Trojan.zlob et hacktool bloqué et pc rame

Résolu
chlaimer -  
Bonjour,mon pc sous vista rame et je vois hacktool et trojan.zlob sont bloqué dans norton anti virus que dois-je faire ? je ni connais rien en informatique merci pour votre aide j attend vos réponses !!!
Configuration: Windows Vista
Internet Explorer 7.0

91 réponses

Résumé de la discussion

Un PC sous Windows Vista présente des ralentissements et Norton bloque des éléments identifiés comme HackTool et Trojan.Zlob. Les réponses recommandent de générer des rapports de diagnostic avec des outils tels que HijackThis et RSIT afin d’identifier les programmes et les entrées de démarrage potentiellement malveillants. Un intervenant impute le problème à des cracks illégaux et soutient qu’une désinfection est inutile sans suppression des cracks. D’autres préconisent des procédures complémentaires impliquant RSIT et la collecte des logs (log.txt et info.txt) pour analyse, sans conclure à une résolution directe.

Bobot (l’IA à votre service)
  4. chlaimer Auteur
    Ok merci pour ta réponse j 'ai antivir et mbam je peux rajouter spybot ?
    2. Destrio5 Modérateur
      "et pour l anti -virus et l'anti-malwares lequels sont les meilleurs pour vista ?"
      ---> Antivir, MBAM, Spybot...
      1. Destrio5 Modérateur
        Bien.

        Des soucis ?
        1. chlaimer Auteur
          Non plus rien apparament j ai aussi redemarrer c trop le top !!! et pour l anti -virus et l'anti-malwares lequels sont les meilleurs pour vista ? (MERCI POUR TON AIDE ET POUR TOUS CE QUE TU AS FAIT)
      2. Destrio5 Modérateur
        Bonne année 2009 ;)
        1. chlaimer Auteur
          Avira AntiVir Personal
          Date de création du fichier de rapport : 2008-12-31 20:45

          La recherche porte sur 1138026 souches de virus.

          Détenteur de la licence :Avira AntiVir PersonalEdition Classic
          Numéro de série : 0000149996-ADJIE-0001
          Plateforme : Windows Vista
          Version de Windows :(Service Pack 1) [6.0.6001]
          Mode Boot : Démarré normalement
          Identifiant : SYSTEM
          Nom de l'ordinateur :PC-DE-PHILIPPE

          Informations de version :
          BUILD.DAT : 8.2.0.52 16931 Bytes 2008-12-02 14:55:00
          AVSCAN.EXE : 8.1.4.10 315649 Bytes 2008-11-18 08:21:00
          AVSCAN.DLL : 8.1.4.1 49921 Bytes 2008-07-21 13:44:27
          LUKE.DLL : 8.1.4.5 164097 Bytes 2008-06-12 12:44:16
          LUKERES.DLL : 8.1.4.0 13057 Bytes 2008-07-04 07:30:27
          ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 2008-10-27 11:30:36
          ANTIVIR1.VDF : 7.1.1.33 1705984 Bytes 2008-12-24 05:18:00
          ANTIVIR2.VDF : 7.1.1.34 2048 Bytes 2008-12-24 05:18:00
          ANTIVIR3.VDF : 7.1.1.56 265728 Bytes 2008-12-31 10:17:49
          Version du moteur: 8.2.0.45
          AEVDF.DLL : 8.1.0.6 102772 Bytes 2008-10-14 10:05:56
          AESCRIPT.DLL : 8.1.1.19 336252 Bytes 2008-12-31 05:18:05
          AESCN.DLL : 8.1.1.5 123251 Bytes 2008-11-07 15:06:41
          AERDL.DLL : 8.1.1.3 438645 Bytes 2008-11-04 13:58:38
          AEPACK.DLL : 8.1.3.4 393591 Bytes 2008-11-11 09:41:39
          AEOFFICE.DLL : 8.1.0.33 196987 Bytes 2008-12-31 05:18:04
          AEHEUR.DLL : 8.1.0.75 1524087 Bytes 2008-12-31 05:18:04
          AEHELP.DLL : 8.1.2.0 119159 Bytes 2008-12-31 05:18:03
          AEGEN.DLL : 8.1.1.8 323956 Bytes 2008-12-31 05:18:02
          AEEMU.DLL : 8.1.0.9 393588 Bytes 2008-10-14 10:05:56
          AECORE.DLL : 8.1.5.2 172405 Bytes 2008-12-31 05:18:02
          AEBB.DLL : 8.1.0.3 53618 Bytes 2008-10-14 10:05:56
          AVWINLL.DLL : 1.0.0.12 15105 Bytes 2008-07-09 08:40:02
          AVPREF.DLL : 8.0.2.0 38657 Bytes 2008-05-16 09:27:58
          AVREP.DLL : 8.0.0.2 98344 Bytes 2008-07-31 12:02:15
          AVREG.DLL : 8.0.0.1 33537 Bytes 2008-05-09 11:26:37
          AVARKT.DLL : 1.0.0.23 307457 Bytes 2008-02-12 08:29:19
          AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 2008-06-12 12:27:46
          SQLITE3.DLL : 3.3.17.1 339968 Bytes 2008-01-22 17:28:02
          SMTPLIB.DLL : 1.2.0.23 28929 Bytes 2008-06-12 12:49:36
          NETNT.DLL : 8.0.0.1 7937 Bytes 2008-01-25 12:05:07
          RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 2008-07-04 07:23:16
          RCTEXT.DLL : 8.0.52.1 86273 Bytes 2008-07-17 10:08:43

          Configuration pour la recherche actuelle :
          Nom de la tâche..................: Contrôle intégral du système
          Fichier de configuration.........: c:\program files\avira\antivir personaledition classic\sysscan.avp
          Documentation....................: bas
          Action principale................: interactif
          Action secondaire................: ignorer
          Recherche sur les secteurs d'amorçage maître: marche
          Recherche sur les secteurs d'amorçage: marche
          Secteurs d'amorçage..............: C:, D:,
          Recherche dans les programmes actifs: marche
          Recherche en cours sur l'enregistrement: marche
          Recherche de Rootkits............: arrêt
          Fichier mode de recherche........: Sélection de fichiers intelligente
          Recherche sur les archives.......: marche
          Limiter la profondeur de récursivité: 20
          Archive Smart Extensions.........: marche
          Heuristique de macrovirus........: marche
          Heuristique fichier..............: moyen

          Début de la recherche : 2008-12-31 20:45

          La recherche sur les processus démarrés commence :
          Processus de recherche 'avscan.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'avcenter.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'ieuser.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'MSASCui.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'usnsvc.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'GoogleDesktop.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'eRAgent.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'Acer.Empowering.Framework.Supervisor.ex' - '1' module(s) sont contrôlés
          Processus de recherche 'wmpnetwk.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'GoogleDesktop.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'ePower_DMC.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'eNMTray.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'p2phost.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'wmpnscfg.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'ehmsas.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'ehtray.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'msnmsgr.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'avgnt.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'jusched.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'GoogleDesktop.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'explorer.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'dwm.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'taskeng.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'taskeng.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'WmiPrvSE.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'unsecapp.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'WmiPrvSE.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'ePowerSvc.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'capuserv.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'eRecoveryService.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'XAudio.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'SearchIndexer.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'RichVideo.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'MobilityService.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'LSSrvc.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'GoogleUpdaterService.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'eNet Service.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'eLockServ.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'eDSService.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'avguard.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'a2service.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'sched.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'spoolsv.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'SLsvc.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'audiodg.exe' - '0' module(s) sont contrôlés
          Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'winlogon.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'lsm.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'lsass.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'services.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'csrss.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'wininit.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'csrss.exe' - '1' module(s) sont contrôlés
          Processus de recherche 'smss.exe' - '1' module(s) sont contrôlés
          '63' processus ont été contrôlés avec '63' modules

          La recherche sur les secteurs d'amorçage maître commence :
          Secteur d'amorçage maître HD0
          [INFO] Aucun virus trouvé !

          La recherche sur les secteurs d'amorçage commence :
          Secteur d'amorçage 'C:\'
          [INFO] Aucun virus trouvé !
          Secteur d'amorçage 'D:\'
          [INFO] Aucun virus trouvé !

          La recherche sur les renvois aux fichiers exécutables (registre) commence.
          Le registre a été contrôlé ( '38' fichiers).

          La recherche sur les fichiers sélectionnés commence :

          Recherche débutant dans 'C:\' <ACER>
          C:\pagefile.sys
          [AVERTISSEMENT] Impossible d'ouvrir le fichier !
          C:\Users\philippe\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\IPRB2TKX\eicar_com[1].zip
          [0] Type d'archive: ZIP
          --> eicar.com
          [RESULTAT] Contient le code du virus Eicar-Test-Signature
          [REMARQUE] Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '49bed50e.qua' !
          C:\Users\philippe\AppData\Local\Temp\Temp1_eicar_com.zip\eicar.com
          [RESULTAT] Contient le code du virus Eicar-Test-Signature
          [REMARQUE] Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '49bed53f.qua' !
          C:\Users\philippe\Desktop\Downloads\eicar_com.zip
          [0] Type d'archive: ZIP
          --> eicar.com
          [RESULTAT] Contient le code du virus Eicar-Test-Signature
          [REMARQUE] Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '49bed587.qua' !
          Recherche débutant dans 'D:\' <DATA>

          Fin de la recherche : 2008-12-31 22:10
          Temps nécessaire: 1:25:18 Heure(s)

          La recherche a été effectuée intégralement

          17557 Les répertoires ont été contrôlés
          350481 Des fichiers ont été contrôlés
          3 Des virus ou programmes indésirables ont été trouvés
          0 Des fichiers ont été classés comme suspects
          0 Des fichiers ont été supprimés
          0 Des virus ou programmes indésirables ont été réparés
          3 Les fichiers ont été déplacés dans la quarantaine
          0 Les fichiers ont été renommés
          1 Impossible de contrôler des fichiers
          350477 Fichiers non infectés
          1337 Les archives ont été contrôlées
          1 Avertissements
          3 Consignes
      3. Destrio5 Modérateur
        1/

        ---> Désinstalle HijackThis.

        ---> Télécharge OTCleanIt sur ton Bureau :
        * Clique droit sur OTCleanIt et choisis Exécuter en tant qu'administrateur.
        * Clique sur CleanUp! puis clique sur Yes à la fenêtre Confirm.
        * Redémarre ton PC comme demandé.

        2/

        ---> Télécharge et installe CCleaner (N'installe pas la Yahoo Toolbar) :
        * Lance-le. Va dans Options puis Avancé et décoche la case Effacer uniquement les fichiers etc....
        * Va dans Nettoyeur, choisis Analyse. Une fois terminé, lance le nettoyage.
        * Ensuite, choisis Registre, puis Chercher des erreurs. Une fois terminé, répare toutes les erreurs (Sauvegarde la base de registre).

        3/

        ---> Il est nécessaire de désactiver puis réactiver la restauration système pour la purger :
        http://www.commentcamarche.net/faq/sujet 13214 desactiver reactiver la restauration systeme de vista

        ---> Je te conseille de créer un point de restauration que tu pourras utiliser plus tard si tu as un problème :
        https://forums.cnetfrance.fr

        4/

        Pour faire un scan en ligne :
        https://www.malekal.com/scan-antivirus-ligne-nod32/#mozTocId291566

        Conserve MBAM. Il te servira à scanner les fichiers douteux en complément de l'antivirus et scanne le disque dur régulièrement.

        Comme navigateur, utilise plutôt Mozilla Firefox qu'Internet Explorer. Tu peux utiliser l'extension Noscript pour plus de sécurité.

        Tu peux aussi modifier le fichier Hosts pour améliorer la sécurité de ton PC :
        http://www.commentcamarche.net/faq/sujet 5993 modifier son fichier hosts
        https://blog.sosordi.net/category/articles

        Par rapport au P2P :
        http://www.libellules.ch/...

        Voici un dossier complet (A lire avec Adobe Reader ou Foxit Reader) :
        https://www.malekal.com/fichiers/projetantimalwares/prevention-protection.pdf

        Sois plus vigilant sur Internet ;)
        1. chlaimer Auteur
          ok merci beaucoup Déstrio5 pour ton énorme coup de main peut-etre qu'un jour c moi qui aideras une personne comme tu l'as fait pour moi merci beaucoup pour tous tes conseils des gens comme toi il sont très rares merci du fond du coeur passe une bonne soirée et une bonne année 2009 a un de ces jours peut-etre sur le forum de ccm bay Philippe
      4. Destrio5 Modérateur
        Ton PC va comment ?
        1. chlaimer Auteur
          vraiment superbe bien plus de ramage plus de sites qui s'invitent comme neuf !!!!
        2. chlaimer Auteur
          ce qui a de neuf c que quand je veux lire les message de ccm dans la messagerie il me dit attention connexion non securisé d'autres utilisateur pourrons lire ou je sais plus quoi !!!
      5. Destrio5 Modérateur
        ---> Supprime le dossier RSIT situé dans C:\

        - Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.

        - Double-clique sur RSIT.exe afin de lancer le programme.

        - Clique sur Continue à l'écran Disclaimer.

        - Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

        - Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

        Note : Les rapports sont sauvegardés dans le dossier C:\rsit.
        1. chlaimer Auteur
          Logfile of random's system information tool 1.05 (written by random/random)
          Run by philippe at 2008-12-30 22:17:05
          Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
          System drive C: has 23 GB (43%) free of 52 GB
          Total RAM: 2037 MB (51% free)

          Logfile of Trend Micro HijackThis v2.0.2
          Scan saved at 22:17:08, on 30/12/2008
          Platform: Windows Vista SP1 (WinNT 6.00.1905)
          MSIE: Internet Explorer v7.00 (7.00.6001.18000)
          Boot mode: Normal

          Running processes:
          C:\Windows\system32\taskeng.exe
          C:\Windows\system32\Dwm.exe
          C:\Windows\system32\conime.exe
          C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
          C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
          C:\Program Files\Java\jre6\bin\jusched.exe
          C:\Program Files\Windows Live\Messenger\msnmsgr.exe
          C:\Windows\ehome\ehtray.exe
          C:\Windows\System32\p2phost.exe
          C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
          C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
          C:\Windows\ehome\ehmsas.exe
          C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
          C:\Program Files\Windows Media Player\wmpnscfg.exe
          C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
          C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
          C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
          C:\Windows\Explorer.exe
          C:\Program Files\Internet Explorer\IEUser.exe
          C:\Windows\system32\SearchFilterHost.exe
          C:\Users\philippe\Desktop\Downloads\RSIT.exe
          C:\Program Files\Trend Micro\HijackThis\philippe.exe

          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
          O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
          O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
          O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
          O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
          O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
          O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
          O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
          O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
          O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
          O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
          O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
          O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
          O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
          O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
          O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
          O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
          O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
          O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
          O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
          O4 - HKCU\..\Run: [Speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
          O4 - HKCU\..\Run: [CollaborationHost] C:\Windows\system32\p2phost.exe -s
          O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
          O4 - HKUS\S-1-5-18\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'SYSTEM')
          O4 - HKUS\.DEFAULT\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'Default user')
          O4 - Global Startup: Empowering Technology Launcher.lnk = ?
          O8 - Extra context menu item: Download Video on This Page - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
          O8 - Extra context menu item: Download Video This Links To - C:\Program Files\Tomato\YouTube Video Downloader\IELink.html
          O9 - Extra button: Download Video - {11F19C45-9675-488A-A8E0-8E8234DC245D} - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
          O9 - Extra 'Tools' menuitem: Download Video on This Page - {11F19C45-9675-488A-A8E0-8E8234DC245D} - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
          O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
          O13 - Gopher Prefix:
          O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
          O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
          O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
          O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
          O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
          O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
          O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
          O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
          O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
          O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
          O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
          O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
          O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
          O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
          O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
          O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
          O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
        2. chlaimer Auteur
          je sais pas comment supprimer le dossier RSIT situé dans C:\ ------- Je lance hidjakthis ?
      6. Destrio5 Modérateur
        "---> Clique sur Démarrer, Exécuter, tape notepad clique sur OK." = Ouvre le Bloc-notes.
        1. chlaimer Auteur
          ComboFix 08-12-29.02 - philippe 2008-12-30 21:57:24.2 - NTFSx86
          Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.2037.972 [GMT 1:00]
          Lancé depuis: c:\users\philippe\Desktop\Downloads\ComboFix.exe
          Commutateurs utilisés :: c:\users\philippe\Desktop\CFScript.txt
          * Un nouveau point de restauration a été créé
          .

          ((((((((((((((((((((((((((((( Fichiers créés du 2008-11-28 au 2008-12-30 ))))))))))))))))))))))))))))))))))))
          .

          2008-12-30 20:18 . 2008-12-30 20:18 <REP> d-------- c:\program files\a-squared Free
          2008-12-29 21:44 . 2008-12-29 21:44 <REP> d-------- C:\_OTMoveIt
          2008-12-29 19:01 . 2008-12-29 19:01 410,984 --a------ c:\windows\System32\deploytk.dll
          2008-12-29 18:54 . 2008-12-29 19:28 <REP> d-------- c:\users\All Users\NOS
          2008-12-29 18:54 . 2008-12-29 19:28 <REP> d-------- c:\programdata\NOS
          2008-12-29 18:54 . 2008-12-29 19:28 <REP> d-------- c:\program files\NOS
          2008-12-29 18:03 . 2008-12-29 18:04 <REP> d-------- C:\rsit
          2008-12-29 01:45 . 2008-12-29 01:45 <REP> d-------- c:\users\All Users\Avira
          2008-12-29 01:45 . 2008-12-29 01:45 <REP> d-------- c:\programdata\Avira
          2008-12-29 01:45 . 2008-12-29 01:45 <REP> d-------- c:\program files\Avira
          2008-12-28 23:31 . 2008-12-28 23:31 <REP> d-------- c:\program files\Alwil Software
          2008-12-28 23:31 . 2008-11-26 18:17 51,792 --a------ c:\windows\System32\drivers\aswMonFlt.sys
          2008-12-27 18:18 . 2008-12-27 18:18 <REP> d-------- c:\users\Private\AppData\Roaming\Malwarebytes
          2008-12-25 23:28 . 2008-12-26 17:00 225,827,023 --a------ c:\windows\MEMORY.DMP
          2008-12-25 13:38 . 2008-12-25 13:38 <REP> d-------- c:\users\Private\AppData\Roaming\Yahoo!
          2008-12-25 13:29 . 2008-12-25 13:29 <REP> d-------- c:\users\Private\AppData\Roaming\agi
          2008-12-25 13:22 . 2008-12-25 13:22 <REP> dr------- c:\users\Private\Searches
          2008-12-25 13:22 . 2008-12-26 00:56 <REP> dr------- c:\users\Private\Contacts
          2008-12-25 13:21 . 2008-12-25 13:22 <REP> dr------- c:\users\Private\Videos
          2008-12-25 13:21 . 2008-12-25 13:22 <REP> dr------- c:\users\Private\Saved Games
          2008-12-25 13:21 . 2008-12-27 19:12 <REP> dr------- c:\users\Private\Pictures
          2008-12-25 13:21 . 2008-12-25 13:22 <REP> dr------- c:\users\Private\Music
          2008-12-25 13:21 . 2008-12-25 13:22 <REP> dr------- c:\users\Private\Links
          2008-12-25 13:21 . 2008-12-25 13:22 <REP> dr------- c:\users\Private\Downloads
          2008-12-25 13:21 . 2008-12-26 00:57 <REP> dr------- c:\users\Private\Documents
          2008-12-25 13:21 . 2006-11-02 13:37 <REP> d-------- c:\users\Private\AppData\Roaming\Media Center Programs
          2008-12-25 13:21 . 2008-12-25 13:22 <REP> d--h----- c:\users\Private\AppData
          2008-12-25 13:21 . 2008-12-25 13:22 <REP> d-------- c:\users\Private
          2008-12-24 20:29 . 2008-12-24 20:29 <REP> d-------- c:\users\All Users\NortonInstaller
          2008-12-24 20:29 . 2008-12-24 20:29 <REP> d-------- c:\programdata\NortonInstaller
          2008-12-24 17:41 . 2008-12-24 17:41 <REP> d-------- c:\users\philippe\AppData\Roaming\Malwarebytes
          2008-12-24 17:41 . 2008-12-24 17:41 <REP> d-------- c:\users\All Users\Malwarebytes
          2008-12-24 17:41 . 2008-12-24 17:41 <REP> d-------- c:\programdata\Malwarebytes
          2008-12-24 17:41 . 2008-12-24 17:41 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
          2008-12-24 17:41 . 2008-12-03 19:52 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
          2008-12-24 17:41 . 2008-12-03 19:52 15,504 --a------ c:\windows\System32\drivers\mbam.sys
          2008-12-24 15:24 . 2008-12-29 19:37 <REP> d-------- C:\ToolBar SD
          2008-12-24 10:23 . 2008-12-24 10:23 <REP> d-------- c:\windows\E80F62FF5D3C4A1984099721F2928206.TMP
          2008-12-24 05:33 . 2008-12-24 05:33 <REP> d-------- c:\program files\7-Zip
          2008-12-23 21:55 . 2008-12-24 19:40 <REP> d-------- c:\program files\Navilog1
          2008-12-23 20:12 . 2008-12-23 20:12 <REP> d-------- c:\program files\CCleaner
          2008-12-23 19:28 . 2008-12-29 17:54 <REP> d-------- c:\program files\Ad-remover
          2008-12-23 13:49 . 2008-12-23 13:49 <REP> d-------- c:\program files\Trend Micro
          2008-12-10 06:33 . 2008-10-22 02:22 2,048 --a------ c:\windows\System32\tzres.dll
          2008-12-10 05:56 . 2008-11-01 02:21 4,240,384 --a------ c:\windows\System32\GameUXLegacyGDFs.dll
          2008-12-10 05:56 . 2008-10-29 07:29 2,927,104 --a------ c:\windows\explorer.exe
          2008-12-10 05:56 . 2008-10-16 05:47 827,392 --a------ c:\windows\System32\wininet.dll
          2008-12-10 05:56 . 2008-10-21 06:25 296,960 --a------ c:\windows\System32\gdi32.dll
          2008-12-10 05:56 . 2008-11-01 04:44 28,672 --a------ c:\windows\System32\Apphlpdm.dll
          2008-12-10 05:55 . 2008-06-23 02:59 2,868,736 --a------ c:\windows\System32\mf.dll
          2008-12-10 05:55 . 2008-06-23 02:59 996,352 --a------ c:\windows\System32\WMNetMgr.dll
          2008-12-10 05:55 . 2008-06-23 02:58 94,720 --a------ c:\windows\System32\logagent.exe
          2008-12-08 15:36 . 2008-12-08 15:36 <REP> d-------- c:\users\philippe\AppData\Roaming\vlc
          2008-12-08 15:09 . 2008-12-08 15:09 <REP> d-------- c:\program files\Tomato
          2008-12-04 17:00 . 2008-12-04 17:00 <REP> d-------- c:\users\philippe\AppData\Roaming\Download Manager
          2008-12-03 19:53 . 2008-12-03 19:54 <REP> d-------- c:\program files\Recuva
          2008-12-03 09:37 . 2008-12-03 09:37 <REP> d-------- c:\program files\VideoLAN
          2008-11-28 12:19 . 2008-12-20 14:17 <REP> d-------- C:\kkrieger
          2008-11-28 01:32 . 2008-11-28 01:41 <REP> d-------- c:\program files\YesMessenger
          2008-11-28 01:17 . 2008-11-28 01:17 <REP> d-------- c:\users\All Users\WindowsSearch
          2008-11-28 01:17 . 2008-11-28 01:17 <REP> d-------- c:\programdata\WindowsSearch
          2008-11-27 12:35 . 2008-11-27 12:35 <REP> d-------- c:\program files\Common Files\Screaming Bee
          2008-11-27 12:34 . 2008-11-27 12:35 <REP> d-------- c:\users\All Users\Screaming Bee
          2008-11-27 12:34 . 2008-11-27 12:35 <REP> d-------- c:\programdata\Screaming Bee
          2008-11-27 09:05 . 2008-11-27 12:35 <REP> d-------- c:\users\philippe\AppData\Roaming\Screaming Bee
          2008-11-27 09:02 . 2008-11-27 09:02 <REP> d-------- C:\videoroll
          2008-11-27 09:02 . 2008-11-27 09:02 <REP> d-------- c:\program files\ATP
          2008-11-27 08:34 . 2008-12-04 17:19 <REP> d-------- c:\program files\Screaming Bee
          2008-11-27 00:30 . 2008-11-27 00:30 <REP> d-------- c:\program files\UltraPlayer
          2008-11-27 00:24 . 2008-11-27 00:24 <REP> d-------- c:\program files\Illustrate
          2008-11-27 00:24 . 2008-11-27 00:24 167,424 --a------ c:\windows\System32\SpoonUninstall.exe
          2008-11-27 00:22 . 2008-11-27 00:22 <REP> d-------- C:\BassBox
          2008-11-26 14:55 . 2008-11-26 15:13 <REP> d-------- c:\program files\Quintessential Player
          2008-11-26 14:46 . 2008-11-26 14:46 <REP> d-------- C:\CD
          2008-11-26 10:50 . 2008-10-21 06:25 1,645,568 --a------ c:\windows\System32\connect.dll
          2008-11-26 10:50 . 2008-08-28 04:40 712,704 --a------ c:\windows\System32\WindowsCodecs.dll
          2008-11-26 10:50 . 2008-08-28 04:40 425,472 --a------ c:\windows\System32\PhotoMetadataHandler.dll
          2008-11-26 10:50 . 2008-08-28 04:40 347,136 --a------ c:\windows\System32\WindowsCodecsExt.dll
          2008-11-26 10:50 . 2008-10-22 04:57 241,152 --a------ c:\windows\System32\PortableDeviceApi.dll
          2008-11-22 01:18 . 2008-11-22 01:25 <REP> d-------- c:\users\philippe\AppData\Roaming\IcoFX
          2008-11-22 01:18 . 2008-11-22 01:18 <REP> d-------- c:\program files\IcoFX 1.6 icone a modifié
          2008-11-13 02:43 . 2008-09-10 04:40 1,334,272 --a------ c:\windows\System32\msxml6.dll
          2008-11-13 02:43 . 2008-09-05 06:14 1,191,936 --a------ c:\windows\System32\msxml3.dll
          2008-11-13 02:43 . 2008-08-27 02:05 212,480 --a------ c:\windows\System32\drivers\mrxsmb10.sys
          2008-11-08 08:42 . 2008-11-08 13:45 <REP> d-------- c:\users\philippe\AppData\Roaming\IconTweaker
          2008-11-08 08:42 . 2008-11-08 13:45 <REP> d-------- c:\users\All Users\IconTweaker
          2008-11-08 08:42 . 2008-11-08 13:45 <REP> d-------- c:\programdata\IconTweaker
          2008-11-07 22:25 . 2008-10-16 22:13 1,809,944 --a------ c:\windows\System32\wuaueng.dll
          2008-11-07 22:25 . 2008-10-16 21:56 1,524,736 --a------ c:\windows\System32\wucltux.dll
          2008-11-07 22:25 . 2008-10-16 22:12 561,688 --a------ c:\windows\System32\wuapi.dll
          2008-11-07 22:25 . 2008-10-16 21:55 83,456 --a------ c:\windows\System32\wudriver.dll
          2008-11-07 22:25 . 2008-10-16 22:09 51,224 --a------ c:\windows\System32\wuauclt.exe
          2008-11-07 22:25 . 2008-10-16 22:09 43,544 --a------ c:\windows\System32\wups2.dll
          2008-11-07 22:25 . 2008-10-16 22:08 34,328 --a------ c:\windows\System32\wups.dll
          2008-11-07 22:24 . 2008-10-16 14:08 162,064 --a------ c:\windows\System32\wuwebv.dll
          2008-11-07 22:24 . 2008-10-16 13:56 31,232 --a------ c:\windows\System32\wuapp.exe
          2008-11-07 20:14 . 2008-11-07 20:14 <REP> d-------- c:\program files\Windows Live SkyDrive
          2008-11-03 03:19 . 2008-11-03 03:19 <REP> d-------- c:\windows\CheckSur

          .
          (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
          .
          2008-12-30 00:10 --------- d-----w c:\programdata\Google Updater
          2008-12-29 18:28 --------- d-----w c:\program files\Yahoo!
          2008-12-29 18:01 --------- d-----w c:\program files\Java
          2008-12-29 17:57 --------- d-----w c:\program files\Common Files\Adobe
          2008-12-27 11:49 --------- d-----w c:\program files\Google
          2008-12-24 19:31 --------- d-----w c:\program files\Common Files\Symantec Shared
          2008-12-23 20:34 --------- d-----w c:\program files\Norton Security Scan
          2008-12-14 16:07 348,160 ----a-w c:\windows\System32\msvcr71.dll
          2008-12-14 16:07 339,968 ----a-w c:\windows\System32\pythoncom25.dll
          2008-12-14 16:07 2,117,632 ----a-w c:\windows\System32\python25.dll
          2008-12-14 16:07 114,688 ----a-w c:\windows\System32\pywintypes25.dll
          2008-12-10 05:46 --------- d-----w c:\program files\Windows Mail
          2008-11-26 23:30 --------- d--h--w c:\program files\InstallShield Installation Information
          2008-11-22 00:18 --------- d-----w c:\program files\IcoFX 1.6 icone a modifié
          2008-11-08 13:03 --------- d-----w c:\program files\Unity
          2008-11-07 00:26 --------- d-----w c:\program files\Realore
          2008-11-07 00:14 --------- d-----w c:\program files\The Bitmap Brothers
          2008-11-04 00:03 --------- d-----w c:\programdata\Microsoft Help
          2008-11-04 00:00 --------- d-----w c:\program files\Microsoft Works
          2008-11-03 23:34 --------- d-----w c:\program files\AstroRaid
          2008-11-03 23:33 --------- d-----w c:\program files\GameTop.com
          2008-11-03 23:16 --------- d-----w c:\program files\Windows Live
          2008-11-01 03:44 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
          2008-11-01 03:44 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
          2008-11-01 03:44 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll
          2008-11-01 03:44 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll
          2008-11-01 03:44 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
          2008-10-16 19:16 796,672 ----a-w c:\windows\GPInstall.exe
          2008-09-30 15:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll
          2008-09-26 10:31 0 ----a-w c:\users\philippe\AppData\Roaming\wklnhst.dat
          2008-09-18 05:09 3,601,464 ----a-w c:\windows\System32\ntkrnlpa.exe
          2008-09-18 05:09 3,549,240 ----a-w c:\windows\System32\ntoskrnl.exe
          2008-09-18 04:56 147,456 ----a-w c:\windows\System32\Faultrep.dll
          2008-09-18 04:56 125,952 ----a-w c:\windows\System32\wersvc.dll
          2008-09-18 02:16 2,032,640 ----a-w c:\windows\System32\win32k.sys
          2008-09-16 16:26 1,332,197 ----a-w c:\windows\System32\pythondll.zip
          2008-09-12 16:07 192,512 ----a-w c:\windows\off-road-uninst.exe
          2008-05-22 12:27 174 --sha-w c:\program files\desktop.ini
          2008-05-21 18:46 173 ----a-w c:\users\philippe\BackupResult.DAT
          .

          ((((((((((((((((((((((((((((( snapshot@2008-12-30_19.50.10,23 )))))))))))))))))))))))))))))))))))))))))
          .
          - 2008-12-30 17:56:09 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
          + 2008-12-30 21:02:11 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
          - 2008-12-30 18:49:41 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
          + 2008-12-30 21:02:58 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
          - 2008-12-30 17:59:40 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
          + 2008-12-30 21:03:01 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
          + 2008-12-30 21:03:01 262,144 ---ha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
          - 2008-12-30 18:42:23 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
          + 2008-12-30 19:21:54 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
          - 2008-12-30 18:42:23 81,920 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
          + 2008-12-30 19:21:54 81,920 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
          - 2008-12-30 18:42:23 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
          + 2008-12-30 19:21:54 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
          - 2008-12-30 18:01:46 101,250 ----a-w c:\windows\System32\perfc009.dat
          + 2008-12-30 19:18:40 101,250 ----a-w c:\windows\System32\perfc009.dat
          - 2008-12-30 18:01:46 123,556 ----a-w c:\windows\System32\perfc00C.dat
          + 2008-12-30 19:18:40 123,556 ----a-w c:\windows\System32\perfc00C.dat
          - 2008-12-30 18:01:46 587,178 ----a-w c:\windows\System32\perfh009.dat
          + 2008-12-30 19:18:40 587,178 ----a-w c:\windows\System32\perfh009.dat
          - 2008-12-30 18:01:46 669,566 ----a-w c:\windows\System32\perfh00C.dat
          + 2008-12-30 19:18:40 669,566 ----a-w c:\windows\System32\perfh00C.dat
          - 2008-12-30 17:58:47 14,246 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2606745893-197517921-552777776-1000_UserData.bin
          + 2008-12-30 19:15:17 14,254 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2606745893-197517921-552777776-1000_UserData.bin
          - 2008-12-30 17:58:47 75,778 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
          + 2008-12-30 19:15:16 75,778 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
          - 2008-12-30 17:58:30 71,452 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
          + 2008-12-30 19:15:12 71,460 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
          .
          ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
          .
          .
          *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
          REGEDIT4

          [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
          "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
          "Speech Recognition"="c:\windows\Speech\Common\sapisvr.exe" [2008-01-19 49664]
          "CollaborationHost"="c:\windows\system32\p2phost.exe" [2008-01-19 192000]
          "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-08 68856]
          "WindowsWelcomeCenter"="oobefldr.dll" [2008-01-19 c:\windows\System32\oobefldr.dll]

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-09-15 29744]
          "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
          "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
          "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-29 136600]

          [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
          "Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-05-22 151552]

          c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
          Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2007-07-31 535336]

          [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
          "FilterAdministratorToken"= 1 (0x1)
          "EnableUIADesktopToggle"= 0 (0x0)

          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
          "AppInit_DLLs"=c:\progra~1\Google\GOOGLE~3\GOEC62~1.DLL

          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
          @="Driver"

          [HKLM\~\startupfolder\C:^Users^philippe^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MorphVOXJr.lnk]
          path=c:\users\philippe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MorphVOXJr.lnk
          backup=c:\windows\pss\MorphVOXJr.lnk.Startup
          backupExtension=.Startup

          [HKLM\~\startupfolder\C:^Users^philippe^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MorphVOXPro.lnk]
          path=c:\users\philippe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MorphVOXPro.lnk
          backup=c:\windows\pss\MorphVOXPro.lnk.Startup
          backupExtension=.Startup

          [HKEY_LOCAL_MACHINE\software\microsoft\security center]
          "UacDisableNotify"=dword:00000001

          [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
          "DisableMonitoring"=dword:00000001

          [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
          "DisableMonitoring"=dword:00000001

          [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
          "DisableMonitoring"=dword:00000001

          [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2606745893-197517921-552777776-1000]
          "EnableNotificationsRef"=dword:00000001

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
          "{A9191AA0-F975-422A-A045-8BE6C6A94DD2}"= c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
          "{C8A951A8-BB7D-44C5-B947-EB3AB29A846B}"= c:\program files\Acer Arcade Deluxe\VideoMagician\VideoMagician.exe:VideoMagician
          "{585C86AC-AE4D-4313-81DF-771121FEAA30}"= c:\program files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe:HomeMedia
          "{ABEFDFC7-B36D-4F11-BB03-0E2865E19AEA}"= c:\program files\Acer Arcade Deluxe\DV Wizard\DV Wizard.exe:DV Wizard
          "{7B0EF77A-F01E-45A5-BDCF-73E3FA39F9C5}"= c:\program files\Acer Arcade Deluxe\DVDivine\DVDivine.exe:DVDivine
          "{F463B540-F154-44DA-99DB-6DAC6F85E813}"= c:\program files\Acer Arcade Deluxe\Play Movie\PlayMovie.exe:Play Movie
          "{1FEC2FF0-2674-4C83-8CD3-9258F59DF564}"= c:\program files\Acer Arcade Deluxe\Play Movie\PMVService.exe:Play Movie Resident Program
          "{9DB02D1D-FD80-411D-8FBA-89D86868823A}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
          "{B25C3DDC-0084-4127-963D-D99762FC74D8}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
          "{CD815638-6A92-4C06-8C8A-91CFE24B66F1}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
          "{B2382129-6027-42D7-AE25-CD7475629CE4}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
          "{609687EC-B609-4DFD-9444-321122F4B54F}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
          "{99179F52-2FD6-4CC8-A5F7-12F972B46178}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
          "{7A42FDDB-BCED-4184-8155-DCD489100435}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
          "{596BC37F-4C8A-47CC-B891-999674D50FDE}"= UDP:c:\users\philippe\AppData\Local\Temp\WZSE0.TMP\SymNRT.exe:Norton Removal Tool
          "{F05D8FE4-B5DA-43B1-B049-FEC2753EB3B7}"= TCP:c:\users\philippe\AppData\Local\Temp\WZSE0.TMP\SymNRT.exe:Norton Removal Tool

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
          "DoNotAllowExceptions"= 0 (0x0)

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
          "c:\\Acer\\Empowering Technology\\eDataSecurity\\eDSfsu.exe"= c:\acer\Empowering Technology\eDataSecurity\eDSfsu.exe:*:Enabled:eDSfsu
          "c:\\Acer\\Empowering Technology\\eDataSecurity\\encryption.exe"= c:\acer\Empowering Technology\eDataSecurity\encryption.exe:*:Enabled:encryption
          "c:\\Acer\\Empowering Technology\\eDataSecurity\\decryption.exe"= c:\acer\Empowering Technology\eDataSecurity\decryption.exe:*:Enabled:decryption

          R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};\??\c:\program files\Acer Arcade Deluxe\Play Movie\[u]0/u00.fcl [2008-03-24 20:20:27 13560]
          R2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [2008-12-28 51792]
          R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2007-07-31 179712]
          R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\screamingbdriver.sys [2006-03-27 13824]
          .
          Contenu du dossier 'Tâches planifiées'

          2008-06-01 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
          - c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 10:20]
          .

          **************************************************************************

          catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
          Rootkit scan 2008-12-30 22:03:12
          Windows 6.0.6001 Service Pack 1 NTFS

          Recherche de processus cachés ...

          Recherche d'éléments en démarrage automatique cachés ...

          Recherche de fichiers cachés ...

          Scan terminé avec succès
          Fichiers cachés: 0

          **************************************************************************
          .
          --------------------- DLLs chargées dans les processus actifs ---------------------

          - - - - - - - > 'Explorer.exe'(5688)
          c:\acer\Empowering Technology\EPOWER\SysHook.dll
          .
          ------------------------ Autres processus actifs ------------------------
          .
          c:\windows\System32\audiodg.exe
          c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
          c:\program files\a-squared Free\a2service.exe
          c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
          c:\acer\Empowering Technology\eDataSecurity\eDSService.exe
          c:\acer\Empowering Technology\eLock\Service\eLockServ.exe
          c:\acer\Empowering Technology\eNet\eNet Service.exe
          c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe
          c:\program files\Common Files\LightScribe\LSSrvc.exe
          c:\acer\Mobility Center\MobilityService.exe
          c:\program files\CyberLink\Shared Files\RichVideo.exe
          c:\windows\System32\drivers\XAudio.exe
          c:\acer\Empowering Technology\eRecovery\eRecoveryService.exe
          c:\acer\Empowering Technology\eSettings\Service\capuserv.exe
          c:\acer\Empowering Technology\ePower\ePowerSvc.exe
          c:\windows\System32\wbem\unsecapp.exe
          c:\windows\System32\conime.exe
          c:\acer\Empowering Technology\eNet\eNMTray.exe
          c:\acer\Empowering Technology\ePower\ePower_DMC.exe
          c:\windows\ehome\ehmsas.exe
          c:\acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
          c:\program files\Windows Media Player\wmpnscfg.exe
          c:\program files\Windows Media Player\wmpnetwk.exe
          c:\acer\Empowering Technology\eRecovery\eRAgent.exe
          c:\program files\Windows Live\Messenger\usnsvc.exe
          c:\windows\servicing\TrustedInstaller.exe
          .
          **************************************************************************
          .
          Heure de fin: 2008-12-30 22:12:06 - La machine a redémarré
          ComboFix-quarantined-files.txt 2008-12-30 21:11:47
          ComboFix2.txt 2008-12-30 18:57:42

          Avant-CF: 23 954 452 480 octets libres
          Après-CF: 23,640,276,992 octets libres

          308 --- E O F --- 2008-12-22 18:17:03
      7. Destrio5 Modérateur
        "c ok mais quand je tape sur demarrer je trouve pas " executer " tu peux me préciser stp j'ai jamais vu executer quand je tape sur le bureau démarrer !!!"
        ---> Ah oui, tu as Vista. Ouvre le Bloc-notes tout simplement.
        1. chlaimer Auteur
          décidément je dois pas avoir les yeux en face des trous ;; quand j'ouvre le bloc-note c une page vide il y a aucun endroit ou je peux taper "executer"
      8. Destrio5 Modérateur
        /!\ Seul chlaimer peut suivre cette procédure /!\

        1/

        ---> Clique sur Démarrer, Exécuter, tape notepad clique sur OK.

        ---> Copie le texte ci-dessous par sélection puis Ctrl+C :

        KillAll::

        Driver::
        AGWinService
        Planificateur LiveUpdate automatique

        Folder::
        C:\Users\philippe\AppData\Roaming\agi
        C:\ProgramData\agi
        C:\Program Files\AGI
        C:\ProgramData\Kiwee Toolbar

        ---> Colle la sélection dans le bloc-notes

        ---> Enregistre ce fichier sur le bureau (Impératif)

        ---> Nom du fichier : CFScript
        ---> Type du fichier : tous les fichiers
        ---> Clique sur Enregistrer
        ---> Quitte le bloc-notes

        2/

        ---> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
        http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif

        [*] Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.

        [*] Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
        Ne touche à rien tant que le scan n'est pas terminé.

        [*] Une fois le scan achevé, un rapport va s'afficher : poste-le

        [*] Si le fichier ne s'ouvre pas, il se trouve ici C:\ComboFix\Combofix.txt
        1. chlaimer Auteur
          c ok mais quand je tape sur demarrer je trouve pas " executer " tu peux me préciser stp j'ai jamais vu executer quand je tape sur le bureau démarrer !!! pour le reste c ok !
      9. Destrio5 Modérateur
        Il me semble avoir vu a-squared Free.
        1. chlaimer Auteur
          Désolé mais si je les supprimes tous definitivement du programme c pas mieux ? pour etre sur !!!
        2. chlaimer Auteur
          @chlaimervoila windows me dit : FIND STRING(QGREP) utility à cessé de fonctionné ------- le rapport : ComboFix 08-12-29.02 - philippe 2008-12-30 19:46:27.1 - NTFSx86
          Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.2037.1041 [GMT 1:00]
          Lancé depuis: c:\users\philippe\Desktop\Downloads\ComboFix.exe
          * Un nouveau point de restauration a été créé
          .

          (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
          .

          c:\windows\system32\x64

          .
          ((((((((((((((((((((((((((((( Fichiers créés du 2008-11-28 au 2008-12-30 ))))))))))))))))))))))))))))))))))))
          .

          2008-12-29 21:44 . 2008-12-29 21:44 <REP> d-------- C:\_OTMoveIt
          2008-12-29 19:01 . 2008-12-29 19:01 410,984 --a------ c:\windows\System32\deploytk.dll
          2008-12-29 18:54 . 2008-12-29 19:28 <REP> d-------- c:\users\All Users\NOS
          2008-12-29 18:54 . 2008-12-29 19:28 <REP> d-------- c:\programdata\NOS
          2008-12-29 18:54 . 2008-12-29 19:28 <REP> d-------- c:\program files\NOS
          2008-12-29 18:03 . 2008-12-29 18:04 <REP> d-------- C:\rsit
          2008-12-29 01:45 . 2008-12-29 01:45 <REP> d-------- c:\users\All Users\Avira
          2008-12-29 01:45 . 2008-12-29 01:45 <REP> d-------- c:\programdata\Avira
          2008-12-29 01:45 . 2008-12-29 01:45 <REP> d-------- c:\program files\Avira
          2008-12-28 23:31 . 2008-12-28 23:31 <REP> d-------- c:\program files\Alwil Software
          2008-12-28 23:31 . 2008-11-26 18:17 51,792 --a------ c:\windows\System32\drivers\aswMonFlt.sys
          2008-12-27 18:18 . 2008-12-27 18:18 <REP> d-------- c:\users\Private\AppData\Roaming\Malwarebytes
          2008-12-25 23:28 . 2008-12-26 17:00 225,827,023 --a------ c:\windows\MEMORY.DMP
          2008-12-25 13:38 . 2008-12-25 13:38 <REP> d-------- c:\users\Private\AppData\Roaming\Yahoo!
          2008-12-25 13:29 . 2008-12-25 13:29 <REP> d-------- c:\users\Private\AppData\Roaming\agi
          2008-12-25 13:22 . 2008-12-25 13:22 <REP> dr------- c:\users\Private\Searches
          2008-12-25 13:22 . 2008-12-26 00:56 <REP> dr------- c:\users\Private\Contacts
          2008-12-25 13:21 . 2008-12-25 13:22 <REP> dr------- c:\users\Private\Videos
          2008-12-25 13:21 . 2008-12-25 13:22 <REP> dr------- c:\users\Private\Saved Games
          2008-12-25 13:21 . 2008-12-27 19:12 <REP> dr------- c:\users\Private\Pictures
          2008-12-25 13:21 . 2008-12-25 13:22 <REP> dr------- c:\users\Private\Music
          2008-12-25 13:21 . 2008-12-25 13:22 <REP> dr------- c:\users\Private\Links
          2008-12-25 13:21 . 2008-12-25 13:22 <REP> dr------- c:\users\Private\Downloads
          2008-12-25 13:21 . 2008-12-26 00:57 <REP> dr------- c:\users\Private\Documents
          2008-12-25 13:21 . 2006-11-02 13:37 <REP> d-------- c:\users\Private\AppData\Roaming\Media Center Programs
          2008-12-25 13:21 . 2008-12-25 13:22 <REP> d--h----- c:\users\Private\AppData
          2008-12-25 13:21 . 2008-12-25 13:22 <REP> d-------- c:\users\Private
          2008-12-24 20:29 . 2008-12-24 20:29 <REP> d-------- c:\users\All Users\NortonInstaller
          2008-12-24 20:29 . 2008-12-24 20:29 <REP> d-------- c:\programdata\NortonInstaller
          2008-12-24 17:41 . 2008-12-24 17:41 <REP> d-------- c:\users\philippe\AppData\Roaming\Malwarebytes
          2008-12-24 17:41 . 2008-12-24 17:41 <REP> d-------- c:\users\All Users\Malwarebytes
          2008-12-24 17:41 . 2008-12-24 17:41 <REP> d-------- c:\programdata\Malwarebytes
          2008-12-24 17:41 . 2008-12-24 17:41 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
          2008-12-24 17:41 . 2008-12-03 19:52 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
          2008-12-24 17:41 . 2008-12-03 19:52 15,504 --a------ c:\windows\System32\drivers\mbam.sys
          2008-12-24 15:24 . 2008-12-29 19:37 <REP> d-------- C:\ToolBar SD
          2008-12-24 10:23 . 2008-12-24 10:23 <REP> d-------- c:\windows\E80F62FF5D3C4A1984099721F2928206.TMP
          2008-12-24 05:33 . 2008-12-24 05:33 <REP> d-------- c:\program files\7-Zip
          2008-12-23 21:55 . 2008-12-24 19:40 <REP> d-------- c:\program files\Navilog1
          2008-12-23 20:12 . 2008-12-23 20:12 <REP> d-------- c:\program files\CCleaner
          2008-12-23 19:28 . 2008-12-29 17:54 <REP> d-------- c:\program files\Ad-remover
          2008-12-23 13:49 . 2008-12-23 13:49 <REP> d-------- c:\program files\Trend Micro
          2008-12-20 11:03 . 2008-12-30 19:42 <REP> d-------- c:\program files\a-squared Free
          2008-12-10 06:33 . 2008-10-22 02:22 2,048 --a------ c:\windows\System32\tzres.dll
          2008-12-10 05:56 . 2008-11-01 02:21 4,240,384 --a------ c:\windows\System32\GameUXLegacyGDFs.dll
          2008-12-10 05:56 . 2008-10-29 07:29 2,927,104 --a------ c:\windows\explorer.exe
          2008-12-10 05:56 . 2008-10-16 05:47 827,392 --a------ c:\windows\System32\wininet.dll
          2008-12-10 05:56 . 2008-10-21 06:25 296,960 --a------ c:\windows\System32\gdi32.dll
          2008-12-10 05:56 . 2008-11-01 04:44 28,672 --a------ c:\windows\System32\Apphlpdm.dll
          2008-12-10 05:55 . 2008-06-23 02:59 2,868,736 --a------ c:\windows\System32\mf.dll
          2008-12-10 05:55 . 2008-06-23 02:59 996,352 --a------ c:\windows\System32\WMNetMgr.dll
          2008-12-10 05:55 . 2008-06-23 02:58 94,720 --a------ c:\windows\System32\logagent.exe
          2008-12-08 15:36 . 2008-12-08 15:36 <REP> d-------- c:\users\philippe\AppData\Roaming\vlc
          2008-12-08 15:09 . 2008-12-08 15:09 <REP> d-------- c:\program files\Tomato
          2008-12-04 17:00 . 2008-12-04 17:00 <REP> d-------- c:\users\philippe\AppData\Roaming\Download Manager
          2008-12-03 19:53 . 2008-12-03 19:54 <REP> d-------- c:\program files\Recuva
          2008-12-03 09:37 . 2008-12-03 09:37 <REP> d-------- c:\program files\VideoLAN
          2008-11-28 12:19 . 2008-12-20 14:17 <REP> d-------- C:\kkrieger
          2008-11-28 01:32 . 2008-11-28 01:41 <REP> d-------- c:\program files\YesMessenger
          2008-11-28 01:17 . 2008-11-28 01:17 <REP> d-------- c:\users\All Users\WindowsSearch
          2008-11-28 01:17 . 2008-11-28 01:17 <REP> d-------- c:\programdata\WindowsSearch
          2008-11-27 12:35 . 2008-11-27 12:35 <REP> d-------- c:\program files\Common Files\Screaming Bee
          2008-11-27 12:34 . 2008-11-27 12:35 <REP> d-------- c:\users\All Users\Screaming Bee
          2008-11-27 12:34 . 2008-11-27 12:35 <REP> d-------- c:\programdata\Screaming Bee
          2008-11-27 09:05 . 2008-11-27 12:35 <REP> d-------- c:\users\philippe\AppData\Roaming\Screaming Bee
          2008-11-27 09:02 . 2008-11-27 09:02 <REP> d-------- C:\videoroll
          2008-11-27 09:02 . 2008-11-27 09:02 <REP> d-------- c:\program files\ATP
          2008-11-27 08:34 . 2008-12-04 17:19 <REP> d-------- c:\program files\Screaming Bee
          2008-11-27 00:30 . 2008-11-27 00:30 <REP> d-------- c:\program files\UltraPlayer
          2008-11-27 00:24 . 2008-11-27 00:24 <REP> d-------- c:\program files\Illustrate
          2008-11-27 00:24 . 2008-11-27 00:24 167,424 --a------ c:\windows\System32\SpoonUninstall.exe
          2008-11-27 00:22 . 2008-11-27 00:22 <REP> d-------- C:\BassBox
          2008-11-26 14:55 . 2008-11-26 15:13 <REP> d-------- c:\program files\Quintessential Player
          2008-11-26 14:46 . 2008-11-26 14:46 <REP> d-------- C:\CD
          2008-11-26 10:50 . 2008-10-21 06:25 1,645,568 --a------ c:\windows\System32\connect.dll
          2008-11-26 10:50 . 2008-08-28 04:40 712,704 --a------ c:\windows\System32\WindowsCodecs.dll
          2008-11-26 10:50 . 2008-08-28 04:40 425,472 --a------ c:\windows\System32\PhotoMetadataHandler.dll
          2008-11-26 10:50 . 2008-08-28 04:40 347,136 --a------ c:\windows\System32\WindowsCodecsExt.dll
          2008-11-26 10:50 . 2008-10-22 04:57 241,152 --a------ c:\windows\System32\PortableDeviceApi.dll
          2008-11-22 01:18 . 2008-11-22 01:25 <REP> d-------- c:\users\philippe\AppData\Roaming\IcoFX
          2008-11-22 01:18 . 2008-11-22 01:18 <REP> d-------- c:\program files\IcoFX 1.6 icone a modifié
          2008-11-13 02:43 . 2008-09-10 04:40 1,334,272 --a------ c:\windows\System32\msxml6.dll
          2008-11-13 02:43 . 2008-09-05 06:14 1,191,936 --a------ c:\windows\System32\msxml3.dll
          2008-11-13 02:43 . 2008-08-27 02:05 212,480 --a------ c:\windows\System32\drivers\mrxsmb10.sys
          2008-11-08 08:42 . 2008-11-08 13:45 <REP> d-------- c:\users\philippe\AppData\Roaming\IconTweaker
          2008-11-08 08:42 . 2008-11-08 13:45 <REP> d-------- c:\users\All Users\IconTweaker
          2008-11-08 08:42 . 2008-11-08 13:45 <REP> d-------- c:\programdata\IconTweaker
          2008-11-07 22:25 . 2008-10-16 22:13 1,809,944 --a------ c:\windows\System32\wuaueng.dll
          2008-11-07 22:25 . 2008-10-16 21:56 1,524,736 --a------ c:\windows\System32\wucltux.dll
          2008-11-07 22:25 . 2008-10-16 22:12 561,688 --a------ c:\windows\System32\wuapi.dll
          2008-11-07 22:25 . 2008-10-16 21:55 83,456 --a------ c:\windows\System32\wudriver.dll
          2008-11-07 22:25 . 2008-10-16 22:09 51,224 --a------ c:\windows\System32\wuauclt.exe
          2008-11-07 22:25 . 2008-10-16 22:09 43,544 --a------ c:\windows\System32\wups2.dll
          2008-11-07 22:25 . 2008-10-16 22:08 34,328 --a------ c:\windows\System32\wups.dll
          2008-11-07 22:24 . 2008-10-16 14:08 162,064 --a------ c:\windows\System32\wuwebv.dll
          2008-11-07 22:24 . 2008-10-16 13:56 31,232 --a------ c:\windows\System32\wuapp.exe
          2008-11-07 20:14 . 2008-11-07 20:14 <REP> d-------- c:\program files\Windows Live SkyDrive
          2008-11-03 03:19 . 2008-11-03 03:19 <REP> d-------- c:\windows\CheckSur

          .
          (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
          .
          2008-12-30 00:10 --------- d-----w c:\programdata\Google Updater
          2008-12-29 18:28 --------- d-----w c:\program files\Yahoo!
          2008-12-29 18:01 --------- d-----w c:\program files\Java
          2008-12-29 17:57 --------- d-----w c:\program files\Common Files\Adobe
          2008-12-27 11:49 --------- d-----w c:\program files\Google
          2008-12-24 19:31 --------- d-----w c:\program files\Common Files\Symantec Shared
          2008-12-23 20:34 --------- d-----w c:\program files\Norton Security Scan
          2008-12-14 16:07 348,160 ----a-w c:\windows\System32\msvcr71.dll
          2008-12-14 16:07 339,968 ----a-w c:\windows\System32\pythoncom25.dll
          2008-12-14 16:07 2,117,632 ----a-w c:\windows\System32\python25.dll
          2008-12-14 16:07 114,688 ----a-w c:\windows\System32\pywintypes25.dll
          2008-12-10 05:46 --------- d-----w c:\program files\Windows Mail
          2008-11-26 23:30 --------- d--h--w c:\program files\InstallShield Installation Information
          2008-11-22 00:18 --------- d-----w c:\program files\IcoFX 1.6 icone a modifié
          2008-11-08 13:03 --------- d-----w c:\program files\Unity
          2008-11-07 00:26 --------- d-----w c:\program files\Realore
          2008-11-07 00:14 --------- d-----w c:\program files\The Bitmap Brothers
          2008-11-04 00:03 --------- d-----w c:\programdata\Microsoft Help
          2008-11-04 00:00 --------- d-----w c:\program files\Microsoft Works
          2008-11-03 23:34 --------- d-----w c:\program files\AstroRaid
          2008-11-03 23:33 --------- d-----w c:\program files\GameTop.com
          2008-11-03 23:16 --------- d-----w c:\program files\Windows Live
          2008-11-01 03:44 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
          2008-11-01 03:44 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
          2008-11-01 03:44 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll
          2008-11-01 03:44 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll
          2008-11-01 03:44 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
          2008-10-16 19:16 796,672 ----a-w c:\windows\GPInstall.exe
          2008-09-30 15:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll
          2008-09-26 10:31 0 ----a-w c:\users\philippe\AppData\Roaming\wklnhst.dat
          2008-09-18 05:09 3,601,464 ----a-w c:\windows\System32\ntkrnlpa.exe
          2008-09-18 05:09 3,549,240 ----a-w c:\windows\System32\ntoskrnl.exe
          2008-09-18 04:56 147,456 ----a-w c:\windows\System32\Faultrep.dll
          2008-09-18 04:56 125,952 ----a-w c:\windows\System32\wersvc.dll
          2008-09-18 02:16 2,032,640 ----a-w c:\windows\System32\win32k.sys
          2008-09-16 16:26 1,332,197 ----a-w c:\windows\System32\pythondll.zip
          2008-09-12 16:07 192,512 ----a-w c:\windows\off-road-uninst.exe
          2008-05-22 12:27 174 --sha-w c:\program files\desktop.ini
          2008-05-21 18:46 173 ----a-w c:\users\philippe\BackupResult.DAT
          .

          ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
          .
          .
          *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
          REGEDIT4

          [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
          "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
          "Speech Recognition"="c:\windows\Speech\Common\sapisvr.exe" [2008-01-19 49664]
          "CollaborationHost"="c:\windows\system32\p2phost.exe" [2008-01-19 192000]
          "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-08 68856]
          "WindowsWelcomeCenter"="oobefldr.dll" [2008-01-19 c:\windows\System32\oobefldr.dll]

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-09-15 29744]
          "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
          "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
          "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-29 136600]

          [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
          "Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-05-22 151552]

          c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
          Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2007-07-31 535336]

          [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
          "FilterAdministratorToken"= 1 (0x1)
          "EnableUIADesktopToggle"= 0 (0x0)

          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
          "AppInit_DLLs"=c:\progra~1\Google\GOOGLE~3\GOEC62~1.DLL eNetHook.dll

          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
          @="Driver"

          [HKLM\~\startupfolder\C:^Users^philippe^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MorphVOXJr.lnk]
          path=c:\users\philippe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MorphVOXJr.lnk
          backup=c:\windows\pss\MorphVOXJr.lnk.Startup
          backupExtension=.Startup

          [HKLM\~\startupfolder\C:^Users^philippe^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MorphVOXPro.lnk]
          path=c:\users\philippe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MorphVOXPro.lnk
          backup=c:\windows\pss\MorphVOXPro.lnk.Startup
          backupExtension=.Startup

          [HKEY_LOCAL_MACHINE\software\microsoft\security center]
          "UacDisableNotify"=dword:00000001

          [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
          "DisableMonitoring"=dword:00000001

          [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
          "DisableMonitoring"=dword:00000001

          [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
          "DisableMonitoring"=dword:00000001

          [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2606745893-197517921-552777776-1000]
          "EnableNotificationsRef"=dword:00000001

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
          "{A9191AA0-F975-422A-A045-8BE6C6A94DD2}"= c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
          "{C8A951A8-BB7D-44C5-B947-EB3AB29A846B}"= c:\program files\Acer Arcade Deluxe\VideoMagician\VideoMagician.exe:VideoMagician
          "{585C86AC-AE4D-4313-81DF-771121FEAA30}"= c:\program files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe:HomeMedia
          "{ABEFDFC7-B36D-4F11-BB03-0E2865E19AEA}"= c:\program files\Acer Arcade Deluxe\DV Wizard\DV Wizard.exe:DV Wizard
          "{7B0EF77A-F01E-45A5-BDCF-73E3FA39F9C5}"= c:\program files\Acer Arcade Deluxe\DVDivine\DVDivine.exe:DVDivine
          "{F463B540-F154-44DA-99DB-6DAC6F85E813}"= c:\program files\Acer Arcade Deluxe\Play Movie\PlayMovie.exe:Play Movie
          "{1FEC2FF0-2674-4C83-8CD3-9258F59DF564}"= c:\program files\Acer Arcade Deluxe\Play Movie\PMVService.exe:Play Movie Resident Program
          "{9DB02D1D-FD80-411D-8FBA-89D86868823A}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
          "{B25C3DDC-0084-4127-963D-D99762FC74D8}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
          "{CD815638-6A92-4C06-8C8A-91CFE24B66F1}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
          "{B2382129-6027-42D7-AE25-CD7475629CE4}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
          "{609687EC-B609-4DFD-9444-321122F4B54F}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
          "{99179F52-2FD6-4CC8-A5F7-12F972B46178}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
          "{7A42FDDB-BCED-4184-8155-DCD489100435}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
          "{596BC37F-4C8A-47CC-B891-999674D50FDE}"= UDP:c:\users\philippe\AppData\Local\Temp\WZSE0.TMP\SymNRT.exe:Norton Removal Tool
          "{F05D8FE4-B5DA-43B1-B049-FEC2753EB3B7}"= TCP:c:\users\philippe\AppData\Local\Temp\WZSE0.TMP\SymNRT.exe:Norton Removal Tool

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
          "DoNotAllowExceptions"= 0 (0x0)

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
          "c:\\Acer\\Empowering Technology\\eDataSecurity\\eDSfsu.exe"= c:\acer\Empowering Technology\eDataSecurity\eDSfsu.exe:*:Enabled:eDSfsu
          "c:\\Acer\\Empowering Technology\\eDataSecurity\\encryption.exe"= c:\acer\Empowering Technology\eDataSecurity\encryption.exe:*:Enabled:encryption
          "c:\\Acer\\Empowering Technology\\eDataSecurity\\decryption.exe"= c:\acer\Empowering Technology\eDataSecurity\decryption.exe:*:Enabled:decryption

          R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};\??\c:\program files\Acer Arcade Deluxe\Play Movie\[u]0/u00.fcl [2008-03-24 20:20:27 13560]
          R2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [2008-12-28 51792]
          R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2007-07-31 179712]
          R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\screamingbdriver.sys [2006-03-27 13824]
          S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;"c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-04-08 29744]

          *Newly Created Service* - PROCEXP90
          .
          Contenu du dossier 'Tâches planifiées'

          2008-06-01 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
          - c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 10:20]
          .
          - - - - ORPHELINS SUPPRIMES - - - -

          HKCU-Run-Acer Tour Reminder - (no file)

          **************************************************************************

          catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
          Rootkit scan 2008-12-30 19:49:37
          Windows 6.0.6001 Service Pack 1 NTFS

          Recherche de processus cachés ...

          Recherche d'éléments en démarrage automatique cachés ...

          Recherche de fichiers cachés ...

          Scan terminé avec succès
          Fichiers cachés: 0

          **************************************************************************
          .
          Heure de fin: 2008-12-30 19:57:41
          ComboFix-quarantined-files.txt 2008-12-30 18:57:31

          Avant-CF: 24 649 961 472 octets libres
          Après-CF: 24,111,120,384 octets libres

          249 --- E O F --- 2008-12-22 18:17:03
      10. Destrio5 Modérateur
        On va sortir ComboFix car sinon, on va jamais finir.

        OTMoveIt n'arrive à supprimer ce que je veux.

        ---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
        http://download.bleepingcomputer.com/sUBs/ComboFix.exe

        /!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

        ---> Double-clique sur Combofix.exe
        Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
        Accepte en cliquant sur "Oui"

        ---> Mets-le en langue française F
        Tape sur la touche 1 (Yes) pour démarrer le scan.

        /!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

        En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

        Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

        /!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

        Note : Le rapport se trouve également là : C:\Combofix.txt

        Tutoriel officiel :
        https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
        1. chlaimer Auteur
          ok mais tu sais le quelle est mon anti-spyware j'en ai tellement installer que je sais pas le quel est activé ! et j attaque
        2. chlaimer Auteur
          anti-malwares et anti-spywares c'est pas la meme chose? car j'ai sur le bureau a squared free , Ccleaner , malwaresbytes je sais plus !!!
      11. Destrio5 Modérateur
        Tu as fait OTMoveIt en MSE ?
        1. chlaimer Auteur
          oui mais je peux toujours pas copier le rapport , que faire ??
      12. Destrio5 Modérateur
        Désolé qu'on arrive au 200ème message ^^
        1. chlaimer Auteur
          Pas grave ! peut etre qu'on va arriver a 400 (mdr)
      13. Destrio5 Modérateur
        Tu peux le faire en mode sans échec.
        1. chlaimer Auteur
          J'ai eu ça : a l instant ========== PROCESSES ==========
          Process explorer.exe killed successfully.
          ========== SERVICES/DRIVERS ==========
          Unable to stop service AGWinService .
          Unable to stop service Planificateur LiveUpdate automatique .
          ========== FILES ==========
          C:\Users\philippe\AppData\Roaming\agi\logs moved successfully.
          C:\Users\philippe\AppData\Roaming\agi\KiweeToolbar\config moved successfully.
          C:\Users\philippe\AppData\Roaming\agi\KiweeToolbar moved successfully.
          C:\Users\philippe\AppData\Roaming\agi\config moved successfully.
          C:\Users\philippe\AppData\Roaming\agi moved successfully.
          Folder move failed. C:\ProgramData\agi\KiweeToolbar\config scheduled to be moved on reboot.
          Folder move failed. C:\ProgramData\agi\KiweeToolbar scheduled to be moved on reboot.
          Folder move failed. C:\ProgramData\agi\config scheduled to be moved on reboot.
          Folder move failed. C:\ProgramData\agi scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\tmp scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\xml\sax scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\xml\parsers scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\xml\etree scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\xml\dom scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\xml scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\logging scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\hotshot scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\encodings scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\email\mime scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\email scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\ctypes scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\compiler scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\DLLs scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25 scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32comext\shell scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32comext\axcontrol scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32comext\authorization scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32comext\adsi scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32comext scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32com\server scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32com\client scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32com scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32\scripts scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32\lib scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32 scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\search\provider scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\search\algorithm scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\search scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\protection scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\process scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\lilw scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\install\installers scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\install\dependency scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\install scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\config scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\dateutil\zoneinfo scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\dateutil scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\comtypes\tools scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\comtypes\server scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\comtypes\gen scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\comtypes\client scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\comtypes scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI scheduled to be moved on reboot.
          Folder move failed. C:\ProgramData\Kiwee Toolbar\images scheduled to be moved on reboot.
          Folder move failed. C:\ProgramData\Kiwee Toolbar\config scheduled to be moved on reboot.
          Folder move failed. C:\ProgramData\Kiwee Toolbar scheduled to be moved on reboot.
          ========== COMMANDS ==========
          File delete failed. C:\Users\philippe\AppData\Local\Temp\~DF7922.tmp scheduled to be deleted on reboot.
          File delete failed. C:\Users\philippe\AppData\Local\Temp\~DF7964.tmp scheduled to be deleted on reboot.
          File delete failed. C:\Users\philippe\AppData\Local\Temp\~DF8CB0.tmp scheduled to be deleted on reboot.
          File delete failed. C:\Users\philippe\AppData\Local\Temp\~DFD7FA.tmp scheduled to be deleted on reboot.
          File delete failed. C:\Users\philippe\AppData\Local\Temp\~DFE077.tmp scheduled to be deleted on reboot.
          File delete failed. C:\Users\philippe\AppData\Local\Temp\~DFE783.tmp scheduled to be deleted on reboot.
          User's Temp folder emptied.
          User's Temporary Internet Files folder emptied.
          User's Internet Explorer cache folder emptied.
          Local Service Temp folder emptied.
          Local Service Temporary Internet Files folder emptied.
          Windows Temp folder emptied.
          Temp folders emptied.
          Explorer started successfully

          OTMoveIt3 by OldTimer - Version 1.0.7.2 log created on 12302008_180607

          Files moved on Reboot...
          Folder move failed. C:\ProgramData\agi\KiweeToolbar\config scheduled to be moved on reboot.
          Folder move failed. C:\ProgramData\agi\KiweeToolbar\config scheduled to be moved on reboot.
          Folder move failed. C:\ProgramData\agi\KiweeToolbar scheduled to be moved on reboot.
          Folder move failed. C:\ProgramData\agi\config scheduled to be moved on reboot.
          Folder move failed. C:\ProgramData\agi\KiweeToolbar\config scheduled to be moved on reboot.
          Folder move failed. C:\ProgramData\agi\KiweeToolbar scheduled to be moved on reboot.
          Folder move failed. C:\ProgramData\agi\config scheduled to be moved on reboot.
          Folder move failed. C:\ProgramData\agi scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\tmp scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\xml\sax scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\xml\parsers scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\xml\etree scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\xml\dom scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\xml\sax scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\xml\parsers scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\xml\etree scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\xml\dom scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\xml scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\logging scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\hotshot scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\encodings scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\email\mime scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\email\mime scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\email scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\ctypes scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\compiler scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\xml\sax scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\xml\parsers scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\xml\etree scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\xml\dom scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\xml scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\logging scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\hotshot scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\encodings scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\email\mime scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\email scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\ctypes scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\compiler scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\DLLs scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\xml\sax scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\xml\parsers scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\xml\etree scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\xml\dom scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\xml scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\logging scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\hotshot scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\encodings scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\email\mime scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\email scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\ctypes scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\compiler scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\DLLs scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25 scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32comext\shell scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32comext\axcontrol scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32comext\authorization scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32comext\adsi scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32comext\shell scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32comext\axcontrol scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32comext\authorization scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32comext\adsi scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32comext scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32com\server scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32com\client scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32com\server scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32com\client scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32com scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32\scripts scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32\lib scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32\scripts scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32\lib scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32 scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\search\provider scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\search\algorithm scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\search\provider scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\search\algorithm scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\search scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\protection scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\process scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\lilw scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\install\installers scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\install\dependency scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\install\installers scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\install\dependency scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\install scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\config scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\search\provider scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\search\algorithm scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\search scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\protection scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\process scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\lilw scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\install\installers scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\install\dependency scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\install scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\config scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\dateutil\zoneinfo scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\dateutil\zoneinfo scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\dateutil scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\comtypes\tools scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\comtypes\server scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\comtypes\gen scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\comtypes\client scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\comtypes\tools scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\comtypes\server scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\comtypes\gen scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\comtypes\client scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\comtypes scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32comext\shell scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32comext\axcontrol scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32comext\authorization scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32comext\adsi scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32comext scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32com\server scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32com\client scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32com scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32\scripts scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32\lib scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32 scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\search\provider scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\search\algorithm scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\search scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\protection scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\process scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\lilw scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\install\installers scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\install\dependency scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\install scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\config scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\dateutil\zoneinfo scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\dateutil scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\comtypes\tools scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\comtypes\server scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\comtypes\gen scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\comtypes\client scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\comtypes scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\tmp scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\xml\sax scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\xml\parsers scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\xml\etree scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\xml\dom scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\xml scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\logging scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\hotshot scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\encodings scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\email\mime scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\email scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\ctypes scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib\compiler scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\Lib scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25\DLLs scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\Python25 scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32comext\shell scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32comext\axcontrol scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32comext\authorization scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32comext\adsi scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32comext scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32com\server scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32com\client scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32com scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32\scripts scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32\lib scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\win32 scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\search\provider scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\search\algorithm scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\search scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\protection scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\process scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\lilw scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\install\installers scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\install\dependency scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\install scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore\config scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\pyagcore scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\dateutil\zoneinfo scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\dateutil scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\comtypes\tools scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\comtypes\server scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\comtypes\gen scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\comtypes\client scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common\comtypes scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI\common scheduled to be moved on reboot.
          Folder move failed. C:\Program Files\AGI scheduled to be moved on reboot.
          Folder move failed. C:\ProgramData\Kiwee Toolbar\images scheduled to be moved on reboot.
          Folder move failed. C:\ProgramData\Kiwee Toolbar\config scheduled to be moved on reboot.
          Folder move failed. C:\ProgramData\Kiwee Toolbar\images scheduled to be moved on reboot.
          Folder move failed. C:\ProgramData\Kiwee Toolbar\config scheduled to be moved on reboot.
          Folder move failed. C:\ProgramData\Kiwee Toolbar scheduled to be moved on reboot.
          File C:\Users\philippe\AppData\Local\Temp\~DF7922.tmp not found!
          File C:\Users\philippe\AppData\Local\Temp\~DF7964.tmp not found!
          File C:\Users\philippe\AppData\Local\Temp\~DF8CB0.tmp not found!
          File C:\Users\philippe\AppData\Local\Temp\~DFD7FA.tmp not found!
          File C:\Users\philippe\AppData\Local\Temp\~DFE077.tmp not found!
          C:\Users\philippe\AppData\Local\Temp\~DFE783.tmp moved successfully.
      14. chlaimer Auteur
        je vois le rapport mais quand je veux le copier ça s'enlève j'essaye en mode sens échec ? c le meme problème que hier quand je l'ai copier par écrit !!! mais celui la est long !!!
        1. Destrio5 Modérateur
          Bon, bah, on va encore faire du tri.

          ---> Désactive ton antivirus le temps de la manipulation car OTMoveIt3 est détecté comme une infection à tort.

          ---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau :
          http://oldtimer.geekstogo.com/OTMoveIt3.exe

          ---> Clique droit sur OTMoveIt3.exe et choisis Exécuter en tant qu'administrateur.

          ---> Copie (Ctrl+C) le texte suivant ci-dessous :

          :processes
          explorer.exe

          :services
          AGWinService
          Planificateur LiveUpdate automatique

          :files
          C:\Users\philippe\AppData\Roaming\agi
          C:\ProgramData\agi
          C:\Program Files\AGI
          C:\ProgramData\Kiwee Toolbar

          :commands
          [purity]
          [emptytemp]
          [start explorer]
          [reboot]

          ---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

          ---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

          Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
          Accepte en cliquant sur YES.

          ---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
          Le nom du rapport correspond au moment de sa création : date_heure.log
          1. chlaimer Auteur
            je voulais aussi te remercier pour ton aide et ta générosité ( Grand Merci a toi ) Philippe
        • 1
        • 2
        • 3
        • 4
        • 5