Qv06

elle sont nettoyer mais extension inutile (j'en ais même pas)et j'ia déja paramètrer mais page de démarrage mais elle ne veut pas partir c'est le but du virus et les page que tu m'as donner ne me servent a rien puisque que je décoche tjrs les case "recommandé" et je n'installe pas toute ces toolbar je ne sais d'ailleur même pas comment ce virus est arrivé
ps.dsl si je suis un peut agressif mais ça fait une semaine que je suis sans solution

mon antivirus l'as bloquer

ann dsl j'avias lancer zhpdiag mais c'est zhpfix
voila: Rapport de ZHPFix 2013.6.12.3 par Nicolas Coolman, Update du 12/06/2013
Fichier d'export Registre :
Run by the wizard at 07/07/2013 20:15:20
High Elevated Privileges : OK
Windows 7 Home Premium Edition, 64-bit Service Pack 1 (Build 7601)

Corbeille vidée

========== Autre ==========
NON TRAITE elle sont nettoyer mais extension inutile (j'en ais même pas)et j'ia déja paramètrer mais page de démarrage mais elle ne veut pas partir c'est le but du virus


========== Récapitulatif ==========
1 : Autre


End of clean in 00mn 00s

========== Chemin de fichier rapport ==========
C:\ZHP\ZHPFix[R1].txt - 07/07/2013 20:15:20 [644]

mais c'est un virus

ha non j'ai réussi mais pour quoi les antivirus le bloque?

c'est ce que j'ai fais

Rapport de ZHPDiag v2013.7.5.7 par Nicolas Coolman, Update du 05/07/2013
Run by the wizard at 07/07/2013 20:20:57
WebSite: https://nicolascoolman.webs.com/
State : Version à jour.
WhiteList : Enable
High Elevated Privileges : OK
UAC : Deactivate by program


---\\ Web Browser
MSIE: Internet Explorer v10.0.9200.16618
GCIE: Google Chrome v27.0.1453.116 (Defaut)

---\\ Windows Product Information
~ Langage: Français
Windows 7 Home Premium Edition, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows(R) 7, OEM_COA_SLP channel
Windows ID Activation : OK
~ Windows Partial Key : X3YCM
~ Windows Remaining Initializations Number : 3
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK

---\\ System Protection
Pack Sécurité
Malwarebytes Anti-Malware version 1.75.0.1300
Windows Defender W7

---\\ System Optimizer
CCleaner v4.02 =>Piriform Ltd

---\\ Peer To Peer (P2P)
µTorrent v3.3.0.29625 =>P2P.µTorrent

---\\ Software Update
Adobe Flash Player 11 Plugin
Adobe Reader XI
Java 7 Update 25

---\\ System Information
~ Processor: AMD64 Family 16 Model 6 Stepping 3, AuthenticAMD
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3839 MB (49% free)
System Restore: Activé (Enable)
System drive C: has 735 GB (78%) free of 931 GB

---\\ Logged in mode
~ Computer Name: PC
~ User Name: the wizard
~ All Users Names: UpdatusUser, the wizard, natha, HomeGroupUser$, christelle, Administrateur,
~ Unselected Option: None
Logged in as Administrator

---\\ Environnement Variables
~ System Unit : C:\
~ %AppData% : C:\Users\the wizard\AppData\Roaming\
~ %Desktop% : C:\Users\the wizard\Desktop\
~ %Favorites% : C:\Users\the wizard\Favorites\
~ %LocalAppData% : C:\Users\the wizard\AppData\Local\
~ %StartMenu% : C:\Users\the wizard\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 735 Go of 931 Go)
D:\ CD-ROM drive (Not Inserted)
E:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
F:\ CD-ROM drive (Not Inserted)



---\\ Security Center & Tools Informations
~ Security Center: 29 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.12716D987D475B051F35895659159705] - (.Microsoft Corporation - Internet Extensions for Win32.) (.17/05/2013 - 01:59:03.) -- C:\Windows\System32\wininet.dll [2241024]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.21/11/2010 - 04:24:29.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.21/11/2010 - 04:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.1C7857B62DE5994A75B054A9FD4C3825] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/12/2011 - 04:59:24.) -- C:\Windows\system32\Drivers\AFD.sys [498688]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.21/11/2010 - 04:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/11/2010 - 04:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/1025
~ Mes musiques (My Musics) : 1/558
~ Mes Videos (My Videos) : 1/30
~ Mes Favoris (My Favorites) : 1/27
~ Mes Documents (My Documents) : 1/69
~ Mon Bureau (My Desktop) : 1/9
~ Menu demarrer (Programs) : 1/46
~ Hidden Files: Scanned in 00mn 01s



---\\ Processus lancés
[MD5.070753E47E04181DD440EA2FEFE3115C] - (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe [18678376] [PID.1368]
[MD5.FBAF93425D4B5A6C48ABB5B7F81088CD] - (.F-Secure Corporation - F-Secure Settings and Statistics.) -- C:\Program Files (x86)\DartyBox Sécurité\Common\FSM32.exe [201128] [PID.3100]
[MD5.D63797E8E7781EE1500A810CB6194FA6] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816] [PID.3212]
[MD5.5521928AA79079565B7CB8FCE6806131] - (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [825808] [PID.1984]
[MD5.E5A7EA8C5C063943231A071789956893] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [7667712] [PID.1776]
[MD5.ADDA5E1951B90D3D23C56D3CF0622ADC] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65640] [PID.1224]
[MD5.2346842F07E2AB64D1DC83A67FCCDFA1] - (.F-Secure Corporation - F-Secure Anti-Virus Scanning Service.) -- C:\Program Files (x86)\DartyBox Sécurité\Anti-Virus\fsgk32st.exe [221608] [PID.1532]
[MD5.0DFEBEA4BB4444488E0032A48524F56A] - (.Freemake - FreemakeUtilsService.) -- C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [101888] [PID.1552]
[MD5.9281297DDEAB730CB2EBB27D74069BD3] - (.F-Secure Corporation - F-Secure Gatekeeper Handler 32-bit.) -- C:\Program Files (x86)\DartyBox Sécurité\Anti-Virus\FSGK32.exe [621504] [PID.1560]
[MD5.8A556A81E9FF95BD9EB7207783E8FCF4] - (.F-Secure Corporation - F-Secure Management Agent.) -- C:\Program Files (x86)\DartyBox Sécurité\Common\FSMA32.exe [188840] [PID.1636]
[MD5.86E8C2EA0BAA47BE919072251DE6489F] - (.F-Secure Corporation - F-Secure DLL Hosting Plugin.) -- C:\Program Files (x86)\DartyBox Sécurité\Common\FSHDLL32.exe [90536] [PID.1700]
[MD5.57DDE1395F86EE048AB25717EEB8CAEB] - (.TeamViewer GmbH - TeamViewer 8.) -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [4150112] [PID.1844]
[MD5.45303CDBC1FD8F8D371E726BF126F771] - (.F-Secure Corporation - F-Secure ORSP Service.) -- C:\Program Files (x86)\DartyBox Sécurité\ORSP Client\fsorsp.exe [60352] [PID.2320]
[MD5.9CB3D8D519DB7A70A463387B8E9AD924] - (.F-Secure Corporation - F-Secure Scanner Manager 32-bit.) -- C:\Program Files (x86)\DartyBox Sécurité\Anti-Virus\fssm32.exe [1039296] [PID.2720]
[MD5.FF73E3E94395D66D455EB0D602A0A639] - (.F-Secure Corporation - F-Secure Anti-Virus Handler.) -- C:\Program Files (x86)\DartyBox Sécurité\Anti-Virus\fsav32.exe [539072] [PID.1208]
[MD5.A3A25E0509F67473B960DAF214828BE3] - (.NVIDIA Corporation - NVIDIA Settings Update Manager.) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [1259296] [PID.4400]
~ Processes Running: Scanned in 00mn 01s



---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\the wizard\AppData\Local\Google\Chrome\User Data\Default\Preferences
G1 - GCS: Preference [User Data\Default] http://search.qvo6.com =>Hijacker.Qvo6
G2 - GCE: Preference [User Data\Default] [npgafapgojphfblahopdafgbpmennpak] HP 7 Part 2 v.1 (Activé)
~ Google Browser: 14 Legitimates Filtered in 00mn 13s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s



---\\ Redirection du fichier Hosts (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21



---\\ Applications démarrées par registre & par dossier (O4)
O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKLM\..\Wow6432Node\Run: [F-Secure Manager] . (.F-Secure Corporation - F-Secure Settings and Statistics.) -- C:\Program Files (x86)\DartyBox Sécurité\Common\FSM32.exe
O4 - HKLM\..\Wow6432Node\Run: [F-Secure TNB] . (.F-Secure Corporation - TNBUtil.) -- C:\Program Files (x86)\DartyBox Sécurité\FSGUI\TNBUtil.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe
O4 - HKUS\S-1-5-21-95953317-4187476415-1103916423-1004\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-21-95953317-4187476415-1103916423-1004\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe
~ Application: Scanned in 00mn 00s



---\\ Autres liens utilisateurs (O4)
O4 - GS\Accessories: Private Character Editor.lnk . (.Microsoft Corporation - Éditeur de caractères privés.) -- C:\Windows\system32\eudcedit.exe
O4 - GS\SendTo: Fax Recipient.lnk . (.Microsoft Corporation - Microsoft Windows Fax and Scan.) -- C:\Windows\system32\WFS.exe
O4 - GS\Desktop: Free YouTube Downloader Converter.lnk . (...) -- C:\Program Files (x86)\Free YouTube Downloader Converter\UNWISE.exe (.not file.) =>PUP.Dealio
O4 - GS\Desktop: PhotoFiltre 7.lnk . (.PhotoFiltre - PhotoFiltre 7.) -- C:\Program Files (x86)\PhotoFiltre 7\PhotoFiltre7.exe
O4 - GS\TaskBar: CCleaner.lnk . (.Piriform Ltd - CCleaner.) -- C:\Program Files\CCleaner\CCleaner64.exe =>Piriform Ltd
O4 - GS\TaskBar: Gameforge Live.lnk . (...) -- C:\Program Files (x86)\GameforgeLive\GameforgeLive.exe
O4 - GS\TaskBar: Gestionnaire des tâches de Windows.lnk . (.Microsoft Corporation - Gestionnaire des tâches de Windows.) -- C:\Windows\System32\taskmgr.exe
O4 - GS\TaskBar: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\TaskBar: OpenOffice.org 3.4.1.lnk . (.OpenOffice.org - OpenOffice.org 3.4.1.) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
O4 - GS\TaskBar: Windows Explorer.lnk . (.Microsoft Corporation - Explorateur Windows.) -- C:\Windows\explorer.exe
O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch: CyberGhost VPN.lnk . (.CyberGhost SRL - CyberGhost VPN Client.) -- C:\Program Files\CyberGhost VPN\CyberGhost.exe
O4 - GS\QuickLaunch: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch: Oracle VM VirtualBox.lnk . (...) -- C:\Program Files (x86)\Oracle\VirtualBox\VirtualBox.exe (.not file.)
O4 - GS\Accessories: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\SendTo: Desk 365.lnk . (...) -- C:\Program Files (x86)\Desk 365\desk365.exe (.not file.) =>Hijacker.22Find
O4 - GS\SendTo: Skype.lnk . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O4 - GS\Desktop: Audacity.lnk . (.The Audacity Team - Audacity®, the Free, Cross-Platform Sound E.) -- C:\Program Files (x86)\Audacity\audacity.exe
O4 - GS\Desktop: GTA san andreas.lnk . (...) -- C:\Users\the wizard\Downloads\gta___san_andreas\GTA - San Andreas\gta_sa.exe
O4 - GS\Desktop: L'Assistant DartyBox.lnk . (.Celliance - Assistant DartyBox.) -- C:\Program Files (x86)\DartyBox_v3\Bewan\AssistantDB\AssistantDB_Bewan.exe
O4 - GS\Desktop: ZHPDiag.lnk . (.Nicolas Coolman - ZHPDiag Setup.) -- C:\Program Files (x86)\ZHPDiag\ZHPhep.exe
O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Accessories: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
~ Global Startup: Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{B3F813B9-63BD-4AAD-9EE5-D7E0C09D28E1}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\..\{B3F813B9-63BD-4AAD-9EE5-D7E0C09D28E1}: DhcpDomain = darty
O17 - HKLM\System\CS1\Services\Tcpip\..\{B3F813B9-63BD-4AAD-9EE5-D7E0C09D28E1}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{B3F813B9-63BD-4AAD-9EE5-D7E0C09D28E1}: DhcpDomain = darty
O17 - HKLM\System\CS2\Services\Tcpip\..\{B3F813B9-63BD-4AAD-9EE5-D7E0C09D28E1}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CS2\Services\Tcpip\..\{B3F813B9-63BD-4AAD-9EE5-D7E0C09D28E1}: DhcpDomain = darty
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
~ Domain: Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: vbscript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Microsoft (R) HTML Viewer.) -- C:\Windows\System32\mshtml.dll
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [Desk 365 RunAsStdUser] (...) -- C:\Program Files (x86)\Desk 365\desk365.exe (.not file.) [0] =>Hijacker.22Find
[MD5.00000000000000000000000000000000] [APT] [{91CEDF63-A695-4809-8CAF-6166EFA5316C}] (...) -- C:\Users\the wizard\Local Settings\Application Data\Bundled software uninstaller\bi_client.exe (.not file.) [0]
~ Scheduled Task: 8 Legitimates Filtered in 00mn 03s



---\\ Pilotes lancés au démarrage (O41)
O41 - Driver: (fsvista) . (...) - C:\Program Files (x86)\DartyBox Sécurité\Anti-Virus\minifilter\fsvista.sys
~ Drivers: 78 Legitimates Filtered in 00mn 00s



---\\ Logiciels installés (O42)
O42 - Logiciel: World of Warplanes - (.Wargaming.net.) [HKLM][64Bits] -- {1EAC1D02-C6AC-4FA6-9A44-96258C37C813EU}_is1
~ Logic: 61 Legitimates Filtered in 00mn 00s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\Softonic] =>Toolbar.Conduit
[HKCU\Software\WEDLMNGR]
~ Key Software: 199 Legitimates Filtered in 00mn 00s



---\\ Derniers fichiers créés dans Windows Prefetcher (O45)
O45 - LFCP:[MD5.C2C1BD834F4D4BEDE3000671772DB571] - 05/07/2013 - 19:21:37 ---A- - C:\Windows\Prefetch\ASSISTANTDB_BEWAN.EXE-0D81F847.pf
O45 - LFCP:[MD5.77117A18D3C0CEE1D301A6081613D710] - 07/07/2013 - 18:11:50 ---A- - C:\Windows\Prefetch\G2ASERVICE.EXE-C4EE8F28.pf
~ Prefetcher: 90 Legitimates Filtered in 00mn 01s



---\\ MountPoints2 Shell Key (O51)
O51 - MPSK:{49521798-cf31-11e2-bb30-7071bc1dc52c}\AutoRun\command. (...) -- F:\Autorun.exe (.not file.)
~ Keys: Scanned in 00mn 00s



---\\ ShareTools MSconfig StartupReg (O53)
O53 - SMSR:HKLM\...\startupreg\Assistant DartyBox [Key] . (.Celliance - Assistant DartyBox.) -- C:\Program Files (x86)\DartyBox_v3\Bewan\AssistantDB\AssistantDB_Bewan.exe
O53 - SMSR:HKLM\...\startupreg\Browser Infrastructure Helper [Key] . (...) -- C:\Users\the wizard\AppData\Local\Smartbar\Application\QuickShare.exe (.not file.) =>Hijacker.SmartBar
O53 - SMSR:HKLM\...\startupreg\Casse Briques La Serie OLR [Key] . (.Avanquest Software - Avanquest Software OnLine Registration Repu.) -- C:\Program Files (x86)\MICROA~1\OLR\CASSEB~1\BVRPOlr.exe
~ SMSR Keys: 4 Legitimates Filtered in 00mn 00s



---\\ Microsoft Windows Policies System (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s



---\\ Liste des Drivers Système (O58)
O58 - SDL:[MD5.2F6B34B83843F0C5118B63AC634F5BF4] - 14/07/2009 - 02:52:21 ---A- . (.Adaptec, Inc. - Adaptec Windows SAS/SATA Storport Driver.) -- C:\Windows\System32\Drivers\adp94xx.sys [491088]
O58 - SDL:[MD5.F87FBE8B104DF9C35CD52909B8D28A4A] - 28/05/2013 - 15:55:02 ---A- . (...) -- C:\Windows\SysWOW64\drivers\fsbts.sys [33408]
~ Drivers: Scanned in 00mn 00s



---\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61)
O61 - LFC: 05/07/2013 - 17:41:29 ---A- C:\Users\the wizard\Downloads\WoT_internet_install_eu.exe [9304408]
O61 - LFC: 05/07/2013 - 17:41:47 ---A- C:\Users\the wizard\Downloads\WoWP_internet_install_eu.exe [8775080]
O61 - LFC: 06/07/2013 - 15:26:39 ---A- C:\Users\the wizard\AppData\Roaming\Wargaming.net\World of Warplanes\gamepad_direct_control.xml [32101]
O61 - LFC: 06/07/2013 - 15:26:39 ---A- C:\Users\the wizard\AppData\Roaming\Wargaming.net\World of Warplanes\joystick.xml [32914]
O61 - LFC: 06/07/2013 - 15:26:39 ---A- C:\Users\the wizard\AppData\Roaming\Wargaming.net\World of Warplanes\keyboard.xml [32245]
O61 - LFC: 06/07/2013 - 15:26:39 ---A- C:\Users\the wizard\AppData\Roaming\Wargaming.net\World of Warplanes\mouse_direct_control.xml [27166]
O61 - LFC: 06/07/2013 - 15:26:39 ---A- C:\Users\the wizard\AppData\Roaming\Wargaming.net\World of Warplanes\mouse_directional.xml [26982]
O61 - LFC: 07/07/2013 - 09:56:19 ---A- C:\Users\the wizard\AppData\Local\Google\Chrome\User Data\Certificate Revocation Lists [266514]
O61 - LFC: 07/07/2013 - 11:32:59 ---A- C:\Users\the wizard\Downloads\WoWP_internet_install_eu (1).exe [8775080]
O61 - LFC: 07/07/2013 - 12:55:29 ---A- C:\Users\the wizard\AppData\Roaming\Wargaming.net\World of Warplanes\preferences.xml [13839]
O61 - LFC: 07/07/2013 - 17:55:26 ---A- C:\Users\the wizard\Downloads\autoi.exe [605576]
O61 - LFC: 07/07/2013 - 18:07:16 ---A- C:\Users\the wizard\Downloads\antares-auto-tune-windows-downloader.exe [162000]
O61 - LFC: 07/07/2013 - 18:15:15 ---A- C:\Users\the wizard\AppData\Local\Google\Chrome\User Data\Profile 1\History [184320]
O61 - LFC: 07/07/2013 - 18:19:39 ---A- C:\Users\the wizard\Downloads\adwcleaner.exe [650027]
O61 - LFC: 07/07/2013 - 18:44:29 ---A- C:\Users\the wizard\Downloads\AutoTune.exe [248016]
O61 - LFC: 07/07/2013 - 18:45:41 ---A- C:\Users\the wizard\Downloads\autoi (1).exe [682183]
O61 - LFC: 07/07/2013 - 18:50:15 ---A- C:\Users\the wizard\Downloads\Autotune Evo.dll [11419648]
O61 - LFC: 07/07/2013 - 18:51:38 ---A- C:\Users\the wizard\Downloads\SoftonicDownloader_pour_fl-studio.exe [393064] =>Toolbar.Conduit
O61 - LFC: 07/07/2013 - 19:22:31 ---A- C:\Users\the wizard\AppData\Local\Google\Chrome\User Data\Local State [37218]
~ 7 Fichiers temporaires (Temporary files)
~ Files: 188 Legitimates Filtered in 00mn 34s



---\\ Liste des outils de nettoyage (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1
~ ADS: Scanned in 00mn 00s



---\\ File Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html> <ChromeHTML>[HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 19 Legitimates Filtered in 00mn 00s



---\\ Start Menu Internet (O68)
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s



---\\ Search Browser Infection (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
~ Keys: Scanned in 00mn 00s



---\\ Recherche particuliere à la racine de certains dossiers (O84)
[MD5.5AA3E89A59E3D556B5F9B6D8D8EE3A82] [SPRF][07/07/2013] (.Somoto Ltd. - Better Installer Cleaner.) -- C:\Users\the wizard\AppData\Local\Temp\bi_cleaner.exe [42080] =>Adware.MegaSearch
[MD5.D295B4F8AEE382AEF9794A3445DFC6E4] [SPRF][07/07/2013] (...) -- C:\Users\the wizard\AppData\Local\Temp\mlv_ar_201374152738_qvo6.exe [200272] =>Hijacker.Qvo6
[MD5.45E0EDACA8702E6E90D1D98CF3647D5F] [SPRF][14/06/2013] (...) -- C:\Users\the wizard\Desktop\fichier.bat [7]
[MD5.9F52FB4A145629D3BEF7FF3EAA27E96D] [SPRF][30/05/2013] (...) -- C:\Users\the wizard\Desktop\mcpatcher-3.0.4.exe [1799386]
[MD5.F0B219392A3BDAAA48DF8B62E48075D3] [SPRF][01/06/2013] (...) -- C:\Users\the wizard\Desktop\Pipix_v2.8.1.exe [1115631]
~ Files: Scanned in 00mn 00s



---\\ Scan Additionnel (O88)
Database Version : v2.12676 - (05/07/2013)
Clés trouvées (Keys found) : 2
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 0
Fichiers trouvés (Files found) : 2

[HKCU\Software\Softonic] =>Toolbar.Conduit
[HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\desksvc] =>Hijacker.22find
C:\Users\the wizard\AppData\Local\Temp\bi_cleaner.exe =>Adware.MegaSearch
~ Additionnel Scan: 160834 Items scanned in 00mn 12s



---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SR - | Auto 11/05/2013 65640 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SS - | Demand 26/04/2012 2438696 | (CGVPNCliSrvc) . (.mobile concepts GmbH.) - C:\Program Files\CyberGhost VPN\CGVPNCliService.exe
SR - | Auto 18/11/2009 221608 | (F-Secure Gatekeeper Handler Starter) . (.F-Secure Corporation.) - C:\Program Files (x86)\DartyBox Sécurité\Anti-Virus\fsgk32st.exe
SR - | Auto 30/05/2013 101888 | (Freemake Improver) . (.Freemake.) - C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe
SR - | Demand 18/11/2009 846248 | (FSDFWD) . (.F-Secure Corporation.) - C:\Program Files (x86)\DartyBox Sécurité\FWES\Program\fsdfwd.exe
SR - | Auto 18/11/2009 188840 | (FSMA) . (.F-Secure Corporation.) - C:\Program Files (x86)\DartyBox Sécurité\Common\FSMA32.exe
SR - | Demand 04/06/2013 60352 | (FSORSPClient) . (.F-Secure Corporation.) - C:\Program Files (x86)\DartyBox Sécurité\ORSP Client\fsorsp.exe
SS - | Auto 28/05/2013 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 28/05/2013 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SR - | Auto 31/01/2013 878368 | (nvsvc) . (.NVIDIA Corporation.) - C:\Windows\system32\nvvsvc.exe
SR - | Auto 19/02/2013 1259296 | (nvUpdatusService) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
SS - | Auto 19/04/2013 161384 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SR - | Auto 13/06/2013 4150112 | (TeamViewer8) . (.TeamViewer GmbH.) - C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
SR - | Auto 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 01s



---\\ Recherche Master Boot Record Infection (MBR)(O80)
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Run by the wizard at 07/07/2013 20:24:28

device: opened successfully
user: error reading MBR

Disk trace:
error: Read Descripteur non valide
kernel: error reading MBR
~ MBR: 9 Legitimates Filtered in 00mn 02s



---\\ Recherche Master Boot Record Infection (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by the wizard at 07/07/2013 20:24:30

********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 04s



---\\ Malicius Software Information
~ http://nicolascoolman.webs.com/apps/blog/show/26631242-hijacker-qvo6 =>Hijacker.Qvo6
~ http://nicolascoolman.webs.com/apps/blog/show/27443462-pup-dealio =>PUP.Dealio
~ http://nicolascoolman.webs.com/apps/blog/show/26630379-hijacker-22find =>Hijacker.22Find
~ http://nicolascoolman.webs.com/apps/blog/show/29507721-toolbar-conduit =>Toolbar.Conduit
~ http://nicolascoolman.webs.com/apps/blog/show/26990375-hijacker-smartbar =>Hijacker.SmartBar
~ http://nicolascoolman.webs.com/apps/blog/show/26919368-adware-megasearch =>Adware.MegaSearch
~ MSI: 6 link(s) detected in 00mn 04s



~ 1170 Legitimates filtered by white list
End of the scan (429 lines in 03mn 32s)(0)

quel rapport entre le moteur de recherche et ma clé USB et mon disque dur externe?

ok mais comment je fait pour qvo6 alors?

ok

voila :
############################## | UsbFix V 7.129 | [Recherche]

Utilisateur: the wizard (Administrateur) # PC
Mis à jour le 24/06/2013 par El Desaparecido
Lancé à 09:08:19 | 08/07/2013

Site Web: https://www.sosvirus.net/
Upload Malware: http://www.sosvirus.net/upload-malware-pour-analyse-t489.html
Contact: contact@sosvirus.net

PC: Hewlett-Packard (G5133fr) (x64-based PC)
CPU: AMD Athlon(tm) II X2 220 Processor (2812)
RAM -> [Total : 3839 | Free : 2897]
BIOS: BIOS Date: 05/21/10 14:32:47 Ver: 6.09
BOOT: Fail-safe boot

OS: Microsoft Windows 7 Édition Familiale Premium (6.1.7601 64-Bit) # Service Pack 1
WB: Windows Internet Explorer 10.0.9200.16618

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
AV: Pack Sécurité 9.12 [Enabled | Updated]
FW: Windows FireWall Service [(!) Disabled]

C:\ (%systemdrive%) -> Disque fixe # 931 Go (735 Go libre(s) - 79%) [] # NTFS
D:\ -> CD-ROM
F:\ -> CD-ROM
G:\ -> Disque fixe # 466 Go (376 Go libre(s) - 81%) [Expansion Drive] # NTFS

################## | Processus Actif |

C:\Windows\system32\csrss.exe (328)
C:\Windows\system32\csrss.exe (368)
C:\Windows\system32\wininit.exe (376)
C:\Windows\system32\winlogon.exe (404)
C:\Windows\system32\services.exe (464)
C:\Windows\system32\lsass.exe (472)
C:\Windows\system32\lsm.exe (480)
C:\Windows\system32\svchost.exe (580)
C:\Windows\system32\svchost.exe (644)
C:\Windows\System32\svchost.exe (728)
C:\Windows\system32\svchost.exe (776)
C:\Windows\system32\svchost.exe (812)
C:\Windows\system32\userinit.exe (272)
C:\Windows\Explorer.EXE (260)
C:\Windows\system32\ctfmon.exe (364)
C:\Windows\system32\DllHost.exe (1044)
C:\UsbFix\Go.exe (1284)
C:\Windows\system32\wbem\wmiprvse.exe (1332)

################## | El Desaparecido Section |

HKLM\SOFTWARE | Run : [F-Secure Manager] - "C:\Program Files (x86)\DartyBox Sécurité\Common\FSM32.EXE" /splash
HKLM\SOFTWARE | Run : [F-Secure TNB] - "C:\Program Files (x86)\DartyBox Sécurité\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
HKLM\SOFTWARE | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKLM\SOFTWARE\wow6432Node | Run : [F-Secure Manager] - "C:\Program Files (x86)\DartyBox Sécurité\Common\FSM32.EXE" /splash
HKLM\SOFTWARE\wow6432Node | Run : [F-Secure TNB] - "C:\Program Files (x86)\DartyBox Sécurité\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
HKLM\SOFTWARE\wow6432Node | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
HKLM\SOFTWARE\wow6432Node | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKLM\SOFTWARE | RunOnce : [] -
HKLM\SOFTWARE\wow6432Node | RunOnce : [] -
HKU\S-1-5-19\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-95953317-4187476415-1103916423-1003\SOFTWARE | Run : [Skype] - "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
HKU\S-1-5-21-95953317-4187476415-1103916423-1003\SOFTWARE | Run : [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
HKU\S-1-5-19\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
HKU\S-1-5-20\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe

################## | Éléments infectieux |

Présent! G:\desktop.ini

################## | Registre |


################## | Mountpoints2 |

HKCU\.\.\.\.\Explorer\MountPoints2\{49521798-cf31-11e2-bb30-7071bc1dc52c}
Shell\AutoRun\Command = F:\Autorun.exe



################## | Vaccin |

(!) Cet ordinateur n'est pas vacciné!

################## | E.O.F | https://www.sosvirus.net/ |

non je ne l'ais pas désactiver

voila :
############################## | UsbFix V 7.129 | [Suppression]

Utilisateur: the wizard (Administrateur) # PC
Mis à jour le 24/06/2013 par El Desaparecido
Lancé à 10:27:38 | 08/07/2013

Site Web: https://www.sosvirus.net/
Upload Malware: http://www.sosvirus.net/upload-malware-pour-analyse-t489.html
Contact: contact@sosvirus.net

PC: Hewlett-Packard (G5133fr) (x64-based PC)
CPU: AMD Athlon(tm) II X2 220 Processor (2800)
RAM -> [Total : 3839 | Free : 2583]
BIOS: BIOS Date: 05/21/10 14:32:47 Ver: 6.09
BOOT: Normal boot

OS: Microsoft Windows 7 Édition Familiale Premium (6.1.7601 64-Bit) # Service Pack 1
WB: Windows Internet Explorer 10.0.9200.16618

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
AV: Pack Sécurité 9.12 [Enabled | Updated]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Disque fixe # 931 Go (741 Go libre(s) - 80%) [] # NTFS
D:\ -> CD-ROM
F:\ -> CD-ROM

################## | El Desaparecido Section |

HKLM\SOFTWARE | Run : [F-Secure Manager] - "C:\Program Files (x86)\DartyBox Sécurité\Common\FSM32.EXE" /splash
HKLM\SOFTWARE | Run : [F-Secure TNB] - "C:\Program Files (x86)\DartyBox Sécurité\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
HKLM\SOFTWARE | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKLM\SOFTWARE\wow6432Node | Run : [F-Secure Manager] - "C:\Program Files (x86)\DartyBox Sécurité\Common\FSM32.EXE" /splash
HKLM\SOFTWARE\wow6432Node | Run : [F-Secure TNB] - "C:\Program Files (x86)\DartyBox Sécurité\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
HKLM\SOFTWARE\wow6432Node | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
HKLM\SOFTWARE\wow6432Node | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKLM\SOFTWARE | RunOnce : [] -
HKLM\SOFTWARE\wow6432Node | RunOnce : [] -
HKU\S-1-5-19\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-95953317-4187476415-1103916423-1003\SOFTWARE | Run : [Skype] - "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
HKU\S-1-5-21-95953317-4187476415-1103916423-1003\SOFTWARE | Run : [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
HKU\S-1-5-21-95953317-4187476415-1103916423-1004\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-19\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
HKU\S-1-5-20\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
HKU\S-1-5-21-95953317-4187476415-1103916423-1004\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe

################## | Processus Stoppés |

Stoppé! C:\Windows\system32\nvvsvc.exe (696)
Stoppé! C:\Windows\System32\spoolsv.exe (1124)
Stoppé! C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (1244)
Stoppé! C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (1324)
Stoppé! C:\Windows\system32\nvvsvc.exe (1332)
Stoppé! C:\Program Files (x86)\DartyBox Sécurité\Anti-Virus\fsgk32st.exe (1544)
Stoppé! C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe (1564)
Stoppé! C:\Program Files (x86)\DartyBox Sécurité\Anti-Virus\FSGK32.EXE (1572)
Stoppé! C:\Program Files (x86)\DartyBox Sécurité\Common\FSMA32.EXE (1644)
Stoppé! C:\Program Files (x86)\DartyBox Sécurité\Common\FSHDLL32.EXE (1708)
Stoppé! C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe (1844)
Stoppé! C:\Program Files (x86)\DartyBox Sécurité\Common\FSHDLL64.EXE (1520)
Stoppé! C:\Windows\system32\taskhost.exe (2336)
Stoppé! C:\Program Files (x86)\DartyBox Sécurité\FWES\Program\fsdfwd.exe (2396)
Stoppé! C:\Program Files (x86)\DartyBox Sécurité\ORSP Client\fsorsp.exe (2492)
Stoppé! C:\Windows\system32\sppsvc.exe (3012)
Stoppé! C:\Windows\System32\WUDFHost.exe (3028)
Stoppé! C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (2296)
Stoppé! C:\Program Files (x86)\DartyBox Sécurité\Anti-Virus\fsav32.exe (2696)
Stoppé! C:\Program Files (x86)\Skype\Phone\Skype.exe (2608)
Stoppé! C:\Program Files\Windows Sidebar\sidebar.exe (2616)
Stoppé! C:\Program Files (x86)\DartyBox Sécurité\Common\FSM32.EXE (3172)
Stoppé! C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (3304)
Stoppé! C:\Program Files (x86)\DartyBox Sécurité\Spam Control\fsscoepl_x64.exe (3596)
Stoppé! C:\Windows\system32\SearchIndexer.exe (3864)
Stoppé! C:\Program Files\Windows Media Player\wmpnetwk.exe (4020)
Stoppé! C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (2280)
Stoppé! C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe (4872)

################## | Éléments infectieux |


(!) Fichiers temporaires supprimés.

################## | Registre |


################## | Mountpoints2 |

Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{49521798-cf31-11e2-bb30-7071bc1dc52c}

################## | Listing |

[07/06/2013 - 14:46:41 | SHD ] C:\$Recycle.Bin
[07/07/2013 - 19:27:34 | N | 1503] C:\AdwCleaner[R1].txt
[07/07/2013 - 19:28:18 | N | 1563] C:\AdwCleaner[R2].txt
[07/07/2013 - 19:19:57 | N | 393] C:\AdwCleaner[S1].txt
[07/07/2013 - 19:22:26 | N | 6552] C:\AdwCleaner[S2].txt
[07/07/2013 - 19:29:42 | N | 364] C:\AdwCleaner[S3].txt
[07/07/2013 - 19:32:21 | N | 1634] C:\AdwCleaner[S4].txt
[14/07/2009 - 07:08:56 | SHD ] C:\Documents and Settings
[05/07/2013 - 18:43:16 | D ] C:\Games
[08/07/2013 - 09:11:16 | ASH | 3019350016] C:\hiberfil.sys
[08/07/2013 - 09:11:17 | ASH | 4025802752] C:\pagefile.sys
[14/07/2009 - 05:20:08 | D ] C:\PerfLogs
[07/07/2013 - 20:24:29 | N | 512] C:\PhysicalDisk0_MBR.bin
[08/07/2013 - 09:38:08 | D ] C:\Program Files
[07/07/2013 - 20:13:21 | D ] C:\Program Files (x86)
[08/07/2013 - 09:38:26 | HD ] C:\ProgramData
[28/05/2013 - 15:09:14 | SHD ] C:\Recovery
[24/06/2013 - 17:10:19 | D ] C:\Riot Games
[08/07/2013 - 09:38:02 | SHD ] C:\System Volume Information
[08/07/2013 - 10:28:41 | D ] C:\UsbFix
[08/07/2013 - 10:28:52 | A | 6266] C:\UsbFix [Clean 2] PC.txt
[08/07/2013 - 08:47:17 | N | 6394] C:\UsbFix [Scan 1] PC.txt
[08/07/2013 - 09:10:07 | N | 3854] C:\UsbFix [Scan 2] PC.txt
[07/06/2013 - 14:46:35 | D ] C:\Users
[08/07/2013 - 08:52:53 | D ] C:\Windows
[07/07/2013 - 20:24:30 | D ] C:\ZHP

################## | Vaccin |

C:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)

################## | E.O.F | https://www.sosvirus.net/ |

je l'ais poster le rapport de surpresion

voila :
Rapport de ZHPFix 2013.6.12.3 par Nicolas Coolman, Update du 12/06/2013
Fichier d'export Registre :
Run by the wizard at 08/07/2013 10:55:52
High Elevated Privileges : OK
Windows 7 Home Premium Edition, 64-bit Service Pack 1 (Build 7601)

Corbeille vidée

========== Clé(s) du Registre ==========
SUPPRIME Key: HKCU\Software\Softonic
SUPPRIME Key*: StartupReg: Browser Infrastructure Helper
SUPPRIME Key: HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\desksvc

========== Valeur(s) du Registre ==========
ABSENT Valeur Standard Profile: FirewallRaz :
ABSENT Valeur Domain Profile: FirewallRaz :
SUPPRIME FirewallRaz (Domain) : NetPres-In-TCP-NoScope
SUPPRIME FirewallRaz (Domain) : NetPres-Out-TCP-NoScope
SUPPRIME FirewallRaz (None) : NetPres-WSD-In-UDP
SUPPRIME FirewallRaz (None) : NetPres-WSD-Out-UDP
SUPPRIME FirewallRaz (Public) : NetPres-In-TCP
SUPPRIME FirewallRaz (Public) : NetPres-Out-TCP

========== Préférences navigateur ==========
PRESENT Chrome File: C:\Users\the wizard\AppData\Local\Google\Chrome\User Data\Default\Preferences
SUPPRIME Chrome Site: http://search.qvo6.com

========== Dossier(s) ==========
Aucun dossiers CLSID Local utilisateur vide
SUPPRIME Temporaires Windows
SUPPRIME Flash Cookies

========== Fichier(s) ==========
ABSENT File: c:\users\the wizard\desktop\free youtube downloader converter.lnk
ABSENT File: c:\program files (x86)\free youtube downloader converter\unwise.exe
ABSENT File: c:\users\the wizard\appdata\roaming\microsoft\windows\sendto\o4 - gs\sendto: desk 365.lnk
ABSENT File: c:\users\the wizard\appdata\local\smartbar\application\quickshare.exe
SUPPRIME File: c:\users\the wizard\downloads\softonicdownloader_pour_fl-studio.exe
ABSENT Folder/File: c:\users\the wizard\appdata\local\temp\bi_cleaner.exe
ABSENT Folder/File: c:\users\the wizard\appdata\local\temp\mlv_ar_201374152738_qvo6.exe
SUPPRIME Temporaires Windows
SUPPRIME Flash Cookies

========== Tache planifiée ==========
SUPPRIME Task: Desk 365 RunAsStdUser
SUPPRIME Task: {91CEDF63-A695-4809-8CAF-6166EFA5316C}

========== Restauration Système ==========
Point de restauration du système créé avec succès


========== Récapitulatif ==========
3 : Clé(s) du Registre
8 : Valeur(s) du Registre
3 : Dossier(s)
9 : Fichier(s)
2 : Préférences navigateur
2 : Tache planifiée
1 : Restauration Système


End of clean in 00mn 30s

========== Chemin de fichier rapport ==========
C:\ZHP\ZHPFix[R1].txt - 07/07/2013 19:15:20 [695]
C:\ZHP\ZHPFix[R2].txt - 08/07/2013 10:55:52 [2519]

dsl j'ais oublier de le mettre en PDF sur cjoint

nn je n'ais plus rien de qvo6 mais je vient de me rendre compte que c'est mon petit frère qui télécharge n'importe quoi et que j'ai encore un autre moteur de recherche qui s'appelle esay a life mais je vais m'en occupé tout seul
ps.dsl de raconter ma vie ;)

juste (dsl si je te re dérange) tu pourais me refaire un script pour zhpfix comme pour qvo6 mais pour esay a life, celui là aussi c'est bloquer en navigateur par défaut

nn justement j'y arrive pas c'est ce que j'ai fait en premier mais il est bloquer en navigateur par défaut comme qvo6

oui je sais le faire ça et je l'ais déjà fait mais ça ne fonctionne pas je ne peut pas activer google en moteur de recherche par défaut et esay a life est bloquer je ne peut pas l'enlever exactement comme qvo6

oui tkt je sais le faire ça ne fais que 2 fois ;)

oui voila :
https://www.cjoint.com/?3GisKfPG52N

je suis totalement d'accord avec toi et j'essaie de persuader ma mère (oui je suis mineur et c'est elle qui paye) depuis longtemps de prendre Avast ou un autre antivirus meilleur mais le problème est que f-secure est un antivirus fourni par mon FAI (darty avec le pack sécurité) et qu'elle ne veut pas résilier ce pack. dsl si je raconte ma vie :)

moi c'est tout réfléchit et je suis d'accord avec toi reste plus que ma mère

sinn je fais quoi pour esay a life?