Virus facebook, help please !

Bonsoir,

Télécharge OTL (de OldTimer) sur ton Bureau.
http://www.geekstogo.com/forum/files/file/398-otl-oldtimers-list-it/

Prends le soin de fermer toutes les autres fenêtres Windows afin de ne pas interrompre le scan.

* Double-clique sur OTL.exe pour le lancer.
Si Sous Vista/seven, , click droit sur sur le fichier et choisir Exécuter en tant qu'administrateur.
* Sélectionne l'option tous les utilisateurs.
* Dans la partie Personnalisation, copie/colle la liste suivante.

netsvcs 
Drivers32
msconfig  
 /md5start  
userinit.exe  
winlogon.exe 
explorer.exe
svchost.exe
wininit.exe
/md5stop
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.exe /s
%appdata%\*.exe /s
%APPDATA%\*. 
%systemroot%\*. /mp /s 
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job
hklm\software\clients\startmenuinternet|command /rs 
hklm\software\clients\startmenuinternet|command /64 /rs
hklm\System\CurrentControlSet\Control\SessionManager\SubSystems /s
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCerDlls /s
SAVEMBR:0
CREATERESTOREPOINT 

* Enfin, clique sur le bouton Analyse rapide.

* Une fois l'analyse terminée, deux fenêtres vont s'ouvrir dans le Bloc-notes : OTL.txt et Extras.txt. Ils se trouvent au même endroit que OTL (donc par défaut sur le Bureau)

Utilise un site comme https://www.cjoint.com/ pour les déposer.
indique ensuite les deux liens crées.

A+

voilà les deux liens:

http://cjoint.com/11dc/ALztTKa7nL7.htm

http://cjoint.com/11dc/ALztU2OqJYR.htm

Pateuf30,

Il y a une infection susceptible d'infecter les supports amovibles.

------------------------------------------------

Télécharge USBFix ( par El Desaparecido ) sur ton bureau.

* Double clique sur UsbFix.exe présent sur ton bureau .
* clique sur Suppression.
* Un message t'avertira de brancher les supports amovibles.
(!) Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptibles d'avoir été infectées sans les ouvrir
FAIS-LE.
* Laisse travailler l'outil.
* Ensuite poste le rapport UsbFix.txt qui apparaitra.

Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt )

-------------------------------------------------

A la fin du rapport USBFix, il est demandé de faire une remontée d'informations vers le concepteur de l'outil.
# va à l'adresse suivante : http://eldesaparecido.com/upload.html
# Clique sur parcourir et choisis le fichier UsbFix_Upload_Me_Nom de l'ordinateur.zip qui se trouve sur ton bureau.
# Puis clique sur envoyer le fichier.

A+
Allez jusqu'au bout de la procédure de désinfection.

Oui,

Poste le rapport UsbFix.txt.

A+

Voilà le rapport UsbFix.txt, et merci beaucoup de m'aider à résoudre ce problème :)

############################## | UsbFix V 7.076 | [Suppression]

Utilisateur: dominique (Administrateur) # PC-DE-DOMINIQUE
Mis à jour le 21/12/2011 par El Desaparecido
Lancé à 20:18:41 | 25/12/2011

Site Web: https://www.sosvirus.net/
Fichier suspect ? : http://eldesaparecido.com/upload.html
Contact: contact@eldesaparecido.com

PC: Acer (Aspire T180) (X86-based PC) # Desktop Computer
CPU: AMD Athlon(tm) 64 Processor 3800+ (2400)
RAM -> [ Total : 1791 | Free : 980 ]
BIOS: )Phoenix - Award WorkstationBIOS v6.00PG
BOOT: Normal boot

OS: Microsoft® Windows Vista(TM) Édition Familiale Basique (6.0.6001 32-Bit) # Service Pack 1
WB: Windows Internet Explorer 8.0.6001.19088

SC: Security Center Service [ (!) Disabled ]
WU: Windows Update Service [ Enabled ]
AV: AntiVir Desktop [ Enabled | Updated ]
FW: Windows FireWall Service [ (!) Disabled ]

C:\ (%systemdrive%) -> Disque fixe # 113 Go (20 Go libre(s) - 18%) [ACER] # NTFS
D:\ -> Disque fixe # 113 Go (16 Go libre(s) - 14%) [DATA] # NTFS
E:\ -> CD-ROM

################## | Processus Actif |

C:\Windows\system32\csrss.exe (508)
C:\Windows\system32\wininit.exe (556)
C:\Windows\system32\csrss.exe (564)
C:\Windows\system32\services.exe (604)
C:\Windows\system32\lsass.exe (620)
C:\Windows\system32\lsm.exe (628)
C:\Windows\system32\winlogon.exe (652)
C:\Windows\system32\svchost.exe (824)
C:\Windows\system32\nvvsvc.exe (880)
C:\Windows\system32\svchost.exe (904)
C:\Windows\System32\svchost.exe (936)
C:\Windows\System32\svchost.exe (1064)
C:\Windows\system32\svchost.exe (1084)
C:\Windows\system32\svchost.exe (1176)
C:\Windows\system32\SLsvc.exe (1196)
C:\Windows\system32\svchost.exe (1232)
C:\Windows\system32\svchost.exe (1348)
C:\Windows\system32\rundll32.exe (1392)
C:\Windows\System32\spoolsv.exe (1580)
C:\Program Files\Avira\AntiVir Desktop\sched.exe (1604)
C:\Windows\system32\taskeng.exe (2024)
C:\Windows\system32\Dwm.exe (268)
C:\Windows\system32\taskeng.exe (316)
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe (280)
C:\Windows\Explorer.EXE (452)
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe (464)
C:\Windows\System32\SysMonitor.exe (1148)
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe (1220)
C:\Acer\Empowering Technology\eMode\PCM\PCMService.exe (1316)
C:\Windows\System32\rundll32.exe (1372)
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (1364)
C:\Program Files\Winamp\winampa.exe (1496)
C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe (1548)
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (1692)
C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (1780)
C:\Program Files\Windows Sidebar\sidebar.exe (1800)
C:\Program Files\Windows Live\Messenger\msnmsgr.exe (1492)
C:\Program Files\Logitech\Vid HD\Vid.exe (1468)
C:\Program Files\Pando Networks\Media Booster\PMB.exe (1504)
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (1856)
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe (912)
C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe (1920)
C:\Program Files\Avira\AntiVir Desktop\avguard.exe (2092)
C:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLCapSvc.exe (2120)
C:\Windows\System32\svchost.exe (2156)
C:\Program Files\Common Files\LightScribe\LSSrvc.exe (2208)
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (2236)
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (2248)
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (2288)
C:\Windows\system32\IoctlSvc.exe (2312)
C:\Program Files\CyberLink\Shared Files\RichVideo.exe (2392)
C:\Windows\system32\svchost.exe (2484)
C:\Windows\System32\svchost.exe (2528)
C:\Windows\system32\SearchIndexer.exe (2592)
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe (2624)
C:\Windows\system32\taskeng.exe (2696)
C:\Windows\system32\WUDFHost.exe (2732)
C:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLSched.exe (2792)
C:\Program Files\OpenOffice.org 3\program\soffice.exe (3044)
C:\Program Files\OpenOffice.org 3\program\soffice.bin (3172)
C:\Windows\System32\mobsync.exe (3760)
C:\Program Files\Windows Media Player\wmpnscfg.exe (4076)
C:\Program Files\Windows Media Player\wmpnetwk.exe (2044)
C:\Users\dominique\M-1-25-5432-6437-5685\winmgr.exe (3868)
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE (3724)
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe (3352)
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe (4004)
C:\Windows\system32\wuauclt.exe (2180)
C:\Program Files\Windows Live\Contacts\wlcomm.exe (4800)
C:\Windows\System32\ping.exe (4128)
C:\Program Files\trend micro\HijackThis\HijackThis.exe (1280)
C:\Program Files\Mozilla Firefox\firefox.exe (5164)
C:\Program Files\Mozilla Firefox\plugin-container.exe (3564)
C:\UsbFix\Go.exe (5160)
C:\Windows\system32\wbem\wmiprvse.exe (3272)

################## | Processus Stoppés |

Stoppé! C:\Windows\system32\nvvsvc.exe (880)
Stoppé! C:\Windows\system32\SLsvc.exe (1196)
Stoppé! C:\Windows\system32\rundll32.exe (1392)
Stoppé! C:\Windows\System32\spoolsv.exe (1580)
Stoppé! C:\Program Files\Avira\AntiVir Desktop\sched.exe (1604)
Stoppé! C:\Windows\system32\taskeng.exe (2024)
Stoppé! C:\Windows\system32\taskeng.exe (316)
Stoppé! C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe (280)
Stoppé! C:\Windows\Explorer.EXE (452)
Stoppé! C:\Acer\Empowering Technology\ePerformance\MemCheck.exe (464)
Stoppé! C:\Windows\System32\SysMonitor.exe (1148)
Stoppé! C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe (1220)
Stoppé! C:\Acer\Empowering Technology\eMode\PCM\PCMService.exe (1316)
Stoppé! C:\Windows\System32\rundll32.exe (1372)
Stoppé! C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (1364)
Stoppé! C:\Program Files\Winamp\winampa.exe (1496)
Stoppé! C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe (1548)
Stoppé! C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (1692)
Stoppé! C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (1780)
Stoppé! C:\Program Files\Windows Sidebar\sidebar.exe (1800)
Stoppé! C:\Program Files\Windows Live\Messenger\msnmsgr.exe (1492)
Stoppé! C:\Program Files\Logitech\Vid HD\Vid.exe (1468)
Stoppé! C:\Program Files\Pando Networks\Media Booster\PMB.exe (1504)
Stoppé! C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (1856)
Stoppé! C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe (912)
Stoppé! C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe (1920)
Stoppé! C:\Program Files\Avira\AntiVir Desktop\avguard.exe (2092)
Stoppé! C:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLCapSvc.exe (2120)
Stoppé! C:\Program Files\Common Files\LightScribe\LSSrvc.exe (2208)
Stoppé! C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (2236)
Stoppé! C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (2248)
Stoppé! C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (2288)
Stoppé! C:\Windows\system32\IoctlSvc.exe (2312)
Stoppé! C:\Program Files\CyberLink\Shared Files\RichVideo.exe (2392)
Stoppé! C:\Windows\system32\SearchIndexer.exe (2592)
Stoppé! C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe (2624)
Stoppé! C:\Windows\system32\taskeng.exe (2696)
Stoppé! C:\Windows\system32\WUDFHost.exe (2732)
Stoppé! C:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLSched.exe (2792)
Stoppé! C:\Program Files\OpenOffice.org 3\program\soffice.exe (3044)
Stoppé! C:\Program Files\OpenOffice.org 3\program\soffice.bin (3172)
Stoppé! C:\Windows\System32\mobsync.exe (3760)
Stoppé! C:\Program Files\Windows Media Player\wmpnscfg.exe (4076)
Stoppé! C:\Program Files\Windows Media Player\wmpnetwk.exe (2044)
Stoppé! C:\Users\dominique\M-1-25-5432-6437-5685\winmgr.exe (3868)
Stoppé! C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE (3724)
Stoppé! C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe (3352)
Stoppé! C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe (4004)
Stoppé! C:\Windows\system32\wuauclt.exe (2180)
Stoppé! C:\Program Files\Windows Live\Contacts\wlcomm.exe (4800)
Stoppé! C:\Windows\System32\ping.exe (4128)
Stoppé! C:\Program Files\trend micro\HijackThis\HijackThis.exe (1280)
Stoppé! C:\Program Files\Mozilla Firefox\firefox.exe (5164)
Stoppé! C:\Program Files\Mozilla Firefox\plugin-container.exe (3564)

################## | Éléments infectieux |

Supprimé! C:\Users\DOMINI~1\AppData\Local\Temp\2491402.exe
Supprimé! C:\Users\DOMINI~1\AppData\Local\Temp\3756610.exe
Supprimé! C:\Users\DOMINI~1\AppData\Local\Temp\98928.exe
Supprimé! C:\Users\dominique\M-1-25-5432-6437-5685
Supprimé! C:\$RECYCLE.BIN\S-1-5-21-178061325-3444739432-590418636-1000
Supprimé! D:\$RECYCLE.BIN\S-1-5-21-178061325-3444739432-590418636-1000
Supprimé! D:\$RECYCLE.BIN\S-1-5-21-1877104568-4230358895-1159088474-1000
Supprimé! D:\$RECYCLE.BIN\S-1-5-21-1877104568-4230358895-1159088474-501
Supprimé! D:\$RECYCLE.BIN\S-1-5-21-2114330733-1512565593-1593329315-1000
Supprimé! D:\$RECYCLE.BIN\S-1-5-21-2144189109-3394072128-4216790726-1000
Supprimé! D:\$RECYCLE.BIN\S-1-5-21-2711142476-2373479530-4205305735-1000
Supprimé! D:\$RECYCLE.BIN\S-1-5-21-3182613468-2066600138-3208889591-1000
Supprimé! D:\$RECYCLE.BIN\S-1-5-21-671469396-2236953285-4044156725-1000
Supprimé! C:\cold

(!) Fichiers temporaires supprimés.

################## | Registre |

################## | Mountpoints2 |

################## | Listing |

[25/12/2011 - 20:20:58 | SHD ] C:\$RECYCLE.BIN
[13/10/2011 - 16:49:56 | D ] C:\100MSDCF
[30/05/2011 - 19:39:35 | D ] C:\Acer
[31/03/2011 - 21:53:45 | D ] C:\AcerSW
[21/06/2011 - 07:24:03 | D ] C:\articles deja mis sur mon new blog
[18/09/2006 - 22:43:36 | N | 24] C:\autoexec.bat
[26/12/2006 - 07:40:09 | D ] C:\Book
[04/04/2011 - 09:54:49 | D ] C:\Boot
[19/01/2008 - 08:45:45 | RASH | 333203] C:\bootmgr
[26/12/2006 - 07:40:59 | N | 8192] C:\BOOTSECT.BAK
[10/04/2011 - 07:04:55 | N | 89268] C:\chaque jour je pleure (2).gif
[10/04/2011 - 07:08:21 | N | 89268] C:\chaque jour je pleure-1.gif
[05/06/2007 - 18:53:00 | N | 34544] C:\chaque jour je pleure.gif
[18/09/2006 - 22:43:37 | N | 10] C:\config.sys
[24/04/2011 - 22:12:05 | D ] C:\CustomEmoticons
[29/04/2011 - 03:54:20 | D ] C:\DCIM
[07/08/2011 - 14:10:54 | D ] C:\de beaux MP et de belles pensees de moi
[02/08/2011 - 18:02:17 | D ] C:\diaporamas pour mpd
[18/06/2009 - 09:05:40 | N | 406] C:\diaporamas pour mpd - Raccourci.lnk
[03/11/2011 - 20:16:29 | D ] C:\divers humour
[02/11/2006 - 13:59:44 | SHD ] C:\Documents and Settings
[12/10/2011 - 19:29:21 | D ] C:\dominiquedu30@hotmail.fr
[26/12/2006 - 07:40:09 | D ] C:\DRV
[13/10/2011 - 14:55:56 | N | 159738] C:\DSC00341.JPG
[13/10/2011 - 14:57:40 | N | 55169] C:\DSC00342.JPG
[13/10/2011 - 15:00:26 | N | 55045] C:\DSC00343.JPG
[02/08/2011 - 19:30:25 | D ] C:\DVDVolume
[27/11/2011 - 18:06:43 | D ] C:\For my love
[26/11/2011 - 19:59:58 | D ] C:\For you BB
[25/12/2011 - 17:18:35 | ASH | 1878581248] C:\hiberfil.sys
[04/04/2004 - 14:53:16 | N | 1206784] C:\Humour sexi au lit.pps
[26/01/2008 - 11:19:55 | N | 64848] C:\kiss.gif.dt2
[13/10/2011 - 22:45:55 | D ] C:\Ma beauté
[29/08/2009 - 18:46:50 | N | 5288] C:\mes chansons en videos.txt
[17/12/2007 - 13:52:05 | N | 3714] C:\Mes citations messages de deconnexion.txt
[13/10/2011 - 22:35:48 | N | 387795] C:\mon tresor portrait.jpg
[29/04/2011 - 20:30:28 | D ] C:\MyAudio
[10/05/2011 - 10:52:27 | D ] C:\MyWorks
[26/06/2011 - 15:25:12 | D ] C:\NVIDIA
[12/04/2011 - 23:06:12 | D ] C:\ObjectStore
[25/12/2011 - 17:18:34 | ASH | 2192384000] C:\pagefile.sys
[04/04/2011 - 09:44:29 | D ] C:\PerfLogs
[01/04/2011 - 04:35:56 | D ] C:\Photo telephone
[09/11/2011 - 12:56:22 | D ] C:\photos diverses
[07/04/2011 - 08:57:06 | D ] C:\photos Ford
[04/05/2011 - 07:28:02 | D ] C:\photos inspiratrices
[07/04/2011 - 08:55:14 | D ] C:\photos Saab
[25/12/2011 - 19:11:51 | N | 512] C:\PhysicalMBR.bin
[29/04/2011 - 03:55:37 | D ] C:\Picture
[09/09/2011 - 12:25:47 | D ] C:\Pictures
[25/12/2011 - 18:11:53 | D ] C:\Program Files
[10/10/2011 - 00:40:48 | HD ] C:\ProgramData
[12/10/2011 - 19:25:46 | N | 1995] C:\proverbes(irc).txt
[26/12/2006 - 00:06:56 | N | 351] C:\RHDSetup.log
[18/11/2011 - 08:37:23 | D ] C:\Riot Games
[25/12/2011 - 18:12:32 | D ] C:\rsit
[26/12/2006 - 00:14:28 | N | 178] C:\setup.log
[01/04/2011 - 07:19:55 | D ] C:\Sony Ericsson PC Companion
[01/04/2011 - 07:23:04 | D ] C:\Sony Ericsson PC Suite
[25/12/2011 - 19:30:42 | SHD ] C:\System Volume Information
[24/10/2011 - 17:17:28 | D ] C:\toutes mes images
[17/07/2011 - 04:57:32 | D ] C:\trucs et astuces Dofus avatars
[01/04/2011 - 07:39:47 | D ] C:\Update Service
[25/12/2011 - 20:20:58 | D ] C:\UsbFix
[25/12/2011 - 20:19:07 | A | 12858] C:\UsbFix.txt
[31/03/2011 - 21:38:41 | D ] C:\Users
[11/10/2011 - 23:46:59 | D ] C:\Varietes françaises
[18/05/2011 - 18:54:02 | N | 15157] C:\verdict1eralbum21grammes avec les moyens du bord.jpg
[03/06/2008 - 12:04:53 | N | 2799] C:\veuxtumepouser.gif
[25/12/2011 - 17:02:59 | D ] C:\Windows
[08/04/2011 - 10:50:33 | D ] C:\WinRAR
[25/12/2011 - 20:20:58 | SHD ] D:\$RECYCLE.BIN
[15/08/2011 - 17:13:56 | D ] D:\1990 - L'Essentiel
[15/08/2011 - 16:40:21 | D ] D:\1992 - Anthologie 1971-1985
[28/03/2011 - 08:59:16 | N | 984819] D:\3jours et un papier pour dire aux flics en panne.JPG
[29/03/2011 - 10:27:32 | N | 744290] D:\ce midi a attendre le diagnostique de cette caisse pourrie.JPG
[29/03/2011 - 10:36:36 | N | 885361] D:\de derriere le pot...JPG
[18/06/2009 - 09:11:56 | D ] D:\diaporamas pour mpd
[29/03/2011 - 10:24:14 | N | 908524] D:\dommage elle a de la gueule cette caisse j' aime bien.JPG
[08/11/2011 - 21:39:28 | D ] D:\DVDVolume
[28/03/2011 - 08:04:04 | N | 808263] D:\en panne à Alès juste après avoir fait la carte grise.JPG
[04/05/2007 - 16:28:31 | D ] D:\erData
[08/11/2011 - 21:39:21 | N | 204] D:\Lecteur CD - Raccourci (2).lnk
[08/11/2011 - 21:39:12 | N | 204] D:\Lecteur CD - Raccourci.lnk
[22/10/2007 - 19:25:29 | N | 6198979] D:\les hommes qui passent nouvelle cuvee.wmv
[03/08/2007 - 14:15:52 | N | 7983219] D:\Les hommes qui passent.wmv
[29/03/2011 - 16:11:03 | D ] D:\music
[23/04/2011 - 13:22:27 | D ] D:\Musiques variees
[10/10/2011 - 03:13:36 | D ] D:\Rap
[27/11/2011 - 17:32:47 | D ] D:\Slows
[06/12/2011 - 20:50:23 | SHD ] D:\System Volume Information
[30/10/2011 - 21:03:39 | D ] D:\Tous les slows
[11/10/2011 - 23:41:33 | D ] D:\Varietes internationales
[29/03/2011 - 10:25:12 | N | 723901] D:\vue de face.JPG

################## | Vaccin |

C:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
D:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)

################## | Upload |

Veuillez envoyer le fichier: C:\UsbFix_Upload_Me_PC-DE-DOMINIQUE.zip
http://eldesaparecido.com/upload.html
Merci de votre contribution.

################## | E.O.F |

Re,

Il y a sans doute une infection plus sérieuse sur le PC.

------------------------------------------------

Tu vas commencer par faire du ménage sur le PC.
ce sont soit des logiciels inutiles comme les barres d'outils ou d'autres plus suspicieux.

désinstalle ce qui suit.
Tu passes par par le panneau de configuration --> programmes et fonctionnalités

# Asktoolbar
# Yahoo! Toolbar
# bittorent toolbar
# PriceGong 2.1.0
# Pando Media Booster

Si tu as des soucis pour désinstaller l'un ou l'autre de ces logiciels, signale-le moi.

------------------------------------------------

Puis, relance OTL et choisis Analyse.

poste le rapport obtenu.

A+

Je me demande comment t'arrive à savoir ce que j'dois faire uniquement enb lisant tout ce charabia :p respect, nouveau rapport:

OTL logfile created on: 25/12/2011 21:36:16 - Run 3
OTL by OldTimer - Version 3.2.31.0 Folder = c:\Users\dominique\Downloads
Windows Vista Home Basic Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19088)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy

1,75 Gb Total Physical Memory | 0,81 Gb Available Physical Memory | 46,34% Memory free
3,75 Gb Paging File | 1,91 Gb Available in Paging File | 51,02% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 113,20 Gb Total Space | 19,70 Gb Free Space | 17,40% Space Free | Partition Type: NTFS
Drive D: | 112,85 Gb Total Space | 16,17 Gb Free Space | 14,33% Space Free | Partition Type: NTFS

Computer Name: PC-DE-DOMINIQUE | User Name: dominique | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - [2011/12/25 19:07:46 | 000,584,192 | ---- | M] (OldTimer Tools) -- c:\Users\dominique\Downloads\OTL.exe
PRC - [2011/11/10 07:30:17 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011/08/30 17:41:32 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2011/04/28 12:45:24 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2011/04/24 12:20:48 | 000,066,864 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
PRC - [2011/03/31 23:51:01 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2011/03/22 19:37:06 | 000,074,752 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\Winamp\winampa.exe
PRC - [2011/03/22 12:53:56 | 002,403,024 | ---- | M] (IObit) -- C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
PRC - [2011/02/04 11:08:48 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011/01/17 18:09:00 | 011,322,880 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.exe
PRC - [2011/01/17 18:09:00 | 011,314,688 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.bin
PRC - [2011/01/13 03:01:28 | 006,129,496 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\Vid HD\Vid.exe
PRC - [2010/11/10 15:41:14 | 003,052,544 | ---- | M] () -- C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
PRC - [2010/01/14 20:11:14 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009/10/14 12:36:56 | 002,793,304 | ---- | M] () -- C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
PRC - [2009/10/14 12:34:18 | 000,560,472 | ---- | M] () -- C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe
PRC - [2009/10/07 00:47:34 | 000,154,136 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe
PRC - [2008/02/28 16:07:58 | 001,828,136 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
PRC - [2008/02/18 15:29:02 | 002,221,352 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
PRC - [2008/01/19 08:33:19 | 000,015,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\PING.EXE
PRC - [2006/12/08 14:45:32 | 000,045,056 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
PRC - [2006/11/25 00:58:28 | 000,118,870 | ---- | M] () -- C:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLSched.exe
PRC - [2006/11/25 00:58:26 | 000,274,520 | ---- | M] () -- C:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLCapSvc.exe
PRC - [2006/11/25 00:57:52 | 000,151,552 | ---- | M] (CyberLink Corp.) -- C:\Acer\Empowering Technology\eMode\PCM\PCMService.exe
PRC - [2006/11/23 15:24:54 | 000,319,488 | ---- | M] () -- C:\Windows\System32\SysMonitor.exe
PRC - [2006/11/17 07:26:58 | 000,453,120 | ---- | M] (HiTRUST) -- C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
PRC - [2006/11/12 20:35:08 | 000,024,576 | ---- | M] () -- C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
PRC - [2006/11/12 11:35:58 | 000,393,216 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eRecovery\eRAgent.exe

[color=#E56717]========== Modules (No Company Name) ==========[/color]

MOD - [2011/12/05 14:25:50 | 000,076,800 | ---- | M] () -- C:\Users\dominique\AppData\Roaming\Mozilla\Firefox\Profiles\rfgrqtbk.default\extensions\{ef79f67a-6ad7-4715-a0f8-932fca442023}\components\RadioWMPCoreGecko8.dll
MOD - [2011/11/10 07:30:16 | 001,989,592 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2011/06/16 02:37:11 | 012,430,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\381fb23cb39e1a61e13b8770eb9800ba\System.Windows.Forms.ni.dll
MOD - [2011/06/16 02:36:33 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\f1aa2385c0109f3059e0e6ba8b58ff68\System.Drawing.ni.dll
MOD - [2011/06/16 02:34:16 | 007,950,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9dff86a62a525ec8dc827fe9f50298b7\System.ni.dll
MOD - [2011/06/16 02:34:01 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\0309936a8e1672d39b9cf14463ce69f9\mscorlib.ni.dll
MOD - [2011/05/30 19:54:04 | 000,985,088 | ---- | M] () -- C:\Program Files\OpenOffice.org 3\program\libxml2.dll
MOD - [2011/04/24 12:20:47 | 000,061,496 | ---- | M] () -- C:\Program Files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\clntutil.dll
MOD - [2011/01/13 02:57:34 | 000,751,616 | ---- | M] () -- C:\Program Files\Logitech\Vid HD\vpxmd.dll
MOD - [2011/01/13 02:55:28 | 000,027,472 | ---- | M] () -- C:\Program Files\Logitech\Vid HD\SDL.dll
MOD - [2010/11/10 15:41:14 | 003,052,544 | ---- | M] () -- C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
MOD - [2010/03/15 10:28:22 | 000,141,824 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll
MOD - [2010/01/22 13:13:30 | 000,323,160 | ---- | M] () -- C:\Program Files\IObit\Advanced SystemCare 3\winSkinD7R.bpl
MOD - [2010/01/22 13:13:16 | 000,045,656 | ---- | M] () -- C:\Program Files\IObit\Advanced SystemCare 3\CoolTrayIcon_D6plus.bpl
MOD - [2010/01/22 13:11:36 | 000,150,616 | ---- | M] () -- C:\Program Files\IObit\Advanced SystemCare 3\STFix.dll
MOD - [2010/01/22 13:11:30 | 000,057,432 | ---- | M] () -- C:\Program Files\IObit\Advanced SystemCare 3\NtfsData.dll
MOD - [2009/10/14 12:36:56 | 002,793,304 | ---- | M] () -- C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
MOD - [2009/10/14 12:34:18 | 000,560,472 | ---- | M] () -- C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe
MOD - [2009/04/22 22:53:56 | 000,969,040 | ---- | M] () -- C:\Program Files\Logitech\Vid HD\QtNetwork4.dll
MOD - [2009/04/10 00:04:56 | 002,141,008 | ---- | M] () -- C:\Program Files\Logitech\Vid HD\QtCore4.dll
MOD - [2009/03/03 23:18:08 | 000,138,064 | ---- | M] () -- C:\Program Files\Logitech\Vid HD\plugins\imageformats\qjpeg4.dll
MOD - [2009/03/03 23:18:06 | 000,035,152 | ---- | M] () -- C:\Program Files\Logitech\Vid HD\plugins\imageformats\qico4.dll
MOD - [2009/03/03 23:18:06 | 000,029,008 | ---- | M] () -- C:\Program Files\Logitech\Vid HD\plugins\imageformats\qgif4.dll
MOD - [2009/03/03 23:17:46 | 011,311,952 | ---- | M] () -- C:\Program Files\Logitech\Vid HD\QtWebKit4.dll
MOD - [2009/03/03 23:17:46 | 000,363,856 | ---- | M] () -- C:\Program Files\Logitech\Vid HD\QtXml4.dll
MOD - [2009/03/03 23:17:44 | 000,200,016 | ---- | M] () -- C:\Program Files\Logitech\Vid HD\QtSql4.dll
MOD - [2009/03/03 23:17:40 | 000,475,472 | ---- | M] () -- C:\Program Files\Logitech\Vid HD\QtOpenGL4.dll
MOD - [2009/03/03 23:17:38 | 007,704,400 | ---- | M] () -- C:\Program Files\Logitech\Vid HD\QtGui4.dll
MOD - [2009/03/03 23:17:32 | 000,291,664 | ---- | M] () -- C:\Program Files\Logitech\Vid HD\phonon4.dll
MOD - [2008/01/19 08:35:15 | 000,223,232 | ---- | M] () -- \\?\globalroot\systemroot\system32\mswsock.dll
MOD - [2008/01/19 08:35:15 | 000,223,232 | ---- | M] () -- \\.\globalroot\systemroot\system32\mswsock.dll
MOD - [2006/11/25 00:58:30 | 000,339,968 | ---- | M] () -- C:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLTinyDB.dll
MOD - [2006/11/25 00:58:12 | 000,237,662 | ---- | M] () -- C:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLCapEngine.dll
MOD - [2006/11/25 00:58:12 | 000,114,776 | ---- | M] () -- C:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLSchMgr.dll
MOD - [2006/11/25 00:58:12 | 000,032,768 | ---- | M] () -- C:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLCapSvcps.dll
MOD - [2006/11/23 15:24:54 | 000,319,488 | ---- | M] () -- C:\Windows\System32\SysMonitor.exe
MOD - [2006/11/16 12:20:10 | 000,086,016 | ---- | M] () -- C:\Windows\System32\MSNSpook.dll
MOD - [2006/11/16 12:19:10 | 000,037,376 | ---- | M] () -- C:\Windows\System32\MSNChatHook.dll
MOD - [2006/11/16 12:19:04 | 000,123,904 | ---- | M] () -- C:\Windows\System32\BatchCrypto.dll
MOD - [2006/11/16 12:18:58 | 000,073,728 | ---- | M] () -- C:\Windows\System32\APISlice.dll
MOD - [2006/11/16 12:18:50 | 000,063,488 | ---- | M] () -- C:\Windows\System32\ShowErrMsg.dll
MOD - [2006/08/24 12:17:52 | 000,004,096 | ---- | M] () -- C:\Program Files\Messenger Plus! Live\Detoured.dll

[color=#E56717]========== Win32 Services (SafeList) ==========[/color]

SRV - File not found [Auto | Stopped] -- -- (Planificateur LiveUpdate automatique)
SRV - File not found [Auto | Stopped] -- -- (CLTNetCnService)
SRV - [2011/08/30 17:41:32 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/04/28 12:45:24 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011/04/12 09:11:26 | 000,311,744 | ---- | M] (CybelSoft) [On_Demand | Stopped] -- C:\Program Files\ma-config.com\maconfservice.exe -- (maconfservice)
SRV - [2011/04/02 02:04:26 | 000,378,368 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- winhttp.dll -- (WinHttpAutoProxySvc)
SRV - [2009/10/07 00:47:34 | 000,154,136 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2006/12/08 14:45:32 | 000,045,056 | ---- | M] (Acer Inc.) [Auto | Running] -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe -- (eRecoveryService)
SRV - [2006/11/25 00:58:28 | 000,118,870 | ---- | M] () [Auto | Running] -- C:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLSched.exe -- (CLSched) CyberLink Task Scheduler (CTS)
SRV - [2006/11/25 00:58:26 | 000,274,520 | ---- | M] () [Auto | Running] -- C:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLCapSvc.exe -- (CLCapSvc) CyberLink Background Capture Service (CBCS)
SRV - [2006/11/12 20:35:08 | 000,024,576 | ---- | M] () [Auto | Running] -- C:\Acer\Empowering Technology\ePerformance\MemCheck.exe -- (AcerMemUsageCheckService)

[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV - [2011/08/30 17:41:36 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/08/30 17:41:36 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011/04/21 14:16:42 | 000,273,408 | ---- | M] () [Kernel | System | Running] -- C:\Windows\system32\drivers\afd.sys -- (AFD)
DRV - [2010/08/30 11:19:54 | 000,014,336 | ---- | M] (CybelSoft) [Kernel | On_Demand | Stopped] -- C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys -- (driverhardwarev2)
DRV - [2010/06/17 13:28:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/10/07 00:46:36 | 000,025,752 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2009/05/01 00:01:34 | 000,265,496 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)
DRV - [2009/04/30 23:55:32 | 000,013,976 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lv302af.sys -- (pepifilter)
DRV - [2009/04/30 21:55:58 | 002,687,512 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LV302V32.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV - [2008/06/19 23:04:00 | 007,468,128 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2007/10/12 03:00:43 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2006/12/11 18:34:22 | 000,097,576 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2006/12/07 17:12:02 | 000,076,584 | ---- | M] () [Kernel | Auto | Running] -- C:\Acer\Empowering Technology\eRecovery\int15.sys -- (int15)

[color=#E56717]========== Standard Registry (SafeList) ==========[/color]

[color=#E56717]========== Internet Explorer ==========[/color]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search bar = http://www.bing.com/spresults.aspx
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-178061325-3444739432-590418636-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKU\S-1-5-21-178061325-3444739432-590418636-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = https://search.yahoo.com/web{searchTerms}&ei=utf-8&fr=b1ie7
IE - HKU\S-1-5-21-178061325-3444739432-590418636-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = https://www.acer.com/worldwide/selection.html [binary data]
IE - HKU\S-1-5-21-178061325-3444739432-590418636-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
IE - HKU\S-1-5-21-178061325-3444739432-590418636-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-178061325-3444739432-590418636-1000\..\URLSearchHook: {ef79f67a-6ad7-4715-a0f8-932fca442023} - No CLSID value found
IE - HKU\S-1-5-21-178061325-3444739432-590418636-1000\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found
IE - HKU\S-1-5-21-178061325-3444739432-590418636-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[color=#E56717]========== FireFox ==========[/color]

FF - prefs.js..browser.search.defaultthis.engineName: "Dofus Barre Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2190311&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "Recherche de vidéos YouTube"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {0497D7FA-B45F-11DB-9DCC-3D3756D89593}:1.0.0
FF - prefs.js..extensions.enabledItems: {8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}:2.1.0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@ma-config.com/HardwareDetection: C:\Program Files\ma-config.com\nphardwaredetection.dll (Cybelsoft)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.11: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/11/10 07:30:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/09/03 19:01:59 | 000,000,000 | ---D | M]

[2011/06/06 12:46:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\dominique\AppData\Roaming\Mozilla\Extensions
[2011/12/24 14:08:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\dominique\AppData\Roaming\Mozilla\Firefox\Profiles\rfgrqtbk.default\extensions
[2011/06/06 12:47:21 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\dominique\AppData\Roaming\Mozilla\Firefox\Profiles\rfgrqtbk.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/12/24 14:08:09 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\dominique\AppData\Roaming\Mozilla\Firefox\Profiles\rfgrqtbk.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011/12/05 17:35:12 | 000,000,000 | ---D | M] (BittorrentBar_FR Community Toolbar) -- C:\Users\dominique\AppData\Roaming\Mozilla\Firefox\Profiles\rfgrqtbk.default\extensions\{ef79f67a-6ad7-4715-a0f8-932fca442023}
[2011/05/29 17:39:40 | 000,000,925 | ---- | M] () -- C:\Users\dominique\AppData\Roaming\Mozilla\Firefox\Profiles\rfgrqtbk.default\searchplugins\conduit.xml
[2011/06/23 11:38:07 | 000,002,076 | ---- | M] () -- C:\Users\dominique\AppData\Roaming\Mozilla\Firefox\Profiles\rfgrqtbk.default\searchplugins\recherche-de-vidos-youtube.xml
[2011/11/27 07:31:37 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/04/01 21:45:43 | 000,000,000 | ---D | M] (MSN Pictures Displayer) -- C:\Program Files\Mozilla Firefox\extensions\{0497D7FA-B45F-11DB-9DCC-3D3756D89593}
[2011/11/10 07:30:17 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/05/04 03:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011/03/22 19:38:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll
[2010/01/01 09:00:00 | 000,001,516 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazon-france.xml
[2010/01/01 09:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2010/01/01 09:00:00 | 000,001,822 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\cnrtl-tlfi-fr.xml
[2010/01/01 09:00:00 | 000,001,154 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-france.xml
[2010/01/01 09:00:00 | 000,001,426 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-fr.xml
[2010/01/01 09:00:00 | 000,000,956 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-france.xml

[color=#E56717]========== Chrome ==========[/color]

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\dominique\AppData\Local\Google\Chrome\Application\12.0.742.112\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Java Deployment Toolkit 6.0.220.4 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U22 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Acrobat 7.0\Reader\Browser\nppdf32.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\dominique\AppData\Local\Google\Chrome\Application\12.0.742.112\pdf.dll
CHR - plugin: Chrome NaCl (Disabled) = C:\Users\dominique\AppData\Local\Google\Chrome\Application\12.0.742.112\ppGoogleNaClPluginChrome.dll
CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Users\dominique\AppData\Local\Google\Chrome\Application\12.0.742.112\gears.dll
CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npwachk.dll
CHR - plugin: Ma-Config.com plugin (Enabled) = C:\Program Files\ma-config.com\nphardwaredetection.dll
CHR - plugin: Google Update (Enabled) = C:\Users\dominique\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin

Hosts file not found
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Objet d'aide à la navigation SFR) - {0F6E720A-1A6B-40E1-A294-1D4D19F156C8} - C:\Program Files\SFR\Kit\SFRNavErrorHelper.dll (SFR)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\System32\ActiveToolBand.dll (HiTRUST)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - Reg Error: Value error. File not found
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKU\S-1-5-21-178061325-3444739432-590418636-1000\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O4 - HKLM..\Run: [Acer Empowering Technology Monitor] C:\Windows\System32\SysMonitor.exe ()
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe (HiTRUST)
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PCMService] C:\Acer\Empowering Technology\eMode\PCM\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe (Acer Inc.)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-178061325-3444739432-590418636-1000..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)
O4 - HKU\S-1-5-21-178061325-3444739432-590418636-1000..\Run: [Logitech Vid] C:\Program Files\Logitech\Vid HD\Vid.exe (Logitech Inc.)
O4 - HKU\S-1-5-21-178061325-3444739432-590418636-1000..\Run: [Microsoft® Windows Manager] C:\Users\dominique\M-1-25-5432-6437-5685\winmgr.exe File not found
O4 - HKU\S-1-5-21-178061325-3444739432-590418636-1000..\Run: [?????????] ??????????????e File not found
O4 - Startup: C:\Users\dominique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSN Pictures Displayer.lnk = C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe ()
O4 - Startup: C:\Users\dominique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O7 - HKU\S-1-5-21-178061325-3444739432-590418636-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 3
O7 - HKU\S-1-5-21-178061325-3444739432-590418636-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - %SystemRoot%\System32\winrnr.dll File not found
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4D2F1578-8B02-43B4-B591-559CD6616BC6}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\Userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Ma beauté\sofiane-01.jpg
O24 - Desktop BackupWallPaper: C:\Ma beauté\sofiane-01.jpg
O29 - HKLM SecurityProviders - (credssp.dll) -credssp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2011/12/25 20:22:00 | 000,000,000 | RHSD | M] - C:\Autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2011/12/25 20:22:00 | 000,000,000 | RHSD | M] - D:\Autorun.inf -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: aux - wdmaud.drv (Microsoft Corporation)
Drivers32: aux1 - wdmaud.drv (Microsoft Corporation)
Drivers32: aux2 - wdmaud.drv (Microsoft Corporation)
Drivers32: aux3 - wdmaud.drv (Microsoft Corporation)
Drivers32: midi - wdmaud.drv (Microsoft Corporation)
Drivers32: midi1 - wdmaud.drv (Microsoft Corporation)
Drivers32: midi2 - wdmaud.drv (Microsoft Corporation)
Drivers32: midi3 - wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - midimap.dll (Microsoft Corporation)
Drivers32: mixer - wdmaud.drv (Microsoft Corporation)
Drivers32: mixer1 - wdmaud.drv (Microsoft Corporation)
Drivers32: mixer2 - wdmaud.drv (Microsoft Corporation)
Drivers32: mixer3 - wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.imaadpcm - imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - File not found
Drivers32: msacm.mkdmp3enc - C:\Acer\EMPOWE~1\eMode\PCM\Kernel\Burner\MKDMP3Enc.ACM File not found
Drivers32: msacm.msadpcm - msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - msg711.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.siren - sirenacm.dll (Microsoft Corporation)
Drivers32: MSVideo - vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - VfWWDM32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - iccvid.dll (Radius Inc.)
Drivers32: VIDC.HFYU - huffyuv.dll File not found
Drivers32: VIDC.I420 - lvcodec2.dll (Logitech Inc.)
Drivers32: VIDC.IYUV - iyuv_32.dll (Microsoft Corporation)
Drivers32: VIDC.LAGS - lagarith.dll File not found
Drivers32: vidc.mrle - msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - msvidc32.dll (Microsoft Corporation)
Drivers32: VIDC.UYVY - msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YUY2 - msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVU9 - tsbyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVYU - msyuv.dll (Microsoft Corporation)
Drivers32: wave - wdmaud.drv (Microsoft Corporation)
Drivers32: wave1 - wdmaud.drv (Microsoft Corporation)
Drivers32: wave2 - wdmaud.drv (Microsoft Corporation)
Drivers32: wave3 - wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - msacm32.drv (Microsoft Corporation)

PhysicalDisk0 MBR saved to C:\PhysicalMBR.bin

[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

[2011/12/25 21:23:19 | 000,245,760 | ---- | C] (Ask.com) -- C:\Program Files\Uninstall Ask Toolbar.dll
[2011/12/25 20:22:00 | 000,000,000 | RHSD | C] -- C:\Autorun.inf
[2011/12/25 20:17:05 | 000,000,000 | ---D | C] -- C:\UsbFix
[2011/12/25 18:28:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis
[2011/12/25 18:11:53 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro
[2011/12/25 18:11:50 | 000,000,000 | ---D | C] -- C:\rsit
[2011/03/31 21:43:17 | 000,016,384 | ---- | C] ( ) -- C:\Windows\System32\ClearEvent.exe
[2006/12/26 00:18:13 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\Interop.Shell32.dll
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

[2011/12/25 21:38:37 | 000,000,512 | ---- | M] () -- C:\PhysicalMBR.bin
[2011/12/25 21:26:40 | 000,000,378 | ---- | M] () -- C:\Windows\tasks\AWC Startup.job
[2011/12/25 21:26:19 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/12/25 21:26:19 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/12/25 21:26:11 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/12/25 21:26:05 | 1878,581,248 | -HS- | M] () -- C:\hiberfil.sys
[2011/12/25 20:23:51 | 500,216,203 | ---- | M] () -- C:\UsbFix_Upload_Me_PC-DE-DOMINIQUE.zip
[2011/12/25 19:55:03 | 000,084,480 | ---- | M] () -- C:\Users\dominique\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/12/25 18:28:20 | 000,001,878 | ---- | M] () -- C:\Users\dominique\Desktop\HijackThis.lnk
[2011/12/25 17:48:06 | 000,000,008 | ---- | M] () -- C:\Users\dominique\AppData\Roaming\DofusAppId0_5
[2011/12/25 17:47:59 | 000,000,008 | ---- | M] () -- C:\Users\dominique\AppData\Roaming\DofusAppId0_1
[2011/12/25 17:47:54 | 000,000,008 | ---- | M] () -- C:\Users\dominique\AppData\Roaming\DofusAppId0_2
[2011/12/25 17:46:52 | 000,000,177 | ---- | M] () -- C:\Users\dominique\AppData\Roaming\D2Info0
[2011/12/25 17:16:08 | 000,000,008 | ---- | M] () -- C:\Users\dominique\AppData\Roaming\DofusAppId0_4
[2011/12/25 17:16:03 | 000,000,008 | ---- | M] () -- C:\Users\dominique\AppData\Roaming\DofusAppId0_3
[2011/12/24 17:23:04 | 000,000,008 | ---- | M] () -- C:\Users\dominique\AppData\Roaming\DofusAppId0_6
[2011/12/14 14:47:19 | 000,678,804 | ---- | M] () -- C:\Windows\System32\perfh00C.dat
[2011/12/14 14:47:19 | 000,595,798 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/12/14 14:47:19 | 000,126,420 | ---- | M] () -- C:\Windows\System32\perfc00C.dat
[2011/12/14 14:47:19 | 000,103,872 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/12/07 15:27:55 | 000,099,978 | ---- | M] () -- C:\Users\dominique\Documents\AVI PARIS.pdf
[2011/11/30 14:55:19 | 000,002,497 | ---- | M] () -- C:\Users\dominique\Desktop\Visionneuse Microsoft PowerPoint .lnk
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

[color=#E56717]========== Files Created - No Company Name ==========[/color]

[2011/12/25 20:22:28 | 500,216,203 | ---- | C] () -- C:\UsbFix_Upload_Me_PC-DE-DOMINIQUE.zip
[2011/12/25 19:11:51 | 000,000,512 | ---- | C] () -- C:\PhysicalMBR.bin
[2011/12/25 18:28:20 | 000,001,878 | ---- | C] () -- C:\Users\dominique\Desktop\HijackThis.lnk
[2011/12/07 15:27:55 | 000,099,978 | ---- | C] () -- C:\Users\dominique\Documents\AVI PARIS.pdf
[2011/07/01 06:12:31 | 000,007,052 | ---- | C] () -- C:\Users\dominique\AppData\Local\d3d9caps.dat
[2011/06/16 01:10:41 | 000,273,408 | ---- | C] () -- C:\Windows\System32\drivers\afd.sys
[2011/05/18 16:14:11 | 000,084,480 | ---- | C] () -- C:\Users\dominique\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/05/06 20:17:04 | 000,000,008 | ---- | C] () -- C:\Users\dominique\AppData\Roaming\DofusAppId0_7
[2011/04/24 12:32:05 | 000,082,289 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2011/04/09 05:41:06 | 000,000,008 | ---- | C] () -- C:\Users\dominique\AppData\Roaming\DofusAppId0_6
[2011/04/04 17:35:11 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2011/04/04 17:35:11 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2011/04/01 21:45:42 | 000,194,560 | ---- | C] () -- C:\Windows\System32\ShellMPD.dll
[2011/04/01 07:38:49 | 000,000,008 | ---- | C] () -- C:\Users\dominique\AppData\Roaming\DofusAppId0_5
[2011/04/01 04:09:04 | 000,000,008 | ---- | C] () -- C:\Users\dominique\AppData\Roaming\DofusAppId0_4
[2011/04/01 04:03:19 | 000,000,008 | ---- | C] () -- C:\Users\dominique\AppData\Roaming\DofusAppId0_3
[2011/04/01 03:58:10 | 000,000,008 | ---- | C] () -- C:\Users\dominique\AppData\Roaming\DofusAppId0_1
[2011/04/01 03:56:47 | 000,000,177 | ---- | C] () -- C:\Users\dominique\AppData\Roaming\D2Info0
[2011/04/01 03:56:47 | 000,000,008 | ---- | C] () -- C:\Users\dominique\AppData\Roaming\DofusAppId0_2
[2011/03/31 21:48:00 | 000,000,042 | ---- | C] () -- C:\Windows\Acer(Wide).ini
[2011/03/31 21:47:57 | 000,000,044 | ---- | C] () -- C:\Windows\Acer(Normal).ini
[2011/03/31 21:43:17 | 000,016,384 | ---- | C] () -- C:\Windows\System32\LauncheRyAgentUser.exe
[2009/10/07 00:46:36 | 000,025,752 | ---- | C] () -- C:\Windows\System32\drivers\LVPr2Mon.sys
[2009/10/07 00:23:08 | 000,013,584 | ---- | C] () -- C:\Windows\System32\drivers\iKeyLFT2.dll
[2006/12/26 08:38:10 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIBUN4.dll
[2006/12/26 07:40:11 | 000,000,700 | ---- | C] () -- C:\Windows\generic.ini
[2006/12/26 07:40:11 | 000,000,095 | ---- | C] () -- C:\Windows\Alaunch.ini
[2006/12/26 00:18:17 | 000,319,488 | ---- | C] () -- C:\Windows\System32\SysMonitor.exe
[2006/12/26 00:18:16 | 000,331,776 | ---- | C] () -- C:\Windows\System32\ScrollBarLib.dll
[2006/12/26 00:13:54 | 000,013,952 | ---- | C] () -- C:\Windows\System32\drivers\UBHelper.sys
[2006/11/16 12:20:38 | 000,266,240 | ---- | C] () -- C:\Windows\System32\NotesExtmngr.dll
[2006/11/16 12:20:20 | 000,200,704 | ---- | C] () -- C:\Windows\System32\NotesActnMenu.dll
[2006/11/16 12:20:10 | 000,086,016 | ---- | C] () -- C:\Windows\System32\MSNSpook.dll
[2006/11/16 12:19:10 | 000,037,376 | ---- | C] () -- C:\Windows\System32\MSNChatHook.dll
[2006/11/16 12:19:04 | 000,123,904 | ---- | C] () -- C:\Windows\System32\BatchCrypto.dll
[2006/11/16 12:18:58 | 000,073,728 | ---- | C] () -- C:\Windows\System32\APISlice.dll
[2006/11/16 12:18:50 | 000,063,488 | ---- | C] () -- C:\Windows\System32\ShowErrMsg.dll
[2006/11/16 12:18:06 | 000,022,016 | ---- | C] () -- C:\Windows\System32\MailFormat_U.dll
[2006/11/13 04:50:06 | 000,071,680 | ---- | C] () -- C:\Windows\System32\HTCA_SelfExtract.bin
[2006/11/02 16:45:36 | 000,678,804 | ---- | C] () -- C:\Windows\System32\perfh00C.dat
[2006/11/02 16:45:36 | 000,340,236 | ---- | C] () -- C:\Windows\System32\perfi00C.dat
[2006/11/02 16:45:36 | 000,126,420 | ---- | C] () -- C:\Windows\System32\perfc00C.dat
[2006/11/02 16:45:36 | 000,037,390 | ---- | C] () -- C:\Windows\System32\perfd00C.dat
[2006/11/02 13:53:49 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 13:44:53 | 000,258,648 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 11:33:01 | 000,595,798 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 11:33:01 | 000,103,872 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2001/12/26 15:12:30 | 000,065,536 | ---- | C] () -- C:\Windows\System32\multiplex_vcd.dll
[2001/09/03 22:46:38 | 000,110,592 | ---- | C] () -- C:\Windows\System32\Hmpg12.dll
[2001/07/30 15:33:56 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC.dll
[2001/07/23 21:04:36 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC_MMX.dll

[color=#E56717]========== Custom Scans ==========[/color]

[color=#A23BEC]< MD5 for: EXPLORER.EXE >[/color]
[2011/03/31 23:51:01 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2011/03/31 23:51:01 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\explorer.exe
[2011/03/31 23:51:01 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2011/03/31 23:51:00 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2011/04/01 00:10:43 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
[2011/04/01 00:10:43 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
[2009/04/11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\SoftwareDistribution\Download\bcfed137e95e2bc1b83ef80262a82b16\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2011/03/31 23:51:01 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2006/11/02 10:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
[2008/01/19 08:33:10 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

[color=#A23BEC]< MD5 for: SVCHOST.EXE >[/color]
[2006/11/02 10:45:47 | 000,022,016 | ---- | M] (Microsoft Corporation) MD5=10DA15933D582D2FEDCF705EFE394B09 -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6000.16386_none_b38497a50862ad11\svchost.exe
[2008/01/19 08:33:32 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\System32\svchost.exe
[2008/01/19 08:33:32 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6001.18000_none_b5bb59a1054dbde5\svchost.exe

[color=#A23BEC]< MD5 for: USERINIT.EXE >[/color]
[2008/01/19 08:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008/01/19 08:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006/11/02 10:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe

[color=#A23BEC]< MD5 for: WININIT.EXE >[/color]
[2008/01/19 08:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008/01/19 08:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
[2006/11/02 10:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe

[color=#A23BEC]< MD5 for: WINLOGON.EXE >[/color]
[2009/04/11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\SoftwareDistribution\Download\bcfed137e95e2bc1b83ef80262a82b16\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006/11/02 10:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008/01/19 08:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\System32\winlogon.exe
[2008/01/19 08:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

[color=#A23BEC]< %SYSTEMDRIVE%\*.exe >[/color]

[color=#A23BEC]< %ALLUSERSPROFILE%\Application Data\*.exe /s >[/color]

[color=#A23BEC]< %appdata%\*.exe /s >[/color]

[color=#A23BEC]< %APPDATA%\*. >[/color]
[2011/04/01 20:17:07 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\Adobe
[2011/04/22 23:13:39 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\AdobeUM
[2011/10/20 20:35:52 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\AnkamaCertificates
[2011/04/01 03:56:49 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\app
[2011/04/02 08:10:53 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\Avira
[2011/08/11 10:09:47 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\Beat Hazard
[2011/12/25 21:24:44 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\BitTorrent
[2011/05/10 10:36:50 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\CyberLink
[2011/12/21 20:18:34 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\Dofus 2
[2011/04/01 03:56:47 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\Dofus-2.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
[2011/04/01 04:03:19 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\Dofus-3.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
[2011/04/01 04:09:04 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\Dofus-4.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
[2011/04/01 07:38:49 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\Dofus-5.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
[2011/04/09 05:41:06 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\Dofus-6.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
[2011/05/06 20:17:03 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\Dofus-7.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
[2011/04/01 03:58:10 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\Dofus.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
[2011/03/31 21:39:33 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\Identities
[2011/04/01 04:56:24 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\IObit
[2011/04/03 14:57:36 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\Leadertech
[2011/08/24 13:07:46 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\LolClient
[2011/03/31 21:53:28 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\Macromedia
[2011/08/08 13:02:16 | 000,000,000 | --SD | M] -- C:\Users\dominique\AppData\Roaming\Microsoft
[2011/06/06 12:46:17 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\Mozilla
[2011/12/25 21:28:00 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\MSN Pictures Displayer
[2011/10/10 00:44:02 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\Nero
[2011/05/30 19:54:53 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\OpenOffice.org
[2011/04/01 03:56:49 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\Reg.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
[2011/11/27 07:30:49 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\Skype
[2011/04/26 21:22:46 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\Sony Ericsson
[2011/04/27 03:25:28 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\Teleca
[2011/09/30 11:59:29 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\vlc
[2011/12/25 04:07:45 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\Winamp
[2011/04/08 10:53:09 | 000,000,000 | ---D | M] -- C:\Users\dominique\AppData\Roaming\WinRAR

[color=#A23BEC]< %systemroot%\*. /mp /s >[/color]

[color=#A23BEC]< %systemroot%\system32\*.dll /lockedfiles >[/color]
[1 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]

[color=#A23BEC]< %systemroot%\Tasks\*.job >[/color]
[2011/12/25 21:26:40 | 000,000,378 | ---- | M] () -- C:\Windows\Tasks\AWC Startup.job

[color=#A23BEC]< hklm\software\clients\startmenuinternet|command /rs >[/color]
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2011/11/10 07:30:15 | 000,715,688 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2011/11/10 07:30:15 | 000,715,688 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2011/11/10 07:30:15 | 000,715,688 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\open\command\\: C:\Program Files\Mozilla Firefox\firefox.exe [2011/11/10 07:30:17 | 000,924,632 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\properties\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2011/11/10 07:30:17 | 000,924,632 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\safemode\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode [2011/11/10 07:30:17 | 000,924,632 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\Windows\system32\ie4uinit.exe" -hide [2011/05/28 05:32:51 | 000,173,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\Windows\system32\ie4uinit.exe" -show [2011/05/28 05:32:51 | 000,173,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\Windows\system32\ie4uinit.exe" -reinstall [2011/05/28 05:32:51 | 000,173,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2011/05/28 07:09:21 | 000,638,232 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\Program Files\Internet Explorer\iexplore.exe [2011/05/28 07:09:21 | 000,638,232 | ---- | M] (Microsoft Corporation)

[color=#A23BEC]< hklm\software\clients\startmenuinternet|command /64 /rs >[/color]
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2011/11/10 07:30:15 | 000,715,688 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2011/11/10 07:30:15 | 000,715,688 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2011/11/10 07:30:15 | 000,715,688 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\open\command\\: C:\Program Files\Mozilla Firefox\firefox.exe [2011/11/10 07:30:17 | 000,924,632 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\properties\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2011/11/10 07:30:17 | 000,924,632 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\safemode\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode [2011/11/10 07:30:17 | 000,924,632 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\Windows\system32\ie4uinit.exe" -hide [2011/05/28 05:32:51 | 000,173,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\Windows\system32\ie4uinit.exe" -show [2011/05/28 05:32:51 | 000,173,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\Windows\system32\ie4uinit.exe" -reinstall [2011/05/28 05:32:51 | 000,173,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2011/05/28 07:09:21 | 000,638,232 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\Program Files\Internet Explorer\iexplore.exe [2011/05/28 07:09:21 | 000,638,232 | ---- | M] (Microsoft Corporation)

[color=#A23BEC]< hklm\System\CurrentControlSet\Control\SessionManager\SubSystems /s >[/color]

[color=#A23BEC]< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCerDlls /s >[/color]

[color=#E56717]========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========[/color]
[C:\Windows\$NtUninstallKB24123$] -> Error: Cannot create file handle -> Unknown point type

[color=#E56717]========== Alternate Data Streams ==========[/color]

@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:8CE646EE

< End of report >

Re,

1/ télécharge le fichier Script.txt avec le lien suivant :
http://ww38.toofiles.com/fr/oip/documents/txt/script.html

2/ Relance OTL.exe.

* Sous l'onglet Personnalisation en bas de la fenêtre, copie-colle le texte du fichier Script.txt.

* Puis clique sur le bouton Correction en haut de la fenêtre.
* Laisse le programme travailler, le PC va redémarrer.

Tu verras un log s'ouvrir après le fix (c'est le log qui montre si la suppression a réussi).
sauvegarde-le sur ton Bureau et poste-le après redémarrage.

Note : Si tu ne le trouves pas, c'est un fichier log dans C:\_OTL\MovedFiles
Regarde suivant la date : mmjjaaaa_xxxxxxxx.log

-----------------------------------------------------------------

On va voir pour l'autre infection sur le PC.

Télécharge TDSSKiller sur ton Bureau.

# Décompresse le (clic droit sur le fichier et extraire) sur le bureau.
# dans le dossier crée, déplacer le fichier TDSSKiller.exe pour le mettre sur le Bureau
# Faire un double clic sur TDSSKiller.exe pour le lancer.
# Cliquer sur Start scan pour lancer l'analyse,

# Lors de l'analyse, vérifie que l'action proposée par défaut est la suivante :
- Pour TDSS.tdl2 : l'option Delete sera cochée.
- Pour TDSS.tdl3 ou TDSS.tdl4 : assure toi que Cure est bien cochée.
- Pour "Suspicious object" laisse sur "Skip"
- Attention pour Rootkit.Win32.ZAccess :
-- Choisir Cure pour les fichiers .sys et Delete pour le fichier .exe
# Puis cliquer sur le bouton <gras>Continue.
# Si l'outil a besoin d'un redémarrage pour finaliser le nettoyage, cliquer sur le bouton Reboot Computer.

Envoyer en réponse le rapport de TDSSKiller

Note : Il se trouve aussi en C:\TDSSKiller.Version_Date_Heure_log.txt

A+

Ceci est le log de la correction OTL, pour TDSSkiller il ne me trouve aucun threats et j'ai pas d'action proposée ducoup.

Service Planificateur LiveUpdate automatique stopped successfully!
Service Planificateur LiveUpdate automatique deleted successfully!
Registry value HKEY_USERS\S-1-5-21-178061325-3444739432-590418636-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{ef79f67a-6ad7-4715-a0f8-932fca442023} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ef79f67a-6ad7-4715-a0f8-932fca442023}\ not found.
Registry value HKEY_USERS\S-1-5-21-178061325-3444739432-590418636-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ deleted successfully.
Prefs.js: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2190311&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry value HKEY_USERS\S-1-5-21-178061325-3444739432-590418636-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Microsoft® Windows Manager deleted successfully.
Registry value HKEY_USERS\S-1-5-21-178061325-3444739432-590418636-1000\Software\Microsoft\Windows\CurrentVersion\Run\\????????? deleted successfully.
File C:\Program Files\Uninstall Ask Toolbar.dll not found.
ADS C:\ProgramData\TEMP:8CE646EE deleted successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{89FF73A1-47CE-4573-8CF2-1486F18A2C60} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{89FF73A1-47CE-4573-8CF2-1486F18A2C60}\ not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56475 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: dominique
->Temp folder emptied: 37205576 bytes
->Temporary Internet Files folder emptied: 9055148 bytes
->Java cache emptied: 605968 bytes
->FireFox cache emptied: 81518705 bytes
->Google Chrome cache emptied: 367506305 bytes
->Flash cache emptied: 1023 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 109080 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 473,00 mb

OTL by OldTimer - Version 3.2.31.0 log created on 12252011_231740

Files\Folders moved on Reboot...
File move failed. C:\Windows\temp\logishrd\LVPrcInj01.dll scheduled to be moved on reboot.

Registry entries deleted on Reboot...

pateuf30,

Poste le rapport de TDSSKiller tout de même.
Utilise pour cela le site https://www.cjoint.com/

j'en aurais besoin. ;-)

------------------------------------------

Télécharge gmer sur ton bureau ( IMPORTANT )
http://www.gmer.net/#files

Précautions d'usage :
- Commence par désactiver ou arrêter des logiciels comme Alcolhol Soft ou Daemon tools car ils biaisent le rapport de gmer.
- Durant l'utilisation du logiciel, désactive tes protections actives ( antivirus, parefeu ). IMPORTANT.
- Ferme également toutes les applications actives dont ton navigateur.

# Double-clique sur l'exécutable téléchargé .
Si sous Vista , click droit sur l'exécutable et choisir exécuter en tant qu'administrateur.
# Le scan va se lancer de lui-même.

Si tu reçois un message t'indiquant la présence de rootkits, choisis oui pour effectuer une analyse complète du PC mais ne supprime rien.

# Clique ensuite sur Scan et laisse se faire l'analyse.

# A la fin de l'analyse, clique sur save pour enregistrer le rapport
# Enregistre-le sur le bureau ( fichier .log )

Édite ce rapport dans ta prochaine réponse.
Utilise pour cela le site https://www.cjoint.com/

A+

voila le rapport, pour TDSSkiller je n'obtient pas de rapport apres le scan :S

http://cjoint.com/11dc/ALAaNLK3U8l.htm

Re,

Tu trouveras le rapport de TDSSKiller à la racine de C:

A+

Merci pour l'info, Voilà le rapport TDSSkiller:

http://cjoint.com/11dc/ALAbFdZiIXP.htm

Re,

Tu vas télécharger ComBoFix et enregistre le sur ton bureau ( IMPORTANT )
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

# Désactive les protections résidentes de ton ordinateur ( antivirus, antispyware et parefeu )
# Branche tes différents supports amovibles ( clés USB, disque dur externe ) sans les ouvrir.

# Lance Combofix.exe et suis les invites.

Il est possible que ComBoFix redémarre l'ordinateur pour supprimer certains fichiers.

# Une fois le scan fini, un rapport va apparaitre.

Copie/colle ce rapport dans ta prochaine réponse.

Note : Si tu ne le trouves pas, il est à C:\ComboFix.txt.

A+

Le scan combofix m'as détecté un rootkit comme tu m'en avais parlé :s
Par je ne trouve pas le rapport du scan en tapant C:\ComboFix.txt. il me dit que ça existe pas et dans C:\ j'ai un gros dossier combofix mais pas de fichier de se nom :/

Re,

Oui, par précaution, n'utilise pas de CB.

Il y avait deux infections identifiées sur le PC : un backdoor et un rootkit TDL.
Pas de ransomware ( voleurs de mots de passe ) mais on n'a pas fini le nettoyage donc attends.

-------------------------------------------------------------

Regarde si il y a un dossier C:\Qoobox.
Tu devrais trouver le fichier ComboFix.txt.

A défaut, si tu ne trouves pas, regarde si il y a un fichier ComboFix-quarantined-files.txt dans ce dossier ou dans C:\combofix.

A+
Allez jusqu'au bout de la procédure de désinfection.

Re,

Oui, refais une analyse avec ComboFix.
Tu ne devrais plus avoir le message d'alerte sur le rootkit.

Poste évidemment le rapport.

A+

Ca y est je l'ai enfin ! :)

http://cjoint.com/11dc/ALAnP71Ps7s.htm

pateuf30,

Nickel.
pas la peine de relancer ComboFix.

------------------------------------------------

deux analyse pour vérifier que le PC est propre.
Pour éviter des détections redondantes,
# Ouvre OTL et clique sur purge outils.
Vérifie que le dossier C:\Qoobox est bien supprimé.
le PC va redémarrer.

1/ Tu télécharges MalwareBytes .

Tu l'installes. Choisis les options par défaut.
# A la fin de l'installation, il te sera demandé de mettre à jour MalwareBytes et de l'éxecuter .
# Accepte. Après la, mise à jour, le logiciel va s'ouvrir.

# Dans l'onglet Recherche, sélectionne Exécuter un examen complet.
# Clique sur recherche. Tu ne sélectionnes que les disques durs de l'ordinateur.
# Clique sur lancer l'examen.

# A la fin de la recherche, comme il est demandé, clique sur afficher les résultats.
# Si des infections sont trouvées, clique sur Supprimer la sélection.
Tu postes le rapport dans ton prochain message.

Si tu ne retrouves pas le rapport, ouvre MalwareBytes et regarde dans l'onglet Rapport/logs. Il y est. Clique dessus et choisir ouvrir.

2/ Fais un scan en ligne avec ESET :
tuto

A+

Je suis en train de faire le scan ESET voilà le rapport malwaresbytes:

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Version de la base de données: 911122602

Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.19088

26/12/2011 14:57:46
mbam-log-2011-12-26 (14-57-46).txt

Type d'examen: Examen complet (C:\|D:\|)
Elément(s) analysé(s): 316405
Temps écoulé: 50 minute(s), 37 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
c:\UsbFix\quarantine\C\Users\DOMINI~1\AppData\Local\Temp\2491402.exe.vir (Trojan.MSIL) -> Quarantined and deleted successfully.
c:\UsbFix\quarantine\C\Users\DOMINI~1\AppData\Local\Temp\3756610.exe.vir (Trojan.MSIL) -> Quarantined and deleted successfully.