Manson/Liser.dll Trojan help please!

1/

---> Désinstalle HijackThis.

---> Télécharge OTC sur ton Bureau :
* Clique droit sur OTC et choisis Exécuter en tant qu'administrateur.
* Clique sur CleanUp! puis clique sur Yes à la fenêtre Confirm.
* Redémarre ton PC comme demandé.

2/

---> Télécharge et installe CCleaner (N'installe pas la Yahoo Toolbar) :
* Lance-le. Va dans Options puis Avancé et décoche la case Effacer uniquement les fichiers etc....
* Va dans Nettoyeur, choisis Analyse. Une fois terminé, lance le nettoyage.

3/

---> Il est nécessaire de désactiver puis réactiver la restauration système pour la purger.

==Prévention==

Réactive l'UAC si ce n'est pas déjà fait.

Je te conseille de remplacer Avast par AntiVir.

Conserve MBAM. Il te servira à scanner les fichiers douteux en complément de l'antivirus et scanne le disque dur régulièrement.

Par rapport au P2P : Lien

Voici un dossier complet (A lire avec Adobe Reader ou Foxit Reader) : Lien

Sois plus vigilant(e) sur Internet ;)

Je voudrais vous remerciez de la pacience dont vous faites preuve encore merci merci merci

Malwarebytes' Anti-Malware 1.37
Version de la base de données: 2291
Windows 6.0.6000

17/06/2009 03:48:17
mbam-log-2009-06-17 (03-48-17).txt

Type de recherche: Examen rapide
Eléments examinés: 76211
Temps écoulé: 3 minute(s), 18 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Normalement oui.

Desoler sa prend un peu de temps j'ai que du 512 mais j'ai une question le virus est partit ?

Le rapport est OK, tu peux supprimer RSIT et le dossier RSIT situé dans C:\.

---> Désinstalle les programmes suivants :
- Java 6 Update 2
- Java 6 Update 5
- Java 6 Update 7

---> Mets à jour Java.

---> Mets à jour Adobe Reader.

---> Télécharge Malwarebytes' Anti-Malware (MBAM) sur ton Bureau.
---> Double-clique sur le fichier téléchargé pour lancer le processus d'installation.
---> Dans l'onglet Mise à jour, clique sur le bouton Recherche de mise à jour : si le pare-feu demande l'autorisation à MBAM de se connecter à Internet, accepte.
---> Une fois la mise à jour terminée, rends-toi dans l'onglet Recherche.
---> Sélectionne Exécuter un examen rapide.
---> Clique sur Rechercher. L'analyse démarre.

A la fin de l'analyse, un message s'affiche :

L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.

---> Clique sur OK pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
---> Ferme tes navigateurs.
Si des malwares ont été détectés, clique sur Afficher les résultats.
---> Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre infectés et en mettre une copie dans la quarantaine.
---> MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport dans ta prochaine réponse.

Voila le rapport

Logfile of random's system information tool 1.06 (written by random/random)
Run by Jean-Marc at 2009-06-17 03:08:29
Microsoft® Windows Vista™ Édition Familiale Premium
System drive C: has 59 GB (42%) free of 141 GB
Total RAM: 3070 MB (60% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:08:33, on 17/06/2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16851)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\ProgramData\EPSON\EPW!3 SSRP\E_S40ST7.EXE
C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\OrangeHSS\Launcher\Launcher.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\OrangeHSS\systray\systrayapp.exe
C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\conime.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\program files\aol\aol toolbar 5.0\AolTbServer.exe
C:\Windows\system32\taskeng.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\DivX\DivX Codec\divxsm.exe
C:\Users\Jean-Marc\Desktop\RSIT.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Jean-Marc\Downloads\Jean-Marc.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [EPSON SX100 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIEDE.EXE /FU "C:\Windows\TEMP\E_S9F1B.tmp" /EF "HKCU"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: Free Music Zilla.lnk = C:\Program Files\Free Music Zilla\FMZilla.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 5.0\resources\fr-fr\local\search.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O15 - Trusted Zone: http://*.mappy.com
O15 - Trusted Zone: http://*.orange.fr
O15 - Trusted Zone: http://rw.search.ke.voila.fr
O15 - Trusted Zone: http://orange.weborama.fr
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: EPSON V5 Service4(01) (EPSON_EB_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40ST7.EXE
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

--> Refais un scan RSIT et poste le rapport log pour que je vérifie que c'est OK.

Au fait, ton Vista n'est pas à jour, il est en SP0 alors que le SP2 est sorti récemment.

Pour l'UAC que j'ai desactivé au debut je le reactive ou pas ?

Je l'ai redémaré mais je comprend pas pourquoi il y a autant d'analyse dans certain rapport il trouve même plus le fichier Manson\liser.exe je doute pas de vos connaissances je me renseigne seulement

Redémarre le PC.

Eu mon bureau a disparu le logiciel a bug c'était marquer OTM de repond plus et il c fermer

---> Désactive ton antivirus le temps de la manipulation car OTM est détecté comme une infection à tort.

---> Télécharge OTM (OldTimer) sur ton Bureau.

--->Clique droit sur OTM.exe et choisis Exécuter en tant qu'administrateur.

---> Copie (Ctrl+C) le texte suivant ci-dessous :

:processes
explorer.exe

:files
C:\Program Files\Manson

:reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"kell"=-

:commands
[purity]
[emptytemp]
[reboot]

---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

---> Clique maintenant sur le bouton MoveIt! puis ferme OTM.

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.

---> Poste le rapport situé dans ce dossier : C:\_OTM\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log

Voila le rapport

Logfile of random's system information tool 1.06 (written by random/random)
Run by Jean-Marc at 2009-06-17 02:32:06
Microsoft® Windows Vista™ Édition Familiale Premium
System drive C: has 59 GB (42%) free of 141 GB
Total RAM: 3070 MB (62% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:32:14, on 17/06/2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16851)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\ProgramData\EPSON\EPW!3 SSRP\E_S40ST7.EXE
C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Windows\system32\taskeng.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\explorer.exe
c:\program files\aol\aol toolbar 5.0\AolTbServer.exe
C:\Windows\system32\conime.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\DivX\DivX Codec\divxsm.exe
C:\Users\Jean-Marc\Desktop\RSIT.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Jean-Marc\Downloads\Jean-Marc.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [EPSON SX100 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIEDE.EXE /FU "C:\Windows\TEMP\E_S9F1B.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [kell] C:\Program Files\Manson\liser.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: Free Music Zilla.lnk = C:\Program Files\Free Music Zilla\FMZilla.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 5.0\resources\fr-fr\local\search.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O15 - Trusted Zone: http://*.mappy.com
O15 - Trusted Zone: http://*.orange.fr
O15 - Trusted Zone: http://rw.search.ke.voila.fr
O15 - Trusted Zone: http://orange.weborama.fr
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: EPSON V5 Service4(01) (EPSON_EB_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40ST7.EXE
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

--> Refais un scan RSIT et poste le rapport log.

Voila le rapport

0 bytes size received / Se ha recibido un archivo vacio

Casino770 est parti à la benne avec les autres adwares.

--> Désinstalle Ad-Remover.

--> Fais analyser ce fichier : C:\Program Files\Manson\liser.exe

--> Sur VirusTotal et poste le lien de l'analyse.

Voila le rapport

.
======= RAPPORT D'AD-REMOVER 1.1.4.5_J | UNIQUEMENT XP/VISTA/SEVEN =======
.
Mit à jour par C_XX le 14/06/2009 à 10:30 PM
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 1:36:51, 17/06/2009 | Mode Normal | Option: CLEAN
Exécuté de: C:\Program Files\Ad-remover\
Système d'exploitation: Microsoft® Windows Vista™ Home Premium v6.0.6000
Nom du PC: PC-DE-JEAN-MARC | Utilisateur actuel: Jean-Marc
.
Administrateur: Administrateur *Desactive*
N'est pas administrateur: Invité *Desactive*
Administrateur: Jean-Marc
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.
.
HKCR\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKCR\EoRezoBHO.EoBho
HKCR\EoRezoBHO.EoBho.1
HKCR\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
HKCU\Software\EoRezo
HKCU\Software\Grand Virtual
HKCU\Software\ItsLabel
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKLM\Software\Dealio
HKLM\Software\EoRezo
HKLM\Software\ItsLabel
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Eoengine
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F}
.
C:\Users\JEAN-M~1\AppData\Roaming\EoRezo\cache
C:\Users\JEAN-M~1\AppData\Roaming\EoRezo\cmhost.cyp
C:\Users\JEAN-M~1\AppData\Roaming\EoRezo\ConfMedia.cyp
C:\Users\JEAN-M~1\AppData\Roaming\EoRezo\db
C:\Users\JEAN-M~1\AppData\Roaming\EoRezo\eoDesktop
C:\Users\JEAN-M~1\AppData\Roaming\EoRezo\eoStats
C:\Users\JEAN-M~1\AppData\Roaming\EoRezo\host.cyp
C:\Users\JEAN-M~1\AppData\Roaming\EoRezo\modules.cyp
C:\Users\JEAN-M~1\AppData\Roaming\EoRezo\user.cyp
C:\Users\JEAN-M~1\AppData\Roaming\EoRezo\db\cat.cyp
C:\Users\JEAN-M~1\AppData\Roaming\EoRezo\eoDesktop\config.xml
C:\Users\JEAN-M~1\AppData\Roaming\EoRezo\eoDesktop\eoDesktop.html
C:\Users\JEAN-M~1\AppData\Roaming\EoRezo\eoDesktop\userConfig.xml
C:\Users\JEAN-M~1\AppData\Roaming\EoRezo\eoStats\eoStats.txt
C:\Users\JEAN-M~1\AppData\Roaming\EoRezo
C:\Users\JEAN-M~1\AppData\Roaming\ItsLabel\ItsTV
C:\Users\JEAN-M~1\AppData\Roaming\ItsLabel\ItsTV\itsTV.xml
C:\Users\JEAN-M~1\AppData\Roaming\ItsLabel
C:\Program Files\Dealio\kb127
C:\Program Files\Dealio
C:\Program Files\EoRezo\EoAdv
C:\Program Files\EoRezo\EoAdv\eoAdv.url
C:\Program Files\EoRezo\EoAdv\EoRezoBho.old
C:\Program Files\EoRezo\EoAdv\tmp
C:\Program Files\EoRezo\EoAdv\tmp\eoRezoBho.dll.3454
C:\Program Files\EoRezo\EoAdv\tmp\eoRezoBho.dll.964
C:\Program Files\EoRezo
C:\Casino770\banner.dat
C:\Casino770\casino770.exe
C:\Casino770\casino770.xml
C:\Casino770\conf.dat
C:\Casino770\download
C:\Casino770\intro.dat
C:\Casino770\local.conf
C:\Casino770\loginpop.dat
C:\Casino770\play770.exe
C:\Casino770\playadr.dll
C:\Casino770\playclub.dat
C:\Casino770\playmm.dll
C:\Casino770\playtext.dll
C:\Casino770\server.conf
C:\Casino770\uninstaller.exe
C:\Casino770\download\common
C:\Casino770\download\help770.hlp
C:\Casino770\download\slot_10xplay
C:\Casino770\download\slot_3hitpay
C:\Casino770\download\slot_5xplay
C:\Casino770\download\slot_aircraft
C:\Casino770\download\slot_aliensattacks
C:\Casino770\download\slot_americanclassics
C:\Casino770\download\slot_americaneagle
C:\Casino770\download\slot_aprendreoualaisser
C:\Casino770\download\slot_aquatic
C:\Casino770\download\slot_arabiannight
C:\Casino770\download\slot_aroundtheworld
C:\Casino770\download\slot_articace
C:\Casino770\download\slot_astro
C:\Casino770\download\slot_bananajones
C:\Casino770\download\slot_bellsroses
C:\Casino770\download\slot_blackandwhite
C:\Casino770\download\slot_bonusarrow
C:\Casino770\download\slot_bonusdiamond
C:\Casino770\download\slot_bonusdiamondxplay
C:\Casino770\download\slot_bonusdragon
C:\Casino770\download\slot_bonusfoot
C:\Casino770\download\slot_bonushunt
C:\Casino770\download\slot_bonuslotto
C:\Casino770\download\slot_bowling
C:\Casino770\download\slot_breathoffire
C:\Casino770\download\slot_brothersthiefs
C:\Casino770\download\slot_captaincash
C:\Casino770\download\slot_carnival
C:\Casino770\download\slot_carrun
C:\Casino770\download\slot_casinopoly
C:\Casino770\download\slot_catchthecat
C:\Casino770\download\slot_chefmario
C:\Casino770\download\slot_circusmadness
C:\Casino770\download\slot_cleopatra
C:\Casino770\download\slot_climbdungeon
C:\Casino770\download\slot_coollook
C:\Casino770\download\slot_cosanostra
C:\Casino770\download\slot_cowboy
C:\Casino770\download\slot_crazycoyote
C:\Casino770\download\slot_crazyfire
C:\Casino770\download\slot_crazysafari
C:\Casino770\download\slot_diamondmine
C:\Casino770\download\slot_diamondsking
C:\Casino770\download\slot_doubleagent
C:\Casino770\download\slot_doublebonuslotto
C:\Casino770\download\slot_doublediamond
C:\Casino770\download\slot_dragondice
C:\Casino770\download\slot_duckshot
C:\Casino770\download\slot_easytimes
C:\Casino770\download\slot_edenpark
C:\Casino770\download\slot_empireofpower
C:\Casino770\download\slot_empireofseas
C:\Casino770\download\slot_eskimos
C:\Casino770\download\slot_eternalshine
C:\Casino770\download\slot_famoussevens
C:\Casino770\download\slot_firestar
C:\Casino770\download\slot_firezone
C:\Casino770\download\slot_fivebillion
C:\Casino770\download\slot_forestfever
C:\Casino770\download\slot_frenchriviera
C:\Casino770\download\slot_fruitparty
C:\Casino770\download\slot_fullbonus
C:\Casino770\download\slot_funkytaxi
C:\Casino770\download\slot_funnyfair
C:\Casino770\download\slot_gallobonus
C:\Casino770\download\slot_getafish
C:\Casino770\download\slot_giftsfromcaesar
C:\Casino770\download\slot_goblinprecious
C:\Casino770\download\slot_goldball
C:\Casino770\download\slot_goldeneagle
C:\Casino770\download\slot_goldengolf
C:\Casino770\download\slot_goldenmoon
C:\Casino770\download\slot_goldmine
C:\Casino770\download\slot_goldraiders
C:\Casino770\download\slot_goldrush
C:\Casino770\download\slot_greedysamourai
C:\Casino770\download\slot_halloween
C:\Casino770\download\slot_hardwillrock
C:\Casino770\download\slot_heavychampion
C:\Casino770\download\slot_hellcity
C:\Casino770\download\slot_hitscore
C:\Casino770\download\slot_holdup
C:\Casino770\download\slot_hollywood
C:\Casino770\download\slot_horrornight
C:\Casino770\download\slot_horseracing
C:\Casino770\download\slot_hotmoney
C:\Casino770\download\slot_hottimes
C:\Casino770\download\slot_hugepizza
C:\Casino770\download\slot_hunterofseas
C:\Casino770\download\slot_ilovebonus
C:\Casino770\download\slot_indianchief
C:\Casino770\download\slot_ironsvikings
C:\Casino770\download\slot_jazzonclub
C:\Casino770\download\slot_jetset
C:\Casino770\download\slot_jimmybondy
C:\Casino770\download\slot_joker
C:\Casino770\download\slot_jokertrio
C:\Casino770\download\slot_joyboat
C:\Casino770\download\slot_jungle
C:\Casino770\download\slot_kenobonus
C:\Casino770\download\slot_kingarthur
C:\Casino770\download\slot_lasvegas
C:\Casino770\download\slot_letreflegeant
C:\Casino770\download\slot_littlebigboy
C:\Casino770\download\slot_lostatlantis
C:\Casino770\download\slot_lostincas
C:\Casino770\download\slot_loveangels
C:\Casino770\download\slot_luckymonster
C:\Casino770\download\slot_luickybonus
C:\Casino770\download\slot_magical
C:\Casino770\download\slot_magiccherry
C:\Casino770\download\slot_makingmoney
C:\Casino770\download\slot_mangacrazy
C:\Casino770\download\slot_mangapunch
C:\Casino770\download\slot_medieval
C:\Casino770\download\slot_megadino
C:\Casino770\download\slot_megawheelbonus
C:\Casino770\download\slot_megawin
C:\Casino770\download\slot_mexicanmix
C:\Casino770\download\slot_miami
C:\Casino770\download\slot_millioncents
C:\Casino770\download\slot_montecarlo
C:\Casino770\download\slot_mouseandcat
C:\Casino770\download\slot_moviewood
C:\Casino770\download\slot_mrcashbonus
C:\Casino770\download\slot_multicolorwheel
C:\Casino770\download\slot_multiplierballs
C:\Casino770\download\slot_multipliergods
C:\Casino770\download\slot_multitimes
C:\Casino770\download\slot_multitimeswild
C:\Casino770\download\slot_multiwheel
C:\Casino770\download\slot_musiccountry
C:\Casino770\download\slot_newyork
C:\Casino770\download\slot_paradise
C:\Casino770\download\slot_pharaohprogressive
C:\Casino770\download\slot_pharaohtreasures
C:\Casino770\download\slot_piratesisland
C:\Casino770\download\slot_piratestreasure
C:\Casino770\download\slot_pittandgrant
C:\Casino770\download\slot_pokermania
C:\Casino770\download\slot_powerofwheel
C:\Casino770\download\slot_princesquest
C:\Casino770\download\slot_quicktime
C:\Casino770\download\slot_quiveutgagner
C:\Casino770\download\slot_redwhiteblue
C:\Casino770\download\slot_roadtrip
C:\Casino770\download\slot_scratch
C:\Casino770\download\slot_secretagent
C:\Casino770\download\slot_segacasino
C:\Casino770\download\slot_sheepsandmartians
C:\Casino770\download\slot_snakecharmer
C:\Casino770\download\slot_specialacademy
C:\Casino770\download\slot_speedracer
C:\Casino770\download\slot_spindeuce
C:\Casino770\download\slot_spinoureels
C:\Casino770\download\slot_spinpoker
C:\Casino770\download\slot_splendidaces
C:\Casino770\download\slot_starquest
C:\Casino770\download\slot_superfirestar
C:\Casino770\download\slot_supermultitimes
C:\Casino770\download\slot_supertoon
C:\Casino770\download\slot_supertricolor
C:\Casino770\download\slot_tearfactor
C:\Casino770\download\slot_thunderstorm
C:\Casino770\download\slot_tiger
C:\Casino770\download\slot_timestotimes
C:\Casino770\download\slot_topcash
C:\Casino770\download\slot_treasure
C:\Casino770\download\slot_treasuremonkey
C:\Casino770\download\slot_tropical
C:\Casino770\download\slot_wantedbonus
C:\Casino770\download\slot_wheeloffortune
C:\Casino770\download\slot_wild777
C:\Casino770\download\slot_wildrose
C:\Casino770\download\slot_winabike
C:\Casino770\download\slot_winacar
C:\Casino770\download\slot_worldcup
C:\Casino770\download\slot_worldsports
C:\Casino770\download\slot_worldtour
C:\Casino770\download\slot_worldtrader
C:\Casino770\download\slot_wormapple
C:\Casino770\download\vp_jokermultitimes
C:\Casino770\download\vp_texaspoker
C:\Casino770\download\xcommon
C:\Casino770\download\common\1.0
C:\Casino770\download\common\1.0\bass.dll
C:\Casino770\download\common\1.0\Common.Core.dll
C:\Casino770\download\common\1.0\Common.UI.dll
C:\Casino770\download\common\1.0\fr
C:\Casino770\download\common\1.0\fr\Common.UI.resources.dll
C:\Casino770\download\slot_10xplay\slot_10xplay.jpg
C:\Casino770\download\slot_3hitpay\slot_3hitpay.jpg
C:\Casino770\download\slot_5xplay\slot_5xplay.jpg
C:\Casino770\download\slot_aircraft\slot_aircraft.jpg
C:\Casino770\download\slot_aliensattacks\slot_aliensattacks.jpg
C:\Casino770\download\slot_americanclassics\slot_americanclassics.jpg
C:\Casino770\download\slot_americaneagle\slot_americaneagle.jpg
C:\Casino770\download\slot_aprendreoualaisser\slot_aprendreoualaisser.jpg
C:\Casino770\download\slot_aquatic\slot_aquatic.jpg
C:\Casino770\download\slot_arabiannight\slot_arabiannight.jpg
C:\Casino770\download\slot_aroundtheworld\slot_aroundtheworld.jpg
C:\Casino770\download\slot_articace\slot_articace.jpg
C:\Casino770\download\slot_astro\slot_astro.jpg
C:\Casino770\download\slot_bananajones\slot_bananajones.jpg
C:\Casino770\download\slot_bellsroses\slot_bellsroses.jpg
C:\Casino770\download\slot_blackandwhite\slot_blackandwhite.jpg
C:\Casino770\download\slot_bonusarrow\slot_bonusarrow.jpg
C:\Casino770\download\slot_bonusdiamond\slot_bonusdiamond.jpg
C:\Casino770\download\slot_bonusdiamondxplay\slot_bonusdiamondxplay.jpg
C:\Casino770\download\slot_bonusdragon\slot_bonusdragon.jpg
C:\Casino770\download\slot_bonusfoot\slot_bonusfoot.jpg
C:\Casino770\download\slot_bonushunt\slot_bonushunt.jpg
C:\Casino770\download\slot_bonuslotto\slot_bonuslotto.jpg
C:\Casino770\download\slot_bowling\slot_bowling.jpg
C:\Casino770\download\slot_breathoffire\slot_breathoffire.jpg
C:\Casino770\download\slot_brothersthiefs\slot_brothersthiefs.jpg
C:\Casino770\download\slot_captaincash\slot_captaincash.jpg
C:\Casino770\download\slot_carnival\slot_carnival.jpg
C:\Casino770\download\slot_carrun\slot_carrun.jpg
C:\Casino770\download\slot_casinopoly\slot_casinopoly.jpg
C:\Casino770\download\slot_catchthecat\slot_catchthecat.jpg
C:\Casino770\download\slot_chefmario\slot_chefmario.jpg
C:\Casino770\download\slot_circusmadness\slot_circusmadness.jpg
C:\Casino770\download\slot_cleopatra\slot_cleopatra.jpg
C:\Casino770\download\slot_climbdungeon\slot_climbdungeon.jpg
C:\Casino770\download\slot_coollook\slot_coollook.jpg
C:\Casino770\download\slot_cosanostra\slot_cosanostra.jpg
C:\Casino770\download\slot_cowboy\slot_cowboy.jpg
C:\Casino770\download\slot_crazycoyote\slot_crazycoyote.jpg
C:\Casino770\download\slot_crazyfire\slot_crazyfire.jpg
C:\Casino770\download\slot_crazysafari\slot_crazysafari.jpg
C:\Casino770\download\slot_diamondmine\slot_diamondmine.jpg
C:\Casino770\download\slot_diamondsking\slot_diamondsking.jpg
C:\Casino770\download\slot_doubleagent\slot_doubleagent.jpg
C:\Casino770\download\slot_doublebonuslotto\slot_doublebonuslotto.jpg
C:\Casino770\download\slot_doublediamond\slot_doublediamond.jpg
C:\Casino770\download\slot_dragondice\slot_dragondice.jpg
C:\Casino770\download\slot_duckshot\slot_duckshot.jpg
C:\Casino770\download\slot_easytimes\slot_easytimes.jpg
C:\Casino770\download\slot_edenpark\slot_edenpark.jpg
C:\Casino770\download\slot_empireofpower\slot_empireofpower.jpg
C:\Casino770\download\slot_empireofseas\slot_empireofseas.jpg
C:\Casino770\download\slot_eskimos\slot_eskimos.jpg
C:\Casino770\download\slot_eternalshine\slot_eternalshine.jpg
C:\Casino770\download\slot_famoussevens\slot_famoussevens.jpg
C:\Casino770\download\slot_firestar\slot_firestar.jpg
C:\Casino770\download\slot_firezone\slot_firezone.jpg
C:\Casino770\download\slot_fivebillion\slot_fivebillion.jpg
C:\Casino770\download\slot_forestfever\slot_forestfever.jpg
C:\Casino770\download\slot_frenchriviera\slot_frenchriviera.jpg
C:\Casino770\download\slot_fruitparty\slot_fruitparty.jpg
C:\Casino770\download\slot_fullbonus\slot_fullbonus.jpg
C:\Casino770\download\slot_funkytaxi\slot_funkytaxi.jpg
C:\Casino770\download\slot_funnyfair\slot_funnyfair.jpg
C:\Casino770\download\slot_gallobonus\slot_gallobonus.jpg
C:\Casino770\download\slot_getafish\slot_getafish.jpg
C:\Casino770\download\slot_giftsfromcaesar\slot_giftsfromcaesar.jpg
C:\Casino770\download\slot_goblinprecious\slot_goblinprecious.jpg
C:\Casino770\download\slot_goldball\slot_goldball.jpg
C:\Casino770\download\slot_goldeneagle\slot_goldeneagle.jpg
C:\Casino770\download\slot_goldengolf\slot_goldengolf.jpg
C:\Casino770\download\slot_goldenmoon\slot_goldenmoon.jpg
C:\Casino770\download\slot_goldmine\slot_goldmine.jpg
C:\Casino770\download\slot_goldraiders\slot_goldraiders.jpg
C:\Casino770\download\slot_goldrush\slot_goldrush.jpg
C:\Casino770\download\slot_greedysamourai\slot_greedysamourai.jpg
C:\Casino770\download\slot_halloween\slot_halloween.jpg
C:\Casino770\download\slot_hardwillrock\slot_hardwillrock.jpg
C:\Casino770\download\slot_heavychampion\slot_heavychampion.jpg
C:\Casino770\download\slot_hellcity\slot_hellcity.jpg
C:\Casino770\download\slot_hitscore\slot_hitscore.jpg
C:\Casino770\download\slot_holdup\slot_holdup.jpg
C:\Casino770\download\slot_hollywood\slot_hollywood.jpg
C:\Casino770\download\slot_horrornight\slot_horrornight.jpg
C:\Casino770\download\slot_horseracing\slot_horseracing.jpg
C:\Casino770\download\slot_hotmoney\slot_hotmoney.jpg
C:\Casino770\download\slot_hottimes\slot_hottimes.jpg
C:\Casino770\download\slot_hugepizza\slot_hugepizza.jpg
C:\Casino770\download\slot_hunterofseas\slot_hunterofseas.jpg
C:\Casino770\download\slot_ilovebonus\slot_ilovebonus.jpg
C:\Casino770\download\slot_indianchief\slot_indianchief.jpg
C:\Casino770\download\slot_ironsvikings\slot_ironsvikings.jpg
C:\Casino770\download\slot_jazzonclub\slot_jazzonclub.jpg
C:\Casino770\download\slot_jetset\slot_jetset.jpg
C:\Casino770\download\slot_jimmybondy\slot_jimmybondy.jpg
C:\Casino770\download\slot_joker\slot_joker.jpg
C:\Casino770\download\slot_jokertrio\slot_jokertrio.jpg
C:\Casino770\download\slot_joyboat\slot_joyboat.jpg
C:\Casino770\download\slot_jungle\slot_jungle.jpg
C:\Casino770\download\slot_kenobonus\slot_kenobonus.jpg
C:\Casino770\download\slot_kingarthur\slot_kingarthur.jpg
C:\Casino770\download\slot_lasvegas\slot_lasvegas.jpg
C:\Casino770\download\slot_letreflegeant\slot_letreflegeant.jpg
C:\Casino770\download\slot_littlebigboy\slot_littlebigboy.jpg
C:\Casino770\download\slot_lostatlantis\slot_lostatlantis.jpg
C:\Casino770\download\slot_lostincas\slot_lostincas.jpg
C:\Casino770\download\slot_loveangels\slot_loveangels.jpg
C:\Casino770\download\slot_luckymonster\slot_luckymonster.jpg
C:\Casino770\download\slot_luickybonus\slot_luickybonus.jpg
C:\Casino770\download\slot_magical\slot_magical.jpg
C:\Casino770\download\slot_magiccherry\slot_magiccherry.jpg
C:\Casino770\download\slot_makingmoney\slot_makingmoney.jpg
C:\Casino770\download\slot_mangacrazy\slot_mangacrazy.jpg
C:\Casino770\download\slot_mangapunch\slot_mangapunch.jpg
C:\Casino770\download\slot_medieval\slot_medieval.jpg
C:\Casino770\download\slot_megadino\slot_megadino.jpg
C:\Casino770\download\slot_megawheelbonus\slot_megawheelbonus.jpg
C:\Casino770\download\slot_megawin\slot_megawin.jpg
C:\Casino770\download\slot_mexicanmix\slot_mexicanmix.jpg
C:\Casino770\download\slot_miami\slot_miami.jpg
C:\Casino770\download\slot_millioncents\slot_millioncents.jpg
C:\Casino770\download\slot_montecarlo\slot_montecarlo.jpg
C:\Casino770\download\slot_mouseandcat\slot_mouseandcat.jpg
C:\Casino770\download\slot_moviewood\slot_moviewood.jpg
C:\Casino770\download\slot_mrcashbonus\slot_mrcashbonus.jpg
C:\Casino770\download\slot_multicolorwheel\slot_multicolorwheel.jpg
C:\Casino770\download\slot_multiplierballs\slot_multiplierballs.jpg
C:\Casino770\download\slot_multipliergods\slot_multipliergods.jpg
C:\Casino770\download\slot_multitimes\slot_multitimes.jpg
C:\Casino770\download\slot_multitimeswild\slot_multitimeswild.jpg
C:\Casino770\download\slot_multiwheel\slot_multiwheel.jpg
C:\Casino770\download\slot_musiccountry\slot_musiccountry.jpg
C:\Casino770\download\slot_newyork\slot_newyork.jpg
C:\Casino770\download\slot_paradise\slot_paradise.jpg
C:\Casino770\download\slot_pharaohprogressive\slot_pharaohprogressive.jpg
C:\Casino770\download\slot_pharaohtreasures\slot_pharaohtreasures.jpg
C:\Casino770\download\slot_piratesisland\slot_piratesisland.jpg
C:\Casino770\download\slot_piratestreasure\slot_piratestreasure.jpg
C:\Casino770\download\slot_pittandgrant\slot_pittandgrant.jpg
C:\Casino770\download\slot_pokermania\slot_pokermania.jpg
C:\Casino770\download\slot_powerofwheel\slot_powerofwheel.jpg
C:\Casino770\download\slot_princesquest\slot_princesquest.jpg
C:\Casino770\download\slot_quicktime\slot_quicktime.jpg
C:\Casino770\download\slot_quiveutgagner\slot_quiveutgagner.jpg
C:\Casino770\download\slot_redwhiteblue\slot_redwhiteblue.jpg
C:\Casino770\download\slot_roadtrip\slot_roadtrip.jpg
C:\Casino770\download\slot_scratch\slot_scratch.jpg
C:\Casino770\download\slot_secretagent\slot_secretagent.jpg
C:\Casino770\download\slot_segacasino\slot_segacasino.jpg
C:\Casino770\download\slot_sheepsandmartians\slot_sheepsandmartians.jpg
C:\Casino770\download\slot_snakecharmer\slot_snakecharmer.jpg
C:\Casino770\download\slot_specialacademy\slot_specialacademy.jpg
C:\Casino770\download\slot_speedracer\slot_speedracer.jpg
C:\Casino770\download\slot_spindeuce\slot_spindeuce.jpg
C:\Casino770\download\slot_spinoureels\slot_spinoureels.jpg
C:\Casino770\download\slot_spinpoker\slot_spinpoker.jpg
C:\Casino770\download\slot_splendidaces\slot_splendidaces.jpg
C:\Casino770\download\slot_starquest\slot_starquest.jpg
C:\Casino770\download\slot_superfirestar\slot_superfirestar.jpg
C:\Casino770\download\slot_supermultitimes\slot_supermultitimes.jpg
C:\Casino770\download\slot_supertoon\slot_supertoon.jpg
C:\Casino770\download\slot_supertricolor\slot_supertricolor.jpg
C:\Casino770\download\slot_tearfactor\slot_tearfactor.jpg
C:\Casino770\download\slot_thunderstorm\slot_thunderstorm.jpg
C:\Casino770\download\slot_tiger\slot_tiger.jpg
C:\Casino770\download\slot_timestotimes\slot_timestotimes.jpg
C:\Casino770\download\slot_topcash\slot_topcash.jpg
C:\Casino770\download\slot_treasure\slot_treasure.jpg
C:\Casino770\download\slot_treasuremonkey\slot_treasuremonkey.jpg
C:\Casino770\download\slot_tropical\slot_tropical.jpg
C:\Casino770\download\slot_wantedbonus\slot_wantedbonus.jpg
C:\Casino770\download\slot_wheeloffortune\slot_wheeloffortune.jpg
C:\Casino770\download\slot_wild777\slot_wild777.jpg
C:\Casino770\download\slot_wildrose\slot_wildrose.jpg
C:\Casino770\download\slot_winabike\slot_winabike.jpg
C:\Casino770\download\slot_winacar\slot_winacar.jpg
C:\Casino770\download\slot_worldcup\slot_worldcup.jpg
C:\Casino770\download\slot_worldsports\slot_worldsports.jpg
C:\Casino770\download\slot_worldtour\slot_worldtour.jpg
C:\Casino770\download\slot_worldtrader\slot_worldtrader.jpg
C:\Casino770\download\slot_wormapple\slot_wormapple.jpg
C:\Casino770\download\vp_jokermultitimes\vp_jokermultitimes.jpg
C:\Casino770\download\vp_texaspoker\vp_texaspoker.jpg
C:\Casino770\download\xcommon\ogg.dll
C:\Casino770\download\xcommon\oggtowav.dll
C:\Casino770\download\xcommon\vorbis.dll
C:\Casino770\download\xcommon\vorbisenc.dll
C:\Casino770\download\xcommon\vorbisfile.dll
C:\Casino770
C:\Users\JEAN-M~1\AppData\Roaming\MICROS~1\Windows\Cookies\jean-marc@ads.eorezo[2].txt
C:\Users\JEAN-M~1\AppData\Roaming\MICROS~1\Windows\Cookies\jean-marc@eorezo[1].txt

(!) -- Fichiers temporaires supprimés.

.
============== Scan additionnel ==============
.

* Mozilla FireFox Version 3.0.11 *

Nom du profil: 94crayfl.default (Jean-Marc)
.
(Prefs.js) user_pref("browser.search.selectedEngine", "lo.st");
(Prefs.js) user_pref("browser.startup.homepage", "hxxp://fmz.qiwa.com");
(Prefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.9.0.1");
(Invalidprefs.js) user_pref("browser.search.selectedEngine", "lo.st");
(Invalidprefs.js) user_pref("browser.startup.homepage", "hxxp://lo.st");
(Invalidprefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.9.0.1");
.
.

* Internet Explorer Version 7.0.6000.16851 *

[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/

[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

Tabs: res://ieframe.dll/tabswelcome.htm

============== Suspect (Cracks, Serials ... ) ==============

.
C:\Users\Jean-Marc\Downloads\FlyffFRAct4ManualPatch_JeuxVideo.com_14234.zip
C:\Users\Jean-Marc\Downloads\FlyffFRAct4ManualPatch_JeuxVideo.com_14234.zip.part
C:\Users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.2.9056-to-3.0.3.9183-frFR-patch.exe
C:\Users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.3.9183-to-3.0.8.9464-frFR-patch.exe
C:\Users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.8.9464-to-3.0.8.9506-frFR-patch.exe
C:\Users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.8.9506-to-3.0.9.9551-frFR-patch.exe
C:\Users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.1.0.9767-to-3.1.1.9806-frFR-patch.exe
C:\Users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.1.1.9806-to-3.1.1.9835-frFR-patch.exe
C:\Users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.1.1.9835-to-3.1.2.9901-frFR-patch.exe
C:\Users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.1.2.9901-to-3.1.3.9947-frFR-patch.exe
C:\Users\Public\Documents\Blizzard Entertainment\World of Warcraft\Patches\WoW-3.0.9-to-3.1.0-frFR-Win-patch\Blizzard Updater.exe

+---------------------------------------------------------------------------+

25360 Octet(s) - C:\Ad-Report-CLEAN.log

21 Fichier(s) - C:\Program Files\Ad-remover\BACKUP
31 Fichier(s) - C:\Program Files\Ad-remover\QUARANTINE

Fin à: 1:51:20 | 17/06/2009
.
============== E.O.F ==============
.

Pas de risque. Tu devras remettre ta page d'accueil.

Je voudrais juste savoir si c'est sans risque car c'est l'ordinateur a mon pere est un message est apparut quand je les lancé en me disant que c'est a mes risques et peril j'aime pas trop cette phrase encore si c'etait mon ordinateur je l'aurai fait mais comme c'est celui de mon pere si il lui arrive un probleme je vais avoir des probleme je voudrais juste que vous me disiez si c'est vraiment sans risque ?
Désoler de chipoter et je vous remercie de votre aide sincerment

● Télécharge Ad-Remover (de Cyrildu17 / C_XX) sur ton Bureau.

/!\ Déconnecte-toi d'Internet et ferme toutes applications en cours. /!\

● Double-clique sur le programme d'installation, installe-le dans son emplacement par défaut (C:\Program Files).
● Double-clique sur le raccourci d'Ad-Remover située sur ton Bureau.
(Sous Vista, il faut cliquer droit sur le raccourci d'Ad-Remover et choisir Exécuter en tant qu'administrateur)
● Au menu principal, choisis l'option L.
● Poste le rapport généré (C:\Ad-Report-CLEAN.log).

(CTRL+A pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller)

Note : "Process.exe", une composante de l'outil, est détectée par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.