \.\PhysicalDrive0 at offset 0x00000001'384c7a00  (NTFS)
\.\D: --> \.\PhysicalDrive0 at offset 0x00000013'2e00be00  (FAT32)

PhysicalDrive0 Model Number: HDT722516DLA380, Rev: V43OA96A

      Size  Device Name          MBR Status
  --------------------------------------------
    153 GB  \.\PhysicalDrive0   Unknown MBR code
            SHA1: 6A37CCD118436B688B51F6BD4C2B47A895EBDF7F


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit: 
Options:
  [1] Dump the MBR of a physical disk to file.
  [2] Restore the MBR of a physical disk with a standard boot code.
  [3] Exit.

Enter your choice: Enter the physical disk number to fix (0-99, -1 to cancel):

juju666 · Answer

refais mbrcheck en suivant ce tuto : https://www.commentcamarche.net/faq/25171-infection-sinowal-mebroot-rootkit-mbr-bootkit#cinquieme-methode-mbrcheck

SnakeFurie · Answer

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:			
Windows Version:		Windows XP Home Edition
Windows Information:		Service Pack 3 (build 2600)
Logical Drives Mask:		0x000003fc

Kernel Drivers (total 138):
  0x804D7000 \WINDOWS\system32
toskrnl.exe
  0x80700000 \WINDOWS\system32\hal.dll
  0xF7987000 \WINDOWS\system32\KDCOM.DLL
  0xF7897000 \WINDOWS\system32\BOOTVID.dll
  0xF74E3000 spsa.sys
  0xF7989000 \WINDOWS\System32\Drivers\WMILIB.SYS
  0xF74CB000 \WINDOWS\System32\Drivers\SCSIPORT.SYS
  0xF749C000 ACPI.sys
  0xF75F7000 isapnp.sys
  0xF7876000 pci.sys
  0xF7A4F000 pciide.sys
  0xF7707000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
  0xF7607000 MountMgr.sys
  0xF7857000 ftdisk.sys
  0xF770F000 PartMgr.sys
  0xF7617000 VolSnap.sys
  0xF783F000 atapi.sys
  0xF7627000 disk.sys
  0xF7637000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
  0xF7967000 fltmgr.sys
  0xF782D000 sr.sys
  0xF7647000 PxHelp20.sys
  0xF7950000 KSecDD.sys
  0xF7B52000 Ntfs.sys
  0xF7A22000 NDIS.sys
  0xF7657000 uagp35.sys
  0xF7A0F000 sfvfs02.sys
  0xF7717000 sfhlp02.sys
  0xF7B40000 sfdrv01.sys
  0xF7B26000 Mup.sys
  0xF771F000 avgrkx86.sys
  0xF7667000 AVGIDSEH.Sys
  0xF76B7000 \SystemRoot\system32\DRIVERS\intelppm.sys
  0xB90FA000 \SystemRoot\system32\DRIVERS
v4_mini.sys
  0xB90E6000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
  0xBA02C000 \SystemRoot\system32\DRIVERS\imapi.sys
  0xF774F000 \SystemRoot\system32\drivers\Afc.sys
  0xBA67E000 \SystemRoot\System32\Drivers\UBHelper.SYS
  0xBA01C000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0xBA00C000 \SystemRoot\system32\DRIVERSedbook.sys
  0xB90C3000 \SystemRoot\system32\DRIVERS\ks.sys
  0xF79DD000 \SystemRoot\system32\DRIVERS\NTIDrvr.sys
  0xF7757000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
  0xB8D21000 \SystemRoot\system32\drivers\ALCXWDM.SYS
  0xB8CFD000 \SystemRoot\system32\drivers\portcls.sys
  0xB9FDC000 \SystemRoot\system32\drivers\drmk.sys
  0xF775F000 \SystemRoot\system32\DRIVERS\usbohci.sys
  0xB8CD9000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0xF7767000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0xF776F000 \SystemRoot\system32\DRIVERS\sisnic.sys
  0xB8CA2000 \SystemRoot\System32\Drivers\a0yx9nx9.SYS
  0xB8A87000 \SystemRoot\System32\Drivers\aba9oqpn.SYS
  0xB8A76000 \SystemRoot\system32\DRIVERS\serial.sys
  0xB9D49000 \SystemRoot\system32\DRIVERS\serenum.sys
  0xB8A62000 \SystemRoot\system32\DRIVERS\parport.sys
  0xB9FCC000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0xB9D45000 \SystemRoot\system32\DRIVERS\L8042Kbd.sys
  0xF77E7000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0xF7ABE000 \SystemRoot\system32\DRIVERS\audstub.sys
  0xF743C000 \SystemRoot\system32\DRIVERSasl2tp.sys
  0xB9D41000 \SystemRoot\system32\DRIVERS
distapi.sys
  0xB8947000 \SystemRoot\system32\DRIVERS
diswan.sys
  0xF742C000 \SystemRoot\system32\DRIVERSaspppoe.sys
  0xF740C000 \SystemRoot\system32\DRIVERSaspptp.sys
  0xF77FF000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0xB891F000 \SystemRoot\system32\DRIVERS\psched.sys
  0xBA778000 \SystemRoot\system32\DRIVERS\msgpc.sys
  0xF777F000 \SystemRoot\system32\DRIVERS\ptilink.sys
  0xB9512000 \SystemRoot\system32\DRIVERSaspti.sys
  0xF7697000 \SystemRoot\system32\DRIVERS	ermdd.sys
  0xB950A000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0xF79F1000 \SystemRoot\system32\DRIVERS\swenum.sys
  0xB86EA000 \SystemRoot\system32\DRIVERS\update.sys
  0xF793B000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0xB587E000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0xB589E000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0xF79C7000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0xB58BE000 \SystemRoot\system32\DRIVERS\avgmfx86.sys
  0xF79CB000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0xB170C000 \SystemRoot\System32\Drivers\Null.SYS
  0xB7E79000 \SystemRoot\System32\Drivers\Beep.SYS
  0xB94CA000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0xF77EF000 \SystemRoot\System32\drivers\vga.sys
  0xB7E77000 \SystemRoot\System32\Drivers\mnmdd.SYS
  0xF79D5000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0xF77D7000 \SystemRoot\System32\Drivers\Msfs.SYS
  0xB515F000 \SystemRoot\System32\Drivers\Npfs.SYS
  0xB5FF6000 \SystemRoot\system32\DRIVERSasacd.sys
  0xAF4FF000 \SystemRoot\system32\DRIVERS\ipsec.sys
  0xAF4A6000 \SystemRoot\system32\DRIVERS	cpip.sys
  0xAF45E000 \SystemRoot\system32\DRIVERS\avgtdix.sys
  0xAF438000 \SystemRoot\system32\DRIVERS\ipnat.sys
  0xB58AE000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0xAF410000 \SystemRoot\system32\DRIVERS
etbt.sys
  0xAF3EE000 \SystemRoot\System32\drivers\afd.sys
  0xB588E000 \SystemRoot\system32\DRIVERS
etbios.sys
  0xB16D6000 \SystemRoot\system32\DRIVERS\srvkp.sys
  0xAF3C3000 \SystemRoot\system32\DRIVERSdbss.sys
  0xAF353000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0xB586E000 \SystemRoot\System32\Drivers\Fips.SYS
  0xAF317000 \SystemRoot\system32\DRIVERS\avgldx86.sys
  0xB553A000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
  0xB5532000 \SystemRoot\System32\Drivers\LUsbFilt.Sys
  0xBA738000 \SystemRoot\System32\Drivers\WDFLDR.SYS
  0xAF29C000 \SystemRoot\system32\DRIVERS\Wdf01000.sys
  0xBA7C0000 \SystemRoot\system32\DRIVERS\hidusb.sys
  0xF745C000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0xB86D2000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys
  0xB59DF000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0xB5B7F000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys
  0xAF278000 \SystemRoot\System32\Drivers\Fastfat.SYS
  0xB5259000 \SystemRoot\System32\Drivers\Cdfs.SYS
  0xAF260000 \SystemRoot\System32\Drivers\dump_atapi.sys
  0xB7636000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
  0xBF800000 \SystemRoot\System32\win32k.sys
  0xB2B30000 \SystemRoot\System32\drivers\Dxapi.sys
  0xB5847000 \SystemRoot\System32\watchdog.sys
  0xBF000000 \SystemRoot\System32\drivers\dxg.sys
  0xB1704000 \SystemRoot\System32\drivers\dxgthk.sys
  0xBF012000 \SystemRoot\System32
v4_disp.dll
  0xBF464000 \SystemRoot\System32\ATMFD.DLL
  0xAE019000 \SystemRoot\system32\DRIVERS
wlnkipx.sys
  0xB5C0F000 \SystemRoot\system32\DRIVERS
wlnknb.sys
  0xAE0BB000 \SystemRoot\system32\DRIVERS
disuio.sys
  0xB604F000 \SystemRoot\system32\DRIVERS
wlnkspx.sys
  0xAD6EC000 \SystemRoot\system32\drivers\wdmaud.sys
  0xB7E1B000 \SystemRoot\system32\drivers\sysaudio.sys
  0xAD65B000 \SystemRoot\system32\DRIVERS\atksgt.sys
  0xB58FE000 \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys
  0xAD5F2000 \SystemRoot\System32\Drivers\HTTP.sys
  0xB5137000 \SystemRoot\system32\DRIVERS\lirsgt.sys
  0xAD54A000 \SystemRoot\system32\DRIVERS\srv.sys
  0xB5B29000 \??\C:\WINDOWS\system32\Drivers\Vcs.sys
  0xB602F000 \SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys
  0xAD45A000 \SystemRoot\system32\DRIVERS\AVGIDSDriver.Sys
  0xA9E6B000 \SystemRoot\system32\drivers\kmixer.sys
  0x7C910000 \WINDOWS\system32
tdll.dll
  0x10000000 \Program Files\Alcohol Soft\Alcohol 120\Alcoholx.dll

Processes (total 35):
       0 System Idle Process
       4 System
     648 C:\WINDOWS\system32\smss.exe
     712 C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
    1464 csrss.exe
    1492 C:\WINDOWS\system32\winlogon.exe
    1548 C:\WINDOWS\system32\services.exe
    1560 C:\WINDOWS\system32\lsass.exe
    1744 C:\WINDOWS\system32\svchost.exe
    1804 svchost.exe
    1880 C:\WINDOWS\system32\svchost.exe
    1944 svchost.exe
     200 svchost.exe
     552 C:\WINDOWS\system32\spoolsv.exe
     560 C:\WINDOWS\explorer.exe
    1856 C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    1904 C:\Program Files\AVG\AVG10\avgwdsvc.exe
    1932 C:\Program Files\Bonjour\mDNSResponder.exe
    1972 C:\WINDOWS\system32\svchost.exe
     768 C:\WINDOWS\system32\svchost.exe
     996 wdfmgr.exe
    1940 C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
    1392 C:\Program Files\iTunes\iTunesHelper.exe
    1396 C:\Program Files\AVAST Software\Avast\AvastUI.exe
    1692 C:\Program Files\AVG\AVG10\avgtray.exe
    2512 C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
    2652 C:\Program Files\AVG\AVG10\avgnsx.exe
    2680 C:\Program Files\AVG\AVG10\avgemcx.exe
    3516 C:\Program Files\iPod\bin\iPodService.exe
    3616 C:\WINDOWS\system32\wscntfy.exe
    3676 alg.exe
     236 C:\Program Files\Mozilla Firefox\firefox.exe
    2296 C:\PROGRA~1\AVG\AVG10\avgrsx.exe
    2336 C:\Program Files\AVG\AVG10\avgcsrvx.exe
    1028 C:\Documents and Settings	est\Bureau\MBRCheck.exe

\.\C: --> \.\PhysicalDrive0 at offset 0x00000001'384c7a00  (NTFS)
\.\D: --> \.\PhysicalDrive0 at offset 0x00000013'2e00be00  (FAT32)

PhysicalDrive0 Model Number: HDT722516DLA380, Rev: V43OA96A

      Size  Device Name          MBR Status
  --------------------------------------------
    153 GB  \.\PhysicalDrive0   Unknown MBR code
            SHA1: 6A37CCD118436B688B51F6BD4C2B47A895EBDF7F


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit: 
Options:
  [1] Dump the MBR of a physical disk to file.
  [2] Restore the MBR of a physical disk with a standard boot code.
  [3] Exit.

Enter your choice: Enter the physical disk number to fix (0-99, -1 to cancel): 0Available MBR codes:
 [ 0] Default (Windows XP)
 [ 1] Windows XP
 [ 2] Windows Server 2003
 [ 3] Windows Vista
 [ 4] Windows 2008
 [ 5] Windows 7
 [-1] Cancel

Please select the MBR code to write to this drive: 0
Do you want to fix the MBR code?  Type 'YES' and hit ENTER to continue: yes
Successfully wrote new MBR code!
Please reboot your computer to complete the fix.


Done!

juju666 · Answer

aaah voilà :-)

tu as relancé l ordi ?

Nous allons effectuer un diagnostic de ton PC:
&#9654 Télécharge ZHPDiag sur ton bureau :

https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html
ou :
http://www.premiumorange.com/zeb-help-process/zhpdiag.html
ou :
https://www.commentcamarche.net/telecharger/utilitaires/24803-zhpdiag/

&#9654 Laisse toi guider lors de l'installation,coche "Ajouter une icône sur le bureau" et décoche la case "Exécuter ZHPDiag"

 /!\Utilisateur de Vista et Seven : Clique droit sur le logo de ZHPdiag, « exécuter en tant qu'Administrateur » 

&#9654 Clique sur l'icône représentant une loupe (« Lancer le diagnostic »)
&#9654 Enregistre le rapport sur ton Bureau à l'aide de l'icône représentant une disquette
&#9654 Héberge le rapport ZHPDiag.txt sur un des sites ci dessous, puis copie/colle le lien fourni dans ta prochaine réponse sur le forum :
http://pjjoint.malekal.com/

Si indispo:
http://www.cijoint.fr/
ou :
http://ww38.toofiles.com/fr/documents-upload.html
ou :
https://www.cjoint.com/
ou :
https://www.casimages.com/

&#9654 Tuto zhpdiag :
http://www.premiumorange.com/zeb-help-process/zhpdiag.html 


Hébergement de rapport sur pjjoint.malekal.com

&#9654 Rends toi sur pjjoint.malekal.com
&#9654 Clique sur le bouton Parcourir
&#9654 Sélectionne le fichier que tu veux heberger et clique sur Ouvrir
&#9654 Clique sur le bouton Envoyer
&#9654 Un message de confirmation s'affiche (L'upload a réussi ! - Le lien à transmettre à vos correspondant pour visualiser le fichier est : https://pjjoint.malekal.com/files.php?id=df5ea299241015 Copie le lien dans ta prochaine réponse.

juju666 · Answer

clique sur la loupe ...

SnakeFurie · Answer

https://pjjoint.malekal.com/files.php?read=d9l6q12r8s7u6f6c8z14 et voilà le travail :p ( c'était pas trop dur ça mais j'ai qd même trouvé le moyen de me planter ^^ )

SnakeFurie · Answer

C'est grave docteur ?! ^^

juju666 · Answer

&#9654 Copie tout le texte présent dans la balise code ci-dessous ( tu le sélectionnes avec ta souris / Clique droit dessus et choisis "copier" ou fait Ctrl+C )   


[HKCR\.bc!]
[HKLM\Software\Microsoft\Windows\CurrentVersion\app management\arpcache\vmntoolbar]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zonemap\Domains\getmirar.com]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zonemap\Domains\mirarsearch.com]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains
et-nucleus.com]
M3 - MFPP: Plugins - [test] -- C:\Documents and Settings	est\Application Data\Mozilla\Firefox\Profiles\942ftg2v.default\searchplugins\daemon-search.xml
M3 - MFPP: Plugins - [test] -- C:\Documents and Settings	est\Application Data\Mozilla\Firefox\Profiles\942ftg2v.default\searchplugins\sumotorrentcom-search.xml
[HKLM\Software\05061214]
O23 - Service:  (aswUpdSv) - Clé orpheline
O23 - Service:  (LBTServ) - Clé orpheline
O23 - Service:  (NMIndexingService) - Clé orpheline
R3 - URLSearchHook: PHPNukeFR Toolbar - {258fe8b8-a13c-4b91-9a0c-c2d3cab8b990} . (.Conduit Ltd. - Conduit Toolbar.) (5, 7, 2, 2) -- C:\Program Files\PHPNukeFR	bPHP1.dll
O2 - BHO: PHPNukeFR Toolbar - {258fe8b8-a13c-4b91-9a0c-c2d3cab8b990} . (.Conduit Ltd. - Conduit Toolbar.) -- C:\Program Files\PHPNukeFR	bPHP1.dll
O2 - BHO: Babylon toolbar helper - {2EECD738-5844-4a99-B4B6-146BF802613B} . (.Babylon BHO - Pas de description.) -- C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\bh\BabylonToolbar.dll
O3 - Toolbar: PHPNukeFR Toolbar - {258fe8b8-a13c-4b91-9a0c-c2d3cab8b990} . (.Conduit Ltd. - Conduit Toolbar.) -- C:\Program Files\PHPNukeFR	bPHP1.dll
O3 - Toolbar: Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} . (.Babylon Ltd. - Pas de description.) -- C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarTlbr.dll
O4 - HKLM\..\Run: [BabylonToolbar] . (.Babylon Ltd. - Pas de description.) -- C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe     
O42 - Logiciel: PHPNukeFR Toolbar - (.Pas de propriétaire.) [HKLM] -- PHPNukeFR Toolbar
[HKCU\Software\BabylonToolbar] 
[HKCU\Software\PHPNukeFR]
[HKLM\Software\PHPNukeFR]
O43 - CFD: 13/03/2011 - 16:04:02 - [1630587] ----D- C:\Program Files\BabylonToolbar     
O43 - CFD: 26/04/2010 - 18:26:04 - [737] ----D- C:\Program Files\DAEMON Tools Toolbar  
O43 - CFD: 02/04/2011 - 16:17:36 - [6911473] ----D- C:\Program Files\PHPNukeFR
O43 - CFD: 14/03/2011 - 12:41:50 - [0] ----D- C:\Documents and Settings	est\Application Data\BabylonToolbar    
O43 - CFD: 02/04/2011 - 16:17:36 - [2332741] ----D- C:\Documents and Settings	est\Local Settings\Application Data\PHPNukeFR
EmptyTemp
EmptyFlash
FirewallRAZ


&#9654 Puis Lance ZHPFix depuis le raccourci du bureau .  

&#9654 Une fois l'outil ZHPFix ouvert , clique sur le bouton [ H ] ( "coller les lignes Helper" ) .  

&#9654 Dans l'encadré principal tu verras donc les lignes que tu as copié précédemment apparaitrent .  

&#9654 Vérifie que toutes les lignes que je t'ai demandé de copier (et seulement elles) sont dans la fenêtre.  

&#9654 Clique sur le bouton « GO » pour lancer le nettoyage

&#9654 Copie/Colle le rapport à l'écran dans ton prochain message  

&#9654 (le rapport se trouve aussi dans le dossier de zhpdiag dans program files sous le nom de ZHPFixReport.txt)   

&#9654 Redémarre ton ordinateur, refais une analyse avec ZHPDiag et héberge son rapport

SnakeFurie · Answer

Bonjour, 
désolé juju mais comme je fatiguais à faire les manips, enfin c'est mon ordinateur qui me fatiguais, et que j'ai vu que tu serais absent, j'ai pris un peu le large quant au pc, un peu de recul quoi et j'y ai plus touché ! Je vais en acheter un autre :p. Cependant je veux tout de même réparer celui-ci si tu es toujours disponible j'ai besoin de ton aide pour continuer le travail que nous faisions ! :p Voilà mes devoirs avec du retard :

Rapport de ZHPFix 1.12.3269 par Nicolas Coolman, Update du 30/03/2011
Fichier d'export Registre : 
Run by test at 13/04/2011 17:39:16
Windows XP Home Edition Service Pack 3 (Build 2600)
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html

========== Clé(s) du Registre ==========
HKCR\.bc!  => Clé supprimée avec succès
HKLM\Software\Microsoft\Windows\CurrentVersion\app management\arpcache\vmntoolbar  => Clé absente
HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zonemap\Domains\getmirar.com  => Clé absente
HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zonemap\Domains\mirarsearch.com  => Clé absente
HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains
et-nucleus.com  => Clé absente
HKLM\Software\05061214  => Clé absente
O23 - Service:  (aswUpdSv) - Clé orpheline  => Clé supprimée avec succès
O23 - Service:  (LBTServ) - Clé orpheline  => Clé supprimée avec succès
O23 - Service:  (NMIndexingService) - Clé orpheline  => Clé supprimée avec succès
O2 - BHO: PHPNukeFR Toolbar - {258fe8b8-a13c-4b91-9a0c-c2d3cab8b990} . (.Conduit Ltd. - Conduit Toolbar.) -- C:\Program Files\PHPNukeFR	bPHP1.dll  => Clé supprimée avec succès
O2 - BHO: Babylon toolbar helper - {2EECD738-5844-4a99-B4B6-146BF802613B} . (.Babylon BHO - Pas de description.) -- C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\bh\BabylonToolbar.dll  => Clé supprimée avec succès
HKCU\Software\BabylonToolbar  => Clé absente
HKCU\Software\PHPNukeFR  => Clé absente
HKLM\Software\PHPNukeFR  => Clé absente

========== Valeur(s) du Registre ==========
R3 - URLSearchHook: PHPNukeFR Toolbar - {258fe8b8-a13c-4b91-9a0c-c2d3cab8b990} . (.Conduit Ltd. - Conduit Toolbar.) (5, 7, 2, 2) -- C:\Program Files\PHPNukeFR	bPHP1.dll  => Valeur absente
O3 - Toolbar: PHPNukeFR Toolbar - {258fe8b8-a13c-4b91-9a0c-c2d3cab8b990} . (.Conduit Ltd. - Conduit Toolbar.) -- C:\Program Files\PHPNukeFR	bPHP1.dll  => Valeur absente
O3 - Toolbar: Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} . (.Babylon Ltd. - Pas de description.) -- C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarTlbr.dll  => Valeur absente
O4 - HKLM\..\Run: [BabylonToolbar] . (.Babylon Ltd. - Pas de description.) -- C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe  => Valeur absente
FirewallRaz (SP) : C:\Program Files\Xfire\xfire.exe  => Valeur supprimée avec succès
FirewallRaz (SP) : C:\Program Files\Mumble\murmur.exe  => Valeur supprimée avec succès
FirewallRaz (SP) : C:\DOCUME~1	est\LOCALS~1\Temp\IXP000.TMP\hfghf.exe  => Valeur supprimée avec succès
FirewallRaz (SP) : C:\Program Files\Call of Duty 4 Modern Warfare\iw3mp.exe  => Valeur supprimée avec succès
FirewallRaz (SP) : C:\Program Files\World of Warcraft\Launcher.exe  => Valeur supprimée avec succès
FirewallRaz (SP) : C:\Program Files\World of Warcraft\Launcher.patch.exe  => Valeur supprimée avec succès
FirewallRaz (SP) : C:\Program Files\World of Warcraft\Blizzard Downloader.exe  => Valeur supprimée avec succès
FirewallRaz (SP) : C:\Documents and Settings	est\Bureau\AviConverterSetup.exe  => Valeur supprimée avec succès
FirewallRaz (SP) : D:\World of Warcraft\Launcher.patch.exe  => Valeur supprimée avec succès
FirewallRaz (DP) : C:\Program Files\MSN Messenger\msncall.exe  => Valeur supprimée avec succès
FirewallRaz (DP) : C:\Program Files\MSN Messenger\livecall.exe  => Valeur supprimée avec succès
FirewallRaz : Aucune valeur présente dans la clé d'exception du registre .

========== Dossier(s) ==========
Dossiers Flash Cookies supprimés : 1109

========== Fichier(s) ==========
Fichiers Flash Cookies supprimés : 531

========== Logiciel(s) ==========
O42 - Logiciel: PHPNukeFR Toolbar - (.Pas de propriétaire.) [HKLM] -- PHPNukeFR Toolbar  => Logiciel déjà supprimé


========== Récapitulatif ==========
14 : Clé(s) du Registre
16 : Valeur(s) du Registre
1 : Dossier(s)
1 : Fichier(s)
1 : Logiciel(s)


End of the scan

______________________________________________________________

Puis l'autre partie se trouve ici : http://www.cijoint.fr/cjlink.php?file=cj201104/cijH3pcWSo.txt

Voilà et désolé d'avoir abandonné la tâche un moment ;p

juju666 · Answer

refais la meme manip avec ça:

O43 - CFD: 12/04/2011 - 01:21:08 - [0] ----D- C:\Documents and Settings	est\Application Data\54740546
O43 - CFD: 12/04/2011 - 01:25:50 - [0] ----D- C:\Documents and Settings	est\Application Data\55015718
C:\Documents and Settings	est\Application Data\54740546
C:\Documents and Settings	est\Application Data\55015718
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com
R0 - HKUS\S-1-5-21-3263419757-2289793591-2864839140-1007\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com

SnakeFurie · Answer

Seulement avec ces lignes là de copiés ? Ca marche !

SnakeFurie · Answer

Rapport de ZHPFix 1.12.3269 par Nicolas Coolman, Update du 30/03/2011
Fichier d'export Registre : 
Run by test at 13/04/2011 18:31:31
Windows XP Home Edition Service Pack 3 (Build 2600)
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html

========== Elément(s) de donnée du Registre ==========
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com  => Donnée supprimée avec succès
R0 - HKUS\S-1-5-21-3263419757-2289793591-2864839140-1007\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com  => Donnée supprimée avec succès

========== Dossier(s) ==========
C:\Documents and Settings	est\Application Data\54740546  => Supprimé et mis en quarantaine
C:\Documents and Settings	est\Application Data\55015718  => Supprimé et mis en quarantaine

========== Fichier(s) ==========
c:\documents and settings	est\application data\54740546  => Fichier absent
c:\documents and settings	est\application data\55015718  => Fichier absent


========== Récapitulatif ==========
2 : Elément(s) de donnée du Registre
2 : Dossier(s)
2 : Fichier(s)


End of the scan

________________________________________________________________

http://www.cijoint.fr/cjlink.php?file=cj201104/cijCwcQteO.txt

Voila ! =)

juju666 · Answer

c est mieux et c est fini ^^

&#9654 télécharge Ccleaner et enregistre le sur le bureau 

&#9654 double-clique sur le fichier pour lancer l'installation 

/!\Utilisateur de Vista et windows 7 : Clique droit sur le logo de Ccleaner, « exécuter en tant qu'administrateur » 

&#9654 sur la fenêtre de l'installation langage bien choisir français et OK 
&#9654 clique sur suivant 
&#9654 lis la licence et j'accepte 
&#9654 cliques sur suivant 
&#9654 là tu ne gardes de coché que mettre un raccourci sur le bureau et puis contrôler automatiquement les mises à jour de Ccleaner 
&#9654 cliques sur installer 
&#9654 cliques sur fermer 
&#9654 double-cliques sur l'icône de Ccleaner pour l'ouvrir 
&#9654 &#9654 une fois ouvert tu cliques sur option et puis avancé 
&#9654 tu décoches effacer uniquement les fichiers, du dossier temp de windows plus vieux que 24 heures 
&#9654 &#9654 cliques sur nettoyeur 
&#9654cliques sur windows et dans la colonne avancé 
&#9654coches la première case vieilles données du perfetch que celle-la ce qui te donnes la case vielles données du perfetch et la case avancé qui c'est coché automatiquement mais que celle-la 
&#9654 cliques sur analyse une fois l'analyse terminé 
&#9654 cliques sur lancer le nettoyage et sur la demande de confirmation OK il vas falloir que tu le refasses une autre fois une fois fini vérifs en appuyant de nouveau sur analyse pour être sur qu'il n'y est plus rien 
&#9654 &#9654 cliques maintenant sur registre et puis sur rechercher les erreurs 
&#9654 laisses tout cochées et cliques sur réparer les erreurs sélectionnées 
&#9654 il te demande de sauvegarder OUI 
&#9654 tu lui donnes un nom pour pouvoir la retrouver et enregistre 
&#9654 cliques sur corriger toutes les erreurs sélectionnées et sur la demande de confirmation OK 
&#9654 il supprime et fermer tu vérifies en relançant rechercher les erreurs 
&#9654 tu retournes dans option et tu recoches la case effacer uniquement les fichiers, du dossier temp de windows plus vieux que 48 heures et sur nettoyeur, windows sous avancé tu décoches la première case vieilles données du perfetch 
&#9654 tu peux fermer Ccleaner 

------ 

&#9654 Désactivation, puis Réactivation de la restauration système après désinfection : 

Il est nécessaire de désactiver puis réactiver la restauration système pour la purger car les points de restauration peuvent être infectés : 

XP/Vista : http://www.forum-fec.net/t97-purger-la-restauration-du-systeme
Seven: http://www.forum-fec.net/faq-tutoriel-astuces-f10/purger-la-restauration-du-systeme-sous-windows-7-t142.htm

------ 

Mise à jour Windows : 

Windows Update XP (uniquement avec Internet Explorer): http://update.microsoft.com/windowsupdate/v6/thanks.aspx?ln=fr&&thankspage=5

Windows Update Vista/Seven : cliquer sur le logo windows, dans la rechercher taper "Windows Update", cliquer sur le résultat.

-----

&#9654 Mets à jour Java : https://www.java.com/fr/download/uninstalltool.jsp  

&#9654 Désinstaller les anciennes versions de Java :  

&#9654 Télécharge JavaRa.zip  

&#9654 Décompresse le fichier sur ton bureau (clique droit > Extraire tout.)  

&#9654 Double-clique sur le répertoire JavaRa obtenu.  

&#9654 Puis double-clique sur le fichier JavaRa.exe (le .exe peut ne pas s'afficher)  

&#9654 Clique sur Remove Older Versions.  

&#9654 Clique sur Oui pour confirmer. L'outil va travailler, clique ensuite sur Ok, puis une deuxième fois sur Ok.  

&#9654 Un rapport va s'ouvrir, copie-colle le dans ta prochaine réponse.  

&#9654 Note : le rapport se trouve aussi là : ( C:\JavaRa.log )  

&#9654 Tu peux fermer l'application   

&#9654 &#9654 Met à jour Adobe : 

&#9654 Reader : https://get2.adobe.com/fr/reader/otherversions/
&#9654 &#9654 Décocher le scan Macàfric

&#9654 Flash Player: https://get.adobe.com/flashplayer/?loc=fr

-----

&#9654 &#9654 pour supprimer les outils de désinfection :

&#9654 Télécharge Delfix sur ton bureau : 

&#9654 Clique sur le bouton « Suppression » et poste son rapport sur ton prochain message 
&#9654 &#9654 Pour le désinstaller, il suffit de le relancer et cliquer sur le bouton de désinstallation. 

------ 

Tu peux garder Malwarebytes pour un scan de temps à autres 

----- 

Tu peux lire ce sujet sur les logiciels recommandés, et les attitudes responsables sur le web 
Et celui ci, sur les logiciels gratuits à éviter 

------ 

&#9654 &#9654 Pense à marquer le fil comme résolu  

------ 

Si tu as d'autres questions, je t'écoute avec plaisir :)

@+

afideg · Answer

Hello juju,    

Quelque chose m'échappe dans son hosts.    

1°- https://forums.commentcamarche.net/forum/affich-21456612-fichiers-disparus-windows-repair-me-spam#4   RogueKiller V4.3.6   Mode: Suppression    
Fichier HOSTS:     
127.0.0.1 localhost     
192.246.40.62 etguidauth.evenbalance.com   
127.0.0.1 localhost # loopback     
213.239.219.83 l2authd.lineage2.com # m0o age     
213.239.219.83 L2testauthd.lineage2.com #m0o age     
127.0.0.1 www.007guard.com     
127.0.0.1 007guard.com  
etc.    

2°- https://forums.commentcamarche.net/forum/affich-21456612-fichiers-disparus-windows-repair-me-spam#9   Kill'em.txt  Option Suppression     
¤¤¤¤¤¤¤¤¤¤ Hosts ¤¤¤¤¤¤¤¤¤¤     
127.0.0.1 localhost     

Où sont passés ces trois lignes (douteuses à mon goût)     
- 192.246.40.62 etguidauth.evenbalance.com    
- 213.239.219.83 l2authd.lineage2.com # m0o age     
- 213.239.219.83 L2testauthd.lineage2.com #m0o age   ??    

Al.    

Patience-Vigilance-Amour.

juju666 · Answer

@snakeFurie :

&#9654 Télécharger RstHost d'Xplode  

&#9654 Double clic sur l'icône RstHost pour l'exécuter   
&#9654 &#9654  /!\ Vista/Seven : clic droit sur le logiciel, et choisir "Exécuter en tant qu'administrateur /!\   
&#9654 Clique sur l'option "Restaurer"  
&#9654 Clique sur "Ok" lors de la confirmation de la restauration  
&#9654 Poste le rapport qui s'ouvre à la fin  
(CTRL+A pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller)   
&#9654 &#9654 Ferme le rapport et le programme.

Fichiers disparus + "windows repair" me spam!

29 réponses

Newsletters