Virus

voici le rapport

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:54, on 2008-10-05
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Windows\sttray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Common Files\ACD Systems\FR\DevDetect.exe
C:\Program Files\McAfee\MSK\mskagent.exe
C:\Windows\System32\osa9.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\802.11 Wireless LAN\802.11g USB 2.0 WLAN Dongle\WlanCU.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\Explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer fourni par Dell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: dcads - {3adfedda-582b-7eb0-447a-02d22ea666af} - C:\Windows\system32\nsaE32A.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "c:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [ECenter] c:\dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Device Detector] DevDetect.exe -autorun
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [Office SturtUp] osa9.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [TVAgent WiFi] E:\Fr_wifi\tools\Agent_WiFi.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Wireless Configuration Utility HW.14.lnk = C:\Program Files\802.11 Wireless LAN\802.11g USB 2.0 WLAN Dongle\WlanCU.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe (file missing)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O13 - Gopher Prefix:
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/download/scanner/en-US/wlscctrl2.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://brn446.spaces.live.com/PhotoUpload/VistaMsnPUpldfr-fr.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game02.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {EFD3EA56-234D-4240-90EA-CC9FA3AF5A01} (ConnectivityTester Class) - http://motive.club-internet.fr:2112/lwp/static/installers/WebflowActiveXInstaller_4-0-0.cab
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: lxbk_device - - C:\Windows\system32\lxbkcoms.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

voici le rapport malwarebytes

Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1229
Windows 6.0.6000

2008-10-05 11:40:40
mbam-log-2008-10-05 (11-40-40).txt

Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|)
Eléments examinés: 170033
Temps écoulé: 1 hour(s), 5 minute(s), 30 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 28
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 43

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\dc_ads.ads (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\dc_ads.ads.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\iebrowsercmp.browsercmp (Adware.RightOnAds) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\iebrowsercmp.browsercmp.1 (Adware.RightOnAds) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{8d71eeb8-a1a7-4733-8fa2-1cac015c967d} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\Sidebar.DLL (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\superiorads (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\dcadssearchassistant (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWay) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\AdvRemoteDbg (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MediaHoldings (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\dcadssocial (Adware.RightOnAds) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3adfedda-582b-7eb0-447a-02d22ea666af} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3adfedda-582b-7eb0-447a-02d22ea666af} (Trojan.BHO) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Windows\System32\drivers\downld (Trojan.Agent) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Program Files\eMule\emule.exe (Rogue.Fake!emule.exe) -> Quarantined and deleted successfully.
C:\Program Files\eMule\LinkCreator.exe (Rogue.Fake!emule.exe) -> Quarantined and deleted successfully.
C:\Windows\System32\WhoisCL.exe (Adware.BHO) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\1074425.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\1116608.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\454867.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\467441.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\520544.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\522899.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\534755.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\543335.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\547750.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\559715.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\573428.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\573849.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\576610.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\624284.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\645391.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\656811.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\659353.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\661366.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\679867.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\687200.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\695546.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\704562.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\705389.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\708899.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\711317.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\749428.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\764826.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\794091.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\809208.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\820658.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\851749.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\862935.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\downld\982619.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\dcads_sidebar.dll (Adware.BHO) -> Quarantined and deleted successfully.
C:\Windows\System32\dcads_sidebar_uninstall.exe (Adware.BHO) -> Quarantined and deleted successfully.
C:\Windows\System32\superiorads-uninst.exe (Adware.BHO) -> Quarantined and deleted successfully.
C:\Windows\System32\mdelk.exe (Trojan.Spammer) -> Quarantined and deleted successfully.
C:\Windows\System32\DcadsSocial-uninstall.exe (Adware.RightOnAds) -> Quarantined and deleted successfully.
C:\Users\bidou\AppData\Roaming\urlredir.cfg (Adware.RightOnAds) -> Quarantined and deleted successfully.
C:\Windows\System32\nsaE32A.dll (Trojan.BHO) -> Delete on reboot.

voici le nouveau rapport hijackthis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:53, on 2008-10-05
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Windows\sttray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Common Files\ACD Systems\FR\DevDetect.exe
C:\Program Files\McAfee\MSK\mskagent.exe
C:\Windows\System32\osa9.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\802.11 Wireless LAN\802.11g USB 2.0 WLAN Dongle\WlanCU.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer fourni par Dell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "c:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [ECenter] c:\dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Device Detector] DevDetect.exe -autorun
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [Office SturtUp] osa9.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [TVAgent WiFi] E:\Fr_wifi\tools\Agent_WiFi.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Wireless Configuration Utility HW.14.lnk = C:\Program Files\802.11 Wireless LAN\802.11g USB 2.0 WLAN Dongle\WlanCU.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe (file missing)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O13 - Gopher Prefix:
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/download/scanner/en-US/wlscctrl2.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://brn446.spaces.live.com/PhotoUpload/VistaMsnPUpldfr-fr.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game02.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {EFD3EA56-234D-4240-90EA-CC9FA3AF5A01} (ConnectivityTester Class) - http://motive.club-internet.fr:2112/lwp/static/installers/WebflowActiveXInstaller_4-0-0.cab
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: lxbk_device - - C:\Windows\system32\lxbkcoms.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

j'ai désactivé macafee et ai essayé d'installer antivir mais impossible à faire marcher j'ai un message d'erreur disant qu'antivir n'est pas une appli win32

du coup, je crois que plus rien ne marche en matière d'antivirus

je fais de suite ce que tu me proposes ;-)

merci beaucoup de m'aider

un fois que j'ai téléchargé le pack vista, je dois le dégoupiller?

recoucou
le pack vista ne veut pas s'installer, j'ai un message d'erreur me disant qu'il y a une erreur au niveau de l'install
et pour javara.exe il me dit que mes parametres de connexions ne sont pas compatibles alors que tout est correct
du coup aucun des deux ne marche

voici le rapport de findykill



----------------- FindyKill V3.095 ------------------

* User : bidou - PC-DE-BIDOU
* Emplacement : C:\Program Files\FindyKill
* Outils Mis a jours le 02/10/08 par Chiquitine29
* Recherche effectuée à 14:39:17 le 2008-10-05
* Windows Vista - Internet Explorer 7.0.6000.16643

((((((((((((((((( *** Recherche *** ))))))))))))))))))


»»»» Presence des fichiers dans C:

Présent ! - C:\InfoSat.txt

»»»» Presence des fichiers dans C:\Windows


»»»» Presence des fichiers dans C:\Windows\Prefetch


»»»» Presence des fichiers dans C:\Windows\system32


»»»» Presence des fichiers dans C:\Windows\system32\drivers


»»»» Presence des fichiers dans C:\Users\bidou\AppData\Roaming


»»»» Presence des fichiers dans C:\Users\bidou\AppData\Local\Temp


»»»» Registre :


HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Windows Defender REG_EXPAND_SZ %ProgramFiles%\Windows Defender\MSASCui.exe -hide
NvSvc REG_SZ RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
NvCplDaemon REG_SZ RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
NvMediaCenter REG_SZ RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
SunJavaUpdateSched REG_SZ "c:\Program Files\Java\jre1.6.0\bin\jusched.exe"
SigmatelSysTrayApp REG_SZ sttray.exe
ISUSScheduler REG_SZ "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
(par défaut) REG_SZ
RoxWatchTray REG_SZ "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
PDVDDXSrv REG_SZ "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
ECenter REG_SZ c:\dell\E-Center\EULALauncher.exe
ISUSPM Startup REG_SZ C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
TkBellExe REG_SZ "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
Device Detector REG_SZ DevDetect.exe -autorun
MskAgentexe REG_SZ C:\Program Files\McAfee\MSK\MskAgent.exe
mcagent_exe REG_SZ C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
avgnt REG_SZ "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
Malwarebytes Anti-Malware (reboot) REG_SZ "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript


HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
MsnMsgr REG_SZ "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
TVAgent WiFi REG_SZ E:\Fr_wifi\tools\Agent_WiFi.exe
WMPNSCFG REG_SZ C:\Program Files\Windows Media Player\WMPNSCFG.exe


Présent ! - HKEY_USERS\S-1-5-21-1268719652-840382768-1277365833-1000\Software\Local AppWizard-Generated Applications\hldrrr
Présent ! - HKEY_USERS\S-1-5-21-1268719652-840382768-1277365833-1000\Software\bisoft
Présent ! - HKEY_USERS\S-1-5-21-1268719652-840382768-1277365833-1000\Software\FirtR
Présent ! - HKEY_USERS\S-1-5-21-1268719652-840382768-1277365833-1000\Software\MuleAppData
Présent ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\hldrrr
Présent ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa
Présent ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Présent ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Présent ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA
Présent ! - HKEY_CURRENT_USER\Software\bisoft
Présent ! - HKEY_CURRENT_USER\Software\FirtR
Présent ! - HKEY_CURRENT_USER\Software\MuleAppData
Present ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{55caf37d-7506-11dd-ae84-001aa00f5cfb}
Present ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{55caf37d-7506-11dd-ae84-001aa00f5cfb}
Present ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{55caf37d-7506-11dd-ae84-001aa00f5cfb}


»»»» Presence d infections dans Support amovible :


Présent ! - E:\autorun.inf
Présent ! - J:\autorun.inf
Présent ! - J:\nideiect.com


----------------- ! Fin du rapport ! ------------------

j'ai utilisé tes astuces.. ça me dit que mon ordi est sain..
au moins une bonne chose en plus de ton aide très précieuse en ce dimanche...et je t'en remercie encore beaucoup..
on me conseille de formater tout de même et de revenir à XP.
j'aimerai que tu me donnes ton avis.. merci encore de ta précieuse aide

coucou
voici mon rapport lop
mais je crois qu'il y a un bug dans la mesure où j'avais tout le temps un message d'erreur du style chaine de caractères interrompue ou quelque chose comme ça..


--------------------\\ Lop S&D 4.2.4-5 XP/Vista

Microsoft® Windows Vista™ Édition Familiale Basique ( v6.0.6000 )
X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 X2 Dual Core Processor 3600+ )
BIOS : )Phoenix - Award WorkstationBIOS v6.00PG
USER : bidou ( Administrator )
BOOT : Normal boot
Antivirus : McAfee VirusScan (Not Activated)
Firewall : McAfee Personal Firewall (Not Activated)
C:\ (Local Disk) - NTFS - Total : 138 Go Free : 71 Go
D:\ (Local Disk) - NTFS - Total : 9 Go Free : 6 Go
E:\ (CD or DVD) - CDFS - Total : 0 Go Free : 0 Go
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)
J:\ (USB) - FAT32 - Total : 7633 Mo Free : 1 Go

"C:\Lop SD" ( MAJ : 02-10-2008|23:42 )
Option : [1] ( 2008-10-07| 0:17 )

--------------------\\ Listing des dossiers dans Local

[2008-01-17|20:50] C:\Users\bidou\AppData\Local\ACDSee
[2007-04-30|12:12] C:\Users\bidou\AppData\Local\Adobe
[2007-04-19|22:02] C:\Users\bidou\AppData\Local\Application Data
[2007-05-07|19:35] C:\Users\bidou\AppData\Local\d3d9caps.dat
[2008-10-03|17:29] C:\Users\bidou\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008-08-27|22:04] C:\Users\bidou\AppData\Local\eMule
[2008-10-04|22:40] C:\Users\bidou\AppData\Local\GDIPFONTCACHEV1.DAT
[2008-05-06|00:00] C:\Users\bidou\AppData\Local\Google
[2007-04-19|22:02] C:\Users\bidou\AppData\Local\Historique
[2008-10-05|18:21] C:\Users\bidou\AppData\Local\IconCache.db
[2007-12-06|20:28] C:\Users\bidou\AppData\Local\Logitech-LS
[2008-09-24|08:34] C:\Users\bidou\AppData\Local\Ludi
[2008-10-04|10:34] C:\Users\bidou\AppData\Local\Microsoft
[2008-02-24|23:41] C:\Users\bidou\AppData\Local\Microsoft Games
[2007-04-21|19:39] C:\Users\bidou\AppData\Local\Mozilla
[2008-05-30|00:54] C:\Users\bidou\AppData\Local\NOS
[2008-01-25|23:05] C:\Users\bidou\AppData\Local\PowerDVD DX
[2007-04-21|18:08] C:\Users\bidou\AppData\Local\Protexis
[2008-10-07|00:16] C:\Users\bidou\AppData\Local\Temp
[2007-04-19|22:02] C:\Users\bidou\AppData\Local\Temporary Internet Files
[2007-04-25|12:16] C:\Users\bidou\AppData\Local\VirtualStore
[2008-01-31|20:56] C:\Users\bidou\AppData\Local\WindowsUpdate
[2008-07-16|17:51] C:\Users\bidou\AppData\Local\Zylom Games

--------------------\\ Tâches planifiées dans C:\Windows\tasks

[2008-09-15 16:15][--a------] C:\Windows\tasks\McDefragTask.job
[2008-10-01 01:00][--a------] C:\Windows\tasks\McQcTask.job
[2008-10-05 18:38][--ah-----] C:\Windows\tasks\SA.DAT
[2008-10-05 18:22][--a------] C:\Windows\tasks\SCHEDLGU.TXT

--------------------\\ Listing des dossiers dans C:\ProgramData

[2007-05-07|23:31] C:\ProgramData\.zreglib
[2008-01-17|20:46] C:\ProgramData\ACD Systems
[2008-05-30|10:24] C:\ProgramData\Adobe
[2007-04-25|13:07] C:\ProgramData\Apple Computer
[2007-04-19|21:58] C:\ProgramData\Application Data
[2008-10-04|14:22] C:\ProgramData\Avira
[2007-05-04|21:09] C:\ProgramData\AVS4YOU
[2007-11-09|21:29] C:\ProgramData\Azureus
[2007-04-19|21:58] C:\ProgramData\Bureau
[2007-04-14|19:54] C:\ProgramData\Corel
[2007-05-04|21:28] C:\ProgramData\CyberLink
[2007-04-14|20:02] C:\ProgramData\Dell
[2007-04-19|21:58] C:\ProgramData\Documents
[2008-01-24|00:22] C:\ProgramData\DVD Shrink
[2007-05-07|23:28] C:\ProgramData\Elaborate Bytes
[2008-08-27|22:07] C:\ProgramData\eMule
[2007-04-19|21:58] C:\ProgramData\Favoris
[2008-09-09|18:06] C:\ProgramData\GameHouse
[2007-06-27|00:44] C:\ProgramData\Google
[2008-10-07|00:15] C:\ProgramData\Google Updater
[2007-12-08|18:49] C:\ProgramData\Installer.log
[2007-04-14|19:58] C:\ProgramData\InstallShield
[2007-12-08|18:28] C:\ProgramData\Logishrd
[2008-10-05|10:30] C:\ProgramData\Malwarebytes
[2008-10-04|23:04] C:\ProgramData\McAfee
[2007-04-19|21:58] C:\ProgramData\Menu Démarrer
[2007-05-01|19:21] C:\ProgramData\Messenger Plus!
[2008-02-26|18:42] C:\ProgramData\Microsoft
[2007-04-19|21:58] C:\ProgramData\Modèles
[2008-01-24|20:07] C:\ProgramData\NCH Software
[2008-02-13|13:32] C:\ProgramData\NVIDIA
[2008-07-02|20:27] C:\ProgramData\PlayFirst
[2008-10-01|11:28] C:\ProgramData\Roxio
[2007-04-14|19:58] C:\ProgramData\Sonic
[2008-05-04|16:37] C:\ProgramData\SpinTop Games
[2007-10-16|01:11] C:\ProgramData\TERMINAL Studio
[2007-10-16|01:08] C:\ProgramData\Trymedia
[2008-10-05|12:12] C:\ProgramData\Zylom

--------------------\\ Listing des dossiers dans C:\Program Files

[2008-10-02|14:22] C:\Program Files\802.11 Wireless LAN
[2008-01-17|20:46] C:\Program Files\ACD Systems
[2007-04-14|19:52] C:\Program Files\Adobe
[2008-10-03|20:33] C:\Program Files\Alwil Software
[2008-10-04|14:22] C:\Program Files\Avira
[2007-09-12|17:02] C:\Program Files\AviSynth 2.5
[2008-02-09|22:46] C:\Program Files\AVS4YOU
[2007-04-14|20:05] C:\Program Files\BAE
[2007-10-16|01:06] C:\Program Files\BFG
[2008-10-04|23:04] C:\Program Files\Common Files
[2007-04-14|19:55] C:\Program Files\Corel
[2007-04-14|20:02] C:\Program Files\CyberLink
[2007-04-14|20:07] C:\Program Files\Dell
[2007-05-07|23:34] C:\Program Files\Elaborate Bytes
[2008-10-05|11:40] C:\Program Files\eMule
[2007-04-19|21:58] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
[2008-10-05|15:01] C:\Program Files\FindyKill
[2008-10-05|16:47] C:\Program Files\FreeCommander
[2008-08-28|22:59] C:\Program Files\Google
[2007-06-19|11:07] C:\Program Files\GSpot
[2008-02-14|00:57] C:\Program Files\IE7Pro
[2007-07-02|09:53] C:\Program Files\illiminable
[2008-10-03|21:57] C:\Program Files\InstallShield Installation Information
[2008-04-13|10:23] C:\Program Files\Internet Explorer
[2007-07-20|22:41] C:\Program Files\IrfanView
[2007-04-14|19:50] C:\Program Files\Java
[2008-10-04|23:04] C:\Program Files\JetAudio
[2007-06-05|19:40] C:\Program Files\Lexmark X1100 Series
[2007-12-08|18:32] C:\Program Files\Logitech
[2008-09-24|08:34] C:\Program Files\Ludi
[2008-10-05|10:31] C:\Program Files\Malwarebytes' Anti-Malware
[2008-10-04|23:03] C:\Program Files\McAfee
[2008-10-04|23:03] C:\Program Files\McAfee.com
[2008-03-03|20:02] C:\Program Files\MediaCoder
[2008-02-07|21:02] C:\Program Files\Messenger Plus! Live
[2008-01-31|21:04] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2008-01-20|17:06] C:\Program Files\Microsoft Carioca
[2006-11-02|14:35] C:\Program Files\Microsoft Games
[2007-04-14|19:52] C:\Program Files\Microsoft Office
[2008-09-14|10:18] C:\Program Files\Microsoft Works
[2006-11-02|14:40] C:\Program Files\Movie Maker
[2008-10-05|12:39] C:\Program Files\Mozilla Firefox
[2006-11-02|14:35] C:\Program Files\MSBuild
[2006-11-02|14:35] C:\Program Files\MSN
[2008-02-07|21:02] C:\Program Files\MSN Messenger
[2007-04-14|19:49] C:\Program Files\MSXML 4.0
[2007-04-21|18:38] C:\Program Files\QuickZip4
[2008-07-16|17:36] C:\Program Files\Rastafarai Script V4-3
[2008-08-27|22:32] C:\Program Files\Rastafarai Script V4-4
[2008-09-29|13:51] C:\Program Files\Real
[2006-11-02|14:35] C:\Program Files\Reference Assemblies
[2007-04-14|20:01] C:\Program Files\Roxio
[2007-04-14|19:50] C:\Program Files\SigmaTel
[2007-06-22|11:44] C:\Program Files\SlySoft
[2008-10-05|19:36] C:\Program Files\SudokuSweep
[2008-10-05|16:03] C:\Program Files\Tarobot
[2007-10-22|22:32] C:\Program Files\The Rise of Atlantis
[2008-10-05|09:54] C:\Program Files\Trend Micro
[2008-10-03|21:56] C:\Program Files\TRENDnet
[2006-11-02|14:58] C:\Program Files\Uninstall Information
[2007-04-20|14:07] C:\Program Files\VideoLAN
[2007-07-02|09:56] C:\Program Files\VistaCodecPack
[2007-12-16|11:24] C:\Program Files\Windows Calendar
[2006-11-02|14:40] C:\Program Files\Windows Collaboration
[2007-04-21|03:10] C:\Program Files\Windows Defender
[2008-10-05|15:07] C:\Program Files\Windows Live Safety Center
[2008-03-16|11:11] C:\Program Files\Windows Mail
[2007-12-09|14:47] C:\Program Files\Windows Media Player
[2007-04-19|21:58] C:\Program Files\Windows NT
[2006-11-02|14:40] C:\Program Files\Windows Photo Gallery
[2008-01-13|11:04] C:\Program Files\Windows Sidebar
[2007-07-03|16:35] C:\Program Files\XviD

--------------------\\ Listing des dossiers dans C:\Program Files\Common Files

[2008-01-17|20:46] C:\Program Files\Common Files\ACD Systems
[2008-05-30|10:25] C:\Program Files\Common Files\Adobe
[2008-02-09|22:46] C:\Program Files\Common Files\AVSMedia
[2007-04-14|19:56] C:\Program Files\Common Files\Corel
[2007-12-30|08:53] C:\Program Files\Common Files\COWON
[2007-04-14|19:59] C:\Program Files\Common Files\InstallShield
[2007-04-14|19:50] C:\Program Files\Common Files\Java
[2007-12-08|18:29] C:\Program Files\Common Files\LogiShrd
[2008-10-04|23:03] C:\Program Files\Common Files\McAfee
[2008-02-09|22:45] C:\Program Files\Common Files\microsoft shared
[2007-04-21|08:09] C:\Program Files\Common Files\Motive
[2008-02-05|21:48] C:\Program Files\Common Files\PX Storage Engine
[2007-04-30|15:11] C:\Program Files\Common Files\Real
[2007-04-14|19:58] C:\Program Files\Common Files\Roxio Shared
[2006-11-02|13:18] C:\Program Files\Common Files\Services
[2007-04-14|20:00] C:\Program Files\Common Files\Sonic Shared
[2006-11-02|13:18] C:\Program Files\Common Files\SpeechEngines
[2007-04-14|19:58] C:\Program Files\Common Files\SureThing Shared
[2007-06-14|03:15] C:\Program Files\Common Files\System
[2007-04-30|15:11] C:\Program Files\Common Files\xing shared

--------------------\\ Process

( 77 Processes )

iexplore.exe ~ [PID:4308]

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

C:\Users\bidou\AppData\Roaming\MICROS~1\Windows\Cookies\bidou@advertising[2].txt

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE


--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-07 00:32:28
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 959

--------------------\\ Recherche d'autres infections

impossible d'aller jusqu'au bout avec combofix j'ai un écran bleu qui apparait en me disant ce message d'erreur :
invalid_kernel_handle

C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 -->2008-10-07 11:00:57
C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 -->2008-10-07 11:00:57
C:\Windows\System32\CF559.exe -->2008-10-07 10:49:13
C:\Windows\System32\CF28612.exe -->2008-10-07 10:25:09
C:\Windows\System32\PerfStringBackup.INI -->2008-10-05 10:33:37
C:\Windows\System32\perfh00C.dat -->2008-10-05 10:33:37
C:\Windows\System32\perfh009.dat -->2008-10-05 10:33:37
C:\Windows\System32\perfc00C.dat -->2008-10-05 10:33:37
C:\Windows\System32\perfc009.dat -->2008-10-05 10:33:37
C:\Windows\System32\CF21015.exe -->2008-10-04 14:52:37
C:\Windows\System32\FNTCACHE.DAT -->2008-10-04 14:07:11
C:\Windows\System32\config.nt -->2008-10-04 02:46:10
C:\Windows\System32\nvapps.xml -->2008-10-03 21:23:14
C:\Windows\System32\Config.MPF -->2008-10-03 20:24:33
C:\Windows\System32\osa9.exe -->2008-09-29 10:29:25
C:\Windows\System32\lvcoinst.log -->2008-08-27 21:49:29
C:\Windows\System32\mrt.exe -->2008-08-26 22:28:12
C:\Windows\System32\dcads-remove.exe -->2008-07-17 01:46:16
C:\Windows\System32\kd1394.dll -->2008-02-29 08:51:24
C:\Windows\System32\srcore.dll -->2008-02-29 08:39:13
C:\Windows\System32\srclient.dll -->2008-02-29 08:39:13
C:\Windows\System32\srdelayed.exe -->2008-02-29 08:38:59
C:\Windows\System32\rstrui.exe -->2008-02-29 08:38:54
C:\Windows\System32\kbd106n.dll -->2008-02-29 08:35:17
C:\Windows\System32\f3ahvoas.dll -->2008-02-29 08:34:50

C:\Windows\bootstat.dat -->2008-10-07 11:00:07
C:\Windows\WindowsUpdate.log -->2008-10-07 10:43:51
C:\Windows\ntbtlog.txt -->2008-10-07 10:33:38
C:\Windows\SPInstall.etl -->2008-10-05 14:50:28
C:\Windows\PFRO.log -->2008-10-05 11:45:18
C:\Windows\MEMORY.DMP -->2008-10-04 22:06:19
C:\Windows\comm.bin -->2008-10-04 14:29:50
C:\Windows\setupact.log -->2008-10-02 12:52:52
C:\Windows\nsw.log -->2008-10-02 12:43:00
C:\Windows\DPINST.LOG -->2008-10-02 11:36:24
C:\Windows\Absolute Mastermind Setup Log.txt -->2008-02-28 15:32:10
C:\Windows\iun6002.exe -->2008-02-28 15:31:25
C:\Windows\InvInstaller.log -->2008-02-25 21:30:23
C:\Windows\setuperr.log -->2008-02-13 14:33:07
C:\Windows\win.ini -->2008-02-09 11:57:21

C:\Windows\System32\CF559.exe -->2008-10-07 10:49:13
C:\Windows\System32\CF28612.exe -->2008-10-07 10:25:09
C:\Windows\System32\CF21015.exe -->2008-10-04 14:52:37
C:\Windows\System32\osa9.exe -->2008-09-29 10:29:25
C:\Windows\System32\mrt.exe -->2008-08-26 22:28:12
C:\Windows\System32\dcads-remove.exe -->2008-07-17 01:46:16
C:\Windows\System32\srdelayed.exe -->2008-02-29 08:38:59
C:\Windows\System32\rstrui.exe -->2008-02-29 08:38:54
C:\Windows\iun6002.exe -->2008-02-28 15:31:25
C:\Windows\System32\kd1394.dll -->2008-02-29 08:51:24
C:\Windows\System32\srcore.dll -->2008-02-29 08:39:13
C:\Windows\System32\srclient.dll -->2008-02-29 08:39:13
C:\Windows\System32\kbd106n.dll -->2008-02-29 08:35:17
C:\Windows\System32\f3ahvoas.dll -->2008-02-29 08:34:50

oui!

je dois partir travailler...
je ferai cette analyse ce soir en rentrant...
bonne journée à toi

coucou.; je suis rentrée du travail et ai lancé l'analyse...
je dois être fatiguée car je ne trouve pas le rapport!

j'ai justementfaitça.. suite à ceque j'ai lu sur le tuto

bonjour,

j'étais un peu fatiguée hier soir et pas trop assuré..
j'ai refait l'analyse ce matin, et généré le rapport

Version - a-squared Free 3.5
Dernière mise à jour : 2008-10-07 20:03:36

Paramètres des balayages :

Éléments : Mémoire, Traces, Cookies, C:\Windows\, C:\Program Files
Balaye dans les archives : Marche
Analyse heuristique : Marche
Balaye dans les ADS : Marche

Début du balayage : 2008-10-08 09:21:42

c:\program files\the rise of atlantis Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\animation Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\animation\blue Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\animation\clown Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\animation\hz Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\animation\lion Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\animation\treug Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\font Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\sound Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\sound\mult Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\sound\music Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\art Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\art\fire Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\art\fire\pieces Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\art\gold Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\art\gold\pieces Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\art\grass Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\art\grass\pieces Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\art\sky Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\art\sky\pieces Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\art\sun Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\art\sun\pieces Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\art\water Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\art\water\pieces Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\art\weapon Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\art\weapon\pieces Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\chips Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\fields Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\fields\substrates Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\gallery Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\gui Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\help Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\local Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\map Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\map\shtuka Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\menu Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\menu\saver Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\menu\tip Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\menu_gems Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\mults Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\mults\babylon Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\mults\carth Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\mults\egypt Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\mults\greece Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\mults\phoen Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\mults\rome Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\mults\troy Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\particles Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\shield Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\shield\shieldgems Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\sun Objets détectés : Trace.Directory.Trymedia!A2
c:\program files\the rise of atlantis\base\textures\sun\sun_9_base.jpg Objets détectés : Trace.File.Trymedia!A2
c:\program files\the rise of atlantis\bass.dll Objets détectés : Trace.File.Trymedia!A2
c:\program files\the rise of atlantis\settings.ini Objets détectés : Trace.File.Trymedia!A2
c:\program files\the rise of atlantis\the rise of atlantis.exe Objets détectés : Trace.File.Trymedia!A2
Value: HKEY_CLASSES_ROOT\wuse.1 --> wuse_id Objets détectés : Trace.Registry.PurityScan!A2
Value: HKEY_USERS\S-1-5-21-1268719652-840382768-1277365833-1000\Software\The Rise of Atlantis\The Rise of Atlantis --> Start Menu Folder Objets détectés : Trace.Registry.Trymedia!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\The Rise of Atlantis --> DisplayName Objets détectés : Trace.Registry.Trymedia!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\The Rise of Atlantis --> UninstallString Objets détectés : Trace.Registry.Trymedia!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\The Rise of Atlantis\The Rise of Atlantis --> Install_Dir Objets détectés : Trace.Registry.Trymedia!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WUSE.1 --> WUSE_Id Objets détectés : Trace.Registry.WhenU-DesktopBar!A2
Key: HKEY_CLASSES_ROOT\wuse.1 Objets détectés : Trace.Registry.WhenUSearch
C:\Users\bidou\AppData\Roaming\Microsoft\Windows\Cookies\bidou@atdmt[2].txt Objets détectés : Trace.TrackingCookie.atdmt!A2
C:\Users\bidou\AppData\Roaming\Microsoft\Windows\Cookies\bidou@bluestreak[2].txt Objets détectés : Trace.TrackingCookie.bluestreak!A2
C:\Users\bidou\AppData\Roaming\Microsoft\Windows\Cookies\bidou@commentcamarche[1].txt Objets détectés : Trace.TrackingCookie.com!A2
C:\Users\bidou\AppData\Roaming\Microsoft\Windows\Cookies\bidou@doubleclick[1].txt Objets détectés : Trace.TrackingCookie.doubleclick!A2
C:\Users\bidou\AppData\Roaming\Microsoft\Windows\Cookies\bidou@fastclick[2].txt Objets détectés : Trace.TrackingCookie.fastclick!A2
C:\Users\bidou\AppData\Roaming\Microsoft\Windows\Cookies\bidou@media.adrevolver[2].txt Objets détectés : Trace.TrackingCookie.media!A2
C:\Users\bidou\AppData\Roaming\Microsoft\Windows\Cookies\bidou@media.adrevolver[3].txt Objets détectés : Trace.TrackingCookie.media!A2
C:\Users\bidou\AppData\Roaming\Microsoft\Windows\Cookies\bidou@mediaplex[1].txt Objets détectés : Trace.TrackingCookie.media!A2
C:\Users\bidou\AppData\Roaming\Microsoft\Windows\Cookies\bidou@mediaplex[1].txt Objets détectés : Trace.TrackingCookie.mediaplex!A2
C:\Users\bidou\AppData\Roaming\Microsoft\Windows\Cookies\bidou@smartadserver[1].txt Objets détectés : Trace.TrackingCookie.smartadserver!A2
C:\Users\bidou\AppData\Roaming\Microsoft\Windows\Cookies\bidou@specificclick[1].txt Objets détectés : Trace.TrackingCookie.specificclick!A2
C:\Users\bidou\AppData\Roaming\Microsoft\Windows\Cookies\bidou@statse.webtrendslive[2].txt Objets détectés : Trace.TrackingCookie.statse.webtrendslive!A2
C:\Users\bidou\AppData\Roaming\Microsoft\Windows\Cookies\bidou@tradedoubler[2].txt Objets détectés : Trace.TrackingCookie.tradedoubler!A2
C:\Users\bidou\AppData\Roaming\Microsoft\Windows\Cookies\bidou@weborama[1].txt Objets détectés : Trace.TrackingCookie.weborama!A2
C:\Users\bidou\AppData\Roaming\Mozilla\Firefox\Profiles\34x7dq6f.default\cookies.sqlite:1219941054436203 Objets détectés : Trace.TrackingCookie.humanclick!A2
C:\Users\bidou\AppData\Roaming\Mozilla\Firefox\Profiles\34x7dq6f.default\cookies.sqlite:1219941054436431 Objets détectés : Trace.TrackingCookie.com!A2
C:\Users\bidou\AppData\Roaming\Mozilla\Firefox\Profiles\34x7dq6f.default\cookies.sqlite:1219941054436504 Objets détectés : Trace.TrackingCookie.com!A2
C:\Users\bidou\AppData\Roaming\Mozilla\Firefox\Profiles\34x7dq6f.default\cookies.sqlite:1219941054436512 Objets détectés : Trace.TrackingCookie.zedo!A2
C:\Users\bidou\AppData\Roaming\Mozilla\Firefox\Profiles\34x7dq6f.default\cookies.sqlite:1220339598222962 Objets détectés : Trace.TrackingCookie.tradedoubler!A2
C:\Users\bidou\AppData\Roaming\Mozilla\Firefox\Profiles\34x7dq6f.default\cookies.sqlite:1220348063490134 Objets détectés : Trace.TrackingCookie.count!A2

Analysé

Fichiers : 93519
Traces : 445201
Cookies : 789
Processus : 73

Objets trouvés

Fichiers : 0
Traces : 64
Cookies : 20
Processus : 0
Clés de Registre : 0

Fin du balayage : 2008-10-08 10:16:28
Temps du balayage : 0:54:46