Gros soucis de virus

Salut ,

Télécharge ici :

http://images.malwareremoval.com/random/RSIT.exe

random's system information tool (RSIT) par random/random et sauvegarde-le sur le Bureau.

Double-clique sur RSIT.exe afin de lancer RSIT.

Lis le contenu de l'écran Disclaimer puis clique sur Continue (si tu acceptes les conditions).

Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.

Poste le contenu de log.txt

Logfile of random's system information tool 1.04 (written by random/random)
Run by PIEROT at 2008-12-15 22:08:21
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 130 GB (85%) free of 153 GB
Total RAM: 447 MB (31% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:08:51, on 15/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
C:\Program Files\Pinnacle\TVCenter Pro\PMCLoader.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\sistray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Wanadoo\GestionnaireInternet.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Wanadoo\Watch.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\PIEROT\Bureau\RSIT.exe
C:\Program Files\trend micro\PIEROT.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://format.packardbell.com/cgi-bin/redirect/?country=FR&range=AD&phase=6&key=SEARCH
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fr.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\\PSDrvCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe GestionnaireInternet.exe
O4 - HKCU\..\Run: [PMCRemote] C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
O4 - HKCU\..\Run: [PMCLoader] C:\Program Files\Pinnacle\TVCenter Pro\PMCLoader.exe
O4 - HKCU\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D5D2CD76-75B3-4E8A-93BA-3A49F3CBE903}: NameServer = 80.10.246.130 81.253.149.10
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: MysqlInventime - Unknown owner - C:\Apps\INVENT~1\mysql\bin\mysqld-nt.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe

je te remercie par avance pour ton aide

ok

Télécharge Ad-remover ( de C_XX ) sur ton bureau ( et pas ailleurs!) :

http://sd-1.archive-host.com/membres/up/16506160323759868/AD-R.exe

! Déconnecte toi et ferme toutes applications en cours !

* Clique sur "Ad-R.exe" pour lancer l'installation et laisse les paramètres d'installe par défaut .
* Double-clique sur le raccourci Ad-remover qui est sur ton bureau pour lancer l'outil .
* Au menu principal choisis l'option "A" et tape sur [entrée] .

Laisse travailler l'outil et ne touche à rien ...

--> Poste le rapport qui apparait à la fin .

( le rapport est sauvegardé aussi sous C:\Ad-report.log )

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Note :
"Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

--------- Logfile of AD-Remover 1.0.7.7 by C_XX ---------

# START at: 22:18:17 | Lun 15/12/2008 | Microsoft® Windows XP™ (v5.1.2600)
# BOOT MODE: Normal

# OPTION: Scan | EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat

# PC: SN048557620034 | USER: PIEROT ( Current user is an administrator)

# DRIVE(S):
- C:\ (File System: NTFS)
- I:\ (File System: FAT)

# Internet Explorer v6.0.2900.5512

--------- [ RUNNING PROCESSES: 37 ] ---------

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
C:\Program Files\Pinnacle\TVCenter Pro\PMCLoader.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\sistray.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\ntvdm.exe

-----------------------------------

+-----------------------| Boonty/Boonty Games Elements found :

.

+-----------------------| Eorezo Elements found :

"HKEY_CLASSES_ROOT\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}"
"HKEY_CURRENT_USER\SOFTWARE\EoRezo"
"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}"
"HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}"
.
[05/01/2008 12:49|d--------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo
[05/01/2008 12:49|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\cache
[05/01/2008 11:52|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\cmhost.cyp
[05/01/2008 11:52|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\CONFME~1.CYP
[05/01/2008 11:52|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\CONFME~1.OLD
[05/01/2008 11:52|d--------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\db
[05/01/2008 12:48|d--------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EODESK~1
[05/01/2008 12:02|d--------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\eoStats
[05/01/2008 11:52|d--------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1
[05/01/2008 12:46|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1.CFG
[05/01/2008 11:52|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\host.cyp
[05/01/2008 12:49|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\user.cyp
[05/01/2008 11:52|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\db\cat.cyp
[05/01/2008 12:48|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EODESK~1\config.xml
[05/01/2008 12:48|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EODESK~1\EODESK~1.HTM
[05/01/2008 12:48|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EODESK~1\USERCO~1.XML
[05/01/2008 12:02|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\eoStats\eoStats.txt
[05/01/2008 11:52|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\EOWEAT~1.CFG
[05/01/2008 11:52|d--------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\images
[05/01/2008 11:52|d--------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2
[05/01/2008 11:52|d--------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1
[30/06/2005 13:40|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\67_day.png
[30/06/2005 13:40|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\67_night.png
[21/08/2006 12:07|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\69_day.png
[21/08/2006 12:07|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\69_night.png
[13/07/2005 15:04|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\70_day.png
[13/07/2005 15:04|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\70_night.png
[30/06/2005 13:40|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\78_day.png
[30/06/2005 13:40|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\78_night.png
[18/05/2006 13:20|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\82_day.png
[18/05/2006 13:20|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\82_night.png
[18/05/2006 13:20|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\83_day.png
[18/05/2006 13:20|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\83_night.png
[30/06/2005 13:40|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\84_day.png
[30/06/2005 13:40|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\84_night.png
[18/05/2006 13:20|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\85_day.png
[18/05/2006 13:20|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\85_night.png
[18/05/2006 13:20|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\89_day.png
[18/05/2006 13:20|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\89_night.png
[30/10/2006 10:01|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\back.png
[30/10/2006 11:31|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\BA24E2~1.PNG
[30/10/2006 10:01|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\BACKGR~4.PNG
[24/10/2006 09:58|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\BACKGR~3.PNG
[27/09/2006 13:55|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\BACKGR~1.PNG
[27/09/2006 13:57|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\BACKGR~2.PNG
[30/10/2006 10:01|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\BACKPR~1.PNG
[18/05/2006 13:20|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\band.png
[30/06/2005 09:14|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\BAND_S~1.PNG
[10/07/2006 11:38|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\close.png
[10/07/2006 11:37|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\CLOSEP~1.PNG
[23/10/2006 10:32|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\DAYPRE~2.PNG
[23/10/2006 10:33|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\DAYPRE~1.PNG
[25/10/2006 10:59|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\earth.png
[04/10/2006 10:21|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\FONDS_~1.PNG
[10/07/2006 11:50|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\help.png
[10/07/2006 11:49|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\HELPPR~1.PNG
[10/07/2006 11:24|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\minimise.png
[10/07/2006 11:23|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\MINIMI~1.PNG
[30/10/2006 10:01|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\next.png
[30/10/2006 10:01|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\NEXTPR~1.PNG
[31/10/2006 11:45|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\option.png
[31/10/2006 11:45|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\OPTION~1.PNG
[02/10/2006 17:36|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\REFLET~1.PNG
[18/05/2006 13:20|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\SMALL_~1.PNG
[06/11/2006 10:05|--ahs----] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~2\Thumbs.db
[30/10/2006 12:05|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\67_day.png
[30/10/2006 12:05|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\67_night.png
[02/10/2006 16:01|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\69_day.png
[02/10/2006 14:12|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\69_night.png
[06/11/2006 15:18|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\70_day.png
[06/11/2006 15:19|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\70_night.png
[02/10/2006 16:00|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\78_day.png
[02/10/2006 16:00|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\78_night.png
[02/10/2006 15:59|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\82_day.png
[02/10/2006 15:59|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\82_night.png
[02/10/2006 15:58|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\83_day.png
[02/10/2006 15:57|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\83_night.png
[02/10/2006 15:54|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\84_day.png
[02/10/2006 15:56|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\84_night.png
[02/10/2006 13:59|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\85_day.png
[02/10/2006 14:12|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\85_night.png
[02/10/2006 15:56|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\89_day.png
[02/10/2006 15:56|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\89_night.png
[10/01/2007 10:33|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\about.png
[30/10/2006 10:01|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\back.png
[06/11/2006 12:37|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\BACKGR~4.PNG
[06/11/2006 12:38|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\BADB1B~1.PNG
[24/10/2006 09:58|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\BACKGR~3.PNG
[27/09/2006 13:55|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\BACKGR~1.PNG
[27/09/2006 13:57|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\BACKGR~2.PNG
[30/10/2006 10:01|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\BACKPR~1.PNG
[10/07/2006 11:38|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\close.png
[10/07/2006 11:37|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\CLOSEP~1.PNG
[23/10/2006 10:32|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\DAYPRE~2.PNG
[23/10/2006 10:33|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\DAYPRE~1.PNG
[25/10/2006 10:59|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\earth.png
[04/10/2006 10:21|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\FONDS_~1.PNG
[10/07/2006 11:50|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\help.png
[10/07/2006 11:49|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\HELPPR~1.PNG
[10/07/2006 11:24|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\minimise.png
[10/07/2006 11:23|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\MINIMI~1.PNG
[30/10/2006 10:01|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\next.png
[30/10/2006 10:01|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\NEXTPR~1.PNG
[06/11/2006 12:46|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\option.png
[31/10/2006 11:45|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\OPTION~1.PNG
[02/10/2006 17:36|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\REFLET~1.PNG
[10/01/2007 10:33|--ahs----] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\Thumbs.db
[12/07/2005 13:55|--a------] C:\DOCUME~1\PIEROT\APPLIC~1\EoRezo\EOWEAT~1\IMAGES~1\TXT_14~1.PNG

+-----------------------| Everest Poker Elements found :

.

+-----------------------| FunWebProducts/MyWay/MyWebSearch/MyGlobalSearch Elements found :

.

+-----------------------| Messenger Skinner Elements found :

.

+-----------------------| Sweetim Elements found :

.

+-----------------------| ADDED SCAN :

+--[HKEY_CURRENT_USER\..\Run]

WOOKIT REG_SZ C:\PROGRA~1\Wanadoo\GestMaj.exe GestionnaireInternet.exe
PMCRemote REG_SZ C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
PMCLoader REG_SZ C:\Program Files\Pinnacle\TVCenter Pro\PMCLoader.exe
SsAAD.exe REG_SZ C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
MsnMsgr REG_SZ "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

+--[HKEY_LOCAL_MACHINE\..\Run]

QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
TkBellExe REG_SZ "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
PinnacleDriverCheck REG_SZ C:\WINDOWS\system32\\PSDrvCheck.exe
avast! REG_SZ C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

+--[HKEY_USERS\.DEFAULT\..\Run]

CTFMON.EXE REG_SZ C:\WINDOWS\system32\CTFMON.EXE

+--[HKEY_CURRENT_USER\..\Internet Explorer\MAIN]

Start Page : hxxp://www.orange.fr

+--[HKEY_LOCAL_MACHINE\..\Internet Explorer\MAIN]

Start Page : hxxp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home

+---------------------------------------------------------------------------+

- "C:\AD-report-Scan-15.12.2008.log" (~13969 bytes)

# END at: 22:18:37 | 15/12/2008 - Time elapsed: 20.3 seconds

+---------------------------------------------------------------------------+
+------------------------------- [ E.O.F - 192 lines ]
+---------------------------------------------------------------------------+

! Déconnecte toi et ferme toutes application en cours ( navigarteur compris ) !

* Relance "Ad-remover" : au menu principal choisis l'option "B" .

* A l'écran de sélection ( écran ) :

2 - "Eorezo" puis [entrée]

Une fois la sélection faite, tape S puis [entrée] pour lancer la suppression .

--> le programme va travailler , ne touche à rien ...

* Poste le rapport qui apparait à la fin + un nouvel Hijackthis pour analyse ...

( le rapport est sauvegardé aussi sous C:\Ad-report.log )

/!\ Si le Bureau ne réapparait pas, presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tape explorer.exe et valide ) /!\

psiiit, t´as un mp O_Ö...

oué vu ma belle

-------- Logfile of AD-Remover 1.0.7.7 by C_XX ---------

*** Limited to ***

Eorezo

******************

# START at: 22:28:12 | Lun 15/12/2008 | Microsoft® Windows XP™ (v5.1.2600)
# BOOT MODE: Normal

# OPTION: Clean | EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat

# PC: SN048557620034 | USER: PIEROT ( Current user is an administrator)

# DRIVE(S):
- C:\ (File System: NTFS)
- I:\ (File System: FAT)

# Internet Explorer v6.0.2900.5512

--------- [ RUNNING PROCESSES: 37 ] ---------

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
C:\Program Files\Pinnacle\TVCenter Pro\PMCLoader.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\sistray.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\ntvdm.exe

-----------------------------------

(!) ---- IE start pages reset

+-----------------------| Eorezo Elements Deleted :

"HKEY_CLASSES_ROOT\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}"
"HKEY_CURRENT_USER\SOFTWARE\EoRezo"
"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}"
"HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}"
.
[05/01/2008 12:49|d--------] C:\Documents and Settings\PIEROT\Application Data\EoRezo

(!) ---- Temp files deleted.
(!) ---- Recycle bin emptied in all drives.

+-----------------------| ADDED SCAN :

+--[HKEY_CURRENT_USER\..\Run]

WOOKIT REG_SZ C:\PROGRA~1\Wanadoo\GestMaj.exe GestionnaireInternet.exe
PMCRemote REG_SZ C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
PMCLoader REG_SZ C:\Program Files\Pinnacle\TVCenter Pro\PMCLoader.exe
SsAAD.exe REG_SZ C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
MsnMsgr REG_SZ "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

+--[HKEY_LOCAL_MACHINE\..\Run]

QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
TkBellExe REG_SZ "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
PinnacleDriverCheck REG_SZ C:\WINDOWS\system32\\PSDrvCheck.exe
avast! REG_SZ C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

+--[HKEY_USERS\.DEFAULT\..\Run]

CTFMON.EXE REG_SZ C:\WINDOWS\system32\CTFMON.EXE

+--[HKEY_CURRENT_USER\..\Internet Explorer\MAIN]

Start Page : hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

+--[HKEY_LOCAL_MACHINE\..\Internet Explorer\MAIN]

Start Page : hxxp://fr.msn.com/

+---------------------------------------------------------------------------+

- "C:\AD-report-Clean-15.12.2008.log" (~3927 bytes)

- "C:\AD-report-Scan-15.12.2008.log" (~14305 bytes)

# END at: 22:34:17 | 15/12/2008 - Time elapsed: 6 minutes, 5 seconds

+---------------------------------------------------------------------------+
+------------------------------- [ E.O.F - 81 lines ]
+---------------------------------------------------------------------------+

Logfile of random's system information tool 1.04 (written by random/random)
Run by PIEROT at 2008-12-15 22:35:21
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 130 GB (85%) free of 153 GB
Total RAM: 447 MB (43% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:35:26, on 15/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
C:\Program Files\Pinnacle\TVCenter Pro\PMCLoader.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\WINDOWS\system32\sistray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\PIEROT\Bureau\RSIT.exe
C:\Program Files\trend micro\PIEROT.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://format.packardbell.com/cgi-bin/redirect/?country=FR&range=AD&phase=6&key=SEARCH
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fr.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\\PSDrvCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe GestionnaireInternet.exe
O4 - HKCU\..\Run: [PMCRemote] C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
O4 - HKCU\..\Run: [PMCLoader] C:\Program Files\Pinnacle\TVCenter Pro\PMCLoader.exe
O4 - HKCU\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: MysqlInventime - Unknown owner - C:\Apps\INVENT~1\mysql\bin\mysqld-nt.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe

elecharge malwarebytes

Tu l´instale; le programme va se mettre automatiquement a jour.

Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".

Click maintenant sur l´onglet recherche et coche la case : "executer un examen complet".

Puis click sur "rechercher".

Laisse le scanner le pc...

Si des elements on ete trouvés > click sur supprimer la selection.

si il t´es demandé de redemarrer > click sur "yes".

A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.

Copie et colle le rapport stp.

PS : les rapport sont aussi rangé dans l onglet rapport/log

51 fichiers!! énorme je pense!
il ne m'a pas demandé de redémarrer
voici le rapport

Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1456
Windows 5.1.2600 Service Pack 3

15/12/2008 23:11:07
mbam-log-2008-12-15 (23-11-07).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 84099
Temps écoulé: 21 minute(s), 32 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 4
Fichier(s) infecté(s): 44

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\pbfrv2.pbfrv2 (Adware.2020Search) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{4e7bd74f-2b8d-469e-a0e8-ed6ab685fa7d} (Adware.2020Search) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{4e7bd74f-2b8d-469e-a0e8-ed6ab685fa7d} (Adware.2020Search) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Program Files\dynamic toolbar (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2 (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache (Adware.2020search) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Program Files\dynamic toolbar\batch.bat (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\unins000.dat (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\unins000.exe (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\go.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\home.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\logo_pb.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\parent_off.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\parent_on.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\pbfrv2tb0200.cfg (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\popup_off.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\popup_on.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\search.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\services.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\skin.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\skin1.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\skin2.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\skin3.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\skin4.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\skin5.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\store.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\style.css (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\support.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\ticker.xml (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\ErrorLog.txt (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\go.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\home.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\logo_pb.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\parent_off.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\parent_on.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\pbfrv2tb0200.cfg (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\popup_off.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\popup_on.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\search.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\services.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin1.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin2.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin3.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin4.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin5.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\store.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\style.css (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\support.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\ticker.xml (Adware.2020search) -> Quarantined and deleted successfully.

non du tout

c pas tres grave ,

réouvre malewarebyte
va sur quarantaine
supprime tout

Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.

* Lance l'installation du programme en exécutant le fichier téléchargé.
* Double-clique maintenant sur le raccourci de Toolbar-S&D
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
* Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
* Poste le rapport généré. (C:\TB.txt)

Tuto : https://sites.google.com/site/toolbarsd/aideenimages
info : https://forum.malekal.com/viewtopic.php?f=45&t=6173

Relance Toolbar-S&D en double-cliquant sur le raccourci. Tape sur "2" puis valide en appuyant sur "Entrée".
! Ne ferme pas la fenêtre lors de la suppression !
Un rapport sera généré, poste son contenu ici.

-----------\\ ToolBar S&D 1.2.6 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Intel(R) Pentium(R) 4 CPU 2.93GHz )
BIOS : BIOS Date: 07/11/05 18:56:38 Ver: 08.00.09
USER : PIEROT ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1296 [VPS 081215-1] 4.8.1296 (Activated)
C:\ (Local Disk) - NTFS - Total:149 Go (Free:127 Go)
D:\ (CD or DVD)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB) - FAT - Total:240 Mo (Free:0 Go)
J:\ (USB)

"C:\ToolBar SD" ( MAJ : 04-12-2008|20:40 )
Option : [1] ( 15/12/2008|23:20 )

-----------\\ Recherche de Fichiers / Dossiers ...

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="http://format.packardbell.com/cgi-bin/redirect/?country=FR&range=AD&phase=6&key=SEARCH"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Start Page"="https://www.msn.com/fr-fr"

--------------------\\ Recherche d'autres infections

Aucune autre infection trouvée !

1 - "C:\ToolBar SD\TB_1.txt" - 15/12/2008|23:20 - Option : [1]

-----------\\ Fin du rapport a 23:20:36,34

voili voilou

-----------\\ ToolBar S&D 1.2.6 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Intel(R) Pentium(R) 4 CPU 2.93GHz )
BIOS : BIOS Date: 07/11/05 18:56:38 Ver: 08.00.09
USER : PIEROT ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1296 [VPS 081215-1] 4.8.1296 (Activated)
C:\ (Local Disk) - NTFS - Total:149 Go (Free:127 Go)
D:\ (CD or DVD)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB) - FAT - Total:240 Mo (Free:0 Go)
J:\ (USB)

"C:\ToolBar SD" ( MAJ : 04-12-2008|20:40 )
Option : [2] ( 15/12/2008|23:21 )

-----------\\ Recherche de Fichiers / Dossiers ...

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="http://format.packardbell.com/cgi-bin/redirect/?country=FR&range=AD&phase=6&key=SEARCH"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Start Page"="https://www.msn.com/fr-fr/"

--------------------\\ Recherche d'autres infections

Aucune autre infection trouvée !

1 - "C:\ToolBar SD\TB_1.txt" - 15/12/2008|23:20 - Option : [1]
2 - "C:\ToolBar SD\TB_2.txt" - 15/12/2008|23:22 - Option : [2]

-----------\\ Fin du rapport a 23:22:19,09

Télécharge ToolsCleaner sur ton bureau.
-->
http://pc-system.fr/
http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner

# Clique sur Recherche et laisse le scan agir ...
# Clique sur Suppression pour finaliser.
# Tu peux, si tu le souhaites, te servir des Options facultatives.
# Clique sur Quitter pour obtenir le rapport.
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

Désactive et réactive ta restauration system :

(1) Désactiver la Restauration du système

cliques sur Démarrer
Cliques droit sur Poste de travail
cliques sur Propriétés
Cliques sur l'onglet Restauration du système
Coches Désactiver la Restauration du système sur tous les lecteurs
Cliques sur Appliquer, Lorsque le message de confirmation apparaît,
cliques sur Oui.
Cliques sur OK.

(2) Activer la Restauration du système

cliques sur Démarrer
Cliques droit sur Poste de travail
cliques sur Propriétés
Cliques sur l'onglet Restauration du système
Décoches Désactiver la Restauration du système sur tous les lecteurs
Cliques sur Appliquer, Lorsque le message de confirmation apparaît,
cliques sur Oui.
Cliques sur OK.

Tuto xp : http://service1.symantec.com/support/inter/tsgeninfointl.Nsf/fr_docid/20020830101856924

apres refais le scan avec avast

[ Rapport ToolsCleaner version 2.2.7 (par A.Rothstein & dj QUIOU) ]

-->- Recherche:

C:\TB.txt: trouvé !
C:\Toolbar SD: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\PIEROT\Bureau\ToolBarSD.exe: trouvé !
C:\Documents and Settings\PIEROT\Bureau\Rsit.exe: trouvé !
C:\Program Files\Ad-remover\TOOLS\NIRCMD.exe: trouvé !
C:\Program Files\trend micro\HijackThis.exe: trouvé !
C:\Program Files\trend micro\hijackthis.log: trouvé !

---------------------------------
-->- Suppression:

C:\Documents and Settings\PIEROT\Bureau\ToolBarSD.exe: supprimé !
C:\Program Files\trend micro\HijackThis.exe: supprimé !
C:\TB.txt: supprimé !
C:\Documents and Settings\PIEROT\Bureau\Rsit.exe: supprimé !
C:\Program Files\Ad-remover\TOOLS\NIRCMD.exe: supprimé !
C:\Program Files\trend micro\hijackthis.log: supprimé !
C:\Toolbar SD: supprimé !
C:\Rsit: supprimé !

ok comment va le pc ??

avast refait le scan...

ok