Demande d'aide pour analyse adw cleaner et co

Bonjour,

Merci ppour ton aideElectricien 69.
Après supression de la ligne 23 par Hijackthis l'ordi a retrouvé l'adresse IP.
Après ADWcleaner, à nouveau plus d'IP automatique.
Voici mes rapports ADWcleaner et ComboFix.
ComboFix n'a pu se connecter à internet pour charger des fichiers manquants
Merci encore pour ton aide

======= RAPPORT D'AD-REMOVER 2.0.0.1,B | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par C_XX le 13/06/10 à 20:40
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html

C:\Program Files\Ad-Remover\main.exe (SCAN [3]) -> Lancé à 10:17:43 le 11/03/2012, Mode normal

Microsoft Windows XP Édition familiale Service Pack 3 (X86)
vero, LAYEGRE ( )

============== RECHERCHE ==============




============== SCAN ADDITIONNEL ==============

** Mozilla Firefox Version [Impossible d'obtenir la version] **

-- C:\Documents and Settings\vero\Application Data\Mozilla\FireFox\Profiles\6fozxmrb.default\Prefs.js --
browser.startup.homepage, hxxp://www.google.fr/
browser.startup.homepage_override.buildID, 20120215223356
browser.startup.homepage_override.mstone, rv:10.0.2

========================================

** Internet Explorer Version [6.0.2900.5512] **

[HKCU\Software\Microsoft\Internet Explorer\Main]
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\WINDOWS\system32\blank.htm
Search bar: hxxp://www.google.com/ie
Search Page: hxxp://www.google.com
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Use Custom Search URL: 1
Use Search Asst: no

[HKLM\Software\Microsoft\Internet Explorer\Main]
Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Default_Search_URL: hxxp://www.google.com/ie
Delete_Temp_Files_On_Exit: yes
Local Page: C:\WINDOWS\system32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/

[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm

========================================

C:\Program Files\Ad-Remover\Quarantine: 408 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 17 Fichier(s)

C:\Ad-Report-CLEAN[1].txt - 11/03/2012 (7131 Octet(s))
C:\Ad-Report-SCAN[1].txt - 11/03/2012 (6788 Octet(s))
C:\Ad-Report-SCAN[2].txt - 11/03/2012 (6843 Octet(s))
C:\Ad-Report-SCAN[3].txt - 11/03/2012 (447 Octet(s))

Fin à: 10:23:32, 11/03/2012

============== E.O.F ==============



ComboFix 12-03-18.04 - vero 19/03/2012 19:35:28.1.1 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.447.179 [GMT 1:00]
Lancé depuis: c:\documents and settings\vero\Bureau\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Microsoft Security Essentials *Enabled/Outdated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\vero\Application Data\searchqutb
c:\documents and settings\vero\Mes documents\~WRL0002.tmp
c:\documents and settings\vero\WINDOWS
c:\windows\Fonts\setupam.exe
c:\windows\system32\asw9.tmp
c:\windows\system32\aswA.tmp
c:\windows\system32\aswB.tmp
c:\windows\system32\aswC.tmp
c:\windows\system32\aswD.tmp
.
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_SSHNAS
-------\Legacy_WINDOWS_INTERNET_NAME_SERVICE
-------\Service_Windows Internet Name Service
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2012-02-19 au 2012-03-19 ))))))))))))))))))))))))))))))))))))
.
.
2012-03-15 16:58 . 2012-03-15 16:58 -------- d-----w- c:\program files\Trend Micro
2012-03-11 08:51 . 2012-03-11 09:23 -------- d-----w- c:\program files\Ad-Remover
2012-03-05 20:03 . 2012-03-05 20:03 -------- d-----w- c:\documents and settings\Administrateur
2012-03-05 19:15 . 2012-03-05 19:15 -------- d-----w- C:\ERDNT
2012-03-05 17:51 . 2012-03-05 17:57 -------- d-----w- c:\program files\RegCleaner
2012-03-04 13:52 . 2012-03-04 13:52 -------- d-----w- c:\documents and settings\vero\Application Data\Systweak
2012-03-04 08:54 . 2012-02-24 15:43 17280 ----a-w- c:\windows\system32\roboot.exe
2012-02-22 21:00 . 2012-02-22 21:00 -------- d-----w- c:\windows\system32\wbem\Repository
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-31 12:44 . 2010-07-24 11:06 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-01-12 17:20 . 2012-02-16 21:13 1860096 ----a-w- c:\windows\system32\win32k.sys
2012-01-12 17:20 . 2012-02-16 21:13 1860096 ----a-w- c:\windows\system32\_000000_.tmp(2).dll
2012-01-11 19:06 . 2012-02-16 08:53 3072 ------w- c:\windows\system32\iacenc.dll
2012-02-16 15:02 . 2012-03-11 16:02 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"="VTTimer.exe" [2004-10-01 53248]
"SoundMan"="SOUNDMAN.EXE" [2004-02-09 65024]
"CARPService"="carpserv.exe" [2003-03-18 4608]
"USB Storage RW"="c:\program files\USB Storage RW\DskWatch.exe" [2004-12-23 208896]
"EPSON Stylus C66 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I0S2.EXE" [2003-11-26 99840]
"VTTrayp"="VTtrayp.exe" [2004-06-22 143360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 437160]
.
c:\documents and settings\vero\Menu Démarrer\Programmes\Démarrage\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
VIA RAID TOOL.lnk - c:\program files\VIA\RAID\raid_tool.exe [2009-6-29 585728]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 07:37 843712 ----a-w- c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-06-08 04:02 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Akamai NetSession Interface]
2012-02-02 01:44 3329824 ----a-w- c:\documents and settings\vero\Local Settings\Application Data\Akamai\netsession_win.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Facebook Update]
2011-11-26 15:15 137536 ----atw- c:\documents and settings\vero\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Vid]
2009-07-16 14:35 5458704 ----a-w- c:\program files\Logitech\Logitech Vid\Vid.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
2009-10-14 12:36 2793304 ----a-w- c:\program files\Logitech\Logitech WebCam Software\LWS.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]
2005-06-08 13:44 196608 ----a-w- c:\program files\Logitech\Video\ManifestEngine.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
2005-06-08 14:24 458752 ----a-w- c:\program files\Logitech\Video\ISStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
2005-06-08 14:14 217088 ----a-w- c:\program files\Logitech\Video\LogiTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]
2005-07-19 16:32 221184 ----a-w- c:\windows\system32\LVCOMSX.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 09:44 248552 ----a-w- c:\program files\Fichiers communs\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2011-03-09 12:30 247728 ----a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
.
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [05/08/2004 13:00 14336]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [09/03/2011 13:30 92592]
R3 dskwatch;Disk Watch Filter;c:\windows\system32\drivers\dskwatch.sys [29/06/2009 18:23 15232]
S1 MpKsl4432d25b;MpKsl4432d25b;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D44B7840-F1B0-4B70-BD60-1650B75BCE36}\MpKsl4432d25b.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D44B7840-F1B0-4B70-BD60-1650B75BCE36}\MpKsl4432d25b.sys [?]
S1 MpKsl6b09f8d1;MpKsl6b09f8d1;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D44B7840-F1B0-4B70-BD60-1650B75BCE36}\MpKsl6b09f8d1.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D44B7840-F1B0-4B70-BD60-1650B75BCE36}\MpKsl6b09f8d1.sys [?]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [29/01/2010 17:49 135664]
S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys --> c:\windows\system32\drivers\dgderdrv.sys [?]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [12/10/2010 16:42 36640]
S3 GemCCID;GemCCID;c:\windows\system32\drivers\GemCCID.sys [24/09/2011 21:14 89600]
S3 gupdatem;Service Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [29/01/2010 17:49 135664]
S3 RTL8187B;NETGEAR WG111v3 Wireless-G USB Adapter Vista Driver;c:\windows\system32\drivers\wg111v3.sys [31/07/2009 06:12 341504]
S3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8192su.sys [25/11/2010 06:59 606056]
.
--- Autres Services/Pilotes en mémoire ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Contenu du dossier 'Tâches planifiées'
.
2012-03-11 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1957994488-2052111302-725345543-1004Core.job
- c:\documents and settings\vero\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2011-11-26 15:15]
.
2012-03-18 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1957994488-2052111302-725345543-1004UA.job
- c:\documents and settings\vero\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2011-11-26 15:15]
.
2012-03-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 16:48]
.
2012-03-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 16:48]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uInternet Settings,ProxyOverride = 127.0.0.1:9421
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Free YouTube to Mp3 Converter - c:\documents and settings\vero\Application Data\DVDVideoSoftIEHelpers\youtubetomp3.htm
TCP: Interfaces\{F0D250FA-D0BF-448F-8AC1-32B844796CB9}: NameServer = 212.27.53.252,212.27.54.252
FF - ProfilePath - c:\documents and settings\vero\Application Data\Mozilla\Firefox\Profiles\6rbywmbb.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHELINS SUPPRIMES - - - -
.
URLSearchHooks-{1c491116-c175-45e1-a570-6fb14fea8b7b} - c:\program files\PHPNukeFR\prxtbPHP0.dll
BHO-{1c491116-c175-45e1-a570-6fb14fea8b7b} - c:\program files\PHPNukeFR\prxtbPHP0.dll
Toolbar-{1c491116-c175-45e1-a570-6fb14fea8b7b} - c:\program files\PHPNukeFR\prxtbPHP0.dll
WebBrowser-{1C491116-C175-45E1-A570-6FB14FEA8B7B} - c:\program files\PHPNukeFR\prxtbPHP0.dll
MSConfigStartUp-DATAMNGR - c:\progra~1\WINDOW~4\Datamngr\DATAMN~1.EXE
MSConfigStartUp-KiesTrayAgent - c:\program files\Samsung\Kies\/\KiesTrayAgent.exe
AddRemove-EBP Utilitaire d'échanges 1.1 - c:\documents and settings\All Users\Application Data\{C17A5D13-737D-4F46-ACDF-A9BE7C81873C}\setup.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-03-19 19:46
Windows 5.1.2600 Service Pack 3 NTFS
.
Recherche de processus cachés ...
.
Recherche d'éléments en démarrage automatique cachés ...
.
Recherche de fichiers cachés ...
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Akamai]
"ServiceDll"="c:\program files\fichiers communs\akamai/netsession_win_7de0ed9.dll"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_USERS\S-1-5-21-1957994488-2052111302-725345543-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs chargées dans les processus actifs ---------------------
.
- - - - - - - > 'explorer.exe'(4692)
c:\windows\TEMP\logishrd\LVPrcInj01.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\SCardSvr.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\windows\system32\VTTimer.exe
c:\windows\SOUNDMAN.EXE
c:\windows\system32\carpserv.exe
c:\windows\system32\VTtrayp.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Heure de fin: 2012-03-19 19:51:47 - La machine a redémarré
ComboFix-quarantined-files.txt 2012-03-19 18:51
.
Avant-CF: 43 664 322 560 octets libres
Après-CF: 43 834 621 952 octets libres
.
- - End Of File - - D2E109677294C6ABBF36418E3C2F8ACF