PC qui rame + Rapport

SP_Addict -  
Bonjour,
j'ai suivi l'excellent tuto [Virus] Méthode préliminaire de désinfection, et je vous poste les 2 rapports RSIT

Logfile of random's system information tool 1.06 (written by random/random)
Run by YOEUNG at 2009-10-07 20:27:11
Microsoft® Windows Vista™ Édition Familiale Premium
System drive C: has 70 GB (31%) free of 230 GB
Total RAM: 1791 MB (73% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:27:18, on 07/10/2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16890)
Boot mode: Safe mode with network support

Running processes:
C:\Windows\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\YOEUNG\Downloads\THEGRATUIT\HiJackThis.exe
C:\Users\YOEUNG\Downloads\THEGRATUIT\RSIT.exe
C:\Users\YOEUNG\Downloads\THEGRATUIT\YOEUNG.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://format.packardbell.com/...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60341
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://format.packardbell.com/cgi-bin/redirect/?country=FR&range=AD&phase=8&key=IESTART
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\ctbr.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll
O3 - Toolbar: HopSurf toolbar - {E9FAB13D-4600-49E1-90D1-EE961C859D39} - C:\Program Files\Comodo\HopSurfToolbar\HopSurfToolbar_IE.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: HopSurf - {ED98F8D1-09AC-4107-B2FF-91DBE011B0C5} - C:\Program Files\Comodo\HopSurfToolbar\HopSurfToolbar_IE.dll
O13 - Gopher Prefix:
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\ctbr.dll
O20 - AppInit_DLLs: C:\Windows\system32\guard32.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: Service Google Update (gupdate1ca29a125310338) (gupdate1ca29a125310338) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

--
End of file - 8218 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Extension de garantie.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\Recovery DVD Creator.job
C:\Windows\tasks\User_Feed_Synchronization-{42FA57C4-9840-4D0A-95DE-0A120A577A1E}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}]
C:\PROGRA~1\Crawler\ctbr.dll [2009-08-10 1218560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}]
BitComet Helper - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll [2007-09-28 521528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}]
EoBho Class - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{4B3803EA-5230-4DC3-A7FC-33638F3D3542} - Barre d'outils &Crawler - C:\PROGRA~1\Crawler\ctbr.dll [2009-08-10 1218560]
{E9FAB13D-4600-49E1-90D1-EE961C859D39} - HopSurf toolbar - C:\Program Files\Comodo\HopSurfToolbar\HopSurfToolbar_IE.dll [2009-09-04 1122496]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2007-08-30 1006264]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2006-11-09 3784704]
""= []
"RoxWatchTray"=C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe [2007-01-11 232184]
"EoEngine"= []
"EoWeather"= []
"Windows Mobile Device Center"=C:\Windows\WindowsMobile\wmdc.exe [2007-05-31 648072]
"Windows Mobile-based device management"=C:\Windows\WindowsMobile\wmdSync.exe [2006-11-02 215552]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"SpywareTerminator"=C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe [2009-03-10 2233856]
"MSConfig"=C:\Windows\system32\msconfig.exe [2006-11-02 222208]
"COMODO Internet Security"=C:\Program Files\COMODO\COMODO Internet Security\cfp.exe [2009-09-04 1796368]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2008-01-10 1232896]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2006-11-02 125440]
"Speech Recognition"=C:\Windows\Speech\Common\sapisvr.exe [2006-11-02 49664]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-02-06 3885408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe /startup []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe [2009-04-02 342312]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
C:\Program Files\Picasa2\PicasaMediaDetector.exe [2007-02-21 366400]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2009-01-05 413696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmpcSys]
C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe [2007-07-19 1120568]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-01-21 61440]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\toolbar_eula_launcher]
C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe [2007-02-20 28672]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^YOEUNG^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.0.lnk]
C:\PROGRA~1\OPENOF~1.ORG\program\QUICKS~1.EXE [2008-12-15 384000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"=" C:\Windows\system32\guard32.dll"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{05c386d5-acc4-11dd-a150-001bb9b1cb0b}]
shell\Auto\command - cmd /C launch.bat
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL cmd /C launch.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0f946360-a4f2-11dd-9a72-001bb9b1cb0b}]
shell\AutoRun\command - explorer.exe .

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1e61d7c2-9076-11dd-ae86-001bb9b1cb0b}]
shell\Auto\command - cmd /C launch.bat
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL cmd /C launch.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5bee8a22-ad97-11de-aa61-001bb9b1cb0b}]
shell\Auto\command - cmd /C launch.bat
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL cmd /C launch.bat

======List of files/folders created in the last 2 months======

2009-10-07 20:27:11 ----D---- C:\rsit
2009-10-07 20:19:12 ----A---- C:\Windows\ntbtlog.txt
2009-09-14 21:01:05 ----D---- C:\Program Files\CCleaner
2009-09-09 12:58:41 ----A---- C:\Windows\system32\netiohlp.dll
2009-09-09 12:58:38 ----A---- C:\Windows\system32\tcpipcfg.dll
2009-09-09 12:58:34 ----A---- C:\Windows\system32\ROUTE.EXE
2009-09-09 12:58:34 ----A---- C:\Windows\system32\netiougc.exe
2009-09-09 12:58:34 ----A---- C:\Windows\system32\MRINFO.EXE
2009-09-09 12:58:33 ----A---- C:\Windows\system32\TCPSVCS.EXE
2009-09-09 12:58:33 ----A---- C:\Windows\system32\NETSTAT.EXE
2009-09-09 12:58:33 ----A---- C:\Windows\system32\finger.exe
2009-09-09 12:58:33 ----A---- C:\Windows\system32\ARP.EXE
2009-09-09 12:58:32 ----A---- C:\Windows\system32\HOSTNAME.EXE
2009-09-09 12:58:29 ----A---- C:\Windows\system32\netevent.dll
2009-09-09 12:55:18 ----A---- C:\Windows\system32\wlansec.dll
2009-09-09 12:55:18 ----A---- C:\Windows\system32\wlanmsm.dll
2009-09-09 12:55:18 ----A---- C:\Windows\system32\L2SecHC.dll
2009-09-09 12:55:17 ----A---- C:\Windows\system32\wlansvc.dll
2009-09-09 12:55:17 ----A---- C:\Windows\system32\wlanhlp.dll
2009-09-09 12:55:17 ----A---- C:\Windows\system32\wlanapi.dll
2009-09-09 12:55:01 ----A---- C:\Windows\system32\WMVCORE.DLL
2009-09-09 12:55:00 ----A---- C:\Windows\system32\mf.dll
2009-09-09 12:54:57 ----A---- C:\Windows\system32\rrinstaller.exe
2009-09-09 12:54:56 ----A---- C:\Windows\system32\mfps.dll
2009-09-09 12:54:55 ----A---- C:\Windows\system32\mfpmp.exe
2009-09-09 12:54:54 ----A---- C:\Windows\system32\mferror.dll
2009-09-09 12:54:31 ----A---- C:\Windows\system32\jscript.dll
2009-09-08 13:28:44 ----D---- C:\Program Files\Project64 1.6
2009-09-04 19:15:42 ----D---- C:\Users\YOEUNG\AppData\Roaming\Comodo
2009-09-04 19:12:45 ----D---- C:\ProgramData\Comodo
2009-09-04 19:12:38 ----A---- C:\Windows\system32\guard32.dll
2009-09-04 19:12:33 ----D---- C:\Program Files\COMODO
2009-09-03 13:00:22 ----A---- C:\Windows\system32\gameux.dll
2009-09-03 13:00:19 ----A---- C:\Windows\system32\Apphlpdm.dll
2009-09-03 13:00:18 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll
2009-08-30 20:38:40 ----D---- C:\Program Files\Common Files\DivX Shared
2009-08-27 05:47:02 ----A---- C:\Windows\system32\tzres.dll
2009-08-22 15:12:55 ----A---- C:\Windows\system32\msv1_0.dll
2009-08-22 15:12:55 ----A---- C:\Windows\system32\kerberos.dll
2009-08-22 15:12:54 ----A---- C:\Windows\system32\wdigest.dll
2009-08-22 15:12:53 ----A---- C:\Windows\system32\lsasrv.dll
2009-08-22 15:12:52 ----A---- C:\Windows\system32\schannel.dll
2009-08-22 15:12:51 ----A---- C:\Windows\system32\secur32.dll
2009-08-22 15:12:51 ----A---- C:\Windows\system32\lsass.exe
2009-08-19 08:50:21 ----D---- C:\Program Files\Crawler
2009-08-12 09:02:47 ----A---- C:\Windows\system32\atl.dll
2009-08-12 09:02:43 ----A---- C:\Windows\system32\wkssvc.dll
2009-08-12 09:02:39 ----A---- C:\Windows\system32\mstscax.dll
2009-08-12 09:02:38 ----A---- C:\Windows\system32\tsgqec.dll
2009-08-12 09:02:38 ----A---- C:\Windows\system32\aaclient.dll
2009-08-12 09:02:34 ----A---- C:\Windows\system32\msvfw32.dll
2009-08-12 09:02:34 ----A---- C:\Windows\system32\mciavi32.dll
2009-08-12 09:02:34 ----A---- C:\Windows\system32\avifil32.dll
2009-08-12 09:02:34 ----A---- C:\Windows\system32\avicap32.dll
2009-08-12 09:02:33 ----A---- C:\Windows\system32\msvidc32.dll
2009-08-12 09:02:33 ----A---- C:\Windows\system32\msrle32.dll
2009-08-12 09:02:27 ----A---- C:\Windows\system32\wmp.dll
2009-08-12 09:02:26 ----A---- C:\Windows\system32\wmpdxm.dll
2009-08-12 09:02:24 ----A---- C:\Windows\system32\spwmp.dll
2009-08-12 09:02:23 ----A---- C:\Windows\system32\dxmasf.dll
2009-08-12 09:02:22 ----A---- C:\Windows\system32\wmploc.DLL
2009-08-11 13:42:12 ----D---- C:\Program Files\Connective Tools
2009-08-10 21:06:18 ----D---- C:\Windows\pss
2009-08-10 10:44:23 ----A---- C:\Windows\system32\infocardapi.dll
2009-08-10 10:44:22 ----A---- C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-08-10 10:44:18 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2009-08-10 10:44:18 ----A---- C:\Windows\system32\icardres.dll
2009-08-10 10:44:18 ----A---- C:\Windows\system32\icardagt.exe
2009-08-10 10:44:14 ----A---- C:\Windows\system32\PresentationNative_v0300.dll
2009-08-10 10:44:10 ----A---- C:\Windows\system32\PresentationHost.exe
2009-08-10 10:32:27 ----A---- C:\Windows\system32\dfshim.dll
2009-08-10 10:32:20 ----A---- C:\Windows\system32\mscoree.dll
2009-08-10 10:32:18 ----A---- C:\Windows\system32\netfxperf.dll
2009-08-10 10:31:58 ----A---- C:\Windows\system32\mscorier.dll
2009-08-10 10:31:49 ----A---- C:\Windows\system32\mscories.dll
2009-08-09 21:05:38 ----A---- C:\Windows\system32\d3dx10_37.dll
2009-08-09 21:05:38 ----A---- C:\Windows\system32\D3DCompiler_37.dll
2009-08-09 21:05:36 ----A---- C:\Windows\system32\D3DX9_37.dll
2009-08-09 21:04:27 ----D---- C:\Program Files\Microsoft Games for Windows - LIVE

======List of files/folders modified in the last 2 months======

2009-10-07 20:23:06 ----D---- C:\Program Files\Mozilla Firefox
2009-10-07 20:19:12 ----D---- C:\Windows
2009-10-07 20:16:51 ----D---- C:\Windows\Temp
2009-10-07 20:02:30 ----D---- C:\Windows\Prefetch
2009-10-07 19:57:36 ----SHD---- C:\System Volume Information
2009-10-07 19:53:41 ----D---- C:\Windows\system32\wbem
2009-10-07 19:52:52 ----D---- C:\Windows\system32\config
2009-10-07 19:52:43 ----D---- C:\Windows\Tasks
2009-10-07 19:52:43 ----D---- C:\Windows\system32\Tasks
2009-10-07 19:52:43 ----D---- C:\Windows\system32\spool
2009-10-07 19:52:43 ----D---- C:\Windows\system32\drivers
2009-10-07 19:52:43 ----D---- C:\Windows\system32\CodeIntegrity
2009-10-07 19:52:43 ----D---- C:\Windows\system32\catroot2
2009-10-07 19:52:43 ----D---- C:\Windows\inf
2009-10-07 19:52:43 ----D---- C:\Users\YOEUNG\AppData\Roaming\Spyware Terminator
2009-10-07 19:52:43 ----D---- C:\ProgramData\Spyware Terminator
2009-10-07 19:52:43 ----D---- C:\Program Files\Spyware Terminator
2009-10-07 19:52:43 ----AD---- C:\Windows\System32
2009-10-07 19:52:42 ----D---- C:\Windows\registration
2009-10-05 13:43:31 ----A---- C:\Windows\system32\PerfStringBackup.INI
2009-09-28 21:06:47 ----D---- C:\Users\YOEUNG\AppData\Roaming\Mozilla
2009-09-21 10:48:58 ----RD---- C:\Program Files
2009-09-15 12:55:34 ----D---- C:\Downloads
2009-09-14 21:25:06 ----D---- C:\ancien disque dur
2009-09-14 21:04:28 ----D---- C:\Windows\Debug
2009-09-10 12:56:47 ----D---- C:\Windows\winsxs
2009-09-10 12:54:29 ----D---- C:\Windows\system32\migration
2009-09-10 12:54:29 ----D---- C:\Windows\system32\fr-FR
2009-09-10 12:48:42 ----D---- C:\Windows\system32\catroot
2009-09-10 12:48:35 ----D---- C:\Program Files\Windows Mail
2009-09-10 12:46:16 ----D---- C:\Windows\ehome
2009-09-08 13:28:51 ----SHD---- C:\Windows\Installer
2009-09-07 20:56:25 ----D---- C:\Program Files\Common Files
2009-09-07 20:49:05 ----D---- C:\ProgramData\Adobe
2009-09-05 13:57:42 ----D---- C:\Windows\system32\WDI
2009-09-04 19:12:45 ----HD---- C:\ProgramData
2009-09-03 23:24:06 ----D---- C:\Windows\AppPatch
2009-09-01 21:11:48 ----D---- C:\ProgramData\Roxio
2009-08-30 20:40:22 ----D---- C:\Program Files\Google
2009-08-30 20:38:52 ----D---- C:\Program Files\DivX
2009-08-28 23:38:20 ----A---- C:\Windows\system32\mrt.exe
2009-08-27 22:38:24 ----D---- C:\Windows\WindowsMobile
2009-08-22 19:17:03 ----D---- C:\Windows\Microsoft.NET
2009-08-22 17:47:06 ----D---- C:\ProgramData\Microsoft Help
2009-08-22 17:47:04 ----RSD---- C:\Windows\assembly
2009-08-22 15:21:40 ----RSD---- C:\Windows\Fonts
2009-08-22 15:21:34 ----D---- C:\Program Files\Common Files\microsoft shared
2009-08-17 13:01:56 ----D---- C:\Program Files\WinClamAVShield
2009-08-17 12:54:36 ----HD---- C:\Program Files\InstallShield Installation Information
2009-08-13 09:27:58 ----D---- C:\Program Files\Windows Media Player
2009-08-10 11:06:35 ----D---- C:\Windows\system32\XPSViewer
2009-08-10 11:06:35 ----D---- C:\Windows\system32\en-US

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 cmdHlp;COMODO Internet Security Helper Driver; C:\Windows\System32\DRIVERS\cmdhlp.sys [2009-09-04 29520]
R1 inspect;COMODO Internet Security Firewall Driver; C:\Windows\system32\DRIVERS\inspect.sys [2009-09-04 74328]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\System32\Drivers\GEARAspiWDM.sys [2009-03-19 23400]
R3 RTL8023xp;Pilote Realtek 10/100 NIC Family NDIS x86; C:\Windows\system32\DRIVERS\Rtnicxp.sys [2006-11-02 47104]
S1 cmdGuard;COMODO Internet Security Sandbox Driver; C:\Windows\System32\DRIVERS\cmdguard.sys [2009-09-04 128888]
S1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\Windows\system32\drivers\sp_rsdrv2.sys [2009-03-10 142592]
S1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2007-03-01 28352]
S3 AteksoftAudio;WebCamera Plus Audio; C:\Windows\system32\drivers\ateksoftaudio.sys [2007-12-25 11776]
S3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2008-02-26 3520512]
S3 audiobridge;Virtual Audio Bridge; C:\Windows\system32\DRIVERS\aubridge.sys [2007-07-23 22528]
S3 drmkaud;Filtre de décodeur DRM (Noyau Microsoft); C:\Windows\system32\drivers\drmkaud.sys [2006-11-02 5632]
S3 EagleNT;EagleNT; \??\C:\Windows\system32\drivers\EagleNT.sys []
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2006-11-08 1647976]
S3 k750bus;Sony Ericsson 750 driver (WDM); C:\Windows\system32\DRIVERS\k750bus.sys [2005-02-11 55216]
S3 Ltn_stk7070P;PCTV based TV tuner device; C:\Windows\system32\DRIVERS\Ltn_stk7070P.sys [2007-06-14 466048]
S3 Ltn_stkrc;PCTV Infrared Receiver; C:\Windows\system32\DRIVERS\Ltn_stkrc.sys [2007-06-13 13440]
S3 MSKSSRV;Proxy de service de répartition Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2006-11-02 8192]
S3 MSPCLOCK;Proxy d'horloge de répartition Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2006-11-02 5888]
S3 MSPQM;Proxy de gestion de qualité de répartition Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2006-11-02 5504]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2006-11-02 6016]
S3 PnkBstrK;PnkBstrK; \??\C:\Windows\system32\drivers\PnkBstrK.sys [2009-07-06 139904]
S3 R300;R300; C:\Windows\system32\DRIVERS\atikmdag.sys [2008-02-26 3520512]
S3 usb_rndisx;Carte RNDIS USB; C:\Windows\system32\DRIVERS\usb8023x.sys [2006-11-02 14848]
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2009-03-26 36864]
S3 WINUSB;WinUSB Service; C:\Windows\system32\DRIVERS\WinUSB.SYS [2006-11-02 31616]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2006-11-02 39936]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2006-11-02 82560]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

S2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-03-26 132424]
S2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2008-02-26 655360]
S2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
S2 CLTNetCnService;Symantec Lic NetConnect service; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon []
S2 cmdAgent;COMODO Internet Security Helper Service; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2009-09-04 715392]
S2 gupdate1ca29a125310338;Service Google Update (gupdate1ca29a125310338); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-08-30 133104]
S2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2009-07-06 75064]
S2 PnkBstrB;PnkBstrB; C:\Windows\system32\PnkBstrB.exe [2009-07-06 189744]
S2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; C:\Windows\system32\svchost.exe [2006-11-02 22016]
S2 RoxWatch9;Roxio Hard Drive Watcher 9; C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe [2007-01-11 166648]
S2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2009-03-10 540672]
S2 WcesComm;@%windir%\WindowsMobile\wcescomm.dll,-40079; C:\Windows\system32\svchost.exe [2006-11-02 22016]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-08-30 138168]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-04-02 656168]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 RoxMediaDB9;RoxMediaDB9; C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe [2007-01-11 887544]
S3 stllssvr;stllssvr; C:\Program Files\Common Files\SureThing Shared\stllssvr.exe [2006-09-14 73728]

-----------------EOF-----------------
Configuration: Windows Vista
Firefox 3.5.3

34 réponses

Résumé de la discussion

Une infection détectée après un tutoriel de désinfection est présentée, avec des rapports RSIT et HijackThis qui révèlent un système Windows Vista où les paramètres réseau et des composants indésirables posent problème. Plusieurs éléments signalés incluent des pages de démarrage modifiées, des barres d'outils indésirables, des BHO suspects et des services comme PnkBstrA/B, Spyware Terminator ou Guard32.dll. En pratique, les meilleures réponses évoquent le passage en mode sécurité, la suppression des composants malveillants, la restauration des paramètres du navigateur et l’élimination des entrées auto‑exécutables. Une information utile supplémentaire: les journaux révèlent la présence de composants tiers tels que BitComet et Java ssv.dll, ainsi que des entrées Run et des outils de sécurité qui peuvent persister sans nettoyage approfondi.

Bobot (l’IA à votre service)
  1. SP_Addict Auteur
    le PC se porte bien, desfois il rame pendant le chargement mais c'est beaucoup mieux qu'avant !

    voici le rapport javara

    JavaRa 1.15 Removal Log.

    Report follows after line.

    ------------------------------------

    The JavaRa removal process was started on Thu Oct 08 18:19:31 2009

    Found and removed: C:\Program Files\Java\jre1.6.0_03

    Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_03\

    Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_07\bin\

    ------------------------------------

    Finished reporting.

    sinon pour toolscleaner j'ai un soucis, apres avoir cliquer sur "recherche" il marque que le programme ne repond pas..
    1. Xplode Contributeur sécurité
      La c'est ok!

      Comment se porte le PC ?

      ----------- JAVA -----------

      Télécharge JavaRa à cette adresse : https://sourceforge.net/projects/javara/files/javara/JavaRa/JavaRa.zip/download?use_mirror=freefr&use_mirror=freefr

      Décompresse l'archive sur ton bureau, lance JavaRa et choisis " Français " ( coche " remember my selection " )

      Clique sur " Effacer les anciennes versions "

      Laisse l'outil travailler puis copie/colle le rapport dans ton prochain message

      Clique ensuite sur " Recherche de MaJ " , puis coche " Mettre à jour via le site internet de Sun "

      Dans la page internet qui s'ouvre, cherche la partie " Java SE Runtime Environment (JRE) " puis clique sur download

      Séléctionne " Windows " dans " Platform " et coche " I agree.... "

      Clique enfin sur le lien dans " Available files " , puis installe la dernière version de Java.

      -+-+-+-> Tools Cleaner <-+-+-+-

      [o] Afin de supprimer tout les logiciels qui ont été utilisés pour ta désinfection,

      [o] Télécharge ToolsCleaner sur ton bureau à cette adresse : https://www.commentcamarche.net/telecharger/securite/22061-toolscleaner/

      [o] Double-clique sur « Toolscleaner.exe »

      [o] Clique sur "restauration" pour créer un point de restauration.

      [o] Puis clique sur « recherche »

      [o] Quand la recherche sera terminée, clique sur "suppression".

      [o] A la fin (il y aura des indications dans le cadre en-dessous), clique sur "quitter" et poste le rapport qui se trouve dans C:\Tcleaner.txt
      1. SP_Addict Auteur
        je ne comprend pas, j'avais bien selectionner et supprimer.. et la j'ai fais comme tu m'a dis et voila le rapport

        Logfile of random's system information tool 1.06 (written by random/random)
        Run by YOEUNG at 2009-10-08 18:12:39
        Microsoft® Windows Vista™ Édition Familiale Premium
        System drive C: has 71 GB (31%) free of 230 GB
        Total RAM: 1791 MB (56% free)

        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 18:12:47, on 08/10/2009
        Platform: Windows Vista (WinNT 6.00.1904)
        MSIE: Internet Explorer v7.00 (7.00.6000.16890)
        Boot mode: Normal

        Running processes:
        C:\Windows\system32\Dwm.exe
        C:\Windows\Explorer.EXE
        C:\Windows\system32\taskeng.exe
        C:\Program Files\Windows Defender\MSASCui.exe
        C:\Windows\RtHDVCpl.exe
        C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
        C:\Windows\WindowsMobile\wmdc.exe
        C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
        C:\Program Files\Spyware Terminator\SpywareTerminatorShield.Exe
        C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
        C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
        C:\Program Files\Windows Sidebar\sidebar.exe
        C:\Windows\ehome\ehtray.exe
        C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
        C:\Windows\ehome\ehmsas.exe
        C:\Program Files\OpenOffice.org 3\program\soffice.exe
        C:\Program Files\Windows Sidebar\sidebar.exe
        C:\Program Files\OpenOffice.org 3\program\soffice.bin
        C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
        C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
        C:\Windows\system32\wuauclt.exe
        C:\Windows\system32\SearchFilterHost.exe
        C:\Users\YOEUNG\Downloads\THEGRATUIT\RSIT.exe
        C:\Users\YOEUNG\Downloads\THEGRATUIT\YOEUNG.exe

        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer
        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
        O1 - Hosts: ::1 localhost
        O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
        O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O3 - Toolbar: HopSurf toolbar - {E9FAB13D-4600-49E1-90D1-EE961C859D39} - C:\Program Files\Comodo\HopSurfToolbar\HopSurfToolbar_IE.dll
        O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
        O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
        O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
        O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
        O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
        O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
        O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
        O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
        O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
        O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
        O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
        O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
        O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
        O4 - HKCU\..\Run: [Speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
        O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
        O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
        O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
        O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
        O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
        O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
        O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
        O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
        O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
        O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
        O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
        O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
        O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
        O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
        O9 - Extra button: HopSurf - {ED98F8D1-09AC-4107-B2FF-91DBE011B0C5} - C:\Program Files\Comodo\HopSurfToolbar\HopSurfToolbar_IE.dll
        O13 - Gopher Prefix:
        O20 - AppInit_DLLs: C:\Windows\system32\guard32.dll
        O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
        O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
        O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
        O23 - Service: Service Google Update (gupdate1ca29a125310338) (gupdate1ca29a125310338) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
        O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
        O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
        O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
        O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
        O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
        O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
        O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
        1. Xplode Contributeur sécurité
          Tu as bien coché les lignes que je t'ai indiqué ? elles sont toujours présentes.

          Désactive l'UAC -> (Menu Démarrer \ Panneau de Configuration \ Comptes d'utilisateurs et protection des utilisateurs \ Comptes d'utilisateurs \ Activer ou désactiver le contrôle des comptes d'utilisateurs \ décoche la case Utiliser le contrôle ... et valide par OK , il te sera demandé de redémarrer, fais le)</gras>

          Et lance hijackthis en cliquant droit dessus puis -> Executer en tant qu'administrateur

          -> Réexécute les opérations que je t'ai demandé dans mon dernier post, puis reposte un log RSIT
          2. SP_Addict Auteur
            voila le rapport

            Logfile of random's system information tool 1.06 (written by random/random)
            Run by YOEUNG at 2009-10-08 17:57:27
            Microsoft® Windows Vista™ Édition Familiale Premium
            System drive C: has 72 GB (31%) free of 230 GB
            Total RAM: 1791 MB (45% free)

            Logfile of Trend Micro HijackThis v2.0.2
            Scan saved at 17:57:36, on 08/10/2009
            Platform: Windows Vista (WinNT 6.00.1904)
            MSIE: Internet Explorer v7.00 (7.00.6000.16890)
            Boot mode: Normal

            Running processes:
            C:\Windows\system32\Dwm.exe
            C:\Windows\Explorer.EXE
            C:\Windows\system32\taskeng.exe
            C:\Program Files\Windows Defender\MSASCui.exe
            C:\Windows\RtHDVCpl.exe
            C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
            C:\Windows\WindowsMobile\wmdc.exe
            C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
            C:\Program Files\Spyware Terminator\SpywareTerminatorShield.Exe
            C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
            C:\Program Files\Windows Sidebar\sidebar.exe
            C:\Windows\ehome\ehtray.exe
            C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
            C:\Windows\ehome\ehmsas.exe
            C:\Program Files\Windows Sidebar\sidebar.exe
            C:\Windows\System32\mobsync.exe
            C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
            C:\Program Files\OpenOffice.org 3\program\soffice.exe
            C:\Program Files\OpenOffice.org 3\program\soffice.bin
            C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
            C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
            C:\Windows\system32\wuauclt.exe
            C:\Program Files\Mozilla Firefox\firefox.exe
            C:\Windows\system32\taskeng.exe
            C:\Program Files\Windows Live\Messenger\msnmsgr.exe
            C:\Program Files\Windows Live\Contacts\wlcomm.exe
            C:\Windows\system32\SearchFilterHost.exe
            C:\Users\YOEUNG\Downloads\THEGRATUIT\RSIT.exe
            C:\Users\YOEUNG\Downloads\THEGRATUIT\YOEUNG.exe

            R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
            R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
            R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
            R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer
            R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
            O1 - Hosts: ::1 localhost
            O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
            O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
            O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
            O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
            O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
            O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
            O3 - Toolbar: HopSurf toolbar - {E9FAB13D-4600-49E1-90D1-EE961C859D39} - C:\Program Files\Comodo\HopSurfToolbar\HopSurfToolbar_IE.dll
            O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
            O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
            O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
            O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
            O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
            O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
            O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
            O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
            O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
            O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
            O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
            O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
            O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
            O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
            O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
            O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
            O4 - HKCU\..\Run: [Speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
            O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
            O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
            O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
            O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
            O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
            O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
            O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
            O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
            O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
            O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
            O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
            O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
            O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
            O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
            O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
            O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
            O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
            O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
            O9 - Extra button: HopSurf - {ED98F8D1-09AC-4107-B2FF-91DBE011B0C5} - C:\Program Files\Comodo\HopSurfToolbar\HopSurfToolbar_IE.dll
            O13 - Gopher Prefix:
            O20 - AppInit_DLLs: C:\Windows\system32\guard32.dll
            O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
            O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
            O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
            O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
            O23 - Service: Service Google Update (gupdate1ca29a125310338) (gupdate1ca29a125310338) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
            O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
            O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
            O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
            O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
            O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
            O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
            O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
            O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
            O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
            2. SP_Addict Auteur
              voila j'ai fais a la lettre ce que tu m'a dis de faire mais je n'ai pas pu coché un fichier car je ne le trouvais pas, c'est celui la
              O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
              1. SP_Addict Auteur
                en faite j'ai refais l'option suppresion et ils m'ont demandé d'envoyer un fichier zip. a leur site(que j'ai fais)
                l'ordinateur va beaucoup mieux, je continue les etapes
                1. Xplode Contributeur sécurité
                  Ok bien,

                  Il reste des traces de norton sur ton PC, télécharge ceci pour les supprimer : http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20050414110429924

                  -+-+-+-> Hijackthis <-+-+-+-

                  [x] Lance hijackthis ( C:\Program Files\Trend Micro\Hijackthis.exe )

                  [x] Clique sur " None of the above, just start the program " puis sur " Scan "

                  [x] Coche les lignes en gras ci dessous :

                  R3 - Default URLSearchHook is missing
                  O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
                  O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
                  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
                  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
                  O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
                  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                  O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
                  O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
                  <gras>

                  [x] Clique ensuite sur <gras>" Fix checked "
                  1. SP_Addict Auteur
                    finalement ca a reussi a analyser apres le redemarrage je post le rapport

                    ############################## | UsbFix V6.038 |

                    User : YOEUNG (Administrateurs) # PC-DE-YOEUNG
                    Update on 06/10/2009 by Chiquitine29, C_XX & Chimay8
                    Start at: 13:58:07 | 08/10/2009
                    Website : http://pagesperso-orange.fr/NosTools/index.html

                    Intel(R) Pentium(R) D CPU 3.00GHz
                    Microsoft® Windows Vista™ Édition Familiale Premium (6.0.6000 32-bit) #
                    Internet Explorer 7.0.6000.16890
                    Windows Firewall Status : Enabled
                    AV : COMODO Antivirus 3.9 [ Enabled | Updated ]
                    FW : COMODO Firewall[ Enabled ]3.9

                    C:\ -> Disque fixe local # 224,88 Go (76,01 Go free) [HDD] # NTFS
                    E:\ -> Disque amovible
                    F:\ -> Disque amovible
                    G:\ -> Disque amovible
                    H:\ -> Disque CD-ROM
                    I:\ -> Disque amovible

                    ############################## | Processus actifs |

                    C:\Windows\System32\smss.exe
                    C:\Windows\system32\csrss.exe
                    C:\Windows\system32\wininit.exe
                    C:\Windows\system32\csrss.exe
                    C:\Windows\system32\services.exe
                    C:\Windows\system32\lsass.exe
                    C:\Windows\system32\lsm.exe
                    C:\Windows\system32\winlogon.exe
                    C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe
                    C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
                    C:\Windows\system32\svchost.exe
                    C:\Windows\System32\svchost.exe
                    C:\Windows\system32\Ati2evxx.exe
                    C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe
                    C:\Windows\system32\svchost.exe
                    C:\Windows\system32\SLsvc.exe
                    C:\Windows\system32\svchost.exe
                    C:\Windows\system32\Ati2evxx.exe
                    C:\Windows\System32\spoolsv.exe
                    C:\Windows\system32\taskeng.exe
                    C:\Windows\system32\Dwm.exe
                    C:\Windows\system32\svchost.exe
                    C:\Windows\Explorer.EXE
                    C:\Program Files\Google\Update\GoogleUpdate.exe
                    C:\Windows\system32\taskeng.exe
                    C:\Windows\system32\runonce.exe
                    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                    C:\Program Files\Bonjour\mDNSResponder.exe
                    C:\Windows\system32\PnkBstrA.exe
                    C:\Windows\system32\PnkBstrB.exe
                    C:\Windows\system32\svchost.exe
                    C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
                    C:\Program Files\Spyware Terminator\sp_rsser.exe
                    C:\Windows\system32\svchost.exe
                    C:\Windows\System32\svchost.exe
                    C:\Windows\system32\WUDFHost.exe
                    C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
                    C:\Windows\system32\wbem\wmiprvse.exe

                    ################## | Fichiers # Dossiers infectieux |

                    ################## | Registre # Clés Run infectieuses |

                    ################## | Registre # Mountpoints2 |

                    Supprimé ! HKCU\...\Explorer\MountPoints2\{05c386d5-acc4-11dd-a150-001bb9b1cb0b}\Shell\Auto\Command
                    Supprimé ! HKCU\...\Explorer\MountPoints2\{0f946360-a4f2-11dd-9a72-001bb9b1cb0b}\Shell\AutoRun\Command
                    Supprimé ! HKCU\...\Explorer\MountPoints2\{1e61d7c2-9076-11dd-ae86-001bb9b1cb0b}\Shell\Auto\Command
                    Supprimé ! HKCU\...\Explorer\MountPoints2\{5bee8a22-ad97-11de-aa61-001bb9b1cb0b}\Shell\Auto\Command

                    ################## | Listing des fichiers présent |

                    [07/10/2009 21:07|--a------|2741] C:\Ad-Report-CLEAN[1].log
                    [07/10/2009 20:56|--a------|3489] C:\Ad-Report-SCAN[1].log
                    [18/09/2006 23:43|--a------|24] C:\autoexec.bat
                    [02/11/2006 11:53|-rahs----|438840] C:\bootmgr
                    [30/08/2007 08:57|-ra-s----|8192] C:\BOOTSECT.BAK
                    [18/09/2006 23:43|--a------|10] C:\config.sys
                    [?|?|?] C:\pagefile.sys
                    [12/04/2008 12:27|--ah-----|268] C:\sqmdata00.sqm
                    [12/04/2008 12:27|--ah-----|244] C:\sqmnoopt00.sqm
                    [07/10/2009 21:18|--a------|3368] C:\TB.txt
                    [08/10/2009 15:30|--a------|3417] C:\UsbFix.txt

                    ################## | Vaccination |

                    # C:\autorun.inf -> Folder created by UsbFix.

                    ################## | ! Fin du rapport # UsbFix V6.038 ! |
                    1. SP_Addict Auteur
                      mais le redemarrage ce fait en mode normal, comment faire pour que le redemarrage soit en mode sans echec ? estce qu'il va quand meme analyser tout seul en mode sans echec?
                      2. SP_Addict Auteur
                        je ne peux rien faire en mode normal, je dois lancer usbfix en mode sans echec ?
                        1. Xplode Contributeur sécurité
                          Ok alors fait ceci :

                          Si tu es sous vista : Désactive l'UAC (Menu Démarrer \ Panneau de Configuration \ Comptes d'utilisateurs et protection des utilisateurs \ Comptes d'utilisateurs \ Activer ou désactiver le contrôle des comptes d'utilisateurs \ décoche la case Utiliser le contrôle ... et valide par OK , il te sera demandé de redémarrer, fais le)

                          - Lance USBfix en cliquant droit dessus puis " Executer en tant qu'administrateur "

                          Normalement ca devrait passer pour l'option 2
                          1. SP_Addict Auteur
                            voila le rapport

                            Logfile of random's system information tool 1.06 (written by random/random)
                            Run by YOEUNG at 2009-10-07 22:40:44
                            Microsoft® Windows Vista™ Édition Familiale Premium
                            System drive C: has 78 GB (34%) free of 230 GB
                            Total RAM: 1791 MB (73% free)

                            Logfile of Trend Micro HijackThis v2.0.2
                            Scan saved at 22:40:52, on 07/10/2009
                            Platform: Windows Vista (WinNT 6.00.1904)
                            MSIE: Internet Explorer v7.00 (7.00.6000.16890)
                            Boot mode: Safe mode with network support

                            Running processes:
                            C:\Windows\Explorer.EXE
                            C:\Program Files\Mozilla Firefox\firefox.exe
                            C:\Users\YOEUNG\Downloads\THEGRATUIT\RSIT.exe
                            C:\Users\YOEUNG\Downloads\THEGRATUIT\YOEUNG.exe

                            R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                            R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
                            R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                            R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
                            R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
                            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                            R3 - Default URLSearchHook is missing
                            O1 - Hosts: ::1 localhost
                            O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
                            O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
                            O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
                            O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
                            O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                            O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                            O3 - Toolbar: HopSurf toolbar - {E9FAB13D-4600-49E1-90D1-EE961C859D39} - C:\Program Files\Comodo\HopSurfToolbar\HopSurfToolbar_IE.dll
                            O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
                            O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
                            O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
                            O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
                            O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
                            O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
                            O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
                            O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
                            O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
                            O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
                            O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
                            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
                            O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
                            O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                            O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
                            O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
                            O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
                            O4 - HKCU\..\Run: [Speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
                            O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                            O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
                            O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
                            O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
                            O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
                            O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
                            O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
                            O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
                            O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
                            O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
                            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
                            O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
                            O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
                            O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
                            O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
                            O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
                            O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
                            O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
                            O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
                            O9 - Extra button: HopSurf - {ED98F8D1-09AC-4107-B2FF-91DBE011B0C5} - C:\Program Files\Comodo\HopSurfToolbar\HopSurfToolbar_IE.dll
                            O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
                            O13 - Gopher Prefix:
                            O20 - AppInit_DLLs: C:\Windows\system32\guard32.dll
                            O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                            O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
                            O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
                            O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
                            O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
                            O23 - Service: Service Google Update (gupdate1ca29a125310338) (gupdate1ca29a125310338) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
                            O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                            O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
                            O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                            O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
                            O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
                            O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
                            O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
                            O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
                            O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
                            2. SP_Addict Auteur
                              impossible car au redemarrage en mode normal, je ne peux effectuer aucune action(pc qui rame trop, application qui ne se lance pas)( ca fait 30min que j'essaye..)
                              1. Xplode Contributeur sécurité
                                Ok, donc la suppression n'a pas été effectuée, réessaye l'option 2
                                1. SP_Addict Auteur
                                  voila le rapport avec option 1

                                  ############################## | UsbFix V6.038 |

                                  User : YOEUNG (Administrateurs) # PC-DE-YOEUNG
                                  Update on 06/10/2009 by Chiquitine29, C_XX & Chimay8
                                  Start at: 21:38:02 | 07/10/2009
                                  Website : http://pagesperso-orange.fr/NosTools/index.html

                                  Intel(R) Pentium(R) D CPU 3.00GHz
                                  Microsoft® Windows Vista™ Édition Familiale Premium (6.0.6000 32-bit) #
                                  Internet Explorer 7.0.6000.16890
                                  Windows Firewall Status : Enabled
                                  AV : COMODO Antivirus 3.9 [ Enabled | Updated ]
                                  FW : COMODO Firewall[ Enabled ]3.9

                                  C:\ -> Disque fixe local # 224,88 Go (76,09 Go free) [HDD] # NTFS
                                  D:\ -> Disque fixe local
                                  E:\ -> Disque amovible # 968,25 Mo (861,06 Mo free) # FAT
                                  F:\ -> Disque amovible
                                  G:\ -> Disque amovible
                                  H:\ -> Disque CD-ROM
                                  I:\ -> Disque amovible

                                  ############################## | Processus actifs |

                                  C:\Windows\System32\smss.exe
                                  C:\Windows\system32\csrss.exe
                                  C:\Windows\system32\csrss.exe
                                  C:\Windows\system32\wininit.exe
                                  C:\Windows\system32\winlogon.exe
                                  C:\Windows\system32\services.exe
                                  C:\Windows\system32\lsass.exe
                                  C:\Windows\system32\lsm.exe
                                  C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe
                                  C:\Windows\System32\svchost.exe
                                  C:\Windows\System32\svchost.exe
                                  C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe
                                  C:\Windows\Explorer.EXE
                                  C:\Windows\system32\svchost.exe
                                  C:\Windows\System32\svchost.exe
                                  C:\Program Files\Mozilla Firefox\firefox.exe
                                  C:\Windows\system32\wbem\wmiprvse.exe

                                  ################## | Fichiers # Dossiers infectieux |

                                  ################## | Registre # Clés Run infectieuses |

                                  ################## | Registre # Mountpoints2 |

                                  HKCU\..\..\Explorer\MountPoints2\{05c386d5-acc4-11dd-a150-001bb9b1cb0b}
                                  shell\Auto\command =cmd /C launch.bat
                                  shell\AutoRun\command =C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL cmd /C launch.bat

                                  HKCU\..\..\Explorer\MountPoints2\{0f946360-a4f2-11dd-9a72-001bb9b1cb0b}
                                  shell\AutoRun\command =explorer.exe .

                                  HKCU\..\..\Explorer\MountPoints2\{1e61d7c2-9076-11dd-ae86-001bb9b1cb0b}
                                  shell\Auto\command =cmd /C launch.bat
                                  shell\AutoRun\command =C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL cmd /C launch.bat

                                  HKCU\..\..\Explorer\MountPoints2\{5bee8a22-ad97-11de-aa61-001bb9b1cb0b}
                                  shell\Auto\command =cmd /C launch.bat
                                  shell\AutoRun\command =C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL cmd /C launch.bat

                                  ################## | ! Fin du rapport # UsbFix V6.038 ! |
                                  1. SP_Addict Auteur
                                    je precise que j'ai demarer en mode sans echec avec partage reseau car en mode normal, la page d'accueil m'affiche un fond blanc et que ca continuer a ramer
                                    • 1
                                    • 2