rlvknlg.exe Comment le supprimer? Fermé

Question

Bonjour, 
Aujourd'hui en faisant un petit tour sur le PC de ma mère, je me rends compte qu'au bout d'un certain temps il se met a rammer monstrueusement. Je regarde alors dans mon gestionaire de taches, et je vois UC 100%. Mais quel programme peut utiliser environ 88% de mon UC ? C'est bel et bien rlvknlg.exe, je ne sais pas comment il est arrivé la, mais je n'arrive pas a m'en défaire quelqu'un peut-il m'aider? 
Merci d'avance.


Configuration: Windows XP / Opera 9.80

Valuu · Answer

Bonjour bonjour :)

On va vérifier ça ;)

--------------------------------------------------------------------------------------
Utilise ce logiciel de diagnostic : 

    * Télécharge ZHPDiag (de Nicolas Coolman) 
    * Laisse toi guider lors de l'installation, il se lancera automatiquement à la fin. 
    * Sous Vista/Seven, si ça ne se lance pas --> Clic droit/Exécuter en tant qu'administrateur
    * Clique sur l'icône représentant une loupe (« Lancer le diagnostic ») 
    * Enregistre le rapport sur ton Bureau à l'aide de l'icône représentant une disquette 
    * Héberge le rapport ZHPDiag.txt sur ce site, puis copie/colle le lien fourni dans ta prochaine réponse sur le forum.

Valuu · Answer

C'est mieux :P

--------------------------------------------------------------------------------------
Télécharge WinChk sur ton bureau.
Lance le et appuie sur le bouton [Exécuter]
Un rapport s'ouvrira. Il sera également enregistré sous C:\WinChk.txt
Rends toi sur pjjoint.
Clique sur [Parcourir] , navigue jusqu'au fichier C:\WinChk.txt puis clique sur [OK]
Clique enfin sur [Envoyer le fichier] puis copie/colle dans ta prochaine réponse le lien créé qui apparaitra à l'écran.

Valuu · Answer

Télécharge AdwCleaner ( d'Xplode ) sur ton bureau. 
Lance le, clique sur [Recherche] puis patiente le temps du scan. 
Une fois le scan fini, un rapport s'ouvrira. Poste moi son contenu dans ta prochaine réponse. 
Note : Le rapport est également sauvegardé sous C:\AdwCleaner[R1].txt

Pin-pin · Answer

# AdwCleaner v1.304 - Rapport créé le 07/09/2011 à 18:06:20
# Mis à jour le 05/09/11 à 14h30 par Xplode
# Système d'exploitation : Microsoft Windows XP Service Pack 3 (32 bits)
# Nom d'utilisateur : HP_Administrateur - PINPINLELAPIN (Administrateur)
# Exécuté depuis : C:\Documents and Settings\HP_Administrateur\Bureau\adwcleaner.exe
# Option [Recherche]


***** [Processus] *****


***** [Services] *****


***** [Fichiers / Dossiers] *****

Dossier Présent : C:\Documents and Settings\HP_Administrateur\Application Data\advantage
Dossier Présent : C:\Documents and Settings\HP_Administrateur\Application Data\EoRezo
Dossier Présent : C:\Documents and Settings\HP_Administrateur\Application Data\PriceGong
Dossier Présent : C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Conduit
Dossier Présent : C:\Program Files\ItsLabel
Dossier Présent : C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\vo8jbp6v.default\extensions\engine@conduit.com

***** [Registre] *****

Clé Présente : HKCU\Software\PriceGong
Clé Présente : HKLM\SOFTWARE\Conduit
Clé Présente : HKLM\SOFTWARE\Classes\Conduit.Engine
Clé Présente : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Clé Présente : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}
Clé Présente : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}
Clé Présente : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A078F691-9C07-4AF2-BF43-35E79EECF8B7}
Valeur Présente : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EEE6C35D-6118-11DC-9C72-001320C79847}]
Valeur Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [AdVantage]

***** [Navigateurs] *****

-\ Internet Explorer v8.0.6001.18702

[OK] Le registre ne contient aucune entrée illégitime.

-\ Mozilla Firefox v [Impossible d'obtenir la version]

Profil : vo8jbp6v.default
Fichier : C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\vo8jbp6v.default\prefs.js

[OK] Le fichier ne contient aucune entrée illégitime.

-\ Google Chrome v [Impossible d'obtenir la version]

Fichier : C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences

[OK] Le fichier ne contient aucune entrée illégitime.

-\ Opera v11.51.1087.0

Fichier : C:\Documents and Settings\HP_Administrateur\Application Data\Opera\Opera\operaprefs.ini

[OK] Le fichier ne contient aucune entrée illégitime.

*************************

AdwCleaner[R1].txt - [2828 octets] - [07/09/2011 18:06:20]

########## EOF - C:\AdwCleaner[R1].txt - [2956 octets] ##########

Valuu · Answer

Bien, repasse le en mode suppression puis :

--------------------------------------------------------------------------------------
* Télécharge AD-Remover(de la TeamXscript) sur ton Bureau. 
Déconnecte toi et ferme toutes les applications en cours 
* Double-clique sur l'icône AD-Remover 
* Au menu principal, clique sur Scanner
* Confirme le lancement de l'analyse et laisse l'outil travailler 
* Poste le rapport qui apparait à la fin (il est aussi sauvegardé sous C:\Ad-report-CLEAN.txt )

Pin-pin · Answer

======= RAPPORT D'AD-REMOVER 2.0.0.2,G | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par TeamXscript le 12/04/11
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
Site web: http://www.teamxscript.org

C:\Program Files\Ad-Remover\main.exe (SCAN [1]) -> Lancé à 18:13:17 le 07/09/2011, Mode normal

Microsoft Windows XP Professionnel Service Pack 3 (X86) 
HP_Administrateur@PINPINLELAPIN ( ) 
 
============== RECHERCHE ==============


Dossier trouvé: C:\WINDOWS\Eurobarre
Dossier trouvé: C:\Program Files\GamesBar
Dossier trouvé: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\RelevantKnowledge
Dossier trouvé: C:\Program Files\RelevantKnowledge
Dossier trouvé: C:\Documents and Settings\HP_Administrateur\Application Data\Toolbar4
Dossier trouvé: C:\Documents and Settings\HP_Administrateur\Application Data\ItsLabel
Dossier trouvé: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\ItsLabel
Fichier trouvé: C:\Program Files\Windows Live\Messenger\Riched20.dll
Fichier trouvé: C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\ukais_nav.dat

Clé trouvée: HKLM\Software\Classes\Interface\{08AA0598-6A23-4364-9BF4-6D5F57F42993}
Clé trouvée: HKLM\Software\Classes\Interface\{B0E8C398-DABE-4CE1-B4D9-ED43B64923F5}
Clé trouvée: HKLM\Software\Classes\Interface\{C7F127DF-8877-4E1E-A196-FBBECBC5BC6D}
Clé trouvée: HKLM\Software\Classes\TypeLib\{2615F050-9C18-4267-B711-8E3687DC0145}
Clé trouvée: HKLM\Software\Classes\TypeLib\{CA295D63-514A-4ED0-9B5F-640890F2366B}
Clé trouvée: HKLM\Software\Classes\TypeLib\{CB0D9D8C-535E-4352-BA8F-65C3C8676612}
Clé trouvée: HKLM\Software\Classes\SearchBar.InitToolbarBHO
Clé trouvée: HKLM\Software\Classes\SearchBar.InstallerClass
Clé trouvée: HKLM\Software\Classes\SearchBar.Toolbar
Clé trouvée: HKLM\Software\Classes\Toolbar.CT2504091
Clé trouvée: HKLM\Software\Classes\Toolbar.CT2849852
Clé trouvée: HKLM\Software\GamesBarSetup
Clé trouvée: HKLM\Software\PopCap
Clé trouvée: HKCU\Software\fcn
Clé trouvée: HKCU\Software\Lanconfig
Clé trouvée: HKCU\Software\PopCap
Clé trouvée: HKU\.DEFAULT\Software\Conduit
Clé trouvée: HKU\S-1-5-18\Software\Conduit
Clé trouvée: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\ItsLabel
Clé trouvée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}
Clé trouvée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}
Clé trouvée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127}
Clé trouvée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7}
Clé trouvée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{5549C19D-46FE-4975-AD54-5B37E87FF6E2}
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{D08D9F98-1C78-4704-87E6-368B0023D831}
Clé trouvée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEBF}
Clé trouvée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEC0}
Clé trouvée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45DD-9B68-D6A12C30E5D7}
Clé trouvée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll
Clé trouvée: HKLM\Software\Microsoft\Multimedia\WMPlayer\Schemes\f3pss
Clé trouvée: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RelevantKnowledge
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4D7B-9389-0F166788785A}
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98D9753D-D73B-42D5-8C85-4469CDA897AB}
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9FF05104-B030-46FC-94B8-81276E4E27DF}

Valeur trouvée: HKLM\Software\Mozilla\Firefox\Extensions|{6E19037A-12E3-4295-8915-ED48BC341614}
Valeur trouvée: HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser|{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B}


============== SCAN ADDITIONNEL ==============

-- C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\FireFox\Profiles\vo8jbp6v.default --
Extensions\cacaoweb@cacaoweb.org (cacaoweb)
Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} (Google Toolbar for Firefox)
Extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc} (?)
Extensions\{ef79f67a-6ad7-4715-a0f8-932fca442023} (BittorrentBar_FR Community Toolbar)
User.js - keyword.URL, hxxp://redirecterror.sfr.fr/?q=
Prefs.js - browser.search.defaultenginename, Google
Prefs.js - browser.search.defaulturl, hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
Prefs.js - browser.search.selectedEngine, Google
Prefs.js - browser.startup.homepage_override.mstone, rv:1.9.0.8

-- C:\Documents and Settings\Patate-Boy\Application Data\Mozilla\FireFox\Profiles\kynrkty8.default --
Extensions\staged-xpis (?)
Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} (?)
Prefs.js - browser.download.dir, C:\Documents and Settings\Patate-Boy\Mes documents
Prefs.js - browser.search.defaultenginename, Google
Prefs.js - browser.search.defaulturl, hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
Prefs.js - browser.search.selectedEngine, Google
Prefs.js - browser.startup.homepage_override.mstone, rv:1.9.0.1

========================================

**** Internet Explorer Version [8.0.6001.18702] ****

HKCU_Main|Default_Page_URL - hxxp://81.29.214.174/Search.aspx
HKCU_Main|Default_Search_URL - hxxp://81.29.214.174/Search.aspx
HKCU_Main|Start Page - hxxp://www.google.fr/
HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=69157
HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Search bar - hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=63&bd=PAVILION&pf=desktop
HKLM_Main|Search Page - hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM_Main|Start Page - hxxp://www.bigseekpro.com/accmeware/{B1E7719A-8BE9-4E63-82DA-90509DAEDD75}
HKCU_URLSearchHooks|{ba14329e-9550-4989-b3f2-9732e92d17cc} (x)
HKCU_URLSearchHooks|{BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - "SearchHook Class" (C:\Program Files\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll)
HKCU_SearchScopes\{18291348-B055-400E-8BCD-3B927FA9ED87} - "?" (hxxp://81.29.214.174/Search.aspx?ct=it&key={searchTerms}&ref=PGTB&cg=1423716fc35...)
HKCU_SearchScopes\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e} - "Search" (hxxp://www.bigseekpro.com/search/browser/accmeware/{B1E7719A-8BE9-4E63-82DA-9050...)
HKCU_SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} - "SweetIM Search" (hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms})
HKLM_SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} - "SweetIM Search" (hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms})
HKCU_Toolbar\ShellBrowser|{C4069E3A-68F1-403E-B40E-20066696354B} (x)
HKCU_Toolbar\ShellBrowser|{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} (x)
HKCU_Toolbar\WebBrowser|{A057A204-BACC-4D26-9990-79A187E2698E} (x)
HKCU_Toolbar\WebBrowser|{266FCDCA-7BB3-4DA7-B3BF-F845DEA2EBD6} (C:\Program Files\IsoBuster	bIso0.dll) (x)
HKCU_Toolbar\WebBrowser|{EEE6C35B-6118-11DC-9C72-001320C79847} (x)
HKCU_Toolbar\WebBrowser|{CCC7A320-B3CA-4199-B1A6-9F516DD69829} (x)
HKLM_Toolbar|{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} (C:\Program Files\IsoBuster	bIso0.dll) (x)
HKLM_Toolbar|{CCC7A320-B3CA-4199-B1A6-9F516DD69829} (x)
HKLM_Toolbar|{c9a6357b-25cc-4bcf-96c1-78736985d412} (mscoree.dll) (x)
HKLM_ElevationPolicy\5eb3ef40-307d-42f9-96cf-1dc460d4bbf4 - C:\Program Files\Vuze_Remote\Vuze_RemoteToolbarHelper.exe (x)
HKLM_ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481} - C:\Program Files\MyWebSearch\bar\1.bin\m3impipe.exe (x)
HKLM_ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291} - C:\Program Files\AccmeWare DB Toolbar\TbHelper2.exe (x)
HKLM_ElevationPolicy\{68AF847F-6E91-45dd-9B68-D6A12C30E5D7} - C:\WINDOWS\system32\f3PSSavr.scr (x)
HKLM_ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907} - C:\Program Files\MyWebSearch\bar\1.bin\m3SkPlay.exe (x)
HKLM_ElevationPolicy\{A6E2003F-95C5-4591-BA9A-0093080FDB5C} - C:\Program Files\Fichiers communs\Oberon Media\OberonBroker\1.0.0.63\OberonBroker.exe (?)
HKLM_ElevationPolicy\{B2321D2F-1154-4d97-AD3E-2FE0BAE2897B} - C:\Program Files\SFR\Kit\9launch.exe (SFR)
HKLM_ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127} - C:\Program Files\MyWebSearch\bar\1.bin\m3medint.exe (x)
HKLM_ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7} - C:\Program Files\MyWebSearch\bar\1.bin\m3SlSrch.exe (x)
HKLM_ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA} - C:\Program Files\MyWebSearch\bar\1.bin\m3SrchMn.exe (x)
HKLM_Extensions\{3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - "SmartShopper - Compare product prices" (C:\Program Files\SmartShopper\Bin\2.5.0\SmrtShpr.dll,203)
HKLM_Extensions\{3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - "SmartShopper - Compare travel rates" (C:\Program Files\SmartShopper\Bin\2.5.0\SmrtShpr.dll,201)
HKLM_Extensions\{d9288080-1baa-4bc4-9cf8-a92d743db949} - "Run IMVU" (C:\Documents and Settings\HP_Administrateur\Application Data\IMVUClient\imvu.ico)
HKLM_Extensions\{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - "?" (?)
HKLM_Extensions\{E2D4D26B-0180-43a4-B05F-462D6D54C789} - "Aide à la connexion" (C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\conn_support.ico)
HKLM_Extensions\{e2e2dd38-d088-4134-82b7-f2ba38496583} - "?" (?)
BHO\83CED28E-B96A-43FC-A276-2AD7A48EB6BE (?)
BHO\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - "AcroIEHlprObj Class" (C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll)
BHO\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8} - "Objet d'aide à la navigation SFR" (C:\Program Files\SFR\Kit\SFRNavErrorHelper.dll)
BHO\{1d970ed5-3eda-438d-bffd-715931e2775b} - "SearchBar.InitToolbarBHO" (mscoree.dll) (x)
BHO\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - "IsoBuster Toolbar" (C:\Program Files\IsoBuster	bIso0.dll) (x)
BHO\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} (?)
BHO\{4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} (?)
BHO\{5C255C8A-E604-49b4-9D64-90988571CECB} (?)
BHO\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - "Search Helper" (C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll)
BHO\{9030D464-4C02-4ABF-8ECC-5164760863C6} (?)
BHO\{A057A204-BACC-4D26-9990-79A187E2698E} (?)
BHO\{A3BC75A2-1F87-4686-AA43-5347D756017C} (?)
BHO\{AA58ED58-01DD-4d91-8333-CF10577473F7} (?)
BHO\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E} (?)
BHO\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} (?)
BHO\{EEE6C35C-6118-11DC-9C72-001320C79847} (?)
BHO\{ef79f67a-6ad7-4715-a0f8-932fca442023} (?)

========================================

C:\Program Files\Ad-Remover\Quarantine: 0 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 1 Fichier(s)

C:\Ad-Report-SCAN[1].txt - 07/09/2011 18:13:20 (9211 Octet(s)) 

Fin à: 18:14:03, 07/09/2011 
 
============== E.O.F ==============

Valuu · Answer

--------------------------------------------------------------------------------------
* Double-clique sur l'icône AD-Remover 
Déconnecte toi et ferme toutes les applications en cours 
* Au menu principal, clique sur Nettoyer 
* Confirme le lancement de l'analyse et laisse l'outil travailler 
* Poste le rapport qui apparait à la fin (il est aussi sauvegardé sous C:\Ad-report-CLEAN.txt ) 

--------------------------------------------------------------------------------------
    * Télécharge RogueKiller sur le bureau
    * Quitte tous les programmes en cours
    * Sous Vista/Seven , clic droit -> lancer en tant qu'administrateur
    * Sinon lance simplement RogueKiller.exe
    * Lorsque demandé, tape 1 et valide
    * Un rapport à dû s'ouvrir (RKreport.txt se trouve également à côté de l'exécutable), donne moi son contenu dans ta prochaine réponse.
    * Si le programme a été bloqué, ne pas hésiter a essayer plusieurs fois. Si vraiment cela ne passe pas (ça peut arriver), le renommer en winlogon.exe

Pin-pin · Answer

Voila le rapport rogue killer: RogueKiller V5.3.4 [30/08/2011] par Tigzy contact sur https://www.luanagames.com/index.fr.html mail: tigzyRKgmailcom Remontees: https://www.luanagames.com/index.fr.html Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 3) 32 bits version Demarrage : Mode normal Utilisateur: HP_Administrateur [Droits d'admin] Mode: Recherche -- Date : 07/09/2011 18:59:29 Processus malicieux: 2 [SUSP PATH] arservice.exe -- c:\windows\arservice.exe -> KILLED [TermProc] [SUSP PATH] arpwrmsg.exe -- c:\windows\arpwrmsg.exe -> KILLED [TermProc] Entrees de registre: 5 [SUSP PATH] {BB65B0FB-5712-401b-B616-E69AC55E2757}.job : C:\DOCUME~1\PATATE~1\LOCALS~1\Temp\a.exe -> FOUND [SUSP PATH] {7B02EF0B-A410-4938-8480-9BA26420A627}.job : C:\WINDOWS\msa.exe -> FOUND [SUSP PATH] IMVU.lnk : C:\Documents and Settings\HP_Administrateur\Application Data\IMVUClient\IMVUClient.exe -> FOUND [SUSP PATH] Notification de cadeaux MSN.lnk : C:\Documents and Settings\HP_Administrateur\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe -> FOUND [HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND Fichiers / Dossiers particuliers: Fichier HOSTS: 127.0.0.1 localhost 127.0.0.1 www.007guard.com 127.0.0.1 007guard.com 127.0.0.1 008i.com 127.0.0.1 www.008k.com 127.0.0.1 008k.com 127.0.0.1 www.00hq.com 127.0.0.1 00hq.com 127.0.0.1 010402.com 127.0.0.1 www.032439.com 127.0.0.1 032439.com 127.0.0.1 www.0scan.com 127.0.0.1 0scan.com 127.0.0.1 100888290cs.com 127.0.0.1 www.100888290cs.com 127.0.0.1 www.100sexlinks.com 127.0.0.1 100sexlinks.com 127.0.0.1 10sek.com 127.0.0.1 www.10sek.com 127.0.0.1 123topsearch.com [...] Termine : << RKreport[1].txt >> RKreport[1].txt

Valuu · Answer

--------------------------------------------------------------------------------------
    * Quitte tous les programmes en cours
    * Sous Vista/Seven , clic droit -> lancer en tant qu'administrateur
    * Sinon lance simplement RogueKiller.exe
    * Lorsque demandé, tape 2 et valide
    * Un rapport à dû s'ouvrir (RKreport.txt se trouve également à côté de l'exécutable), donne moi son contenu dans ta prochaine réponse
    * Si le programme a été bloqué, ne pas hésiter a essayer plusieurs fois. Si vraiment cela ne passe pas (ça peut arriver), le renommer en winlogon.exe

--------------------------------------------------------------------------------------
MBAM
    * Télécharge Malwarebytes' Anti-Malware
    * Fais la mise à jour du logiciel (elle se fait normalement à l'installation)
    * Lance une analyse complète en cliquant sur "Exécuter un examen complet"
    * Sélectionne les disques que tu veux analyser et clique sur "Lancer l'examen"
    * L'analyse peut durer un bon moment.....
    * Une fois l'analyse terminée, clique sur "OK" puis sur "Afficher les résultats"
    * Vérifie que tout est bien coché et clique sur "Supprimer la sélection" => et ensuite sur "OK"
    * Il se pourrait que certains fichiers devront être supprimés au redémarrage du PC... Fais le en cliquant sur "oui" à la question posée
   * Un rapport va s'ouvrir dans le bloc note... Fais un copié/collé du rapport dans ta prochaine réponse sur le forum

Pin-pin · Answer

Rapport de rogue killer : RogueKiller V5.3.4 [30/08/2011] par Tigzy contact sur https://www.luanagames.com/index.fr.html mail: tigzyRKgmailcom Remontees: https://www.luanagames.com/index.fr.html Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 3) 32 bits version Demarrage : Mode normal Utilisateur: HP_Administrateur [Droits d'admin] Mode: Suppression -- Date : 07/09/2011 19:03:50 Processus malicieux: 0 Entrees de registre: 5 [SUSP PATH] {BB65B0FB-5712-401b-B616-E69AC55E2757}.job : C:\DOCUME~1\PATATE~1\LOCALS~1\Temp\a.exe -> DELETED [SUSP PATH] {7B02EF0B-A410-4938-8480-9BA26420A627}.job : C:\WINDOWS\msa.exe -> DELETED [SUSP PATH] IMVU.lnk : C:\Documents and Settings\HP_Administrateur\Application Data\IMVUClient\IMVUClient.exe -> DELETED [SUSP PATH] Notification de cadeaux MSN.lnk : C:\Documents and Settings\HP_Administrateur\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe -> DELETED [HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0) Fichiers / Dossiers particuliers: Fichier HOSTS: 127.0.0.1 localhost 127.0.0.1 www.007guard.com 127.0.0.1 007guard.com 127.0.0.1 008i.com 127.0.0.1 www.008k.com 127.0.0.1 008k.com 127.0.0.1 www.00hq.com 127.0.0.1 00hq.com 127.0.0.1 010402.com 127.0.0.1 www.032439.com 127.0.0.1 032439.com 127.0.0.1 www.0scan.com 127.0.0.1 0scan.com 127.0.0.1 100888290cs.com 127.0.0.1 www.100888290cs.com 127.0.0.1 www.100sexlinks.com 127.0.0.1 100sexlinks.com 127.0.0.1 10sek.com 127.0.0.1 www.10sek.com 127.0.0.1 123topsearch.com [...] Termine : << RKreport[2].txt >> RKreport[1].txt ; RKreport[2].txt

Pin-pin · Answer

Rapport de MBAM :

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Version de la base de données: 7672

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

07/09/2011 19:29:31
mbam-log-2011-09-07 (19-29-31).txt

Type d'examen: Examen rapide
Elément(s) analysé(s): 220337
Temps écoulé: 9 minute(s), 20 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 51
Valeur(s) du Registre infectée(s): 7
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 27
Fichier(s) infecté(s): 54

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
c:\program fileselevantknowledgells.dll (Adware.RelevantKnowledge) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RelevantKnowledge (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\243B60DF-796C-409E-BE55-0AD5C9710BA4 (Adware.Platrium) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{2615F050-9C18-4267-B711-8E3687DC0145} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{5D2631E5-8696-7543-50B2-F674CD4308EB} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{CA295D63-514A-4ED0-9B5F-640890F2366B} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{B0E8C398-DABE-4CE1-B4D9-ED43B64923F5} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{CB0D9D8C-535E-4352-BA8F-65C3C8676612} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{08AA0598-6A23-4364-9BF4-6D5F57F42993} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{137E6E5E-A205-4657-A49F-1AB865787089} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{137E6E5E-A205-4657-A49F-1AB865787089} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{137E6E5E-A205-4657-A49F-1AB865787089} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{83CED28E-B96A-43FC-A276-2AD7A48EB6BE} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{83CED28E-B96A-43FC-A276-2AD7A48EB6BE} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEBF} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEBF} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEC0} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEC0} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45dd-9B68-D6A12C30E5D7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4D7B-9389-0F166788785A} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98D9753D-D73B-42D5-8C85-4469CDA897AB} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9FF05104-B030-46FC-94B8-81276E4E27DF} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\glaide32 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.HbAx (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.HbAx.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.HbInfoBand (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.HbInfoBand.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.IEButton (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.IEButton.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.IEButtonA (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.IEButtonA.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.IEButtonB (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.IEButtonB.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.SmrtShprCtl (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\SmartShopper.SmrtShprCtl.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\bc.DLL (Adware.Platrium) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\SmartShopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\SmartShopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\xpreapp (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831} (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SmartShopper (Adware.SmartShopper) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEBF} (Adware.SmartShopper) -> Value: {3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEBF} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEC0} (Adware.SmartShopper) -> Value: {3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEC0} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} (Adware.SmartShopper) -> Value: {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} (Adware.SmartShopper) -> Value: {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} (Adware.Zango) -> Value: {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} (Adware.Zango) -> Value: {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RList (Malware.Trace) -> Value: RList -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BITS\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemRoot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Delete on reboot.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\wuauserv\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemroot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Delete on reboot.

Dossier(s) infecté(s):
c:\documents and settings\all users\application data\10692344 (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\hotbar_icons (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\db (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\dwld (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cseport (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cses1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\db (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\dwld (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cseport (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cses1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program fileselevantknowledge (Spyware.MarketScore) -> Delete on reboot.
c:\program fileselevantknowledge\components (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\smartshopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program files\smartshopper\Bin (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program files\smartshopper\Bin\2.5.0 (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program files\smartshopper\cs (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program files\smartshopper\cs\antiphishing (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmeselevantknowledge (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\smartshopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\db (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\eodesktop (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\eoStats (Adware.EoRezo) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
c:\program fileselevantknowledgells.dll (Adware.RelevantKnowledge) -> Delete on reboot.
c:\documents and settings\hp_administrateur\application data\wiaserva.log (Malware.Trace) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\i85o3wrf.exe.a_a (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\drivers\glaide32.sys (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\hotbar_icons\3bsoftware_icon_1.ico (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\Config.xml (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\db\Aliases.dbs (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\db\Sites.dbs (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\dwld\phishinglist.xip (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cs\dwld\whitelist.xip (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cseport\aggr_storage.xml (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cseport\send_storage.xml (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\hp_administrateur\application data\smartshopper\cses1\whitelist.dbs (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\Config.xml (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\db\Aliases.dbs (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\db\Sites.dbs (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\dwld\phishinglist.xip (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cs\dwld\whitelist.xip (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cseport\aggr_storage.xml (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cseport\send_storage.xml (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\patate-boy\application data\smartshopper\cses1\whitelist.dbs (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program fileselevantknowledge\chrome.manifest (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program fileselevantknowledge\install.rdf (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program fileselevantknowledge
cncf.dat (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program fileselevantknowledge
scf.dat (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program fileselevantknowledgells64.dll (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program fileselevantknowledgeloci.bin (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program fileselevantknowledgelph.dll (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program fileselevantknowledgelservice.exe (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program fileselevantknowledgelvknlg.exe (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program fileselevantknowledgelvknlg64.exe (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program fileselevantknowledgelxf.dll (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program fileselevantknowledge\componentslxg.dll (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\program files\smartshopper\Uninst.exe (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program files\smartshopper\cs\antiphishing\antiphishing.html (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program files\smartshopper\cs\antiphishing\phishalert.gif (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program files\smartshopper\cs\antiphishing\x.gif (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\program files\smartshopper\cs\antiphishing\xActive.gif (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmeselevantknowledge\about relevantknowledge.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmeselevantknowledge\privacy policy and user license agreement.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmeselevantknowledge\Support.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmeselevantknowledge\uninstall instructions.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\smartshopper\smartshopper - comapre product prices.lnk (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\smartshopper\smartshopper - compare travel rate.lnk (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\smartshopper\smartshopper help.lnk (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\all users\menu démarrer\programmes\smartshopper\uninstall smartshopper.lnk (Adware.SmartShopper) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\cmhost.cyp (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\confmedia.cyp (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\host.cyp (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\user.cyp (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\db\cat.cyp (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\eodesktop\config.xml (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\eodesktop\eodesktop.html (Adware.EoRezo) -> Quarantined and deleted successfully.
c:\documents and settings\Pin-pin\application data\EoRezo\eodesktop\userconfig.xml (Adware.EoRezo) -> Quarantined and deleted successfully.

Valuu · Answer

Arf, tu n'avais pas passé le mode suppression d'Ad-Remover comme demandé, d'où le long rapport ^^ Passe le quand même voir si il restait des trucs.
Ensuite refait moi un ZHPDiag stp (et héberge le)

Pin-pin · Answer

Le rapport de nettoyage d'ad-remover:  

======= RAPPORT D'AD-REMOVER 2.0.0.2,G | UNIQUEMENT XP/VISTA/7 =======  

Mis à jour par TeamXscript le 12/04/11  
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com  
Site web: http://www.teamxscript.org  

C:\Program Files\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 20:15:36 le 07/09/2011, Mode normal  

Microsoft Windows XP Professionnel Service Pack 3 (X86)   
HP_Administrateur@PINPINLELAPIN ( )   
   
============== ACTION(S) ==============  


Dossier supprimé: C:\WINDOWS\Eurobarre  
Dossier supprimé: C:\Program Files\GamesBar  
Dossier supprimé: C:\Documents and Settings\HP_Administrateur\Application Data\Toolbar4  
Dossier supprimé: C:\Documents and Settings\HP_Administrateur\Application Data\ItsLabel  
Dossier supprimé: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\ItsLabel  
Fichier supprimé: C:\Program Files\Windows Live\Messenger\Riched20.dll  
Fichier supprimé: C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\ukais_nav.dat  

(!) -- Fichiers temporaires supprimés.  


Clé supprimée: HKLM\Software\Classes\Interface\{C7F127DF-8877-4E1E-A196-FBBECBC5BC6D}  
Clé supprimée: HKLM\Software\Classes\SearchBar.InitToolbarBHO  
Clé supprimée: HKLM\Software\Classes\SearchBar.InstallerClass  
Clé supprimée: HKLM\Software\Classes\SearchBar.Toolbar  
Clé supprimée: HKLM\Software\Classes\Toolbar.CT2504091  
Clé supprimée: HKLM\Software\Classes\Toolbar.CT2849852  
Clé supprimée: HKLM\Software\GamesBarSetup  
Clé supprimée: HKLM\Software\PopCap  
Clé supprimée: HKCU\Software\Lanconfig  
Clé supprimée: HKCU\Software\PopCap  
Clé supprimée: HKU\.DEFAULT\Software\Conduit  
Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\ItsLabel  
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{5549C19D-46FE-4975-AD54-5B37E87FF6E2}  

Valeur supprimée: HKLM\Software\Mozilla\Firefox\Extensions|{6E19037A-12E3-4295-8915-ED48BC341614}  


============== SCAN ADDITIONNEL ==============  

-- C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\FireFox\Profiles\vo8jbp6v.default --  
Extensions\cacaoweb@cacaoweb.org (cacaoweb)  
Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} (Google Toolbar for Firefox)  
Extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc} (?)  
Extensions\{ef79f67a-6ad7-4715-a0f8-932fca442023} (BittorrentBar_FR Community Toolbar)  
User.js - keyword.URL, hxxp://redirecterror.sfr.fr/?q=  
Prefs.js - browser.search.defaultenginename, Google  
Prefs.js - browser.search.defaulturl, hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=  
Prefs.js - browser.search.selectedEngine, Google  
Prefs.js - browser.startup.homepage_override.mstone, rv:1.9.0.8  

-- C:\Documents and Settings\Patate-Boy\Application Data\Mozilla\FireFox\Profiles\kynrkty8.default --  
Extensions\staged-xpis (?)  
Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} (?)  
Prefs.js - browser.download.dir, C:\Documents and Settings\Patate-Boy\Mes documents  
Prefs.js - browser.search.defaultenginename, Google  
Prefs.js - browser.search.defaulturl, hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=  
Prefs.js - browser.search.selectedEngine, Google  
Prefs.js - browser.startup.homepage_override.mstone, rv:1.9.0.1  

========================================  

**** Internet Explorer Version [8.0.6001.18702] ****  

HKCU_Main|Default_Page_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome  
HKCU_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch  
HKCU_Main|Search bar - hxxp://go.microsoft.com/fwlink/?linkid=54896  
HKCU_Main|Start Page - hxxp://fr.msn.com/  
HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896  
HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch  
HKLM_Main|Search bar - hxxp://search.msn.com/spbasic.htm  
HKLM_Main|Search Page - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch  
HKLM_Main|Start Page - hxxp://fr.msn.com/  
HKCU_URLSearchHooks|{ba14329e-9550-4989-b3f2-9732e92d17cc} (x)  
HKCU_URLSearchHooks|{BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - "SearchHook Class" (C:\Program Files\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll)  
HKCU_SearchScopes\{18291348-B055-400E-8BCD-3B927FA9ED87} - "?" (hxxp://81.29.214.174/Search.aspx?ct=it&key={searchTerms}&ref=PGTB&cg=1423716fc35...)  
HKCU_SearchScopes\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e} - "Search" (hxxp://www.bigseekpro.com/search/browser/accmeware/{B1E7719A-8BE9-4E63-82DA-9050...)  
HKCU_SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} - "SweetIM Search" (hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms})  
HKLM_SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} - "SweetIM Search" (hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms})  
HKCU_Toolbar\ShellBrowser|{C4069E3A-68F1-403E-B40E-20066696354B} (x)  
HKCU_Toolbar\WebBrowser|{A057A204-BACC-4D26-9990-79A187E2698E} (x)  
HKCU_Toolbar\WebBrowser|{266FCDCA-7BB3-4DA7-B3BF-F845DEA2EBD6} (C:\Program Files\IsoBuster	bIso0.dll) (x)  
HKCU_Toolbar\WebBrowser|{EEE6C35B-6118-11DC-9C72-001320C79847} (x)  
HKCU_Toolbar\WebBrowser|{CCC7A320-B3CA-4199-B1A6-9F516DD69829} (x)  
HKLM_Toolbar|{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} (C:\Program Files\IsoBuster	bIso0.dll) (x)  
HKLM_Toolbar|{CCC7A320-B3CA-4199-B1A6-9F516DD69829} (x)  
HKLM_Toolbar|{c9a6357b-25cc-4bcf-96c1-78736985d412} (mscoree.dll) (x)  
HKLM_ElevationPolicy\5eb3ef40-307d-42f9-96cf-1dc460d4bbf4 - C:\Program Files\Vuze_Remote\Vuze_RemoteToolbarHelper.exe (x)  
HKLM_ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291} - C:\Program Files\AccmeWare DB Toolbar\TbHelper2.exe (x)  
HKLM_ElevationPolicy\{A6E2003F-95C5-4591-BA9A-0093080FDB5C} - C:\Program Files\Fichiers communs\Oberon Media\OberonBroker\1.0.0.63\OberonBroker.exe (?)  
HKLM_ElevationPolicy\{B2321D2F-1154-4d97-AD3E-2FE0BAE2897B} - C:\Program Files\SFR\Kit\9launch.exe (SFR)  
HKLM_Extensions\{d9288080-1baa-4bc4-9cf8-a92d743db949} - "Run IMVU" (C:\Documents and Settings\HP_Administrateur\Application Data\IMVUClient\imvu.ico)  
HKLM_Extensions\{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - "?" (?)  
HKLM_Extensions\{E2D4D26B-0180-43a4-B05F-462D6D54C789} - "Aide à la connexion" (C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\conn_support.ico)  
HKLM_Extensions\{e2e2dd38-d088-4134-82b7-f2ba38496583} - "?" (?)  
BHO\83CED28E-B96A-43FC-A276-2AD7A48EB6BE (?)  
BHO\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - "AcroIEHlprObj Class" (C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll)  
BHO\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8} - "Objet d'aide à la navigation SFR" (C:\Program Files\SFR\Kit\SFRNavErrorHelper.dll)  
BHO\{1d970ed5-3eda-438d-bffd-715931e2775b} - "SearchBar.InitToolbarBHO" (mscoree.dll) (x)  
BHO\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - "IsoBuster Toolbar" (C:\Program Files\IsoBuster	bIso0.dll) (x)  
BHO\{30F9B915-B755-4826-820B-08FBA6BD249D} (?)  
BHO\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} (?)  
BHO\{4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} (?)  
BHO\{5C255C8A-E604-49b4-9D64-90988571CECB} (?)  
BHO\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - "Search Helper" (C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll)  
BHO\{9030D464-4C02-4ABF-8ECC-5164760863C6} (?)  
BHO\{A057A204-BACC-4D26-9990-79A187E2698E} (?)  
BHO\{A3BC75A2-1F87-4686-AA43-5347D756017C} (?)  
BHO\{AA58ED58-01DD-4d91-8333-CF10577473F7} (?)  
BHO\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E} (?)  
BHO\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} (?)  
BHO\{EEE6C35C-6118-11DC-9C72-001320C79847} (?)  
BHO\{ef79f67a-6ad7-4715-a0f8-932fca442023} (?)  

========================================  

C:\Program Files\Ad-Remover\Quarantine: 6 Fichier(s)  
C:\Program Files\Ad-Remover\Backup: 15 Fichier(s)  

C:\Ad-Report-CLEAN[1].txt - 07/09/2011 20:15:43 (1935 Octet(s))   
C:\Ad-Report-SCAN[1].txt - 07/09/2011 18:13:20 (11468 Octet(s))   
C:\Ad-Report-SCAN[2].txt - 07/09/2011 20:14:43 (7880 Octet(s))   

Fin à: 20:16:33, 07/09/2011   
   
============== E.O.F ==============

Le ZHPdiag arrive dans 5 minutes. En tout cas Rlvknlg a disparu de mon gestionnaire de taches. =)

Pin-pin · Answer

Voila le ZHPdiag :

 https://pjjoint.malekal.com/files.php?id=ZHPDiag_c10h10h12f10l10c15o11n15t7r12k12l12v12o7i11s15y15e10t66

En tout cas merci bien pour ton aide ;)

Valuu · Answer

Yop c'est pas fini :) -------------------------------------------------------------------------------------- * Télécharge UsbFix (créé par El Desaparecido & C_XX) sur ton Bureau. Si ton antivirus affiche une alerte, ignore le et désactive le temporairement. * Branche tes sources de données externes à ton PC (clé USB, disque dur externe, etc...) sans les ouvrir * Double clique sur le raccourci UsbFix sur ton Bureau, l'installation se fera automatiquement * Clique sur "Recherche" * Laisse travailler l'outil * A la fin, le rapport va s'afficher : poste le dans ta prochaine réponse (il est aussi sauvegardé a la racine du disque dur) Aide en images : Tutoriel "Recherche" -------------------------------------------------------------------------------------- * Lance ZHPFix (si tu es sous Windows Vista ou Windows 7, lance le par un clic-droit dessus --> exécuter en temps qu'administrateur). * Copie les lignes suivantes : --------------------------------------------------- M2 - MFEP: prefs.js [HP_Administrateur - vo8jbp6v.default\cacaoweb@cacaoweb.org] [] cacaoweb v1.0.17 (.http://www.cacaoweb.org/ M2 - MFEP: prefs.js [HP_Administrateur - vo8jbp6v.default\{ef79f67a-6ad7-4715-a0f8-932fca442023}] [] BittorrentBar_FR Community Toolbar v3.2.5.2 (.Conduit Ltd..) R3 - URLSearchHook: (no name) - {ba14329e-9550-4989-b3f2-9732e92d17cc} . (...) (No version) -- (.not file.) O2 - BHO: (no name) - 83CED28E-B96A-43FC-A276-2AD7A48EB6BE Clé orpheline O2 - BHO: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} Clé orpheline O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} Clé orpheline O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} Clé orpheline O2 - BHO: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} Clé orpheline O2 - BHO: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} Clé orpheline O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} Clé orpheline O2 - BHO: (no name) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} Clé orpheline O2 - BHO: (no name) - {EEE6C35C-6118-11DC-9C72-001320C79847} Clé orpheline O2 - BHO: (no name) - {ef79f67a-6ad7-4715-a0f8-932fca442023} Clé orpheline O3 - Toolbar: IsoBuster Toolbar - {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} . (...) -- C:\Program Files\IsoBuster bIso0.dll O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} . (...) -- (.not file.) O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} . (...) -- (.not file.) O4 - HKLM\..\Run: [PCDrProfiler] Clé orpheline O4 - HKLM\..\Run: [NPSStartup] Clé orpheline O4 - HKLM\..\Run: [DriverCD] E:\Run.exe (.not file.) O4 - HKLM\..\Run: [KernelFaultCheck] Clé orpheline O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} -- C:\Documents and Settings\HP_Administrateur\Application Data\IMVUClient\imvu.ico (.not file.) O15 - Trusted Zone: [HKLM\...\Domains] *.antimalwareguard.com O23 - Service: (BITS) - Clé orpheline O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At1.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At10.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At11.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At12.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At13.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At14.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At15.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At16.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At17.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At18.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At19.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At2.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At20.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At21.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At22.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At23.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At24.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At25.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At26.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At27.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At28.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At29.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At3.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At30.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At31.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At32.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At33.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At34.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At35.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At36.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At37.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At38.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At39.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At4.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At40.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At41.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At42.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At43.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At44.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At45.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At46.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At47.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At48.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At5.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At6.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At7.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At8.job O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At9.job [MD5.00000000000000000000000000000000] [APT] [At1] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At10] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At11] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At12] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At13] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At14] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At15] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At16] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At17] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At18] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At19] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At2] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At20] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At21] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At22] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At23] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At24] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At25] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At26] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At27] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At28] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At29] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At3] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At30] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At31] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At32] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At33] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At34] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At35] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At36] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At37] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At38] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At39] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At4] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At40] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At41] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At42] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At43] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At44] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At45] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At46] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At47] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At48] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At5] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At6] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At7] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At8] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [At9] (...) -- C:\WINDOWS\system32\I85o3WRf.exe (.not file.) O41 - Driver: (aswSnx) . (. - .) - aswSnx.sys (.not file.) O42 - Logiciel: SearchToolbar - (.Pas de propriétaire.) [HKLM] -- SearchToolbar [HKCU\Software\BittorrentBar_FR] [HKCU\Software\SweetIM] [HKCU\Software\cacaoweb] [HKLM\Software\supersexplayer] O43 - CFD: 24/12/2009 - 14:11:24 - [400624] ----D- C:\Program Files\cacaoweb O43 - CFD: 04/01/2009 - 17:35:30 - [3639313] ----D- C:\Program Files\SweetIM O43 - CFD: 07/09/2011 - 13:06:24 - [331373255] ----D- C:\Documents and Settings\HP_Administrateur\Application Data\cacaoweb O67 - Shell Spawning: <.html> [HKCU\..\open\Command] (.Not Key.) O67 - Shell Spawning: <.com> <>[HKU\..\open\Command] (.Not Key.) O67 - Shell Spawning: <.exe> <>[HKU\..\open\Command] (.Not Key.) --------------------------------------------------- * Clique sur l'icône représentant la lettre H (« coller les lignes Helper ») * Les lignes se collent automatiquement dans ZHPFix. * Clique sur le bouton « GO » pour lancer le nettoyage, * Colle le contenu du rapport dans ta prochaine réponse.

Rlvknlg.exe Comment le supprimer?

15 réponses

Discussions similaires