Antivirus Desactivè automatiquement !!!!

Résolu
migoura -  
Bonjour,
je crois que j'ai un virus qui a désactivé mon Antivirus (Avast)
et je peux plus installer un nouveau antivirus
Donc, comment je peux me débarrasser de ce virus sans formater le PC ?
Merci pour votre aide.
Configuration: Windows XP (SP2)
Firefox 3.0.4

22 réponses

Résumé de la discussion

Problème majeur : un virus semble avoir désactivé l’antivirus Avast et empêche l’installation d’un nouveau logiciel de sécurité, sur un PC Windows XP SP2 sous Firefox 3.0.4. Des interventions variées préconisent des outils et méthodes pour diagnostiquer et neutraliser l’infection, notamment l’utilisation de HijackThis pour analyser les entrées système et repérer les éléments malveillants. Par ailleurs, des indices évoquent Bagle et des traces de rootkit, avec des procédures comme le démarrage en mode sans échec, la suppression de barres d’outils indésirables et des rapports de scan. D’autres réponses soulignent que les infections peuvent laisser des traces persistantes et nécessiter plusieurs passes, des nettoyages manuels et des outils spécialisés pour éviter une réinfection sans reformater.

Bobot (l’IA à votre service)
  1. chimay8 Contributeur sécurité
    Bonjour,

    - Télécharge HiJackThis.exe de Merijn(prog de diagnostic) sur ton bureau.
    - Cette version est sans installateur! ( Zip à décompresser )
    - Enregistre le sur ton bureau
    ----> exemple C:\hijackthis *** Enregistre le bien dans C: ! ***
    installer hijackthis correctement:
    https://forums.cnetfrance.fr

    - Double-clique dessus
    - Génère un rapport en suivant ces indications :
    - Exécute le et clique sur "Do a scan and save log file".
    - Le rapport s'ouvre sur le Bloc-Note.
    - Colle le rapport ici, pour cela :
    - Menu Edition / Selectionner Tout
    - Menu Edition / copier
    - Ici dans un nouveau message : clic droit / coller
    - ** ne pas fixer de lignes sans notre avis **
    Aide : N'hésite pas à consulter l'aide HiJackThis de Malekal_morte
    En image
    0
    1. migoura Auteur
      merci chimay8
      mais le programme que tu m'a donné se ferme automatiquement
      comment faire svp
      0
      1. chimay8 Contributeur sécurité
        essaye de faire un scan en ligne avec bit defender

        Faire un ScanOnline chez Bitdefender :
        http://www.bitdefender.fr/bd/site/page.php ou https://www.bitdefender.fr/
        ( fonctionne uniquement sous Internet Explorer en acceptant l’ activeX)
        * En bas, à gauche de la fenêtre, cliquer sur "BitDefender SCAN ONLINE"
        * Dans la nouvelle fenêtre, cliquer sur "I agree" (Accepte la licence )
        Accepter et installer le contrôle des ActivesX
        * La fenêtre change encore, cliquer sur "Click here to scan"
        * Les signatures se chargent, etc.
        (sauvegarder le rapport au format TEXTE svp. merci)
        Cliquer sur "Enregistrer sous..." > enregistrer le rapport au format .txt ( en "nom" mettre "RapportBitD1" par exemple ; et en "type" choisir "fichier texte" (*.txt) > ouvrir le fichier sauvegardé > copier/coller le rapport sur le forum.
        Aide MALEKAL_morte < https://www.malekal.com/scan-antivirus-ligne-nod32/ >
        Tuto Morgane < http://pageperso.aol.fr/loraline60/bitdefender_scan.htm >
        0
        1. migoura Auteur
          slt chimay8
          voila le message d'erreur qui apparait avec bitdefender:
          "Could not load the Online Scanner! Service Pack 2 was detected on this computer.Click on the information bar and select "Install ActiveX Control...".Click here for other possible fixes."
          keske je peux faire d'autre svp
          0
      2. chimay8 Contributeur sécurité
        Click on the information bar and select "Install ActiveX Control...

        il te demande d'installer l'activeX

        Configurer le contrôle des ActiveX < http://www.inoculer.com/activex.php3 >
        0
        1. migoura Auteur
          j'ai deja kliké sur la barre d'information et je l'ai installé mais rien ne se passe !!!!
          0
        2. migoura Auteur
          oooops je crois que c bon il est passé
          il est en train de scanner
          0
        3. migoura Auteur
          merci chimay pour ton aide
          mais j'ai résolu le problème a l'aide d'un logiciel espagnol
          puis a l'aide de l'invite de commandes
          pour ce qui ont le meme problème veillez consulter cette page
          http://forum.telecharger.01net.com/forum/high-tech/SECURITE/Securite/resolu-infection-hdlrrr-sujet_39701_1.htm
          0
      4. jorginho67 Contributeur sécurité
        Salut !

        Je crois que j'ai un virus qui a désactivé mon Antivirus (Avast)
        et je peux plus installer un nouveau antivirus

        c'etairt pourtant évident qu'il s'agissait de Bagle...

        Pour être sur, veux tu faire ceci stp :

        Télécharge FindyKill (par Chiquitine29) sur ton bureau :
        http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe

        Ø Lance l'installation avec les paramètres par defaut

        Ø Double-clique sur le raccourci FindyKill sur ton bureau

        Ø Au menu principal, choisis l'option * 1 * (Recherche)

        Ø Poste le rapport FindyKill.txt

        Note : le rapport FindyKill.txt est sauvegardé à la racine du disque.

        Bagle est une infection qu'on attrape en téléchargeant des cracks sur peer to peer.
        Il supprime les antivirus, firewall, empèche le redémarrage en mode sans échec... et ralentit considérablement l'ordinateur.

        S'il y a bien une infection que l'on attrape stupidement, c'est celle-ci.
        0
        1. chimay8 Contributeur sécurité
          Je crois que j'ai un virus qui a désactivé mon Antivirus (Avast)
          et je peux plus installer un nouveau antivirus

          c'etairt pourtant évident qu'il s'agissait de Bagle...

          si je ne m'abuse,il n'y a pas que bagle qui désactive les antivirus.
          0
          1. jorginho67 Contributeur sécurité
            Heu...

            Ah bon ?? qu'est ce qui peux le faire ??

            Je crois que j'ai un virus qui a désactivé mon Antivirus (Avast)
            et je peux plus installer un nouveau antivirus

            C'est typique Bagle...

            0
            1. migoura Auteur
              Merci Joginho, voila le rapport

              --------------- [ Processus actifs ] ----------------

              C:\WINDOWS\System32\smss.exe
              C:\WINDOWS\system32\csrss.exe
              C:\WINDOWS\system32\winlogon.exe
              C:\WINDOWS\system32\services.exe
              C:\WINDOWS\system32\lsass.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\System32\svchost.exe
              C:\Program Files\Ahead\InCD\InCDsrv.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\system32\svchost.exe
              C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
              C:\Program Files\Alwil Software\Avast4\ashServ.exe
              C:\WINDOWS\Explorer.EXE
              C:\WINDOWS\system32\spoolsv.exe
              C:\Program Files\VIA\RAID\raid_tool.exe
              C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
              C:\Program Files\Ahead\InCD\InCD.exe
              C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
              C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
              C:\WINDOWS\VM_STI.EXE
              C:\WINDOWS\system32\VTTimer.exe
              C:\WINDOWS\system32\VTtrayp.exe
              C:\WINDOWS\SOUNDMAN.EXE
              C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
              C:\WINDOWS\system32\ctfmon.exe
              C:\Program Files\Messenger\msmsgs.exe
              C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
              C:\Program Files\DNA\btdna.exe
              C:\Program Files\BitTorrent\bittorrent.exe
              C:\WINDOWS\system32\svchost.exe
              C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
              C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
              C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
              C:\WINDOWS\System32\alg.exe
              C:\WINDOWS\System32\svchost.exe
              C:\PROGRA~1\ALWILS~1\Avast4\ashQuick.exe
              C:\WINDOWS\system32\wuauclt.exe
              C:\Program Files\Windows Media Player\wmplayer.exe
              C:\Program Files\Mozilla Firefox\firefox.exe
              C:\WINDOWS\system32\wuauclt.exe

              --------------- [ Fichiers/Dossiers infectieux ] ----------------

              »»»» Presence des fichiers dans C:

              Found ! [11/12/2008 18:04] - "C:\Muestras"
              Found ! [11/12/2008 18:38] - C:\InfoSat.txt

              »»»» Presence des fichiers dans C:\WINDOWS

              »»»» Presence des fichiers dans C:\WINDOWS\Prefetch

              »»»» Presence des fichiers dans C:\WINDOWS\system32

              »»»» Presence des fichiers dans C:\WINDOWS\system32\config\systemprofile\AppData\Roaming

              »»»» Presence des fichiers dans C:\WINDOWS\system32\drivers

              Found ! [29/05/2008 12:36] - C:\WINDOWS\system32\drivers\mdelk.exe
              Found ! [11/12/2008 16:04] - "C:\WINDOWS\system32\drivers\downld"
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1003562.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\100734.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1010812.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1013703.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1018750.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1026046.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1028812.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1035937.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1041609.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\106531.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1066703.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1066750.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1092046.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1104968.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1131125.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1139484.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1147859.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1183234.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1195109.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1203062.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1207687.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\124343.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\128125.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1296156.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\132234.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1329343.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1357140.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1412062.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\145734.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1459218.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\14869593.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\14887625.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\14989328.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\14993296.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\15018968.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\15037109.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\15052765.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\15088656.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\151125.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\151250.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\15151937.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\15198046.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\15205812.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\15221546.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\15238593.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\15335703.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\15374984.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1546921.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\164968.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1651437.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1670968.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1697328.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\169921.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\171828.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\172125.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\173500.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1777234.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\181187.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\184203.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\186703.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1890687.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\1896718.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\192156.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\195000.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\199265.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\213406.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\218531.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\221671.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\225593.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\236031.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\238359.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\243125.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\247546.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\279421.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\284343.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\305703.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\308921.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\311921.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\319218.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\320921.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\328343.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\382312.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\385093.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\400703.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\429375.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\442187.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\444468.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\462171.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\483453.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\530359.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\585234.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\600343.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\601078.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\607421.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\610593.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\623687.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\624859.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\653109.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\653578.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\664109.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\69937.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\699453.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\700859.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\700968.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\701500.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\703875.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\707187.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\718234.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\735625.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\741843.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\742156.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\747375.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\750546.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\769656.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\772046.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\77953.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\779578.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\796015.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\804703.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\809937.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\81500.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\834437.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\861625.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\86921.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\87593.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\877859.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\888468.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\890125.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\897843.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\902500.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\905406.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\91375.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\935343.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\944468.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\94578.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\96015.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\97265.exe
              Found ! [11/12/2008 16:04] - C:\WINDOWS\system32\drivers\downld\982203.exe

              »»»» Presence des fichiers dans C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Application Data

              »»»» Presence des fichiers dans C:\DOCUME~1\YASSIN~2.UNI\LOCALS~1\Temp

              »»»» Presence des fichiers dans C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Local Settings\Temporary Internet Files\Content.IE5

              Found ! [15/07/2007 14:35] - C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Local Cache\26A4AFDD6DB64A03ADFA6DAB836DB8D6_more.jpg
              Found ! [10/11/2006 10:39] - C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Local Cache\7B5560BB781B40259A06350E9B643B6E_more.jpg
              Found ! [14/10/2007 19:40] - C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Local Cache\D3987B641C134048B815DB578D607F42_more.jpg

              --------------- [ Registre / Startup ] ----------------

              [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
              SpybotSD TeaTimer=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
              YSearchProtection=C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
              ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe
              MSMSGS="C:\Program Files\Messenger\msmsgs.exe" /background
              RocketDock="C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
              BitTorrent DNA="C:\Program Files\DNA\btdna.exe"
              BitTorrent="C:\Program Files\BitTorrent\bittorrent.exe"

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
              RaidTool=C:\Program Files\VIA\RAID\raid_tool.exe
              TkBellExe="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
              NeroFilterCheck=C:\WINDOWS\system32\NeroCheck.exe
              InCD=C:\Program Files\Ahead\InCD\InCD.exe
              PRONoMgr.exe=C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
              PCSuiteTrayApplication=C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
              SunJavaUpdateSched=C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
              YSearchProtection="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
              IMJPMIG8.1="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
              MSPY2002=C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
              PHIME2002ASync=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
              PHIME2002A=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
              EoEngine=
              EoProgrammeTele=
              BigDogPath=C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
              VTTimer=VTTimer.exe
              VTTrayp=VTtrayp.exe
              SoundMan=SOUNDMAN.EXE
              avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
              KernelFaultCheck=%systemroot%\system32\dumprep 0 -k
              HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\avp6_post_uninstall=
              HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
              HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL=
              Installed=1
              HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI=
              Installed=1
              NoChange=1
              HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS=
              Installed=1

              [HKEY_CURRENT_USER\software\local appwizard-generated applications\756756788945634534776456456456456565768768768768456]
              [HKEY_CURRENT_USER\software\local appwizard-generated applications\CDGenPS2]
              [HKEY_CURRENT_USER\software\local appwizard-generated applications\LG Contents Bank]
              [HKEY_CURRENT_USER\software\local appwizard-generated applications\VIA RAID Tool]

              --------------- [ Registre / Clés infectieuses ] ----------------

              Found ! - HKEY_USERS\S-1-5-21-1708537768-1275210071-1801674531-1003\Software\FFC
              Found ! - HKEY_USERS\S-1-5-21-1708537768-1275210071-1801674531-1003\Software\FirtR
              Found ! - HKEY_USERS\S-1-5-21-1708537768-1275210071-1801674531-1003\Software\MuleAppData
              Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa
              Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
              Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
              Found ! - HKEY_CURRENT_USER\Software\FirtR

              --------------- [ Etat / Services ] ----------------

              +- Services : [ Auto=2 / Demande=3 / Désactivé=4 ]

              /!\ Ndisuio - Type de démarrage = 4

              EapHost - Type de démarrage = 3

              /!\ Ip6Fw - Type de démarrage = 4

              SharedAccess - Type de démarrage = 2

              wuauserv - Type de démarrage = 2

              /!\ wscsvc - Type de démarrage = 4

              --------------- [ Recherche dans supports amovibles] ----------------

              +- Informations :

              C: - Lecteur fixe

              D: - Lecteur fixe

              E: - Lecteur fixe

              +- presence des fichiers :

              --------------- [ Registre / Mountpoint2 ] ----------------

              Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{73604920-2d70-11dd-8708-00e0207265b2}\Shell\AutoRun\command
              Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{73604920-2d70-11dd-8708-00e0207265b2}\Shell\explore\Command
              Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{73604920-2d70-11dd-8708-00e0207265b2}\Shell\open\Command
              Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dc2753e8-7e7b-11dd-b075-00e0207265b2}\Shell\AutoRun\command
              Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dc2753e8-7e7b-11dd-b075-00e0207265b2}\Shell\open\Command

              ------------------- ! Fin du rapport ! --------------------
              0
          2. jorginho67 Contributeur sécurité
            Relance findykill,

            Ø Choisis cette fois ci l'option * 2 * (suppression)

            il y aura 2 redémarrages, laisse travailler l'outil jusqu'a l'apparition du message "nettoyage effectué"

            un rapport va s'ouvrir, poste le dans ta prochaine réponse stp

            Note : le rapport FindyKill.txt est sauvegardé a la racine du disque
            0
            1. migoura Auteur
              Voici le rapport que vous avez demandè

              --------------- [ Active Processes ] ----------------

              C:\WINDOWS\System32\smss.exe
              C:\WINDOWS\system32\csrss.exe
              C:\WINDOWS\system32\winlogon.exe
              C:\WINDOWS\system32\services.exe
              C:\WINDOWS\system32\savedump.exe
              C:\WINDOWS\system32\lsass.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\System32\svchost.exe
              C:\Program Files\Ahead\InCD\InCDsrv.exe
              C:\Program Files\Ahead\InCD\InCDsrv.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\system32\logonui.exe
              C:\WINDOWS\system32\svchost.exe
              C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
              C:\Program Files\Alwil Software\Avast4\ashServ.exe
              C:\WINDOWS\system32\userinit.exe
              C:\WINDOWS\system32\spoolsv.exe

              --------------- [ Infected files / folders ] ----------------

              »»»» Supression files in C:

              Deleted ! - "C:\Muestras"
              Deleted ! - C:\InfoSat.txt

              »»»» Supression files in C:\WINDOWS

              »»»» Supression files in C:\WINDOWS\Prefetch

              »»»» Supression files in C:\WINDOWS\system32

              »»»» Supression files in C:\WINDOWS\system32\config\systemprofile\AppData\Roaming

              »»»» Supression files in C:\WINDOWS\system32\drivers

              Deleted ! - C:\WINDOWS\system32\drivers\mdelk.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1003562.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\100734.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1010812.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1013703.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1018750.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1026046.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1028812.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1035937.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1041609.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\106531.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1066703.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1066750.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1092046.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1104968.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1131125.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1139484.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1147859.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1183234.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1195109.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1203062.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1207687.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\124343.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\128125.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1296156.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\132234.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1329343.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1357140.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1412062.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\145734.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1459218.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\14869593.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\14887625.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\14989328.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\14993296.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\15018968.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\15037109.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\15052765.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\15088656.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\151125.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\151250.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\15151937.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\15198046.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\15205812.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\15221546.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\15238593.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\15335703.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\15374984.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1546921.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\164968.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1651437.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1670968.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1697328.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\169921.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\171828.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\172125.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\173500.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1777234.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\181187.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\184203.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\186703.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1890687.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\1896718.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\192156.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\195000.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\199265.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\213406.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\218531.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\221671.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\225593.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\236031.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\238359.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\243125.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\247546.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\279421.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\284343.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\305703.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\308921.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\311921.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\319218.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\320921.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\328343.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\382312.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\385093.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\400703.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\429375.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\442187.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\444468.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\462171.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\483453.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\530359.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\585234.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\600343.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\601078.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\607421.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\610593.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\623687.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\624859.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\653109.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\653578.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\664109.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\69937.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\699453.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\700859.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\700968.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\701500.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\703875.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\707187.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\718234.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\735625.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\741843.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\742156.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\747375.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\750546.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\769656.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\772046.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\77953.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\779578.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\796015.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\804703.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\809937.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\81500.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\834437.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\861625.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\86921.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\87593.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\877859.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\888468.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\890125.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\897843.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\902500.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\905406.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\91375.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\935343.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\944468.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\94578.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\96015.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\97265.exe
              Deleted ! - C:\WINDOWS\system32\drivers\downld\982203.exe
              Deleted ! - "C:\WINDOWS\system32\drivers\downld"

              »»»» Supression files in C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Application Data

              »»»» Supression files in C:\DOCUME~1\YASSIN~2.UNI\LOCALS~1\Temp

              »»»» Supression files in C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Local Settings\Temporary Internet Files\Content.IE5

              Deleted ! - C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Local Cache\26A4AFDD6DB64A03ADFA6DAB836DB8D6_more.jpg
              Deleted ! - C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Local Cache\7B5560BB781B40259A06350E9B643B6E_more.jpg
              Deleted ! - C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Local Cache\D3987B641C134048B815DB578D607F42_more.jpg
              Deleted ! - C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Local Settings\Application Data\Microsoft\Media Player\Cache d'images\LocalMLS\{0674FF51-698E-41DD-9B03-21A27363B64B}.jpg

              --------------- [ Registry / Infected keys ] ----------------

              Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA

              --------------- [ States / Restarting of services ] ----------------

              +- Showing of hidden files has been repaired !

              +- Services : [ Auto=2 / Request=3 / Disable=4 ]

              Ndisuio - Type of startup = 3

              EapHost - Type of startup = 2

              Ip6Fw - Type of startup = 2

              SharedAccess - Type of startup = 2

              wuauserv - Type of startup = 2

              wscsvc - Type of startup = 2

              --------------- [ Cleaning removable drives ] ----------------

              +- Informations :

              C: - Lecteur fixe

              D: - Lecteur fixe

              E: - Lecteur fixe

              F: - Lecteur de CD-ROM

              +- deleting files :

              --------------- [ Registry / Mountpoint2 ] ----------------

              Deleted ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{73604920-2d70-11dd-8708-00e0207265b2}\Shell\AutoRun\command
              Deleted ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{73604920-2d70-11dd-8708-00e0207265b2}\Shell\explore\Command
              Deleted ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{73604920-2d70-11dd-8708-00e0207265b2}\Shell\open\Command
              Deleted ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a09f42b2-c837-11dd-b1c3-00e0207265b2}\Shell\AutoRun\command
              Deleted ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dc2753e8-7e7b-11dd-b075-00e0207265b2}\Shell\AutoRun\command
              Deleted ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dc2753e8-7e7b-11dd-b075-00e0207265b2}\Shell\open\Command

              --------------- [ Searching Cracks / Keygen ] ----------------

              C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Application Data\Real\RealPlayer\History\Crack House.lnk
              C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Adobe Photoshop Cs2 Activation Crack.rar
              C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Borland.Delphi.2005.Architect.KeyGenerator.rar
              C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Colin McRae Rally 2005 Crack No-DVD + CD-Key.par.eMule-Paradise.com.zip
              C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Crack TOCA Race Driver3 NoDVD.rar
              C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Fifa 08 Nocd Cracksux
              C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Fifa 08 Nocd Cracksux.rar
              C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Seriale - Attivazione - Crack - Adobe Photoshop CS2 v9.0 ITA.rar
              C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Fifa 08 Nocd Cracksux\Fifa.08.NOCD.Crack-FLTSUX.[PC_GaMeR]
              C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Fifa 08 Nocd Cracksux\Fifa.08.NOCD.Crack-FLTSUX.[PC_GaMeR]\FIFA08.exe
              C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Fifa 08 Nocd Cracksux\Fifa.08.NOCD.Crack-FLTSUX.[PC_GaMeR]\fltsux-fif8.nfo
              C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\WinAVI 3GP MP4 PSP iPod Video Converter v2.0\Crack
              C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\WinAVI 3GP MP4 PSP iPod Video Converter v2.0\Crack\CORE.NFO
              C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\WinAVI 3GP MP4 PSP iPod Video Converter v2.0\Crack\keygen.exe
              C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\WinAVI 3GP MP4 PSP iPod Video Converter v2.0\Crack\ShareFactory.url

              ---------------- ! End of report ! ------------------
              0
          3. jorginho67 Contributeur sécurité
            Hé bé.... ;-((

            Faut pas s'étonner...

            Sur d'autres forums, tu te serais fais éjecté sans états d'ame...

            Il faut virer ces cracks, sinon, a chaque lancement d'un d'eux, l'infection se relancera.

            • Télécharge OTMoveIt3 de OldTimer
            http://oldtimer.geekstogo.com/OTMoveIt3.exe

            * Enregistre-le sur ton bureau
            * Double-clique sur OTMoveIt3.exe pour le lancer (l'extension peut ne pas apparaître)
            * Copie-colle l'ensemble des lignes en gras ci dessous dans la partie "Paste Instructions for Items to be Moved" (en-dessous de la barre jaune) :

            :files
            C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Application Data\Real\RealPlayer\History\Crack House.lnk
            C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Adobe Photoshop Cs2 Activation Crack.rar
            C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Borland.Delphi.2005.Architect.KeyGenerator.rar
            C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Colin McRae Rally 2005 Crack No-DVD + CD-Key.par.eMule-Paradise.com.zip
            C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Crack TOCA Race Driver3 NoDVD.rar
            C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Fifa 08 Nocd Cracksux
            C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Fifa 08 Nocd Cracksux.rar
            C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Seriale - Attivazione - Crack - Adobe Photoshop CS2 v9.0 ITA.rar
            C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Fifa 08 Nocd Cracksux\Fifa.08.NOCD.Crack-FLTSUX.[PC_GaMeR]
            C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Fifa 08 Nocd Cracksux\Fifa.08.NOCD.Crack-FLTSUX.[PC_GaMeR]\FIFA08.exe
            C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Fifa 08 Nocd Cracksux\Fifa.08.NOCD.Crack-FLTSUX.[PC_GaMeR]\fltsux-fif8.nfo
            C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\WinAVI 3GP MP4 PSP iPod Video Converter v2.0\Crack
            C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\WinAVI 3GP MP4 PSP iPod Video Converter v2.0\Crack\CORE.NFO
            C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\WinAVI 3GP MP4 PSP iPod Video Converter v2.0\Crack\keygen.exe
            C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\WinAVI 3GP MP4 PSP iPod Video Converter v2.0\Crack\ShareFactory.url
            :commands
            [emptytemp]
            [Reboot]

            * Clique sur le bouton rouge Moveit! pour lancer le nettoyage
            * Copie-colle dans ta prochaine réponse tout ce qui se trouve dans la fenêtre Results (en vert à droite)

            ==> Un rapport sera généré dans le dossier C:\ _OTMoveIt\MovedFiles avec la date et l'heure du passage de l'outil (mmddyyyy_hhmmss.log)

            * Ferme OTMoveIt3 (en cliquant sur Exit)

            Note : Si un fichier ou un dossier ne sait être supprimé directement, l'outil peut demander un redémarrage pour terminer le processus.
            Clique alors sur "Yes" pour accepter...

            0
            1. migoura Auteur
              ========== FILES ==========
              C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Application Data\Real\RealPlayer\History\Crack House.lnk moved successfully.
              C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Adobe Photoshop Cs2 Activation Crack.rar moved successfully.
              C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Borland.Delphi.2005.Architect.KeyGenerator.rar moved successfully.
              C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Colin McRae Rally 2005 Crack No-DVD + CD-Key.par.eMule-Paradise.com.zip moved successfully.
              C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Crack TOCA Race Driver3 NoDVD.rar moved successfully.
              C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Fifa 08 Nocd Cracksux\Fifa.08.NOCD.Crack-FLTSUX.[PC_GaMeR] moved successfully.
              C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Fifa 08 Nocd Cracksux moved successfully.
              C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Fifa 08 Nocd Cracksux.rar moved successfully.
              C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Seriale - Attivazione - Crack - Adobe Photoshop CS2 v9.0 ITA.rar moved successfully.
              File/Folder C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Fifa 08 Nocd Cracksux\Fifa.08.NOCD.Crack-FLTSUX.[PC_GaMeR] not found.
              File/Folder C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Fifa 08 Nocd Cracksux\Fifa.08.NOCD.Crack-FLTSUX.[PC_GaMeR]\FIFA08.exe not found.
              File/Folder C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Fifa 08 Nocd Cracksux\Fifa.08.NOCD.Crack-FLTSUX.[PC_GaMeR]\fltsux-fif8.nfo not found.
              C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\WinAVI 3GP MP4 PSP iPod Video Converter v2.0\Crack moved successfully.
              File/Folder C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\WinAVI 3GP MP4 PSP iPod Video Converter v2.0\Crack\CORE.NFO not found.
              File/Folder C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\WinAVI 3GP MP4 PSP iPod Video Converter v2.0\Crack\keygen.exe not found.
              File/Folder C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\WinAVI 3GP MP4 PSP iPod Video Converter v2.0\Crack\ShareFactory.url not found.
              ========== COMMANDS ==========
              File delete failed. C:\DOCUME~1\YASSIN~2.UNI\LOCALS~1\Temp\etilqs_iRYD9asPl7QcsR3vhpaU scheduled to be deleted on reboot.
              File delete failed. C:\DOCUME~1\YASSIN~2.UNI\LOCALS~1\Temp\JET10.tmp scheduled to be deleted on reboot.
              File delete failed. C:\DOCUME~1\YASSIN~2.UNI\LOCALS~1\Temp\~DFF788.tmp scheduled to be deleted on reboot.
              User's Temp folder emptied.
              User's Temporary Internet Files folder emptied.
              User's Internet Explorer cache folder emptied.
              Local Service Temp folder emptied.
              Local Service Temporary Internet Files folder emptied.
              File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_5b8.dat scheduled to be deleted on reboot.
              Windows Temp folder emptied.
              Java cache emptied.
              File delete failed. C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Local Settings\Application Data\Mozilla\Firefox\Profiles\shkh4kis.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
              File delete failed. C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Local Settings\Application Data\Mozilla\Firefox\Profiles\shkh4kis.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
              File delete failed. C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Local Settings\Application Data\Mozilla\Firefox\Profiles\shkh4kis.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
              File delete failed. C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Local Settings\Application Data\Mozilla\Firefox\Profiles\shkh4kis.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
              File delete failed. C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Local Settings\Application Data\Mozilla\Firefox\Profiles\shkh4kis.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
              File delete failed. C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Local Settings\Application Data\Mozilla\Firefox\Profiles\shkh4kis.default\XUL.mfl scheduled to be deleted on reboot.
              FireFox cache emptied.
              Temp folders emptied.
              0
              1. migoura Auteur
                Voila ce que j'ai eu apres le redémarrage

                ========== FILES ==========
                C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Application Data\Real\RealPlayer\History\Crack House.lnk moved successfully.
                C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Adobe Photoshop Cs2 Activation Crack.rar moved successfully.
                C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Borland.Delphi.2005.Architect.KeyGenerator.rar moved successfully.
                C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Colin McRae Rally 2005 Crack No-DVD + CD-Key.par.eMule-Paradise.com.zip moved successfully.
                C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Crack TOCA Race Driver3 NoDVD.rar moved successfully.
                C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Fifa 08 Nocd Cracksux\Fifa.08.NOCD.Crack-FLTSUX.[PC_GaMeR] moved successfully.
                C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Fifa 08 Nocd Cracksux moved successfully.
                C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Fifa 08 Nocd Cracksux.rar moved successfully.
                C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Seriale - Attivazione - Crack - Adobe Photoshop CS2 v9.0 ITA.rar moved successfully.
                File/Folder C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Fifa 08 Nocd Cracksux\Fifa.08.NOCD.Crack-FLTSUX.[PC_GaMeR] not found.
                File/Folder C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Fifa 08 Nocd Cracksux\Fifa.08.NOCD.Crack-FLTSUX.[PC_GaMeR]\FIFA08.exe not found.
                File/Folder C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\Fifa 08 Nocd Cracksux\Fifa.08.NOCD.Crack-FLTSUX.[PC_GaMeR]\fltsux-fif8.nfo not found.
                C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\WinAVI 3GP MP4 PSP iPod Video Converter v2.0\Crack moved successfully.
                File/Folder C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\WinAVI 3GP MP4 PSP iPod Video Converter v2.0\Crack\CORE.NFO not found.
                File/Folder C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\WinAVI 3GP MP4 PSP iPod Video Converter v2.0\Crack\keygen.exe not found.
                File/Folder C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Mes documents\emule\incoming\Autres\WinAVI 3GP MP4 PSP iPod Video Converter v2.0\Crack\ShareFactory.url not found.
                ========== COMMANDS ==========
                File delete failed. C:\DOCUME~1\YASSIN~2.UNI\LOCALS~1\Temp\etilqs_iRYD9asPl7QcsR3vhpaU scheduled to be deleted on reboot.
                File delete failed. C:\DOCUME~1\YASSIN~2.UNI\LOCALS~1\Temp\JET10.tmp scheduled to be deleted on reboot.
                File delete failed. C:\DOCUME~1\YASSIN~2.UNI\LOCALS~1\Temp\~DFF788.tmp scheduled to be deleted on reboot.
                User's Temp folder emptied.
                User's Temporary Internet Files folder emptied.
                User's Internet Explorer cache folder emptied.
                Local Service Temp folder emptied.
                Local Service Temporary Internet Files folder emptied.
                File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_5b8.dat scheduled to be deleted on reboot.
                Windows Temp folder emptied.
                Java cache emptied.
                File delete failed. C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Local Settings\Application Data\Mozilla\Firefox\Profiles\shkh4kis.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
                File delete failed. C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Local Settings\Application Data\Mozilla\Firefox\Profiles\shkh4kis.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
                File delete failed. C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Local Settings\Application Data\Mozilla\Firefox\Profiles\shkh4kis.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
                File delete failed. C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Local Settings\Application Data\Mozilla\Firefox\Profiles\shkh4kis.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
                File delete failed. C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Local Settings\Application Data\Mozilla\Firefox\Profiles\shkh4kis.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
                File delete failed. C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Local Settings\Application Data\Mozilla\Firefox\Profiles\shkh4kis.default\XUL.mfl scheduled to be deleted on reboot.
                FireFox cache emptied.
                Temp folders emptied.

                OTMoveIt3 by OldTimer - Version 1.0.7.2 log created on 12122008_164007

                Files moved on Reboot...
                File C:\DOCUME~1\YASSIN~2.UNI\LOCALS~1\Temp\etilqs_iRYD9asPl7QcsR3vhpaU not found!
                File C:\DOCUME~1\YASSIN~2.UNI\LOCALS~1\Temp\JET10.tmp not found!
                C:\DOCUME~1\YASSIN~2.UNI\LOCALS~1\Temp\~DFF788.tmp moved successfully.
                File C:\WINDOWS\temp\Perflib_Perfdata_5b8.dat not found!
                File move failed. C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Local Settings\Application Data\Mozilla\Firefox\Profiles\shkh4kis.default\Cache\_CACHE_001_ scheduled to be moved on reboot.
                File move failed. C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Local Settings\Application Data\Mozilla\Firefox\Profiles\shkh4kis.default\Cache\_CACHE_002_ scheduled to be moved on reboot.
                File move failed. C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Local Settings\Application Data\Mozilla\Firefox\Profiles\shkh4kis.default\Cache\_CACHE_003_ scheduled to be moved on reboot.
                File move failed. C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Local Settings\Application Data\Mozilla\Firefox\Profiles\shkh4kis.default\Cache\_CACHE_MAP_ scheduled to be moved on reboot.
                File move failed. C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Local Settings\Application Data\Mozilla\Firefox\Profiles\shkh4kis.default\urlclassifier3.sqlite scheduled to be moved on reboot.
                File move failed. C:\Documents and Settings\Yassine.UNICORNI-72EEF7\Local Settings\Application Data\Mozilla\Firefox\Profiles\shkh4kis.default\XUL.mfl scheduled to be moved on reboot.
                0
                1. jorginho67 Contributeur sécurité
                  • Télécharge Hijackthis
                  Hijackthis (HJT) est un outil de diagnostic pour voir si tout va bien avec ton pc....

                  Ø Enregistre HJTInstall.exe sur ton bureau
                  Ø Double-clique sur HJTInstall.exe pour lancer le programme
                  *. Par défaut, il s'installera là C:\Program Files\Trend Micro\HijackThis
                  *. Accepte la license en cliquant sur le bouton "I Accept"
                  Ø Choisis l'option "Do a system scan and save a log file"
                  *. Clique sur "Save log" pour enregistrer le rapport qui s'ouvrira avec le bloc-note
                  *. Clique sur "Edition -> Sélectionner tout", puis sur "Edition -> Copier" pour copier tout le contenu du rapport
                  Ø Clic droit => coller ici dans la fenêtre de saisi le rapport que tu viens de copier sur ce forum
                  0
                  1. migoura Auteur
                    Logfile of Trend Micro HijackThis v2.0.2
                    Scan saved at 17:15:21, on 12/12/2008
                    Platform: Windows XP SP2 (WinNT 5.01.2600)
                    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
                    Boot mode: Normal

                    Running processes:
                    C:\WINDOWS\System32\smss.exe
                    C:\WINDOWS\system32\winlogon.exe
                    C:\WINDOWS\system32\services.exe
                    C:\WINDOWS\system32\lsass.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\Program Files\Ahead\InCD\InCDsrv.exe
                    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                    C:\Program Files\Alwil Software\Avast4\ashServ.exe
                    C:\WINDOWS\Explorer.EXE
                    C:\WINDOWS\system32\spoolsv.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\Program Files\VIA\RAID\raid_tool.exe
                    C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                    C:\Program Files\Ahead\InCD\InCD.exe
                    C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
                    C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
                    C:\WINDOWS\VM_STI.EXE
                    C:\WINDOWS\system32\VTTimer.exe
                    C:\WINDOWS\system32\VTtrayp.exe
                    C:\WINDOWS\SOUNDMAN.EXE
                    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                    C:\WINDOWS\system32\ctfmon.exe
                    C:\Program Files\Messenger\msmsgs.exe
                    C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
                    C:\Program Files\DNA\btdna.exe
                    C:\Program Files\BitTorrent\bittorrent.exe
                    C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
                    C:\Program Files\Mozilla Firefox\firefox.exe
                    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                    D:\PROGRA~1\AIST\MOVIEX~1.0\MOVIEX~1.EXE
                    D:\PROGRA~1\AIST\MOVIEX~1.0\mmie.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.yahoo.com
                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
                    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer fourni par Yahoo! France
                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
                    R3 - URLSearchHook: P2P Torrent Toolbar - {bc4be15d-6a34-4356-9e97-79e43da32b1d} - C:\Program Files\P2P_Torrent\tbP2P_.dll
                    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
                    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
                    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO_1.1.5.19.dll
                    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                    O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - d:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
                    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                    O2 - BHO: P2P Torrent Toolbar - {bc4be15d-6a34-4356-9e97-79e43da32b1d} - C:\Program Files\P2P_Torrent\tbP2P_.dll
                    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                    O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
                    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
                    O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
                    O3 - Toolbar: P2P Torrent Toolbar - {bc4be15d-6a34-4356-9e97-79e43da32b1d} - C:\Program Files\P2P_Torrent\tbP2P_.dll
                    O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe
                    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                    O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
                    O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
                    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
                    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
                    O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
                    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
                    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
                    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
                    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
                    O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
                    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
                    O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
                    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                    O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
                    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                    O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
                    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
                    O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe"
                    O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
                    O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
                    O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZJfox000
                    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                    O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
                    O8 - Extra context menu item: Download all links using BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
                    O8 - Extra context menu item: Download all videos using BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm
                    O8 - Extra context menu item: Download link using &BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm
                    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
                    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
                    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
                    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
                    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
                    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                    O23 - Service: CAISafe - Unknown owner - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe (file missing)
                    O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe
                    O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
                    O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
                    O23 - Service: My Web Search Service (MyWebSearchService) - Unknown owner - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe (file missing)
                    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
                    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
                    O23 - Service: VET Message Service (VETMSGNT) - Unknown owner - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe (file missing)
                    0
                    1. jorginho67 Contributeur sécurité
                      Tu es EGAMLEMENT infecté a cause de certaines Toolbars que tu a installé lors de téléchargements de differentes applications.
                      Bien souvent, ces toolbars sont en fait des spywares.

                      Plusieurs barres d'outils peuvent ralentir l'ordinateur ou occasionner des plantages du navigateur.
                      Pour plus d'informations, voir l'article Les Toolbars, c'est pas obligatoire! ( Merci a Malekal )

                      Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.
                      https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

                      Tutoriel d'install' et d'utilisation

                      Ø Lance l'installation du programme en exécutant le fichier téléchargé.
                      Ø Double-clique maintenant sur le raccourci de Toolbar-S&D.
                      * Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
                      Ø Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
                      * Poste le rapport généré qui se trouve ici => (C:\TB.txt)

                      0
                      1. migoura Auteur
                        -----------\\ ToolBar S&D 1.2.6 XP/Vista

                        Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
                        X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 3.00GHz )
                        BIOS : Award Modular BIOS v6.00PG
                        USER : Yassine ( Administrator )
                        BOOT : Normal boot
                        Antivirus : avast! antivirus 4.8.1296 [VPS 081212-0] 4.8.1296 (Activated)
                        C:\ (Local Disk) - NTFS - Total:27 Go (Free:5 Go)
                        D:\ (Local Disk) - NTFS - Total:27 Go (Free:6 Go)
                        E:\ (Local Disk) - NTFS - Total:18 Go (Free:7 Go)
                        F:\ (CD or DVD)

                        "C:\ToolBar SD" ( MAJ : 04-12-2008|20:40 )
                        Option : [1] ( 12/12/2008|21:59 )

                        -----------\\ Recherche de Fichiers / Dossiers ...

                        [Service] MyWebSearchService
                        C:\Program Files\AskSBar
                        C:\Program Files\AskSBar\bar
                        C:\Program Files\AskSBar\bar\1.bin
                        C:\Program Files\AskSBar\bar\Cache
                        C:\Program Files\AskSBar\bar\History
                        C:\Program Files\AskSBar\bar\Settings
                        C:\Program Files\AskSBar\bar\1.bin\A2FFXTBR.JAR
                        C:\Program Files\AskSBar\bar\1.bin\A2FFXTBR.MANIFEST
                        C:\Program Files\AskSBar\bar\1.bin\A2HIGHIN.EXE
                        C:\Program Files\AskSBar\bar\1.bin\A2NTSTBR.JAR
                        C:\Program Files\AskSBar\bar\1.bin\A2NTSTBR.MANIFEST
                        C:\Program Files\AskSBar\bar\1.bin\A2PLUGIN.DLL
                        C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
                        C:\Program Files\AskSBar\bar\1.bin\NPASKSBR.DLL
                        C:\Program Files\AskSBar\bar\1.bin\V2RSSMNU.DLL
                        C:\Program Files\AskSBar\bar\Cache\00053540
                        C:\Program Files\AskSBar\bar\Cache\0005F091
                        C:\Program Files\AskSBar\bar\Cache\0006E1E6
                        C:\Program Files\AskSBar\bar\Cache\000C935C.bin
                        C:\Program Files\AskSBar\bar\Cache\000CA425.bin
                        C:\Program Files\AskSBar\bar\Cache\000CADAA.bin
                        C:\Program Files\AskSBar\bar\Cache\000CBFCB.bin
                        C:\Program Files\AskSBar\bar\Cache\000CCFE8.bin
                        C:\Program Files\AskSBar\bar\Cache\000CD4CA.bin
                        C:\Program Files\AskSBar\bar\Cache\000DD542
                        C:\Program Files\AskSBar\bar\Cache\001A9F8D
                        C:\Program Files\AskSBar\bar\Cache\files.ini
                        C:\Program Files\AskSBar\bar\History\search2
                        C:\Program Files\AskSBar\bar\Settings\prevcfg2.htm
                        C:\DOCUME~1\YASSIN~2.UNI\APPLIC~1\FunWebProducts
                        C:\DOCUME~1\YASSIN~2.UNI\APPLIC~1\FunWebProducts\Data
                        C:\DOCUME~1\YASSIN~2.UNI\APPLIC~1\FunWebProducts\Data\Yassine
                        C:\DOCUME~1\YASSIN~2.UNI\APPLIC~1\FunWebProducts\Data\Yassine\avatar.dat
                        C:\Program Files\P2P_Torrent
                        C:\Program Files\P2P_Torrent\INSTALL.LOG
                        C:\Program Files\P2P_Torrent\P2P_TorrentToolbarHelper.exe
                        C:\Program Files\P2P_Torrent\tbP2P_.dll
                        C:\Program Files\P2P_Torrent\toolbar.cfg
                        C:\Program Files\P2P_Torrent\UNWISE.EXE
                        C:\WINDOWS\iun6002.exe
                        C:\Program Files\Mozilla Firefox\plugins\NPMyWebS.dll
                        C:\Program Files\Mozilla Firefox\plugins\NPAskSBr.dll
                        C:\Program Files\MSN Messenger\riched20.dll

                        -----------\\ [..\Internet Explorer\Main]

                        [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
                        "Start Page"="https://fr.yahoo.com/"
                        "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
                        "Search Page"="http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/"
                        "SearchMigratedDefaultURL"="https://search.yahoo.com/web{searchTerms}&ei=utf-8&fr=b1ie7"
                        "Default_Page_URL"="https://fr.yahoo.com/"

                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
                        "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
                        "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                        "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                        "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home"

                        --------------------\\ Recherche d'autres infections

                        --------------------\\ ROOTKIT !!

                        Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa]
                        Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\srosa]
                        Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\srosa]

                        1 - "C:\ToolBar SD\TB_1.txt" - 12/12/2008|22:01 - Option : [1]

                        -----------\\ Fin du rapport a 22:01:34,32
                        0
                        1. jorginho67 Contributeur sécurité
                          Derme, il reste encore un rootkit de Bagle...

                          Relance Toolbar-S&D en double-cliquant sur le raccourci.
                          Ø Tape sur "2" puis valide en appuyant sur "Entrée".
                          ! Ne ferme pas la fenêtre lors de la suppression !
                          Un rapport sera généré, poste son contenu ici.

                          NOTE : Si ton Bureau ne réapparait pas, appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches.
                          Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter..."
                          Tape explorer puis valide.
                          0
                          1. migoura Auteur
                            -----------\\ ToolBar S&D 1.2.6 XP/Vista

                            Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
                            X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 3.00GHz )
                            BIOS : Award Modular BIOS v6.00PG
                            USER : Yassine ( Administrator )
                            BOOT : Normal boot
                            Antivirus : avast! antivirus 4.8.1296 [VPS 081212-0] 4.8.1296 (Activated)
                            C:\ (Local Disk) - NTFS - Total:27 Go (Free:5 Go)
                            D:\ (Local Disk) - NTFS - Total:27 Go (Free:6 Go)
                            E:\ (Local Disk) - NTFS - Total:18 Go (Free:7 Go)
                            F:\ (CD or DVD)

                            "C:\ToolBar SD" ( MAJ : 04-12-2008|20:40 )
                            Option : [2] ( 12/12/2008|22:14 )

                            -----------\\ SUPPRESSION

                            Supprime! - [Service] MyWebSearchService
                            Echec ! - C:\Program Files\AskSBar\bar
                            Echec ! - C:\Program Files\AskSBar\bar\1.bin
                            Echec ! - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
                            Supprime! - C:\DOCUME~1\YASSIN~2.UNI\APPLIC~1\FunWebProducts\Data
                            Supprime! - C:\Program Files\P2P_Torrent\INSTALL.LOG
                            Supprime! - C:\Program Files\P2P_Torrent\P2P_TorrentToolbarHelper.exe
                            Supprime! - C:\Program Files\P2P_Torrent\tbP2P_.dll
                            Supprime! - C:\Program Files\P2P_Torrent\toolbar.cfg
                            Supprime! - C:\Program Files\P2P_Torrent\UNWISE.EXE
                            Supprime! - C:\WINDOWS\iun6002.exe
                            Supprime! - C:\Program Files\Mozilla Firefox\plugins\NPMyWebS.dll
                            Supprime! - C:\Program Files\Mozilla Firefox\plugins\NPAskSBr.dll
                            Supprime! - C:\Program Files\MSN Messenger\riched20.dll
                            Echec ! - C:\Program Files\AskSBar
                            Supprime! - C:\DOCUME~1\YASSIN~2.UNI\APPLIC~1\FunWebProducts
                            Supprime! - C:\Program Files\P2P_Torrent

                            -----------\\ DEUXIEME PASSAGE

                            Echec ! - C:\Program Files\AskSBar\bar
                            Echec ! - C:\Program Files\AskSBar\bar\1.bin
                            Echec ! - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
                            Echec ! - C:\Program Files\AskSBar

                            -----------\\ Recherche de Fichiers / Dossiers ...

                            C:\Program Files\AskSBar
                            C:\Program Files\AskSBar\bar
                            C:\Program Files\AskSBar\bar\1.bin
                            C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL

                            -----------\\ [..\Internet Explorer\Main]

                            [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
                            "Start Page"="https://fr.yahoo.com/"
                            "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
                            "Search Page"="http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/"
                            "SearchMigratedDefaultURL"="https://search.yahoo.com/web{searchTerms}&ei=utf-8&fr=b1ie7"
                            "Default_Page_URL"="https://fr.yahoo.com/"

                            [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
                            "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
                            "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                            "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                            "Start Page"="https://www.msn.com/fr-fr/"

                            --------------------\\ Recherche d'autres infections

                            --------------------\\ ROOTKIT !!

                            Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa]
                            Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\srosa]
                            Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\srosa]

                            1 - "C:\ToolBar SD\TB_1.txt" - 12/12/2008|22:01 - Option : [1]
                            2 - "C:\ToolBar SD\TB_2.txt" - 12/12/2008|22:18 - Option : [2]

                            -----------\\ Fin du rapport a 22:18:08,87
                            0
                            1. jorginho67 Contributeur sécurité
                              Arfffff... coriace celui là...

                              Redémarre en mode sans échec

                              Pour cela, tapotes la touche F8 (Si F8 ne marche pas utilise la touche F5) dès le début de l’allumage du pc sans t’arrêter.
                              Une fenêtre va s’ouvrir, tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape [Entrée].
                              Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !

                              comment demarrer en mode sans echec en images

                              Relance Toolbar-S&D en double-cliquant sur le raccourci.
                              Ø Tape sur "2" puis valide en appuyant sur "Entrée".
                              ! Ne ferme pas la fenêtre lors de la suppression !
                              Un rapport sera généré, poste son contenu ici.

                              NOTE : Si ton Bureau ne réapparait pas, appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches.
                              Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter..."
                              Tape explorer puis valide.
                              0
                              1. migoura Auteur
                                -----------\\ ToolBar S&D 1.2.6 XP/Vista

                                Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
                                X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 3.00GHz )
                                BIOS : Award Modular BIOS v6.00PG
                                USER : Administrateur ( Administrator )
                                BOOT : Fail-safe boot
                                Antivirus : avast! antivirus 4.8.1296 [VPS 081212-0] 4.8.1296 (Activated)
                                C:\ (Local Disk) - NTFS - Total:27 Go (Free:5 Go)
                                D:\ (Local Disk) - NTFS - Total:27 Go (Free:6 Go)
                                E:\ (Local Disk) - NTFS - Total:18 Go (Free:7 Go)
                                F:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)

                                "C:\ToolBar SD" ( MAJ : 04-12-2008|20:40 )
                                Option : [2] ( 12/12/2008|22:55 )

                                -----------\\ SUPPRESSION

                                Supprime! - C:\Program Files\AskSBar\bar
                                Supprime! - C:\Program Files\AskSBar

                                -----------\\ Recherche de Fichiers / Dossiers ...

                                -----------\\ [..\Internet Explorer\Main]

                                [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
                                "Start Page"="http://www.files-ftp.com/~unicorni/phpBB2/index.php"
                                "Search Bar"="http://fr.rd.yahoo.com/customize/ycomp/defaults/sb/*http://fr.yahoo.com/search/ie.html"
                                "Search Page"="http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/"
                                "Local Page"="C:\\WINDOWS\\system32\\blank.htm"

                                [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
                                "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
                                "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                                "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                                "Start Page"="https://www.msn.com/fr-fr/"

                                --------------------\\ Recherche d'autres infections

                                --------------------\\ ROOTKIT !!

                                Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa]
                                Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\srosa]
                                Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\srosa]

                                1 - "C:\ToolBar SD\TB_1.txt" - 12/12/2008|22:01 - Option : [1]
                                2 - "C:\ToolBar SD\TB_2.txt" - 12/12/2008|22:18 - Option : [2]
                                3 - "C:\ToolBar SD\TB_3.txt" - 12/12/2008|22:58 - Option : [2]

                                -----------\\ Fin du rapport a 22:58:55,62
                                0
                                1. jorginho67 Contributeur sécurité
                                  Pour vérifier, fais ceci stp :

                                  Fais un scan en ligne Kaspersky avec Internet Explorer :

                                  * Clique sur Démarrer Online-Scanner

                                  * Clique maintenant sur J'accepte.
                                  * Valide l'installation d'un ou de plusieurs ActiveX si c'est nécessaire.
                                  * Patiente pendant l'installation des Mises à jour.
                                  * Choisis par la suite l'analyse du Poste de travail.
                                  * Sauvegarde puis colle ici le rapport généré en fin d'analyse.

                                  AIDE : Configurer le contrôle des ActiveX

                                  NOTE : Si tu reçois le message "La licence de Kaspersky On-line Scanner est périmée", va dans Ajout/Suppression de programmes puis désinstalle On-Line Scanner,
                                  reconnecte toi sur le site de Kaspersky pour retenter le scan en ligne                                  .
                                  0
                                  • 1
                                  • 2

                                  Discussions similaires

                                  Clavier bloqué : que faire ?
                                  Benny

                                  215 réponses
                                  Google Chrome "  Échec de l'analyse antivirus "
                                  jmpower

                                  18 réponses