Infectée par BasicServe ? Résolu/Fermé

Question

Bonsoir petit souci : je pense être infectée par BasicServe ma barre de recherche n'arrete pas de m'envoyer sur le site basicserve voici le rapport que j'ai fait avec OTL: OTL Extras logfile created on: 06/08/2013 21:08:01 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\christiane\Downloads 64bit- An unknown product (Version = 6.2.9200) - Type = NTWorkstation Internet Explorer (Version = 9.10.9200.16635) Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy 7,89 Gb Total Physical Memory | 6,26 Gb Available Physical Memory | 79,42% Memory free 9,08 Gb Paging File | 7,41 Gb Available in Paging File | 81,63% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 372,60 Gb Total Space | 323,10 Gb Free Space | 86,71% Space Free | Partition Type: NTFS Drive D: | 537,60 Gb Total Space | 537,44 Gb Free Space | 99,97% Space Free | Partition Type: NTFS Computer Name: CHRISTIANE | User Name: christiane | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\] .html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) .url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\] .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation) .html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\] .html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) [color=#E56717]========== Shell Spawning ==========[/color] [b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htafile [open] -- "%1" %* htmlfile [edit] -- Reg Error: Key error. htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1" http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation) InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation) Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htafile [open] -- "%1" %* htmlfile [edit] -- Reg Error: Key error. htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1" http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation) Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error. [color=#E56717]========== Security Center Settings ==========[/color] [b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 [b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = CE 37 E6 AF FF 6A CD 01 [binary data] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 [b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] [color=#E56717]========== Firewall Settings ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [color=#E56717]========== Authorized Applications List ==========[/color] [color=#E56717]========== Vista Active Open Ports Exception List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{08DF9207-336B-4D4F-B1FD-122BC45D324B}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | "{0D88E7EA-4335-480E-ABFC-33B696062B73}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{14C54B85-EBB8-44D3-8685-C6CD2494901C}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{2800778C-F852-466D-9B08-B77280D4A098}" = rport=138 | protocol=17 | dir=out | app=system | "{2ED360AB-676C-4FDB-9EB8-BE63DBA7AF87}" = lport=10243 | protocol=6 | dir=in | app=system | "{314A8464-9DA8-431C-A44C-6246429A9800}" = lport=2869 | protocol=6 | dir=in | app=system | "{38BECED9-9C25-47C7-A0BE-BD257524632C}" = rport=10243 | protocol=6 | dir=out | app=system | "{3DE9D56D-F077-48A1-ADA4-D3BFA8EDF58B}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{3E3C4863-A06B-44F8-8521-06752BC11540}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{4734059C-D838-4D68-ACC3-ED444B98886A}" = lport=138 | protocol=17 | dir=in | app=system | "{556EDDA1-BE5C-43D4-95B3-0AE35461F7C1}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{6757B130-8B98-4E16-A4EC-8BB14038B85F}" = lport=137 | protocol=17 | dir=in | app=system | "{7B6D88A2-C9BA-443D-B83E-66A82FD42E54}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{A1909C4D-778B-4921-96A6-7FA42174C460}" = lport=139 | protocol=6 | dir=in | app=system | "{A2BA7F50-9442-4BCD-B429-B92FF561B135}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{A901FDF4-A342-42C6-8C5B-FA0909302A3C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{B969596B-A003-48BA-9C02-338E0C30F441}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{CACDB418-5466-44CB-97EB-234638B11E8D}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | "{DC52DBD2-BFFC-429E-BFD8-E23D54EC6FC2}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{E0227AEB-7F1B-43E0-8506-612C9A4BADD9}" = lport=445 | protocol=6 | dir=in | app=system | "{F0905590-E559-44CF-8EFE-729C3310B9A2}" = rport=445 | protocol=6 | dir=out | app=system | "{F5F7EAE3-AFCE-4817-9AB7-99937502667C}" = rport=139 | protocol=6 | dir=out | app=system | "{FA4AB25D-BD60-41C1-B294-3A1125548235}" = rport=137 | protocol=17 | dir=out | app=system | [color=#E56717]========== Vista Active Application Exception List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{010DD732-4B49-48A9-9472-240B408531BB}" = dir=out | name=windows_ie_ac_001 | "{05810386-ADFF-4714-85B4-BA4D9347BB7B}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{0DC9E83D-4D97-4465-B2DE-F613EC75B8BF}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\platform\mcsvchost\mcsvhost.exe | "{222B2667-CD16-47E0-BE66-61176F36C9F7}" = dir=out | name=@{browserchoice_6.2.0.0_neutral_neutral_cw5n1h2txyewy?ms-resource://browserchoice/resources/displayname} | "{2DB33A1F-F369-4A50-8D4E-32B9BA61CCB2}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{336B51EA-49F9-4F83-9515-CA2F39D87FBE}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{3B1A6279-9A3D-4DDB-B95E-8FECEC0C5D1B}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{3B514E83-B88B-46B0-AF13-BBD0558623F8}" = dir=out | name=@{microsoft.bingweather_2.0.0.288_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingweather/resources/apptitle} | "{3C8DAB51-A464-419C-A636-B7366108D04A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{3D467A1B-3FE7-48DF-8F9F-E09CA0817FDC}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{48C483D5-F969-4B97-8A76-61278E4F967A}" = dir=in | name=@{microsoft.windowsphotos_16.4.4388.928_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsphotos/photo/residappname} | "{4C4C9B2D-13A7-4D3C-8378-BCB390FDCBA5}" = dir=out | name=@{magix.musicmakerjam_1.6.1013.3_x64__a2t3txkz9j1jw?ms-resource://magix.musicmakerjam/resources/appname} | "{4CA5AEC6-58D7-4CBE-80BB-507803F8D18A}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{57430468-62CE-455C-B9ED-D7679132D944}" = dir=out | name=@{microsoft.bingmaps_1.6.1821.2624_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingmaps/resources/appdisplayname} | "{5AED8E18-B4A6-42FF-9B20-4CF757E234EA}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{6914E8AD-C8FD-4215-A619-5A4E3CE2B964}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{6A334D07-C942-4994-B887-6A392B481510}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{6FFB5FDE-0FFC-4A96-984B-9CFA1587468A}" = dir=out | name=@{microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} | "{7BABFCAE-87BE-433E-9FC1-E2702A68084A}" = dir=out | name=@{microsoft.bingnews_2.0.0.273_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingnews/resources/news} | "{808F1451-4108-46FD-ADBB-F17324B5F0BD}" = dir=out | name=@{c:\windows\winstore\resources.pri?ms-resource://winstore/resources/displayname} | "{85101D39-3A97-4218-B987-4B9B0523DF30}" = dir=out | name=- games app - | "{8620A23D-CA87-4B7C-8163-73255E64A28B}" = dir=in | name=@{magix.musicmakerjam_1.6.1013.3_x64__a2t3txkz9j1jw?ms-resource://magix.musicmakerjam/resources/appname} | "{864290A5-1168-44A8-B9A7-7B9542197413}" = dir=in | name=skype | "{89EC63B6-B1EE-40E1-83EE-5573DD435C0F}" = dir=out | name=@{microsoft.bingsports_2.0.0.273_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingsports/resources/bingsports} | "{8C5AFAD3-7EEB-4287-B15D-B0EA8D6E1FAC}" = dir=out | name=@{microsoft.xboxlivegames_1.3.10.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.xboxlivegames/resources/34150} | "{8E74388B-54F6-46D4-855B-AC4D9737C364}" = dir=out | name=@{microsoft.windowsphotos_16.4.4388.928_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsphotos/photo/residappname} | "{8F2D28F4-3D49-4429-870D-1D748EA3C793}" = dir=in | name=@{browserchoice_6.2.0.0_neutral_neutral_cw5n1h2txyewy?ms-resource://browserchoice/resources/displayname} | "{8F742722-EB63-4B60-8280-435B83C49A8F}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | "{92DF4A83-1493-44F7-8475-0279545832E3}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{9661BFCA-EFAE-4ECE-BAF3-E475B3480C02}" = dir=out | name=@{microsoft.bing_1.5.1.259_x64__8wekyb3d8bbwe?ms-resource://microsoft.bing/resources/app_name} | "{99AB5382-1059-45AC-AAEB-E32736E99DF9}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\platform\mcsvchost\mcsvhost.exe | "{9CBDB688-1560-4EC3-B3C4-13B86FD1A88A}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\platform\mcsvchost\mcsvhost.exe | "{B323CA9F-3B58-4663-8B09-F937641F2F38}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{B4E8453F-D0D3-4033-88BF-3F8579476650}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd10\powerdvd10.exe | "{B666BAFA-C5AD-4D6B-ACAE-A7D5812668C8}" = dir=out | name=pinball fx2 | "{BB069D6A-1937-4A33-9F1F-7452B29BE369}" = dir=out | name=fresh paint | "{BD227504-CDBD-4F69-8F99-E09731CCC27C}" = dir=out | name=skype | "{BD42CF4D-74A0-49C7-9404-7A95D4EB4A36}" = dir=out | name=@{microsoft.reader_6.2.9200.20623_x64__8wekyb3d8bbwe?ms-resource://microsoft.reader/resources/shortdisplayname} | "{C344FDEE-4380-40A8-AE12-25550525123C}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{C5C4C1AE-0E1B-42CF-B9DC-66E8271A659E}" = dir=out | name=@{microsoft.zunemusic_1.4.18.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunemusic/resources/ids_manifest_music_app_name} | "{C769DAFF-E816-4956-AB53-DE235A362DB8}" = dir=out | name=@{microsoft.bingfinance_2.0.0.300_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingfinance/resources/apptitle} | "{CB8CC6AE-D144-4A8B-A67D-A60066D35038}" = dir=in | name=@{microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} | "{D11DC99A-55B5-45E1-B6BF-D6D90C3E0347}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{D29F4287-DB5A-414B-8278-3AB35FA6BDA7}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{D5884621-81B9-4324-A731-28143FBF1942}" = dir=in | name=@{microsoft.reader_6.2.9200.20623_x64__8wekyb3d8bbwe?ms-resource://microsoft.reader/resources/shortdisplayname} | "{D792E7C4-522B-4B05-BE29-503426DC8DF0}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\platform\mcsvchost\mcsvhost.exe | "{E0FEDE30-5402-497C-A97A-86BFB8C59639}" = dir=out | name=@{microsoft.zunevideo_1.4.19.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunevideo/resources/ids_manifest_video_app_name} | "{E13EA91B-FA16-4BA1-8808-ABAD760583EA}" = dir=out | name=@{microsoft.microsoftskydrive_16.4.4388.928_x64__8wekyb3d8bbwe?ms-resource://microsoft.microsoftskydrive/resources/shortproductname} | "{E7985E1D-C36F-4787-80A8-6350D07E9266}" = dir=in | name=@{c:\windows\winstore\resources.pri?ms-resource://winstore/resources/displayname} | "{ECF990F3-7620-456D-928D-BC13A24F7A21}" = protocol=6 | dir=out | app=system | "{ED2807CE-DF01-4824-A2BA-5B4000F8DEDF}" = dir=in | name=pinball fx2 | "{F3ABDC16-0C54-4ADE-8BDA-661DE1E18065}" = dir=out | name=@{microsoft.bingtravel_2.0.0.274_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingtravel/resources/apptitle} | "{F4911B2E-0D7A-4AF0-8FB7-9DFDB0571B38}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{F6735D4E-3703-4177-9A8F-33C378898D8E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{FE0F29D0-B22F-4B4E-BF47-E9A365F548BD}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 "{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting "{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}" = ASUS Power4Gear Hybrid "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 311.70 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 311.70 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Optimus" = NVIDIA Optimus 4.11.9 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 9.13.0325 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 4.11.9 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components "{E9FA781F-3E80-4399-825A-AD3E11C28C77}" = MSVCRT110_amd64 "{EF79C448-6946-4D71-8134-03407888C054}" = Shared C Run-time for x64 "{F4404AFD-2EF3-40C1-8C09-29E5F3B6972B}" = Intel® Trusted Connect Service Client "4A9DE1E9EBC800B7F01739D4DE7363EF6751BDF5" = Windows Driver Package - ASUS (ATP) Mouse (01/10/2013 1.0.0.170) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{03CC9D58-B132-4CC0-A521-4F3660AA43C7}" = Movie Maker "{0454BB9A-2A7A-4214-BDFF-937F7A711A44}" = Windows Live Communications Platform "{0969AF05-4FF6-4C00-9406-43599238DE0D}" = ASUS Splendid Video Enhancement Technology "{2CF22C94-1369-4C04-9A5F-A4BC6D91B508}" = IncrediMail "{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App" = Update Installer for WildTangent Games App "{30F99474-EBE3-4134-A02B-F6CD38CFE243}" = Photo Gallery "{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver "{3CBD94C1-BA15-488C-888B-D8DD296CC6DC}" = Fotogalerie "{427867D2-9459-4C7B-81E8-2CA570596645}" = NVIDIA PhysX "{446CC8CE-0E90-44F7-ADD0-774B243EF090}" = Galerie de photos "{49110532-D289-4BFF-807C-45B782E66A7C}" = Photo Common "{4AA2A466-8031-403A-8236-5301B4E391FB}" = Windows Live UX Platform Language Pack "{4AF53C99-315D-4536-873F-029D2D274AE2}" = Photo Common "{4CCBD1F4-CEEC-452A-9CB8-46564B501315}" = Windows Live UX Platform "{4D3286A6-F6AB-498A-82A4-E4F040529F3D}" = ASUS Smart Gesture "{63824BC0-B747-43F3-9863-1066D64AD919}" = Photo Gallery "{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components "{690F5BA3-5DEB-42CD-962B-F687EE59FAA7}" = Windows Live Essentials "{6A8DB215-7BCD-4377-B015-2E4541A3E7C6}" = Windows Live PIMT Platform "{6CEA775F-E70A-4D72-A3B4-1EB3A5AD4B5C}" = Windows Live Essentials "{701FE1BC-834A-4857-AF62-6EBA50CFBC78}" = Movie Maker "{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-asus" = WildTangent Games App "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable "{743FD554-A73F-4FE8-BE7B-C283D16297F9}" = Photo Common "{8A642ACD-CE3A-4A23-A8B1-A0F7EB12B214}" = Windows Live SOXE Definitions "{8D813AFF-D91D-4EE0-821F-B901FC2E89FA}" = Windows Live "{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT "{8E14DDC8-EA60-4E18-B3E3-1937104D5BDA}" = MSVCRT110 "{8E6E8CBB-8E58-493C-943F-4664F5F2FEDB}" = Movie Maker "{8F21291E-0444-4B1D-B9F9-4370A73E346D}" = WinFlash "{8FC4F1DD-F7FD-4766-804D-3C8FF1D309B0}" = Ralink RT2860 Wireless LAN Card "{90150000-0138-0409-0000-0000000FF1CE}" = Microsoft Office "{90993BD9-C7D9-4C2F-B56C-2F7AFEBD4CD0}" = Windows Live UX Platform Language Pack "{A17946CA-18E5-4CF0-8D55-A56D804718F8}" = Movie Maker "{A859E3E5-C62F-4BFA-AF1D-2B95E03166AF}" = ASUS USB Charger Plus "{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}" = ATK Package "{AC76BA86-7AD7-1036-7B44-AB0000000001}" = Adobe Reader XI (11.0.03) - Français "{AE8044B5-FCA3-4EBE-AC78-0FB3A6E8DC76}" = Movie Maker "{B096A0E4-26A1-4E9F-8548-577964B9434B}" = Windows Live Essentials "{B727564C-47D3-473A-AC9E-F4BE7B1BD5D3}" = Windows Live UX Platform Language Pack "{B7F31B9C-8775-4500-8E9D-6ABE9AE17CF4}" = Windows Live Essentials "{C424CD5E-EA05-4D3E-B5DA-F9F149E1D3AC}" = Windows Live Installer "{C9B6EFD0-4F01-4BBA-8374-39AD99A3ED72}" = Windows Live Photo Common "{CE542E0D-E056-4426-9F98-084C13E18641}" = Windows Live UX Platform Language Pack "{D04EBB49-C985-4A38-8695-62000861293A}" = Raccolta foto "{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = ASUSDVD "{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10 "{E1203F8C-FF34-4968-A4A5-B4F1F8533DAB}" = Photo Common "{ED6C77F9-4D7E-447C-9EC0-9A212D075535}" = Movie Maker "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU] "{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 "{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F21F0424-B2FF-40BF-A984-9E0D7FB4C97E}" = Windows Live UX Platform Language Pack "{F54030F3-14B6-432D-9361-78DCB1473920}" = Photo Common "{F67CA22C-C11F-4573-8406-57F75BA06B51}" = Photo Gallery "{F9D72742-0351-447C-B160-F0A5AC9D87BF}" = Alcor Micro USB Card Reader "{FA540E67-095C-4A1B-97BA-4D547DEC9AF4}" = ASUS Live Update "{FCB3772C-B7D0-4933-B1A9-3707EBACC573}" = Intel(R) SDK for OpenCL - CPU Only Runtime Package "{FE7C0B3D-50B9-4951-BE78-A321CBF86552}" = Windows Live SOXE "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin "AmUStor" = Alcor Micro USB Card Reader "ASUS WebStorage" = ASUS WebStorage Sync Agent "IncrediMail" = IncrediMail 2.0 "InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = ASUSDVD "Mozilla Firefox 22.0 (x86 fr)" = Mozilla Firefox 22.0 (x86 fr) "MSC" = McAfee LiveSafe - Internet Security "MyBitCast" = MyBitCast 2.0 "Picasa 3" = Picasa 3 "WildTangent wildgames Master Uninstall" = WildTangent Games "WinLiveSuite" = Windows Live Essentials "WTA-0eda17f7-fdf1-44cd-87c0-caf591ca3a2e" = Penguins! "WTA-4ac01422-47f4-450d-be29-dd2c93505f68" = Peggle "WTA-874d1d57-0527-4e80-adaa-bce83e1a070b" = Azteca "WTA-cf23f5a3-be59-42a3-91d4-7147cb84c427" = Bejeweled 3 "WTA-d927468d-46de-4206-b527-35d00680ffb7" = Tales of Lagoona "WTA-f9eaaca9-82be-44ea-8a23-da50b5803b42" = Cut the Rope [color=#E56717]========== Last 20 Event Log Errors ==========[/color] [ Application Events ] Error - 27/07/2013 10:53:13 | Computer Name = christiane | Source = Microsoft-Windows-Immersive-Shell | ID = 5973 Description = Échec de l'activation de l'application microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail avec l'erreur : -2147467263 Pour plus d'informations, voir le journal Microsoft-Windows-TWinUI/Opérationnel. Error - 27/07/2013 10:53:13 | Computer Name = christiane | Source = Microsoft-Windows-Immersive-Shell | ID = 5973 Description = Échec de l'activation de l'application microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail avec l'erreur : -2147467263 Pour plus d'informations, voir le journal Microsoft-Windows-TWinUI/Opérationnel. Error - 27/07/2013 15:04:32 | Computer Name = christiane | Source = MsiInstaller | ID = 1002 Description = Error - 27/07/2013 15:04:36 | Computer Name = christiane | Source = MsiInstaller | ID = 1002 Description = Error - 28/07/2013 06:42:05 | Computer Name = christiane | Source = Application Hang | ID = 1002 Description = Le programme IncMail.exe version 6.3.9.5274 a cessé d'interagir avec Windows et a été fermé. Pour déterminer si des informations supplémentaires sont disponibles, consultez l'historique du problème dans le Centre de maintenance. ID de processus : 704 Heure de début : 01ce8b5457ddec0a Heure de fin : 32 Chemin d'accès de l'application : C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe ID de rapport : 543cafb4-f772-11e2-be78-74d02bb33653 Nom complet du package défaillant : ID de l'application relative au package défaillant : Error - 28/07/2013 12:25:29 | Computer Name = christiane | Source = Microsoft-Windows-Immersive-Shell | ID = 5973 Description = Échec de l'activation de l'application microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail avec l'erreur : -2147467263 Pour plus d'informations, voir le journal Microsoft-Windows-TWinUI/Opérationnel. Error - 28/07/2013 12:25:29 | Computer Name = christiane | Source = Microsoft-Windows-Immersive-Shell | ID = 5973 Description = Échec de l'activation de l'application microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail avec l'erreur : -2147467263 Pour plus d'informations, voir le journal Microsoft-Windows-TWinUI/Opérationnel. Error - 28/07/2013 12:25:29 | Computer Name = christiane | Source = Microsoft-Windows-Immersive-Shell | ID = 5973 Description = Échec de l'activation de l'application microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail avec l'erreur : -2147467263 Pour plus d'informations, voir le journal Microsoft-Windows-TWinUI/Opérationnel. Error - 28/07/2013 12:25:29 | Computer Name = christiane | Source = Microsoft-Windows-Immersive-Shell | ID = 5973 Description = Échec de l'activation de l'application microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail avec l'erreur : -2147467263 Pour plus d'informations, voir le journal Microsoft-Windows-TWinUI/Opérationnel. Error - 29/07/2013 12:00:15 | Computer Name = christiane | Source = MsiInstaller | ID = 1002 Description = [ System Events ] Error - 27/07/2013 12:20:36 | Computer Name = christiane | Source = DCOM | ID = 10000 Description = Error - 27/07/2013 12:36:05 | Computer Name = christiane | Source = DCOM | ID = 10010 Description = Error - 27/07/2013 12:36:35 | Computer Name = christiane | Source = Service Control Manager | ID = 7009 Description = Le dépassement de délai (30000 millisecondes) a été atteint lors de l'attente de la connexion du service McAfee Home Network. Error - 27/07/2013 12:36:35 | Computer Name = christiane | Source = Service Control Manager | ID = 7000 Description = Le service McAfee Home Network n'a pas pu démarrer en raison de l'erreur : %%1053 Error - 27/07/2013 12:36:35 | Computer Name = christiane | Source = Service Control Manager | ID = 7009 Description = Le dépassement de délai (30000 millisecondes) a été atteint lors de l'attente de la connexion du service McAfee Personal Firewall Service. Error - 27/07/2013 12:36:35 | Computer Name = christiane | Source = Service Control Manager | ID = 7000 Description = Le service McAfee Personal Firewall Service n'a pas pu démarrer en raison de l'erreur : %%1053 Error - 27/07/2013 12:36:35 | Computer Name = christiane | Source = Service Control Manager | ID = 7009 Description = Le dépassement de délai (30000 millisecondes) a été atteint lors de l'attente de la connexion du service McAfee Proxy Service. Error - 27/07/2013 12:36:35 | Computer Name = christiane | Source = Service Control Manager | ID = 7000 Description = Le service McAfee Proxy Service n'a pas pu démarrer en raison de l'erreur : %%1053 Error - 27/07/2013 12:36:35 | Computer Name = christiane | Source = Service Control Manager | ID = 7009 Description = Le dépassement de délai (30000 millisecondes) a été atteint lors de l'attente de la connexion du service McAfee Anti-Spam Service. Error - 27/07/2013 12:36:35 | Computer Name = christiane | Source = Service Control Manager | ID = 7000 Description = Le service McAfee Anti-Spam Service n'a pas pu démarrer en raison de l'erreur : %%1053 < End of report > quelqu'un peut-il m'aider a supprimer cette m.... de mon pcportable sous windows 8 ? par avance merci de votre aide cordialement fratzilein

Malekal_morte- · Answer

Salut,     



Télécharge http://general-changelog-team.fr/telechargements/logiciels/viewdownload/75-outils-de-xplode/28-adwcleaner AdwCleaner ( d'Xplode ) sur ton bureau.  
Sur la page d'AdwCleaner, à droite, clic sur la disquette grise avec la flèche verte pour lancer le téléchargement.
Lance AdwCleaner, clique sur [Suppression] puis patiente le temps du scan (Pas besoin de faire de Recherche avant).  
Une fois le scan fini, un rapport s'ouvrira. Copie/colle le contenu du rapport dans ta prochaine réponse par un copier/coller.
Si cela ne fonctionne pas, utilise le site http://pjjoint.malekal.com pour héberger le rapport, donne le lien du rapport dans un nouveau message.

Note : Le rapport est également sauvegardé sous C:\AdwCleaner[S1].txt  


puis:


Faire un scan OTL pour diagnostiquer les programmes qui tournent et déceler des infections - Le programme va générer deux rapports OTL.txt et Extras.txt 
Fournir les deux rapports :

Tu peux suivre les indications de cette page pour t'aider : https://www.malekal.com/tutorial-otl/    

* Télécharge http://www.geekstogo.com/forum/files/file/398-otl-oldtimers-list-it/ sur ton bureau.    
(Sous Vista/Win7, il faut cliquer droit sur OTL et choisir Exécuter en tant qu'administrateur)    

Dans le cas d'Avast!, ne pas lancer le programme dans la Sandbox (voir lien d'aide ci-dessus).

* Lance OTL    
* En haut à droite de Analyse rapide, coche "tous les utilisateurs"
* Sur OTL, sous Personnalisation, copie-colle le script ci-dessous :    



netsvcs   
msconfig   
safebootminimal   
safebootnetwork   
activex   
drivers32   
%ALLUSERSPROFILE%\Application Data\*.   
%ALLUSERSPROFILE%\Application Data\*.exe /s   
%APPDATA%\*.   
%APPDATA%\*.exe /s   
%temp%\*.exe /s   
%SYSTEMDRIVE%\*.exe   
%systemroot%\*. /mp /s
%systemroot%\system32\consrv.dll
%systemroot%\system32\*.dll /lockedfiles   
%windir%\Tasks\*.job /lockedfiles   
%systemroot%\system32\drivers\*.sys /lockedfiles   
%systemroot%\System32\config\*.sav   
/md5start   
explorer.exe   
winlogon.exe
services.exe
wininit.exe
/md5stop
HKEY_CLASSES_ROOT\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32 /s
HKEY_LOCAL_MACHINE\SYSTEM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters /s
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems /s
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls /s
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList /s
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor /s
HKEY_CURRENT_USER\Software\Microsoft\Command Processor /s
CREATERESTOREPOINT   
nslookup https://www.google.fr/?gws_rd=ssl /c   
SAVEMBR:0   
hklm\software\clients\startmenuinternet|command /rs   
hklm\software\clients\startmenuinternet|command /64 /rs



* Clique sur le bouton Analyse.

* Quand le scan est fini, utilise le site http://pjjoint.malekal.com/ pour envoyer le rapport OTL.txt (et Extra.txt si présent).
Donne le ou les liens pjjoint qui pointent vers ces rapports ici dans un nouveau message.
Je répète : donne le lien du rapport pjjoint ici dans un nouveau message.

NE PAS COPIER/COLLER LE RAPPORT ICI - DONNER LE LIEN PJJOINT DANS UN NOUVEAU MESSAGE

fratzilein · Answer

bonsoir malekal
quand je clique sur lelien de pjjoint cela me mets :

nothing found for 403 Php et Error 404 - Page non trouvée

quant au scan de OTL je suisen train de le refaire avec  tes indications 
je mets le rapport dans quelques minutes

cordialement

fratzilein · Answer

bonjour
le rapport ADWCLEANER

# AdwCleaner v2.306 - Rapport créé le 07/08/2013 à 07:23:53
# Mis à jour le 19/07/2013 par Xplode
# Système d'exploitation : Windows 8  (64 bits)
# Nom d'utilisateur : christiane - CHRISTIANE
# Mode de démarrage : Normal
# Exécuté depuis : C:\Users\christiane\Downloads\adwcleaner.exe
# Option [Recherche]


***** [Services] *****


***** [Fichiers / Dossiers] *****


***** [Registre] *****


***** [Navigateurs] *****

-\ Internet Explorer v10.0.9200.16537

[OK] Le registre ne contient aucune entrée illégitime.

-\ Mozilla Firefox v22.0 (fr)

Fichier : C:\Users\christiane\AppData\Roaming\Mozilla\Firefox\Profiles\3mxloe5o.default\prefs.js

[OK] Le fichier ne contient aucune entrée illégitime.

*************************

AdwCleaner[R1].txt - [1136 octets] - [06/08/2013 21:02:02]
AdwCleaner[R2].txt - [821 octets] - [07/08/2013 07:23:53]
AdwCleaner[S1].txt - [1306 octets] - [06/08/2013 21:03:24]
AdwCleaner[S2].txt - [345 octets] - [06/08/2013 21:54:54]
AdwCleaner[S3].txt - [1070 octets] - [07/08/2013 07:21:52]

########## EOF - C:\AdwCleaner[R2].txt - [1059 octets] ##########

Bonne journée
cordialement

Malekal_morte- · Answer

Utilise pjjoint pour donner le rapport OTL.

fratzilein · Answer

bonsoir malekal
comme indiqué je n'arrive pas à accéder à la page de pjjoint 
j'arrive sur une page avec le message : 
nothing found for 403 Php et Error 404 - Page non trouvée

(sur Firefox)

par contre sur IE cela passe (grrrrrrr)

http://pjjoint.malekal.com/files.php?id=OTL_20130807_i6x9g14v11j7
cordialement

Malekal_morte- · Answer

Relance OTL. 
. 
o sous Personnalisation (Custom Scan), copie_colle le contenu du cadre ci dessous (bien prendre :OTL en début).
Clic Correction (Fix), un rapport apparraitra, copie/colle le contenu ici:  

:OTL
IE - HKU\S-1-5-18\..\SearchScopes\{47AE1BA9-0BD1-44F4-88AE-45F8F7B605EF}: URL = http://www.basicserve.com/?prt=BASICSERVE111&sp=&keywords={searchTerms} 
FF - prefs.js..keyword.URL: http://www.basicserve.com/?prt=bscsrvlink1&sp=google&keywords=
[2013/08/06 07:37:35 | 000,000,000 | ---D | M] (BasicServe) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{740B3FD5-4483-469D-BE7F-8555B153BD04} 
[2013/07/26 20:35:20 | 000,000,000 | R--D | C] -- C:\Users\christiane\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 


* redemarre le pc sous windows et poste le rapport ici

fratzilein · Answer

rebonsoir

le nouveau rapport

========== OTL ==========
Registry key HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes\{47AE1BA9-0BD1-44F4-88AE-45F8F7B605EF}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47AE1BA9-0BD1-44F4-88AE-45F8F7B605EF}\ not found.
Prefs.js: http://www.basicserve.com/?prt=bscsrvlink1&sp=google&keywords= removed from keyword.URL
Folder C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{740B3FD5-4483-469D-BE7F-8555B153BD04}\ not found.
Folder C:\Users\christiane\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\ not found.
 
OTL by OldTimer - Version 3.2.69.0 log created on 08072013_221837


par contre sur mon bureau je me retrouve avec  fichier "desktop.init"
j'en fait quoi ???

par avance merci  de ta patience
cordialement

Malekal_morte- · Answer

plus de BasicServe?

fratzilein · Answer

a priori plus de basicserve
en tous les cas il n'apparait plus dans les extensions
merci beaucoup

par contre pour les fichiers .ini je fais quoi (apparu sur mon bureau après que j'ai redémarré windows)

cordialement

Malekal_morte- · Answer

retire l'affichage des fichiers cachés et systèmes : https://www.commentcamarche.net/informatique/windows/185-afficher-les-extensions-et-les-fichiers-caches-sous-windows/


~~

Pour ne plus te faire avoir.
A lire - Programmes parasites / PUPs : https://www.malekal.com/adwares-pup-protection/

fratzilein · Answer

merci beaucoup pour ton aide si précieuse
je vais potasser ton dernier lien pour ne plus me faire pièger

cordialement
fratzilein

Infectée par BasicServe ?

11 réponses

Discussions similaires